belt 0.0.7 → 0.1.1

data/lib/belt/cli/routes_command.rb

@@ -0,0 +1,307 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'optparse'
+require 'fileutils'
+require_relative '../route_dsl'
+require_relative '../table_inference'
+require_relative 'routes_command/schema_loader'
+require_relative 'routes_command/route_inference'
+
+module Belt
+  module CLI
+    class RoutesCommand
+      include SchemaLoader
+      include RouteInference
+
+      def self.run(args)
+        new(args).run
+      end
+
+      def initialize(args)
+        @options = {}
+        parse_options(args)
+      end
+
+      def run
+        routes_file = find_routes_file
+        abort 'Error: No routes file found. Expected infrastructure/routes.tf.rb' unless routes_file
+
+        dsl = load_routes(routes_file)
+        @table_inference = TableInference.new(@options[:tables_file])
+        routes = collect_routes(dsl)
+        routes = apply_grep(routes) if @options[:grep]
+
+        warn 'Warning: --output-dir has no effect without --namespace' if @options[:output_dir] && !@options[:namespace]
+
+        if @options[:namespace]
+          output_ruby(routes, @options[:namespace], routes_file)
+        elsif @options[:format] == 'json'
+          output = { routes: routes }
+          models = load_schema_models(routes_file)
+          output[:models] = models if models.any?
+          puts JSON.pretty_generate(output)
+        else
+          output_concise(routes)
+        end
+      end
+
+      private
+
+      def parse_options(args)
+        OptionParser.new do |opts|
+          opts.banner = 'Usage: belt routes [options]'
+
+          opts.on('-g', '--grep PATTERN', 'Filter routes matching pattern') do |pattern|
+            @options[:grep] = pattern
+          end
+
+          opts.on('-f', '--format FORMAT', 'Output format: concise (default), json') do |format|
+            @options[:format] = format
+          end
+
+          opts.on('--namespace NAMESPACE', 'Generate Ruby route files for NAMESPACE (or "all")') do |ns|
+            @options[:namespace] = ns
+          end
+
+          opts.on('--output-dir DIR', 'Output directory for generated files') do |dir|
+            @options[:output_dir] = dir
+          end
+
+          opts.on('--schema FILE', 'Path to schema.tf.rb for model definitions') do |file|
+            @options[:schema_file] = file
+          end
+
+          opts.on('--tables-file FILE', 'Path to Terraform file with DynamoDB table definitions') do |file|
+            @options[:tables_file] = file
+          end
+
+          opts.on('-h', '--help', 'Show this help') do
+            puts opts
+            exit
+          end
+        end.parse!(args)
+      end
+
+      def find_routes_file
+        path = 'infrastructure/routes.tf.rb'
+        File.exist?(path) ? path : nil
+      end
+
+      def load_routes(file)
+        # Reset schema builder for clean state
+        Belt.instance_variable_set(:@application, nil)
+
+        content = File.read(file)
+        if content.include?('Belt.application.routes.draw')
+          binding_context = binding
+          eval(content, binding_context, file) # rubocop:disable Security/Eval
+        else
+          Belt::RouteDSL.load_from_file(file)
+        end
+      end
+
+      def collect_routes(dsl)
+        routes = []
+        dsl.api_gateways.each do |gateway|
+          gateway.routes.each do |route|
+            routes << build_route_hash(route, gateway)
+          end
+        end
+        routes.sort_by { |r| route_specificity(r[:path], r[:verb]) }
+      end
+
+      def build_route_hash(route, gateway)
+        hash = {
+          name: extract_route_name(route.path),
+          verb: route.method,
+          path: normalize_path(route.path),
+          gateway: gateway.name,
+          lambda: route.lambda.to_s,
+          controller: infer_controller(route, gateway),
+          action: infer_action(route, gateway),
+          auth: route.auth.to_s,
+          tables: get_route_tables(route),
+          request_model: route.request_model.to_s,
+          response_model: route.response_model.to_s
+        }
+        rc = route.response_context.to_s
+        hash[:response_context] = rc unless rc.empty?
+        hash
+      end
+
+      def get_route_tables(route)
+        if route.tables.any?
+          route.tables.map(&:to_s)
+        else
+          @table_inference.infer_tables_from_route(route)
+        end
+      end
+
+      def extract_route_name(path)
+        segments = path.split('/').reject(&:empty?)
+        return 'root' if segments.empty?
+
+        segments.reject { |s| s.start_with?('{', ':') }
+                .map { |s| s.gsub('-', '_') }
+                .join('_')
+      end
+
+      def output_ruby(routes, namespace, _routes_file)
+        output_dir = @options[:output_dir] || File.join(Belt.root, 'lambda/lib/routes')
+        FileUtils.mkdir_p(output_dir)
+        puts "Writing to #{output_dir}/:"
+
+        if namespace == 'all'
+          generate_all_manifests(routes, output_dir)
+        else
+          # Generate gateway-based manifest (all routes for this gateway)
+          filtered = routes.select { |r| r[:gateway] == namespace }
+          # Fall back to lambda-based if no gateway match
+          filtered = routes.select { |r| r[:lambda] == namespace } if filtered.empty?
+          if filtered.empty?
+            warn "No routes found for namespace '#{namespace}' - skipping"
+            return
+          end
+          write_ruby_manifest(filtered, namespace, output_dir)
+        end
+      end
+
+      def generate_all_manifests(routes, output_dir)
+        # Gateway-based manifests (primary — used by main Lambda entry points)
+        by_gateway = routes.group_by { |r| r[:gateway] }
+        by_gateway.each { |gw, gw_routes| write_ruby_manifest(gw_routes, gw, output_dir) }
+
+        # Scoped lambda manifests (where lambda != gateway — separate Lambda functions)
+        scoped = routes.reject { |r| r[:lambda] == r[:gateway] }
+        by_lambda = scoped.group_by { |r| r[:lambda] }
+        by_lambda.each { |lam, lam_routes| write_ruby_manifest(lam_routes, lam, output_dir) }
+      end
+
+      def write_ruby_manifest(routes, name, output_dir)
+        output_file = File.join(output_dir, "#{name}_routes.rb")
+        content = generate_ruby_content(routes, name)
+        File.write(output_file, content)
+        puts "  ✅ #{name}_routes.rb (#{routes.length} routes)"
+      end
+
+      def generate_ruby_content(routes, namespace)
+        constant_name = namespace.upcase
+        lines = [
+          '# frozen_string_literal: true',
+          '',
+          "# Auto-generated by: belt routes --namespace #{namespace}",
+          '# Do not edit manually',
+          '',
+          'module Routes',
+          "  #{constant_name} = ["
+        ]
+
+        routes.each_with_index do |route, index|
+          lines << '    {'
+          lines << "      verb: #{route[:verb].inspect},"
+          lines << "      path: #{route[:path].inspect},"
+          lines << "      gateway: #{route[:gateway].inspect},"
+          lines << "      lambda: #{route[:lambda].inspect},"
+          lines << "      controller: #{route[:controller].inspect},"
+          lines << "      action: #{route[:action].inspect},"
+          lines << "      auth: #{route[:auth].inspect},"
+          tables_syms = route[:tables].map { |t| ":#{t}" }.join(', ')
+          lines << "      tables: [#{tables_syms}]"
+          lines << "    }#{',' if index < routes.length - 1}"
+        end
+
+        lines << '  ].freeze'
+        lines << 'end'
+        lines << ''
+        lines.join("\n")
+      end
+
+      def normalize_path(path)
+        path = "/#{path}" unless path.start_with?('/')
+        normalized = path.gsub(%r{/([a-zA-Z_][a-zA-Z0-9_]*?)/:id(/|$)}) do
+          resource = ::Regexp.last_match(1)
+          trailing = ::Regexp.last_match(2)
+          singular = singularize(resource)
+          "/#{resource}/{#{singular}_id}#{trailing}"
+        end
+        normalized.gsub(/:([a-zA-Z_][a-zA-Z0-9_]*)/) { "{#{::Regexp.last_match(1)}}" }
+      end
+
+      def apply_grep(routes)
+        pattern = Regexp.new(@options[:grep], Regexp::IGNORECASE)
+        routes.select do |r|
+          r[:path].match?(pattern) ||
+            r[:gateway].to_s.match?(pattern) ||
+            r[:lambda].match?(pattern) ||
+            r[:verb].match?(pattern) ||
+            r[:controller].match?(pattern) ||
+            r[:action].match?(pattern)
+        end
+      end
+
+      def output_concise(routes)
+        return puts('No routes defined.') if routes.empty?
+
+        multi_gateway = routes.map { |r| r[:gateway] }.uniq.length > 1
+        verb_w = [routes.map { |r| r[:verb].length }.max, 6].max
+        path_w = [routes.map { |r| r[:path].length }.max, 4].max
+
+        if multi_gateway
+          output_concise_multi_gateway(routes, verb_w, path_w)
+        else
+          output_concise_single_gateway(routes, verb_w, path_w)
+        end
+      end
+
+      def output_concise_multi_gateway(routes, verb_w, path_w)
+        gw_w = [routes.map { |r| r[:gateway].to_s.length }.max, 7].max
+        lam_w = [routes.map { |r| r[:lambda].length }.max, 6].max
+
+        header = "#{'VERB'.ljust(verb_w)}  #{'PATH'.ljust(path_w)}  " \
+                 "#{'GATEWAY'.ljust(gw_w)}  #{'LAMBDA'.ljust(lam_w)}  CONTROLLER#ACTION"
+        puts header
+        puts '-' * (verb_w + path_w + gw_w + lam_w + 20)
+
+        routes.each do |r|
+          line = "#{r[:verb].ljust(verb_w)}  #{r[:path].ljust(path_w)}  " \
+                 "#{r[:gateway].to_s.ljust(gw_w)}  #{r[:lambda].ljust(lam_w)}  " \
+                 "#{r[:controller]}##{r[:action]}"
+          puts line
+        end
+      end
+
+      def output_concise_single_gateway(routes, verb_w, path_w)
+        puts "#{'VERB'.ljust(verb_w)}  #{'PATH'.ljust(path_w)}  CONTROLLER#ACTION"
+        puts '-' * (verb_w + path_w + 30)
+
+        routes.each do |r|
+          puts "#{r[:verb].ljust(verb_w)}  #{r[:path].ljust(path_w)}  #{r[:controller]}##{r[:action]}"
+        end
+      end
+
+      def route_specificity(path, verb)
+        segments = path.split('/').reject(&:empty?)
+        param_count = segments.count { |s| s.start_with?('{') }
+        segment_count = segments.length
+        [param_count, -segment_count, path, verb_order(verb)]
+      end
+
+      def verb_order(verb)
+        { 'GET' => 0, 'POST' => 1, 'PUT' => 2, 'PATCH' => 3, 'DELETE' => 4 }[verb] || 99
+      end
+
+      def singularize(word)
+        if word.end_with?('ies')
+          "#{word[0..-4]}y"
+        elsif word.end_with?('ses') || word.end_with?('xes') || word.end_with?('zes')
+          word[0..-3]
+        elsif word.end_with?('s') && !word.end_with?('ss')
+          word[0..-2]
+        else
+          word
+        end
+      end
+    end
+  end
+end

data/lib/belt/cli/setup_command.rb

@@ -0,0 +1,261 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'shellwords'
+require 'open3'
+require_relative 'app_detection'
+require_relative 'bucket_security'
+require_relative 'tables_command'
+require_relative 'frontend_setup_command'
+
+module Belt
+  module CLI
+    class SetupCommand
+      SUBCOMMANDS = %w[state tables frontend].freeze
+
+      SECURITY_CHECKS = %i[versioning encryption public_access_block tls_policy].freeze
+
+      include AppDetection
+      include BucketSecurity
+
+      def self.run(args)
+        subcommand = args.shift
+
+        case subcommand
+        when 'state'
+          new(args).run_state_setup
+        when 'tables'
+          Belt::CLI::TablesCommand.run(args)
+        when 'frontend'
+          Belt::CLI::FrontendSetupCommand.run(args)
+        else
+          puts 'Usage: belt setup <state|tables|frontend> [options]'
+          puts "\nSubcommands:"
+          puts '  state     Set up S3 bucket for Terraform state'
+          puts '  tables    Generate DynamoDB table definitions from schema.tf.rb'
+          puts '  frontend  Generate S3 + CloudFront infrastructure for frontend hosting'
+          exit 1
+        end
+      end
+
+      def initialize(args = [])
+        @app_name = detect_app_name
+        @env_name = nil
+        @custom_bucket = nil
+        @select_mode = false
+
+        parse_args(args)
+
+        @region = detect_region
+        @bucket_name = resolve_bucket_name
+      end
+
+      def run_state_setup
+        unless aws_configured?
+          puts '✗ AWS credentials not configured. Set AWS_PROFILE or configure aws sso login.'
+          exit 1
+        end
+
+        @bucket_name = interactive_bucket_selection if @select_mode
+        setup_or_verify_bucket
+        apply_lifecycle(@bucket_name)
+        puts '  ensure  lifecycle rules (90-day noncurrent expiration)'
+        update_backend_config
+        print_success_message
+      end
+
+      def setup_or_verify_bucket
+        if bucket_exists?(@bucket_name)
+          verify_existing_bucket
+        else
+          create_new_bucket
+        end
+      end
+
+      def verify_existing_bucket
+        puts "Found existing bucket: #{@bucket_name}"
+        audit = audit_bucket_security(@bucket_name)
+        print_security_audit(audit)
+
+        if audit.values.all?
+          puts "\n✓ Bucket '#{@bucket_name}' passes all security checks"
+        else
+          prompt_and_harden(audit)
+        end
+      end
+
+      def prompt_and_harden(audit)
+        puts "\n⚠ Bucket '#{@bucket_name}' has security issues."
+        print "\nApply security hardening? [Y/n] "
+        response = $stdin.gets&.strip&.downcase
+        if response.nil? || response.empty? || response == 'y'
+          harden_bucket(@bucket_name, audit)
+        else
+          puts '✗ Refusing to use insecure bucket. Fix manually or choose a different bucket.'
+          exit 1
+        end
+      end
+
+      def create_new_bucket
+        puts "Creating state bucket: #{@bucket_name} (#{@region})"
+        create_bucket(@bucket_name)
+        puts "  create  s3://#{@bucket_name}"
+        harden_bucket(@bucket_name, {})
+      end
+
+      def print_success_message
+        puts "\n✓ State bucket '#{@bucket_name}' is ready!"
+        if @env_name
+          puts "\n  cd infrastructure/#{@env_name} && terraform init"
+        else
+          puts "\n  cd infrastructure/<env> && terraform init"
+        end
+      end
+
+      private
+
+      def parse_args(args)
+        while (arg = args.shift)
+          case arg
+          when '--bucket'
+            @custom_bucket = args.shift
+            abort '✗ --bucket requires a value' unless @custom_bucket
+          when '--select'
+            @select_mode = true
+          when '--help', '-h'
+            self.class.run([])
+          else
+            @env_name = arg unless arg.start_with?('-')
+          end
+        end
+      end
+
+      def resolve_bucket_name
+        if @custom_bucket
+          @custom_bucket
+        elsif @env_name
+          "#{@app_name}-terraform-state-#{@env_name}"
+        else
+          "#{@app_name}-terraform-state"
+        end
+      end
+
+      # --- Interactive selection ---
+
+      def interactive_bucket_selection
+        puts "Listing S3 buckets in account...\n\n"
+        buckets = list_buckets
+        if buckets.empty?
+          puts 'No buckets found. Creating a new one.'
+          return @bucket_name
+        end
+
+        # Show buckets with index
+        buckets.each_with_index do |b, i|
+          puts "  [#{i + 1}] #{b}"
+        end
+        puts "  [N] Create new bucket (#{@bucket_name})"
+        puts ''
+        print "Select bucket [1-#{buckets.size}] or N for new: "
+        choice = $stdin.gets&.strip
+
+        if choice.nil? || choice.downcase == 'n' || choice.empty?
+          @bucket_name
+        else
+          idx = choice.to_i - 1
+          if idx >= 0 && idx < buckets.size
+            buckets[idx]
+          else
+            puts '✗ Invalid selection'
+            exit 1
+          end
+        end
+      end
+
+      def list_buckets
+        output = safe_capture('aws', 's3api', 'list-buckets', '--query', 'Buckets[].Name', '--output', 'json')
+        return [] unless output
+
+        JSON.parse(output)
+      rescue JSON::ParserError
+        []
+      end
+
+      # --- AWS operations ---
+
+      def aws_configured?
+        system('aws', 'sts', 'get-caller-identity', out: File::NULL, err: File::NULL)
+      end
+
+      def bucket_exists?(bucket)
+        system('aws', 's3api', 'head-bucket', '--bucket', bucket, err: File::NULL)
+      end
+
+      def create_bucket(bucket)
+        args = ['aws', 's3api', 'create-bucket', '--bucket', bucket, '--region', @region]
+        args.push('--create-bucket-configuration', "LocationConstraint=#{@region}") unless @region == 'us-east-1'
+        run!(*args)
+      end
+
+      def apply_lifecycle(bucket)
+        lifecycle = {
+          Rules: [{
+            ID: 'expire-noncurrent-versions',
+            Status: 'Enabled',
+            Filter: {},
+            NoncurrentVersionExpiration: { NoncurrentDays: 90 },
+            AbortIncompleteMultipartUpload: { DaysAfterInitiation: 7 }
+          }]
+        }
+        run!('aws', 's3api', 'put-bucket-lifecycle-configuration', '--bucket', bucket,
+             '--lifecycle-configuration', JSON.generate(lifecycle))
+      end
+
+      def run!(*args)
+        return if system(*args)
+
+        puts "\n✗ Command failed: #{args.shelljoin}"
+        exit 1
+      end
+
+      def safe_capture(*)
+        output, status = Open3.capture2(*, err: File::NULL)
+        status.success? ? output : nil
+      end
+
+      # --- Backend config ---
+
+      def update_backend_config
+        dirs = if @env_name
+                 [File.join('infrastructure', @env_name)]
+               else
+                 Dir.glob('infrastructure/*/').select { |d| File.exist?(File.join(d, 'backend.tf')) }
+               end
+
+        dirs.each do |env_dir|
+          next unless Dir.exist?(env_dir)
+
+          backend_file = File.join(env_dir, 'backend.tf')
+          next unless File.exist?(backend_file)
+
+          content = File.read(backend_file)
+          updated = content.gsub(/bucket\s*=\s*"[^"]+"/, "bucket  = \"#{@bucket_name}\"")
+          if updated != content
+            File.write(backend_file, updated)
+            puts "  update  #{backend_file} → bucket = \"#{@bucket_name}\""
+          end
+        end
+      end
+
+      # --- Detection ---
+
+      def detect_region
+        Dir.glob('infrastructure/*/backend.tf').each do |f|
+          match = File.read(f).match(/region\s*=\s*"([^"]+)"/)
+          return match[1] if match
+        end
+        'us-east-1'
+      end
+    end
+  end
+end

data/lib/belt/cli/tables_command.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require_relative 'app_detection'
+require_relative 'env_resolver'
+
+module Belt
+  module CLI
+    class TablesCommand
+      SCHEMA_FILE = 'infrastructure/schema.tf.rb'
+
+      include AppDetection
+
+      def self.run(args)
+        env = EnvResolver.resolve(args)
+
+        if env.nil?
+          puts 'Usage: belt setup tables <environment>'
+          puts "\nReads schema.tf.rb and generates dynamodb.tf in the environment directory."
+          puts 'You can also set BELT_ENV to skip the environment argument.'
+          puts "\nExamples:"
+          puts '  belt setup tables wups'
+          puts '  belt setup tables dev01'
+          puts '  BELT_ENV=wups belt setup tables'
+          exit 1
+        end
+
+        new(env).run
+      end
+
+      def initialize(env)
+        @env = env
+        @app_name = detect_app_name
+        @env_dir = "infrastructure/#{@env}"
+      end
+
+      def run
+        validate!
+        models = parse_schema
+        if models.empty?
+          puts "No models found in #{SCHEMA_FILE}"
+          exit 0
+        end
+
+        generate_dynamodb_tf(models)
+      end
+
+      private
+
+      def validate!
+        abort "Error: #{SCHEMA_FILE} not found. Run `belt generate resource` first." unless File.exist?(SCHEMA_FILE)
+        return if Dir.exist?(@env_dir)
+
+        abort "Error: Environment '#{@env}' not found at #{@env_dir}/.\n" \
+              "Create it with: belt generate environment #{@env}"
+      end
+
+      def parse_schema
+        parser = SchemaParser.new
+        schema_content = File.read(SCHEMA_FILE)
+
+        # Replace DSL wrapper with direct parser call
+        # Belt.application.schema.draw do ... end → parser.instance_eval do ... end
+        inner = schema_content.sub(/\A(?:Belt\.application)\.schema\.draw do\n?/, '').sub(/\nend\s*\z/, '')
+        parser.instance_eval(inner, SCHEMA_FILE)
+        parser.models
+      end
+
+      def generate_dynamodb_tf(models)
+        dest = File.join(@env_dir, 'dynamodb.tf')
+        content = render_dynamodb(models)
+        File.write(dest, content)
+        puts "  create  #{dest}"
+        puts "\n✓ Generated DynamoDB tables for #{models.size} model(s):"
+        models.each { |m| puts "    • #{table_name(m[:name])}" }
+        puts "\nRun `belt apply #{@env}` to create them."
+      end
+
+      def render_dynamodb(models)
+        blocks = models.map { |m| render_table(m) }
+        "# Auto-generated by Belt from schema.tf.rb\n" \
+          "# Do not edit manually — re-run `belt setup tables #{@env}`\n\n#{blocks.join("\n\n")}\n"
+      end
+
+      def render_table(model)
+        name = table_name(model[:name])
+        <<~HCL
+          resource "aws_dynamodb_table" "#{model[:name]}s" {
+            name         = "#{name}"
+            billing_mode = "PAY_PER_REQUEST"
+            hash_key     = "id"
+
+            attribute {
+              name = "id"
+              type = "S"
+            }
+
+            tags = {
+              Name        = "#{name}"
+              Environment = var.environment
+              ManagedBy   = "Terraform"
+            }
+          }
+        HCL
+      end
+
+      def table_name(model_name)
+        "#{@app_name}-#{@env}-#{model_name}s"
+      end
+
+      # Minimal DSL parser for schema.tf.rb
+      class SchemaParser
+        attr_reader :models
+
+        def initialize
+          @models = []
+        end
+
+        def model(name, &block)
+          model_def = ModelParser.new
+          model_def.instance_eval(&block) if block
+          @models << { name: name.to_s, fields: model_def.fields }
+        end
+      end
+
+      class ModelParser
+        attr_reader :fields
+
+        def initialize
+          @fields = []
+        end
+
+        def field(name, **opts)
+          @fields << { name: name.to_s, type: opts[:type]&.to_s || 'string' }
+        end
+      end
+    end
+  end
+end