belt 0.2.17 → 0.2.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e1813b72986b167b9449f438b18331cc2e9be46cffa58bd059c403f3c35703e
-  data.tar.gz: 26c3aae3c049bbebff471d6a8a514114a26f8b2d0fdf4671cb154ae9a056798f
+  metadata.gz: 7f706cafa79246d178c2aee6bfb05536bcb5f03111a24f13624e769ef7d9916a
+  data.tar.gz: a99d09c6d472d4826acf78dee6a4fded952c8745071b63c6ea4f54dbfd6b0aef
 SHA512:
-  metadata.gz: 23bbf9977c0cd765c7a1630e7a74ed480db6d62ee07c22e95e6a491a3a9c04d824b8463b0ef63ae4c4b343e13e96ff26c9edb5c86c8005fce7f0a167b6894c64
-  data.tar.gz: e7f625fe93dcb125289530e2a3bdb9dee8c37938eeea41bc9154a31aca6b47675a6336e39c986f3a801719f4cf22052bad40968ff6e1b9a82936140f74432f4a
+  metadata.gz: 2009deb03f2f725c4e960e73abf7745b8a9fdd5899ea76178b3942f21c504fe76338912ba57f05b913db3a18494f635c508e4696a3c347e40ddcb973e4c61541
+  data.tar.gz: b84417ce5814e266715b5dc54b4a965261f8011fee552f9f594c82137751565ff29b20f17444b2be986abfd79c02059b935ae5aa97fcbdbbfdcc79ffafa0421b

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.2.18
+
+### New generator: `belt generate auth`
+
+Scaffolds Cognito user pool infrastructure for authentication. Creates the user pool, client, and wires `cognito_user_pool_arns` into the conveyor-belt resource automatically.
+
+```bash
+belt g auth                    # Single pool: "main"
+belt g auth web mobile         # Multiple pools (e.g., web + mobile clients)
+belt g auth web android ios    # Three pools
+belt destroy auth              # Remove generated files
+```
+
+What it generates:
+- `infrastructure/modules/app/cognito.tf` — User pool + client with sensible defaults (password policy, email verification, deletion protection in prod)
+- `infrastructure/modules/app/cognito_outputs.tf` — Pool ID, ARN, and client ID outputs
+- Patches `main.tf` to pass `cognito_user_pool_arns` to the conveyor-belt resource
+
+Multiple pools are supported out of the box — each gets a suffixed name (e.g., `myapp-prod-web`, `myapp-prod-mobile`) and its own set of outputs.
+
 ## 0.2.12
 
 ### Rename: `routes.tf.rb` → `routes.rb`, `schema.tf.rb` → `contracts.rb`

data/lib/belt/cli/auth_command.rb

@@ -0,0 +1,309 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'erb'
+require_relative 'app_detection'
+
+module Belt
+  module CLI
+    class AuthCommand
+      TEMPLATE_DIR = File.expand_path('../../templates/generate/auth', __dir__)
+      MODULE_DIR = 'infrastructure/modules/app'
+
+      include AppDetection
+
+      def self.run(args)
+        if args.include?('--help') || args.include?('-h')
+          print_help
+          exit 0
+        end
+
+        force = args.delete('--force') || args.delete('-f')
+        signup = args.delete('--signup')
+        pools = parse_pools(args)
+
+        new(pools: pools, force: force, signup: signup).generate
+      end
+
+      def self.destroy(_args)
+        new(pools: [], force: false).remove
+      end
+
+      def self.print_help
+        puts <<~HELP
+          Generate Cognito user pool infrastructure for authentication.
+
+          Usage: belt generate auth [pool_names...] [options]
+
+          Options:
+            --signup        Allow public user registration (generates frontend views)
+            --force, -f     Overwrite existing cognito.tf (skip collision check)
+
+          Arguments:
+            pool_names      Optional pool names for multiple user pools.
+                            If omitted, generates a single pool named "main".
+
+          Examples:
+            belt g auth                        # Admin-only, single pool
+            belt g auth --signup               # Public signup with frontend views
+            belt g auth web                    # Named pool: "web"
+            belt g auth web mobile             # Two pools
+            belt g auth --force                # Overwrite existing
+
+          What this generates:
+            infrastructure/modules/app/cognito.tf          User pool + client resources
+            infrastructure/modules/app/cognito_outputs.tf  Pool ID, ARN, and client ID outputs
+
+          With --signup (when frontend/ exists):
+            frontend/src/lib/auth.js                       Auth module (signIn, signUp, etc.)
+            frontend/src/lib/apiClient.js                  API client with Authorization header
+            frontend/src/pages/auth/Login.jsx              Login page
+            frontend/src/pages/auth/SignUp.jsx             Registration page
+            frontend/src/pages/auth/ConfirmEmail.jsx       Email verification page
+            frontend/src/components/ProtectedRoute.jsx     Route guard component
+
+          Without --signup (admin-only, default):
+            frontend/src/lib/auth.js                       Auth module (signIn only)
+            frontend/src/lib/apiClient.js                  API client with Authorization header
+            frontend/src/pages/auth/Login.jsx              Login page
+            frontend/src/components/ProtectedRoute.jsx     Route guard component
+
+          It also patches:
+            infrastructure/modules/app/main.tf             Adds cognito_user_pool_arns to conveyor_belt
+
+          After running:
+            1. Review the generated Cognito config in cognito.tf
+            2. Add auth: :cognito to your routes namespace
+            3. Run `belt deploy` to create the user pool
+            4. Create your account (admin-only): aws cognito-idp admin-create-user ...
+        HELP
+      end
+
+      # Parse pool names from args. Default to ["main"] if none provided.
+      def self.parse_pools(args)
+        names = args.reject { |a| a.start_with?('-') }
+        names = ['main'] if names.empty?
+        names.map(&:downcase).map { |n| n.gsub(/[^a-z0-9_]/, '_') }
+      end
+
+      def initialize(pools:, force: false, signup: false)
+        @pool_names = pools
+        @force = force
+        @signup = signup
+        @app_name = detect_app_name
+        @pools = build_pool_metadata
+      end
+
+      def generate
+        check_collision! unless @force
+        ensure_module_dir!
+
+        write_cognito_tf
+        write_cognito_outputs_tf
+        patch_main_tf
+        generate_frontend_auth if frontend?
+
+        puts "\n✓ Auth generated!"
+        puts "\nNext steps:"
+        puts '  1. Review infrastructure/modules/app/cognito.tf'
+        puts '  2. Customize password policy, MFA, or Lambda triggers as needed'
+        puts '  3. Run `belt apply <env>` to deploy'
+        puts '  4. Create your account: aws cognito-idp admin-create-user ...' unless @signup
+      end
+
+      def remove
+        removed = []
+
+        cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
+        cognito_outputs_tf = File.join(MODULE_DIR, 'cognito_outputs.tf')
+
+        if File.exist?(cognito_tf)
+          FileUtils.rm(cognito_tf)
+          removed << cognito_tf
+          puts "  remove  #{cognito_tf}"
+        end
+
+        if File.exist?(cognito_outputs_tf)
+          FileUtils.rm(cognito_outputs_tf)
+          removed << cognito_outputs_tf
+          puts "  remove  #{cognito_outputs_tf}"
+        end
+
+        unpatch_main_tf
+        removed << File.join(MODULE_DIR, 'main.tf') if @main_tf_patched
+
+        if removed.empty?
+          puts '  Nothing to remove — auth was not generated.'
+        else
+          puts "\n✓ Auth destroyed!"
+        end
+      end
+
+      private
+
+      def build_pool_metadata
+        if @pool_names.length == 1 && @pool_names.first == 'main'
+          [{ name: 'main', suffix: '', label: '' }]
+        else
+          @pool_names.map do |name|
+            { name: name, suffix: "-#{name}", label: " (#{name})" }
+          end
+        end
+      end
+
+      def frontend?
+        Dir.exist?('frontend/src')
+      end
+
+      def generate_frontend_auth
+        frontend_template_dir = File.join(TEMPLATE_DIR, 'frontend')
+
+        # Generate auth lib files
+        lib_dir = 'frontend/src/lib'
+        FileUtils.mkdir_p(lib_dir)
+        copy_frontend_file(frontend_template_dir, 'auth.js', File.join(lib_dir, 'auth.js'))
+        copy_frontend_file(frontend_template_dir, 'apiClient.js', File.join(lib_dir, 'apiClient.js'))
+
+        pages_dir = 'frontend/src/pages/auth'
+        FileUtils.mkdir_p(pages_dir)
+        copy_frontend_file(frontend_template_dir, 'Login.jsx', File.join(pages_dir, 'Login.jsx'))
+        if @signup
+          # Generate auth pages
+          copy_frontend_file(frontend_template_dir, 'SignUp.jsx', File.join(pages_dir, 'SignUp.jsx'))
+          copy_frontend_file(frontend_template_dir, 'ConfirmEmail.jsx', File.join(pages_dir, 'ConfirmEmail.jsx'))
+        end
+
+        # Generate ProtectedRoute component
+        components_dir = 'frontend/src/components'
+        FileUtils.mkdir_p(components_dir)
+        copy_frontend_file(frontend_template_dir, 'ProtectedRoute.jsx',
+                           File.join(components_dir, 'ProtectedRoute.jsx'))
+
+        install_cognito_sdk
+      end
+
+      def copy_frontend_file(template_dir, filename, dest)
+        src = File.join(template_dir, filename)
+        FileUtils.cp(src, dest)
+        puts "  create  #{dest}"
+      end
+
+      def install_cognito_sdk
+        puts "\n  Installing @aws-sdk/client-cognito-identity-provider..."
+        success = system('npm', 'install', '@aws-sdk/client-cognito-identity-provider',
+                         '--prefix', 'frontend', '--no-fund', '--no-audit', '--silent')
+        if success
+          puts '  ✓      npm dependency installed'
+        else
+          puts '  ⚠      npm install failed — run: cd frontend && npm install @aws-sdk/client-cognito-identity-provider'
+        end
+      end
+
+      def check_collision!
+        cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
+        return unless File.exist?(cognito_tf)
+
+        puts "\n✗ Auth already exists at #{cognito_tf}"
+        puts "\nTo overwrite, run again with --force:"
+        puts "  belt g auth #{@pool_names.join(' ')} --force"
+        exit 1
+      end
+
+      def ensure_module_dir!
+        FileUtils.mkdir_p(MODULE_DIR)
+      end
+
+      def write_cognito_tf
+        dest = File.join(MODULE_DIR, 'cognito.tf')
+        write_template('cognito.tf.erb', dest)
+        puts "  create  #{dest}"
+      end
+
+      def write_cognito_outputs_tf
+        dest = File.join(MODULE_DIR, 'cognito_outputs.tf')
+        write_template('cognito_outputs.tf.erb', dest)
+        puts "  create  #{dest}"
+      end
+
+      def patch_main_tf
+        main_tf = File.join(MODULE_DIR, 'main.tf')
+        return unless File.exist?(main_tf)
+
+        content = File.read(main_tf)
+
+        if content.include?('cognito_user_pool_arns')
+          puts "  skip    #{main_tf} (cognito_user_pool_arns already present)"
+          return
+        end
+
+        return unless content.match?(/^resource "conveyor_belt"/)
+
+        arns = @pools.map { |p| "aws_cognito_user_pool.#{p[:name]}.arn" }
+        arn_value = build_arn_value(arns)
+
+        insert_cognito_into_resource(content, main_tf, arn_value)
+      end
+
+      def build_arn_value(arns)
+        if arns.length == 1
+          "[#{arns.first}]"
+        else
+          "[\n    #{arns.join(",\n    ")}\n  ]"
+        end
+      end
+
+      def insert_cognito_into_resource(content, main_tf, arn_value)
+        lines = content.lines
+        brace_depth = 0
+        insert_index = nil
+        in_resource = false
+
+        lines.each_with_index do |line, idx|
+          if line.match?(/^resource "conveyor_belt"/)
+            in_resource = true
+            brace_depth = 0
+          end
+
+          next unless in_resource
+
+          brace_depth += line.count('{') - line.count('}')
+
+          next unless brace_depth <= 0
+
+          insert_index = idx
+          break
+        end
+
+        return unless insert_index
+
+        cognito_line = "\n  cognito_user_pool_arns = #{arn_value}\n"
+        lines.insert(insert_index, cognito_line)
+        File.write(main_tf, lines.join)
+        puts "  update  #{main_tf} (added cognito_user_pool_arns)"
+      end
+
+      def unpatch_main_tf
+        main_tf = File.join(MODULE_DIR, 'main.tf')
+        @main_tf_patched = false
+        return unless File.exist?(main_tf)
+
+        content = File.read(main_tf)
+        return unless content.include?('cognito_user_pool_arns')
+
+        # Remove the cognito_user_pool_arns line(s) — could be single or multi-line
+        updated = content.gsub(/\n\s*cognito_user_pool_arns\s*=\s*\[[^\]]*\]\n/, "\n")
+        return if updated == content
+
+        File.write(main_tf, updated)
+        puts "  update  #{main_tf} (removed cognito_user_pool_arns)"
+        @main_tf_patched = true
+      end
+
+      def write_template(template_name, dest_path)
+        template_path = File.join(TEMPLATE_DIR, template_name)
+        content = ERB.new(File.read(template_path), trim_mode: '-').result(binding)
+        File.write(dest_path, content)
+      end
+    end
+  end
+end

data/lib/belt/cli/destroy_command.rb

@@ -2,6 +2,7 @@
 
 require 'fileutils'
 require_relative 'app_detection'
+require_relative 'auth_command'
 require_relative 'generator_registry'
 require_relative 'tables_command'
 require_relative '../inflector'
@@ -9,7 +10,7 @@ require_relative '../inflector'
 module Belt
   module CLI
     class DestroyCommand
-      GENERATORS = %w[scaffold resource model controller environment frontend views].freeze
+      GENERATORS = %w[scaffold resource model controller environment frontend views auth].freeze
 
       include AppDetection
 
@@ -51,6 +52,8 @@ module Belt
           new(generator, name, [], **flags).destroy
         when 'frontend'
           new(generator, nil, []).destroy
+        when 'auth'
+          Belt::CLI::AuthCommand.destroy(args)
         when 'views'
           name = args.shift
           if name.nil? || name.empty?
@@ -98,6 +101,7 @@ module Belt
             resource      Alias for scaffold
             model         Remove an ActiveItem model
             controller    Remove a controller
+            auth          Remove Cognito user pool infrastructure
             environment   Remove a deployment environment and tear down infrastructure
             frontend      Remove the frontend/ directory
             views         Remove React pages for a resource

data/lib/belt/cli/generate_command.rb

@@ -3,6 +3,7 @@
 require 'fileutils'
 require 'erb'
 require_relative 'app_detection'
+require_relative 'auth_command'
 require_relative 'environment_command'
 require_relative 'frontend_command'
 require_relative 'tables_command'
@@ -14,7 +15,7 @@ module Belt
   module CLI
     class GenerateCommand
       TEMPLATE_DIR = File.expand_path('../../templates/generate', __dir__)
-      GENERATORS = %w[scaffold resource model controller environment frontend views].freeze
+      GENERATORS = %w[scaffold resource model controller environment frontend views auth].freeze
 
       include AppDetection
 
@@ -126,6 +127,8 @@ module Belt
 
         return Belt::CLI::ViewsCommand.run(args) if generator == 'views'
 
+        return Belt::CLI::AuthCommand.run(args) if generator == 'auth'
+
         name = args.shift
         if name.nil? || name.empty?
           print_generator_help(generator)
@@ -192,6 +195,7 @@ module Belt
             scaffold      Generate model, controller, routes, schema, and views (full REST resource)
             model         Generate an ActiveItem model
             controller    Generate a controller
+            auth          Generate Cognito user pool infrastructure
             environment   Create a new deployment environment
             frontend      Scaffold a frontend app (react, vue, svelte)
             views         Generate React pages for a resource

data/lib/belt/route_dsl.rb

@@ -156,7 +156,7 @@ module Belt
     def initialize(name, options = {})
       @name = name.to_s
       @routes = []
-      @default_auth = options[:auth] || :cognito
+      @default_auth = options[:auth] || :none
       @default_lambda = options[:lambda] || name
       @default_cors = options.fetch(:cors, true)
       @default_tables = Array(options[:tables] || [])

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.17'
+  VERSION = '0.2.19'
 end

data/lib/templates/generate/auth/cognito.tf.erb

@@ -0,0 +1,73 @@
+# Cognito User Pool — authentication for <%= @app_name %>
+# Generated by: belt generate auth
+
+<% @pools.each do |pool| -%>
+resource "aws_cognito_user_pool" "<%= pool[:name] %>" {
+  name = "${var.app_name}-${var.environment}<%= pool[:suffix] %>"
+
+  password_policy {
+    minimum_length    = 8
+    require_lowercase = true
+    require_numbers   = true
+    require_symbols   = false
+    require_uppercase = true
+  }
+
+  # Admin-only signup — users cannot self-register.
+  # Remove this block to allow public sign-up.
+<% unless @signup -%>
+  admin_create_user_config {
+    allow_admin_create_user_only = true
+  }
+
+<% end -%>
+  auto_verified_attributes = ["email"]
+
+  account_recovery_setting {
+    recovery_mechanism {
+      name     = "verified_email"
+      priority = 1
+    }
+  }
+
+  schema {
+    name                = "email"
+    attribute_data_type = "String"
+    required            = true
+    mutable             = true
+
+    string_attribute_constraints {
+      min_length = 1
+      max_length = 256
+    }
+  }
+
+  deletion_protection = var.environment == "prod" ? "ACTIVE" : "INACTIVE"
+}
+
+resource "aws_cognito_user_pool_client" "<%= pool[:name] %>" {
+  name         = "${var.app_name}-${var.environment}<%= pool[:suffix] %>-client"
+  user_pool_id = aws_cognito_user_pool.<%= pool[:name] %>.id
+
+  explicit_auth_flows = [
+    "ALLOW_USER_SRP_AUTH",
+<% if @signup -%>
+    "ALLOW_USER_PASSWORD_AUTH",
+<% end -%>
+    "ALLOW_REFRESH_TOKEN_AUTH"
+  ]
+
+  prevent_user_existence_errors = "ENABLED"
+
+  token_validity_units {
+    access_token  = "hours"
+    id_token      = "hours"
+    refresh_token = "days"
+  }
+
+  access_token_validity  = 1
+  id_token_validity      = 1
+  refresh_token_validity = 30
+}
+
+<% end -%>

data/lib/templates/generate/auth/cognito_outputs.tf.erb

@@ -0,0 +1,19 @@
+# Cognito outputs — generated by: belt generate auth
+
+<% @pools.each do |pool| -%>
+output "cognito_user_pool_id<%= pool[:suffix] %>" {
+  description = "Cognito User Pool ID<%= pool[:label] %>"
+  value       = aws_cognito_user_pool.<%= pool[:name] %>.id
+}
+
+output "cognito_user_pool_arn<%= pool[:suffix] %>" {
+  description = "Cognito User Pool ARN<%= pool[:label] %>"
+  value       = aws_cognito_user_pool.<%= pool[:name] %>.arn
+}
+
+output "cognito_client_id<%= pool[:suffix] %>" {
+  description = "Cognito User Pool Client ID<%= pool[:label] %>"
+  value       = aws_cognito_user_pool_client.<%= pool[:name] %>.id
+}
+
+<% end -%>

data/lib/templates/generate/auth/frontend/ConfirmEmail.jsx

@@ -0,0 +1,55 @@
+import { useState } from 'react'
+import { confirmSignUp } from '../lib/auth'
+
+export default function ConfirmEmail() {
+  const params = new URLSearchParams(window.location.search)
+  const [email, setEmail] = useState(params.get('email') || '')
+  const [code, setCode] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [confirmed, setConfirmed] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      await confirmSignUp(email, code)
+      setConfirmed(true)
+    } catch (err) {
+      setError(err.message || 'Confirmation failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (confirmed) {
+    return (
+      <div className="auth-page">
+        <div className="auth-form">
+          <h2>Email Verified! ✓</h2>
+          <p>Your account is ready.</p>
+          <a href="/login" className="auth-btn">Sign In</a>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Verify Email</h2>
+        <p>Enter the code sent to your email.</p>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required />
+        <input type="text" placeholder="Verification code" value={code}
+          onChange={e => setCode(e.target.value)} required autoFocus />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Verifying...' : 'Verify'}
+        </button>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/Login.jsx

@@ -0,0 +1,81 @@
+import { useState } from 'react'
+import { signIn, completeNewPassword } from '../lib/auth'
+
+export default function Login({ onLogin }) {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [newPassword, setNewPassword] = useState('')
+  const [error, setError] = useState('')
+  const [challenge, setChallenge] = useState(null)
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      const result = await signIn(email, password)
+      if (result.challenge === 'NEW_PASSWORD_REQUIRED') {
+        setChallenge(result)
+      } else {
+        onLogin()
+      }
+    } catch (err) {
+      setError(err.message || 'Sign in failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  async function handleNewPassword(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      await completeNewPassword(email, newPassword, challenge.session)
+      onLogin()
+    } catch (err) {
+      setError(err.message || 'Password change failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (challenge) {
+    return (
+      <div className="auth-page">
+        <form className="auth-form" onSubmit={handleNewPassword}>
+          <h2>Set New Password</h2>
+          <p>Please set a permanent password for your account.</p>
+          {error && <div className="auth-error">{error}</div>}
+          <input type="password" placeholder="New password" value={newPassword}
+            onChange={e => setNewPassword(e.target.value)} required autoFocus />
+          <button type="submit" disabled={loading}>
+            {loading ? 'Saving...' : 'Set Password'}
+          </button>
+        </form>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Sign In</h2>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required autoFocus />
+        <input type="password" placeholder="Password" value={password}
+          onChange={e => setPassword(e.target.value)} required />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Signing in...' : 'Sign In'}
+        </button>
+        <p className="auth-link">
+          Don't have an account? <a href="/signup">Sign up</a>
+        </p>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/ProtectedRoute.jsx

@@ -0,0 +1,9 @@
+import { isAuthenticated } from '../lib/auth'
+import { Navigate } from 'react-router-dom'
+
+export default function ProtectedRoute({ children }) {
+  if (!isAuthenticated()) {
+    return <Navigate to="/login" replace />
+  }
+  return children
+}

data/lib/templates/generate/auth/frontend/SignUp.jsx

@@ -0,0 +1,58 @@
+import { useState } from 'react'
+import { signUp } from '../lib/auth'
+
+export default function SignUp() {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [needsConfirmation, setNeedsConfirmation] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      const result = await signUp(email, password)
+      if (result.needsConfirmation) setNeedsConfirmation(true)
+    } catch (err) {
+      setError(err.message || 'Sign up failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (needsConfirmation) {
+    return (
+      <div className="auth-page">
+        <div className="auth-form">
+          <h2>Check Your Email</h2>
+          <p>We sent a verification code to <strong>{email}</strong>.</p>
+          <a href={`/confirm?email=${encodeURIComponent(email)}`} className="auth-btn">
+            Enter Code
+          </a>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Create Account</h2>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required autoFocus />
+        <input type="password" placeholder="Password (8+ characters)" value={password}
+          onChange={e => setPassword(e.target.value)} required minLength={8} />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Creating...' : 'Create Account'}
+        </button>
+        <p className="auth-link">
+          Already have an account? <a href="/login">Sign in</a>
+        </p>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/apiClient.js

@@ -0,0 +1,34 @@
+import { getToken } from './auth'
+
+const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3000'
+
+export async function apiClient(path, options = {}) {
+  const { method = 'GET', body, headers = {} } = options
+
+  const token = getToken()
+  const config = {
+    method,
+    headers: {
+      Accept: 'application/json',
+      ...(token ? { Authorization: token } : {}),
+      ...headers
+    }
+  }
+
+  if (body !== undefined && body !== null) {
+    config.headers['Content-Type'] = 'application/json'
+    config.body = JSON.stringify(body)
+  }
+
+  const response = await fetch(`${API_URL}${path}`, config)
+  const data = await response.json()
+
+  if (response.status === 401) {
+    window.location.href = '/login'
+    throw new Error('Unauthorized')
+  }
+
+  if (!response.ok) throw new Error(data.error || `Request failed: ${response.status}`)
+
+  return data
+}

data/lib/templates/generate/auth/frontend/auth.js

@@ -0,0 +1,80 @@
+import {
+  CognitoIdentityProviderClient,
+  InitiateAuthCommand,
+  RespondToAuthChallengeCommand,
+  SignUpCommand,
+  ConfirmSignUpCommand
+} from '@aws-sdk/client-cognito-identity-provider'
+
+const REGION = import.meta.env.VITE_AWS_REGION
+const CLIENT_ID = import.meta.env.VITE_COGNITO_CLIENT_ID
+
+const client = new CognitoIdentityProviderClient({ region: REGION })
+
+let idToken = null
+let refreshToken = null
+
+export function getToken() { return idToken }
+export function isAuthenticated() { return idToken !== null }
+
+export async function signIn(username, password) {
+  const response = await client.send(new InitiateAuthCommand({
+    AuthFlow: 'USER_PASSWORD_AUTH',
+    ClientId: CLIENT_ID,
+    AuthParameters: { USERNAME: username, PASSWORD: password }
+  }))
+
+  if (response.ChallengeName === 'NEW_PASSWORD_REQUIRED') {
+    return { challenge: 'NEW_PASSWORD_REQUIRED', session: response.Session }
+  }
+
+  setTokens(response.AuthenticationResult)
+  return { success: true }
+}
+
+export async function signUp(email, password) {
+  await client.send(new SignUpCommand({
+    ClientId: CLIENT_ID,
+    Username: email,
+    Password: password
+  }))
+  return { needsConfirmation: true }
+}
+
+export async function confirmSignUp(email, code) {
+  await client.send(new ConfirmSignUpCommand({
+    ClientId: CLIENT_ID,
+    Username: email,
+    ConfirmationCode: code
+  }))
+  return { success: true }
+}
+
+export async function completeNewPassword(username, newPassword, session) {
+  const response = await client.send(new RespondToAuthChallengeCommand({
+    ChallengeName: 'NEW_PASSWORD_REQUIRED',
+    ClientId: CLIENT_ID,
+    Session: session,
+    ChallengeResponses: { USERNAME: username, NEW_PASSWORD: newPassword }
+  }))
+  setTokens(response.AuthenticationResult)
+  return { success: true }
+}
+
+export function signOut() {
+  idToken = null
+  refreshToken = null
+  localStorage.removeItem('idToken')
+  localStorage.removeItem('refreshToken')
+}
+
+function setTokens(authResult) {
+  idToken = authResult.IdToken
+  refreshToken = authResult.RefreshToken
+  localStorage.setItem('idToken', idToken)
+  if (refreshToken) localStorage.setItem('refreshToken', refreshToken)
+}
+
+// Restore on page load
+const stored = localStorage.getItem('idToken')
+if (stored) idToken = stored

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.2.17
+  version: 0.2.19
 platform: ruby
 authors:
 - Stowzilla
@@ -76,6 +76,7 @@ files:
 - lib/belt/assets/welcome.css
 - lib/belt/cli.rb
 - lib/belt/cli/app_detection.rb
+- lib/belt/cli/auth_command.rb
 - lib/belt/cli/backup_config.rb
 - lib/belt/cli/backup_runner.rb
 - lib/belt/cli/bucket_security.rb
@@ -141,6 +142,14 @@ files:
 - lib/templates/frontend/react/src/pages/Home.jsx.erb
 - lib/templates/frontend/react/vite.config.js
 - lib/templates/frontend_infra/frontend.tf.erb
+- lib/templates/generate/auth/cognito.tf.erb
+- lib/templates/generate/auth/cognito_outputs.tf.erb
+- lib/templates/generate/auth/frontend/ConfirmEmail.jsx
+- lib/templates/generate/auth/frontend/Login.jsx
+- lib/templates/generate/auth/frontend/ProtectedRoute.jsx
+- lib/templates/generate/auth/frontend/SignUp.jsx
+- lib/templates/generate/auth/frontend/apiClient.js
+- lib/templates/generate/auth/frontend/auth.js
 - lib/templates/generate/controller.rb.erb
 - lib/templates/generate/model.rb.erb
 - lib/templates/module/dns.tf.erb