belt 0.2.17 → 0.3.14

data/lib/belt/cli/auth_command.rb

@@ -0,0 +1,395 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'erb'
+require_relative 'app_detection'
+require_relative 'frontend_registry'
+
+module Belt
+  module CLI
+    class AuthCommand
+      TEMPLATE_DIR = File.expand_path('../../templates/generate/auth', __dir__)
+      MODULE_DIR = 'infrastructure/modules/app'
+
+      include AppDetection
+
+      def self.run(args)
+        if args.include?('--help') || args.include?('-h')
+          print_help
+          exit 0
+        end
+
+        force = args.delete('--force') || args.delete('-f')
+        signup = args.delete('--signup')
+        frontend_name = FrontendRegistry.extract_flag!(args, '--frontend')
+        pools = parse_pools(args)
+
+        new(pools: pools, force: force, signup: signup, frontend_name: frontend_name).generate
+      end
+
+      def self.destroy(_args)
+        new(pools: [], force: false, skip_frontend_resolve: true).remove
+      end
+
+      def self.print_help
+        puts <<~HELP
+          Generate Cognito user pool infrastructure for authentication.
+
+          Usage: belt generate auth [pool_names...] [options]
+
+          Options:
+            --signup           Allow public user registration (generates frontend views)
+            --frontend NAME    Target frontend when several exist
+            --force, -f        Overwrite existing cognito.tf (skip collision check)
+
+          Arguments:
+            pool_names      Optional pool names for multiple user pools.
+                            If omitted, generates a single pool named "main".
+
+          Examples:
+            belt g auth                        # Admin-only, single pool
+            belt g auth --signup               # Public signup with frontend views
+            belt g auth web                    # Named pool: "web"
+            belt g auth web mobile             # Two pools
+            belt g auth --force                # Overwrite existing
+
+          What this generates:
+            infrastructure/modules/app/cognito.tf          User pool + client resources
+            infrastructure/modules/app/cognito_outputs.tf  Pool ID, ARN, and client ID outputs
+
+          With --signup (when frontend/ exists):
+            frontend/src/lib/auth.js                       Auth module (signIn, signUp, etc.)
+            frontend/src/lib/apiClient.js                  API client with Authorization header
+            frontend/src/pages/auth/Login.jsx              Login page
+            frontend/src/pages/auth/SignUp.jsx             Registration page
+            frontend/src/pages/auth/ConfirmEmail.jsx       Email verification page
+            frontend/src/components/ProtectedRoute.jsx     Route guard component
+
+          Without --signup (admin-only, default):
+            frontend/src/lib/auth.js                       Auth module (signIn only)
+            frontend/src/lib/apiClient.js                  API client with Authorization header
+            frontend/src/pages/auth/Login.jsx              Login page
+            frontend/src/components/ProtectedRoute.jsx     Route guard component
+
+          It also patches:
+            infrastructure/modules/app/main.tf             Adds cognito_user_pool_arns to conveyor_belt
+
+          After running:
+            1. Review the generated Cognito config in cognito.tf
+            2. Add auth: :cognito to your routes namespace
+            3. Run `belt deploy` to create the user pool
+            4. Create your account (admin-only): aws cognito-idp admin-create-user ...
+        HELP
+      end
+
+      # Parse pool names from args. Default to ["main"] if none provided.
+      def self.parse_pools(args)
+        names = args.reject { |a| a.start_with?('-') }
+        names = ['main'] if names.empty?
+        names.map(&:downcase).map { |n| n.gsub(/[^a-z0-9_]/, '_') }
+      end
+
+      def initialize(pools:, force: false, signup: false, frontend_name: nil, skip_frontend_resolve: false)
+        @pool_names = pools
+        @force = force
+        @signup = signup
+        @app_name = detect_app_name
+        @pools = build_pool_metadata
+        @frontend = skip_frontend_resolve ? nil : resolve_frontend(frontend_name)
+      end
+
+      def generate
+        check_collision! unless @force
+        ensure_module_dir!
+
+        write_cognito_tf
+        write_cognito_outputs_tf
+        patch_main_tf
+        patch_env_outputs
+        generate_frontend_auth if frontend?
+
+        puts "\n✓ Auth generated!"
+        print_next_steps
+      end
+
+      def print_next_steps
+        puts "\nNext steps:"
+        puts '  1. Add auth: :cognito to your routes namespace:'
+        puts ''
+        puts '       namespace :api, auth: :cognito do'
+        puts '         # your resources...'
+        puts '       end'
+        puts ''
+        if frontend?
+          puts "  2. Wire auth into your #{@frontend.src_dir}/App.jsx:"
+          puts ''
+          puts "       import Login from './pages/auth/Login'"
+          puts "       import ProtectedRoute from './components/ProtectedRoute'"
+          puts ''
+          puts '       // Add login route:'
+          puts '       <Route path="/login" element={<Login onLogin={() => window.location.href = \'/\'} />} />'
+          puts ''
+          puts '       // Wrap protected routes:'
+          puts '       <Route path="/*" element={<ProtectedRoute><YourApp /></ProtectedRoute>} />'
+          puts ''
+          puts '  3. Deploy: belt deploy'
+          print_create_user_step(4) unless @signup
+        else
+          puts '  2. Deploy: belt deploy'
+          print_create_user_step(3) unless @signup
+        end
+      end
+
+      def print_create_user_step(step_num)
+        puts "  #{step_num}. Create your account:"
+        puts '       aws cognito-idp admin-create-user \\'
+        puts '         --user-pool-id <pool-id-from-terraform-output> \\'
+        puts '         --username your@email.com \\'
+        puts '         --temporary-password TempPass123 \\'
+        puts '         --message-action SUPPRESS'
+      end
+
+      def remove
+        removed = []
+
+        cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
+        cognito_outputs_tf = File.join(MODULE_DIR, 'cognito_outputs.tf')
+
+        if File.exist?(cognito_tf)
+          FileUtils.rm(cognito_tf)
+          removed << cognito_tf
+          puts "  remove  #{cognito_tf}"
+        end
+
+        if File.exist?(cognito_outputs_tf)
+          FileUtils.rm(cognito_outputs_tf)
+          removed << cognito_outputs_tf
+          puts "  remove  #{cognito_outputs_tf}"
+        end
+
+        unpatch_main_tf
+        removed << File.join(MODULE_DIR, 'main.tf') if @main_tf_patched
+
+        if removed.empty?
+          puts '  Nothing to remove — auth was not generated.'
+        else
+          puts "\n✓ Auth destroyed!"
+        end
+      end
+
+      private
+
+      def build_pool_metadata
+        if @pool_names.length == 1 && @pool_names.first == 'main'
+          [{ name: 'main', suffix: '', label: '' }]
+        else
+          @pool_names.map do |name|
+            { name: name, suffix: "-#{name}", label: " (#{name})" }
+          end
+        end
+      end
+
+      def resolve_frontend(name)
+        registry = FrontendRegistry.new
+        return nil if registry.empty? && name.nil?
+
+        return registry.resolve!(name) if name
+
+        registry.default
+      end
+
+      def frontend?
+        @frontend && Dir.exist?(@frontend.src_dir)
+      end
+
+      def generate_frontend_auth
+        frontend_template_dir = File.join(TEMPLATE_DIR, 'frontend')
+        src = @frontend.src_dir
+
+        # Generate auth lib files
+        lib_dir = File.join(src, 'lib')
+        FileUtils.mkdir_p(lib_dir)
+        copy_frontend_file(frontend_template_dir, 'auth.js', File.join(lib_dir, 'auth.js'))
+        copy_frontend_file(frontend_template_dir, 'apiClient.js', File.join(lib_dir, 'apiClient.js'))
+
+        pages_dir = File.join(src, 'pages/auth')
+        FileUtils.mkdir_p(pages_dir)
+        copy_frontend_file(frontend_template_dir, 'Login.jsx', File.join(pages_dir, 'Login.jsx'))
+        copy_frontend_file(frontend_template_dir, 'auth.css', File.join(pages_dir, 'auth.css'))
+        if @signup
+          # Generate auth pages
+          copy_frontend_file(frontend_template_dir, 'SignUp.jsx', File.join(pages_dir, 'SignUp.jsx'))
+          copy_frontend_file(frontend_template_dir, 'ConfirmEmail.jsx', File.join(pages_dir, 'ConfirmEmail.jsx'))
+        end
+
+        # Generate ProtectedRoute component
+        components_dir = File.join(src, 'components')
+        FileUtils.mkdir_p(components_dir)
+        copy_frontend_file(frontend_template_dir, 'ProtectedRoute.jsx',
+                           File.join(components_dir, 'ProtectedRoute.jsx'))
+
+        install_cognito_sdk
+      end
+
+      def copy_frontend_file(template_dir, filename, dest)
+        src = File.join(template_dir, filename)
+        FileUtils.cp(src, dest)
+        puts "  create  #{dest}"
+      end
+
+      def install_cognito_sdk
+        puts "\n  Installing amazon-cognito-identity-js..."
+        success = system('npm', 'install', 'amazon-cognito-identity-js',
+                         '--prefix', @frontend.path, '--no-fund', '--no-audit', '--silent')
+        if success
+          puts '  ✓      npm dependency installed'
+        else
+          puts "  ⚠      npm install failed — run: cd #{@frontend.path} && " \
+               'npm install amazon-cognito-identity-js'
+        end
+      end
+
+      def check_collision!
+        cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
+        return unless File.exist?(cognito_tf)
+
+        puts "\n✗ Auth already exists at #{cognito_tf}"
+        puts "\nTo overwrite, run again with --force:"
+        puts "  belt g auth #{@pool_names.join(' ')} --force"
+        exit 1
+      end
+
+      def ensure_module_dir!
+        FileUtils.mkdir_p(MODULE_DIR)
+      end
+
+      def write_cognito_tf
+        dest = File.join(MODULE_DIR, 'cognito.tf')
+        write_template('cognito.tf.erb', dest)
+        puts "  create  #{dest}"
+      end
+
+      def write_cognito_outputs_tf
+        dest = File.join(MODULE_DIR, 'cognito_outputs.tf')
+        write_template('cognito_outputs.tf.erb', dest)
+        puts "  create  #{dest}"
+      end
+
+      def patch_main_tf
+        main_tf = File.join(MODULE_DIR, 'main.tf')
+        return unless File.exist?(main_tf)
+
+        content = File.read(main_tf)
+
+        if content.include?('cognito_user_pool_arns')
+          puts "  skip    #{main_tf} (cognito_user_pool_arns already present)"
+          return
+        end
+
+        return unless content.match?(/^resource "conveyor_belt"/)
+
+        arns = @pools.map { |p| "aws_cognito_user_pool.#{p[:name]}.arn" }
+        arn_value = build_arn_value(arns)
+
+        insert_cognito_into_resource(content, main_tf, arn_value)
+      end
+
+      def patch_env_outputs
+        env_dirs = Dir.glob('infrastructure/*/outputs.tf')
+                      .reject { |f| f.include?('modules') }
+
+        env_dirs.each do |outputs_file|
+          content = File.read(outputs_file)
+
+          next if content.include?('cognito_user_pool_id')
+
+          cognito_outputs = @pools.map do |pool|
+            suffix = pool[:suffix]
+            <<~HCL
+
+              output "cognito_user_pool_id#{suffix}" {
+                description = "Cognito User Pool ID#{pool[:label]}"
+                value       = module.app.cognito_user_pool_id#{suffix}
+              }
+
+              output "cognito_client_id#{suffix}" {
+                description = "Cognito User Pool Client ID#{pool[:label]}"
+                value       = module.app.cognito_client_id#{suffix}
+              }
+
+              output "cognito_region" {
+                description = "AWS region for Cognito"
+                value       = var.aws_region
+              }
+            HCL
+          end.join
+
+          File.write(outputs_file, content + cognito_outputs)
+          env_name = File.basename(File.dirname(outputs_file))
+          puts "  update  #{outputs_file} (added cognito outputs for #{env_name})"
+        end
+      end
+
+      def build_arn_value(arns)
+        if arns.length == 1
+          "[#{arns.first}]"
+        else
+          "[\n    #{arns.join(",\n    ")}\n  ]"
+        end
+      end
+
+      def insert_cognito_into_resource(content, main_tf, arn_value)
+        lines = content.lines
+        brace_depth = 0
+        insert_index = nil
+        in_resource = false
+
+        lines.each_with_index do |line, idx|
+          if line.match?(/^resource "conveyor_belt"/)
+            in_resource = true
+            brace_depth = 0
+          end
+
+          next unless in_resource
+
+          brace_depth += line.count('{') - line.count('}')
+
+          next unless brace_depth <= 0
+
+          insert_index = idx
+          break
+        end
+
+        return unless insert_index
+
+        cognito_line = "\n  cognito_user_pool_arns = #{arn_value}\n"
+        lines.insert(insert_index, cognito_line)
+        File.write(main_tf, lines.join)
+        puts "  update  #{main_tf} (added cognito_user_pool_arns)"
+      end
+
+      def unpatch_main_tf
+        main_tf = File.join(MODULE_DIR, 'main.tf')
+        @main_tf_patched = false
+        return unless File.exist?(main_tf)
+
+        content = File.read(main_tf)
+        return unless content.include?('cognito_user_pool_arns')
+
+        # Remove the cognito_user_pool_arns line(s) — could be single or multi-line
+        updated = content.gsub(/\n\s*cognito_user_pool_arns\s*=\s*\[[^\]]*\]\n/, "\n")
+        return if updated == content
+
+        File.write(main_tf, updated)
+        puts "  update  #{main_tf} (removed cognito_user_pool_arns)"
+        @main_tf_patched = true
+      end
+
+      def write_template(template_name, dest_path)
+        template_path = File.join(TEMPLATE_DIR, template_name)
+        content = ERB.new(File.read(template_path), trim_mode: '-').result(binding)
+        File.write(dest_path, content)
+      end
+    end
+  end
+end

data/lib/belt/cli/console_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'optparse'
+require 'stringio'
 require_relative 'environment_config'
 
 module Belt
@@ -59,7 +60,10 @@ module Belt
         boot_app
         puts banner
         ARGV.clear
-        require 'irb'
+        suppress_warnings do
+          require 'irb'
+          require 'rdoc'
+        end
         IRB.start
       end
 
@@ -72,7 +76,7 @@ module Belt
       end
 
       def boot_app
-        require 'bundler/setup'
+        suppress_warnings { require 'bundler/setup' }
 
         environment_file = File.join(Belt.root, 'lambda', 'config', 'environment.rb')
         if File.exist?(environment_file)
@@ -132,6 +136,17 @@ module Belt
           result.inspect
         end
       end
+
+      def suppress_warnings
+        original_verbose = $VERBOSE
+        $VERBOSE = nil
+        original_stderr = $stderr
+        $stderr = StringIO.new
+        yield
+      ensure
+        $stderr = original_stderr
+        $VERBOSE = original_verbose
+      end
     end
   end
 end

data/lib/belt/cli/deploy_command.rb

@@ -10,6 +10,7 @@ require_relative 'backup_config'
 require_relative 'backup_runner'
 require_relative 'environment_config'
 require_relative 'path_gem_materializer'
+require_relative 'zip_artifact_builder'
 
 module Belt
   module CLI
@@ -66,7 +67,8 @@ module Belt
             puts '  belt deploy prod           # Deploy to prod'
             puts '  belt deploy dev --auto     # Deploy without confirmation'
             puts '  belt deploy --rebuild      # Fast code push (no infra changes)'
-            puts '  belt deploy frontend dev   # Deploy frontend only'
+            puts '  belt deploy frontend dev              # Deploy frontend(s)'
+            puts '  belt deploy frontend dev --frontend ops'
             puts "\nNo environments found. Run `belt generate environment dev` first."
             exit 1
           end
@@ -92,10 +94,11 @@ module Belt
             1. Ensure Gemfile.lock is consistent (fix stale PATH refs)
             2. Regenerate route manifests
             3. Run pre-deploy backups (if configured in belt.rb)
-            4. terraform init    (initialize providers/modules)
-            5. terraform plan    (preview changes)
-            6. Prompt for confirmation (unless --auto)
-            7. terraform apply   (deploy changes)
+            4. Build sidecar Lambda zips Terraform needs at plan time
+            5. terraform init    (initialize providers/modules)
+            6. terraform plan    (preview changes)
+            7. Prompt for confirmation (unless --auto)
+            8. terraform apply   (deploy changes)
 
           Options:
             --auto, --yes, -y    Skip confirmation prompt (auto-approve)
@@ -130,7 +133,8 @@ module Belt
             belt deploy prod --rebuild # Fast code push to prod
             belt deploy prod --skip-backup  # Skip backups for this deploy
             belt deploy prod --backup-only  # Run backups without deploying
-            belt deploy frontend dev   # Deploy frontend assets only
+            belt deploy frontend dev              # Deploy frontend asset(s)
+            belt deploy frontend dev --frontend ops
         HELP
       end
 
@@ -145,9 +149,9 @@ module Belt
 
       def run
         validate!
-        env_dir = File.join(@infra_dir, @env)
-
         load_and_apply_env_config!
+        run_preflight_checks!
+        env_dir = File.join(@infra_dir, @env)
 
         puts "belt → deploying #{@env} (in #{env_dir}/)\n\n"
 
@@ -155,6 +159,7 @@ module Belt
         warn_active_path_gems!
         generate_routes_if_needed
         run_backups unless @skip_backup
+        build_zip_artifacts!
 
         Dir.chdir(env_dir) do
           run_init
@@ -263,6 +268,14 @@ module Belt
               "Create it with: belt generate environment #{@env}"
       end
 
+      def run_preflight_checks!
+        require_relative 'doctor_command'
+        doctor = DoctorCommand.new(preflight: true)
+        return if doctor.run
+
+        abort 'Deploy blocked. Fix the issues above, then try again.'
+      end
+
       def validate_aws!
         stdout, status = Open3.capture2('aws', 'sts', 'get-caller-identity', '--output', 'json')
         unless status.success?
@@ -308,6 +321,19 @@ module Belt
           return match[1] if match
         end
 
+        # Try variables.tf for a default app_name value
+        vars_file = File.join(@infra_dir, @env, 'variables.tf')
+        if File.exist?(vars_file)
+          content = File.read(vars_file)
+          if content.match?(/variable\s+"app_name"/)
+            block_match = content.match(/variable\s+"app_name"\s*\{([^}]*)\}/m)
+            if block_match
+              default_match = block_match[1].match(/default\s*=\s*"([^"]+)"/)
+              return default_match[1] if default_match
+            end
+          end
+        end
+
         # Fall back to directory name
         File.basename(@project_root)
       end
@@ -402,7 +428,7 @@ module Belt
 
       def generate_routes(lambda_dir)
         routes_dir = File.join(lambda_dir, 'lib', 'routes')
-        return unless Dir.exist?(routes_dir)
+        FileUtils.mkdir_p(routes_dir)
 
         puts '  🗺️  Regenerating route manifests...'
         success = system('belt', 'routes', '--namespace', 'all', '--output-dir', routes_dir)
@@ -655,6 +681,10 @@ module Belt
         puts ' (timed out waiting, but code was pushed)'
       end
 
+      def build_zip_artifacts!
+        ZipArtifactBuilder.build!(project_root: @project_root, infra_dir: @infra_dir)
+      end
+
       def run_init
         puts '━━━ terraform init ━━━'
         success = system('terraform', 'init')
@@ -698,15 +728,19 @@ module Belt
       end
 
       def deploy_frontend_if_exists
-        frontend_dir = File.join(@project_root, 'frontend')
-        return unless Dir.exist?(frontend_dir) && File.exist?(File.join(frontend_dir, 'package.json'))
-
-        puts "\n━━━ frontend deploy ━━━"
+        require_relative 'frontend_registry'
         require_relative 'frontend_deploy_command'
-        Belt::CLI::FrontendDeployCommand.new(@env).run
-      rescue StandardError => e
-        puts "\n  ⚠ Frontend deploy failed: #{e.message}"
-        puts "    Run `belt deploy frontend #{@env}` manually to retry."
+
+        frontends = FrontendRegistry.new.existing
+        return if frontends.empty?
+
+        frontends.each do |frontend|
+          puts "\n━━━ #{frontend.label} deploy ━━━"
+          Belt::CLI::FrontendDeployCommand.new(@env, frontend: frontend).run
+        rescue StandardError => e
+          puts "\n  ⚠ #{frontend.label.capitalize} deploy failed: #{e.message}"
+          puts "    Run `belt deploy frontend #{@env} --frontend #{frontend.name}` manually to retry."
+        end
       end
 
       def print_outputs(env_dir)