belt 0.2.17 → 0.3.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e1813b72986b167b9449f438b18331cc2e9be46cffa58bd059c403f3c35703e
-  data.tar.gz: 26c3aae3c049bbebff471d6a8a514114a26f8b2d0fdf4671cb154ae9a056798f
+  metadata.gz: 491ae37769b6a21cfd1823301d425d0af0b3f1e3c19952b909febebc7f2c3b32
+  data.tar.gz: a2427f68a34d38be0cf3af42ac33a8d3c3d190f36505c54ef531219cd0c3fb66
 SHA512:
-  metadata.gz: 23bbf9977c0cd765c7a1630e7a74ed480db6d62ee07c22e95e6a491a3a9c04d824b8463b0ef63ae4c4b343e13e96ff26c9edb5c86c8005fce7f0a167b6894c64
-  data.tar.gz: e7f625fe93dcb125289530e2a3bdb9dee8c37938eeea41bc9154a31aca6b47675a6336e39c986f3a801719f4cf22052bad40968ff6e1b9a82936140f74432f4a
+  metadata.gz: 895fb4f7238141ba4752cdfc9200c44b2ef870bbc61585a436d3a9e36f39c689e8429d97ad4cf0101d92cbea06b3771864c1d31e4892dae54448a2f0e8ec138b
+  data.tar.gz: 4b2fee884c2f7ad9ba78bd7a46dacf75d1d5c8aa5da43d151ab7d03889aa740dd60a12a1fce5c18467f7c3bbb54aacb886a55efdcc58a997ed6367148ea37f15

data/CHANGELOG.md

@@ -1,5 +1,246 @@
 # Changelog
 
+## 0.3.15
+
+### Bug Fix
+
+- **`belt generate auth` NEW_PASSWORD_REQUIRED challenge sent `email` even when
+  the user already had it**: The 0.3.14 fix always passed `{ email }` to
+  `completeNewPasswordChallenge`. That fixed pools where `email` was missing, but
+  broke the common case where the user already has `email` set (e.g. created via
+  `admin-create-user` with an email) — Cognito rejects that with a 400
+  `NotAuthorizedException: Cannot modify an already provided email`. The template
+  now reads the `requiredAttributes` list Cognito provides in the
+  `newPasswordRequired` callback and supplies `email` **only when Cognito actually
+  requires it**. Users with email already set complete the challenge without
+  re-sending it; users missing email still get it supplied. Handles both cases.
+
+## 0.3.14
+
+### Bug Fix
+
+- **`belt generate auth` NEW_PASSWORD_REQUIRED challenge dropped the email
+  attribute**: The generated `auth.js` `completeNewPassword` passed an empty
+  attributes object (`{}`) to `completeNewPasswordChallenge`. On user pools that
+  require `email`, admin-created users completing the `NEW_PASSWORD_REQUIRED`
+  challenge (which don't have `email` set yet) got a 400 `Invalid attributes
+  given, email is missing`. The template now supplies `{ email }` (the username
+  is the email) so the challenge completes. `Login.jsx` already passed the email
+  in, so no change was needed there.
+
+## 0.3.13
+
+### Security Fix
+
+- **`belt generate auth` sent passwords in plaintext**: The generated `auth.js`
+  used the raw `@aws-sdk/client-cognito-identity-provider` with
+  `AuthFlow: 'USER_PASSWORD_AUTH'`, which puts the user's cleartext `PASSWORD` in
+  the `InitiateAuth` request payload (visible in devtools, proxies, and any request
+  logging). The template now uses `amazon-cognito-identity-js`, which authenticates
+  via SRP (Secure Remote Password) — the password never leaves the browser, only the
+  `SRP_A` proof is transmitted. `signIn` and the `NEW_PASSWORD_REQUIRED` challenge now
+  run over SRP; `signUp`/`confirmSignUp` are unchanged in behavior but route through the
+  same library.
+- The generator now installs `amazon-cognito-identity-js` instead of
+  `@aws-sdk/client-cognito-identity-provider`.
+- SRP requires the User Pool ID client-side, so `auth.js` now reads
+  `VITE_COGNITO_USER_POOL_ID` (already emitted by the auth generator's terraform
+  outputs and present in `env.yml.example`).
+
+## 0.3.12
+
+### Bug Fix
+
+- **`env.yml.example` Cognito client ID typo**: The example env map referenced
+  `cognito_user_pool_client_id` as the terraform output name for
+  `VITE_COGNITO_CLIENT_ID`, but the correct output name is `cognito_client_id`.
+  Users following the tutorial would uncomment the line and get a missing-output
+  warning on deploy. Fixed in the template, CLI help text, and docs.
+
+## 0.3.11
+
+### Bug Fix
+
+- **`belt deploy` skips route generation on first deploy**: The `generate_routes`
+  method would silently bail if `lambda/lib/routes/` didn't already exist on disk.
+  Since this directory is gitignored (it's a generated build artifact), a fresh clone
+  or first deploy would package the Lambda without route manifests, causing a
+  `LoadError` at cold start. Now creates the directory with `mkdir_p` before running
+  route generation.
+
+## 0.3.10
+
+### Bug Fix
+
+- **`api_url` output missing base path for custom domains**: When a custom domain is
+  configured (e.g. `api.dev.example.com`), the `api_url` terraform output was missing
+  the gateway's base path segment. Conveyor-belt maps each gateway to a base path
+  (gateway "api" → path `/api`), so the correct URL is
+  `https://api.dev.example.com/api` not `https://api.dev.example.com`. The frontend
+  would get the wrong `VITE_API_URL` and hit a 403 on the custom domain root.
+
+## 0.3.9
+
+### Bug Fix
+
+- **`belt setup frontend` with underscored app names**: The 0.3.8 fix placed
+  `local.s3_safe_name` in `dns.tf` but `belt setup frontend` only regenerates
+  `frontend.tf`, causing an "undeclared local value" error on existing apps.
+  The bucket name now uses inline `replace(var.app_name, "_", "-")` directly in
+  `frontend.tf`, making it fully self-contained with no cross-file dependency.
+
+## 0.3.8
+
+### Bug Fix
+
+- **S3 bucket naming with underscored app names**: The module template now sanitizes
+  `var.app_name` for S3 bucket names by replacing underscores with hyphens. Apps named
+  with underscores (e.g. `feature_parity`) previously generated invalid bucket names
+  since S3 follows DNS naming rules which prohibit underscores.
+
+## 0.3.7
+
+### Bug Fix
+
+- **App name detection in worktrees**: `detect_app_name` now checks
+  `infrastructure/*/variables.tf` for `variable "app_name" { default = "..." }`
+  before falling back to the directory name. Fixes incorrect Lambda function
+  lookups (e.g. `belt logs`) when running from a git worktree whose directory
+  name doesn't match the actual app name.
+
+## 0.3.6
+
+### Enhancement
+
+- **Per-action request_model**: `request_model` on `resources` now accepts a Hash
+  to specify different validation schemas per action:
+  ```ruby
+  resources :items, request_model: { create: :create_item, update: :update_item }
+  ```
+  Symbol style (uniform for all body verbs) still works unchanged.
+
+- **Convention-based request_model inference**: When no explicit `request_model` is
+  set on a resource route, `belt routes` auto-discovers matching contracts from
+  `contracts.rb` using a naming cascade:
+  1. `:<verb>_<gateway>_<singular_resource>` (e.g. `:create_customer_item`)
+  2. `:<verb>_<singular_resource>` (e.g. `:create_item`)
+
+  Only applies to body-accepting verbs (POST/PUT/PATCH). Explicit `request_model:`
+  always takes priority. No matching contract = no validation (same as before).
+
+- **Convention-based response_model inference**: When no explicit `response_model` is
+  set on a resource route, `belt routes` auto-discovers a matching response model
+  from `contracts.rb` using the singular resource name.
+  e.g. `resources :items` → looks for `model :item` → auto-wires `response_model: :item`.
+  Applies to all verbs. Explicit `response_model:` always takes priority.
+
+## 0.3.5
+
+### Enhancement
+
+- **Multiple frontends**: Frontend directory is no longer hardcoded to `frontend/`.
+  Declare named SPAs in `config/frontends.yml` (path, dist dir, terraform output names).
+  `belt generate frontend react --name ops --path ops-app` scaffolds an additional app.
+  Generators, `belt server`, `belt frontend env`, and `belt deploy frontend` accept
+  `--frontend NAME`. `belt deploy frontend <env>` deploys all configured frontends;
+  pass `--frontend` to target one. Existing single-`frontend/` apps keep working
+  with no config file.
+- **Sidecar Lambda zips**: `belt deploy` / `belt plan` / `belt apply` build zip
+  artifacts that Terraform `filebase64sha256` needs at plan time (e.g. Stowzilla's
+  Node `image-processor`). Node packages are installed in Docker on linux/amd64
+  so native addons match Lambda. Missing zips are built automatically; unchanged
+  sources skip the rebuild.
+
+### Bug fix
+
+- **Frontend CloudFront invalidation**: `belt deploy frontend` no longer prints
+  terraform's "output not found" error when a named frontend sets
+  `cloudfront_domain_output` instead of a distribution-id output. Missing
+  terraform outputs are read with stderr silenced.
+
+## 0.3.4
+
+### Enhancement
+
+- **Flexible config file extensions**: Lambda config files (`config/lambda/*.yml`) and frontend env maps (`frontend/env.yml`, `.belt/frontend_env.yml`) now also accept `.yaml` as a file extension. (#1124)
+
+## 0.3.2
+
+### Bug fix
+
+- **Table name normalization**: Route JSON output now uses hyphens instead of underscores in inferred table names, matching the ActiveItem convention (e.g., `user-sessions` instead of `user_sessions`). (#51)
+
+## 0.3.1
+
+Version bump only — tagged release for internal tracking.
+
+## 0.3.0
+
+Version bump only — no code changes from 0.2.21.
+
+**Why 0.3.0 instead of another patch?** The route DSL changes in 0.2.21 (`gateway`/`function`/`namespace`/`scope`) were a minor-version level change (new features, new keywords). RubyGems doesn't allow republishing the same version, so we're bumping to 0.3.0 to correct the semver trajectory.
+
+If you're on 0.2.21, you already have the DSL changes. This release is purely for version hygiene.
+
+## 0.2.21
+
+### Route DSL: `gateway`, `function`, `namespace`, and `scope` keywords
+
+The route DSL now uses terminology that matches AWS infrastructure:
+
+- **`gateway`** — Creates an API Gateway with a default Lambda function of the same name (replaces top-level `namespace`)
+- **`function`** — Targets enclosed routes to a different Lambda function
+- **`namespace`** — Rails-like path + module prefix (e.g., `/admin/users` with `admin/users` controller). Does NOT change Lambda target.
+- **`scope`** — Flexible grouping with `path:`, `module:`, `auth:`, `tables:` options. Does NOT change Lambda target.
+
+```ruby
+Belt.application.routes.draw do
+  gateway :api, auth: :cognito do
+    resources :posts                    # → lambda: "api", path: /posts
+
+    function :onboarding do
+      resources :steps                  # → lambda: "onboarding", path: /steps
+    end
+
+    namespace :admin do
+      resources :users                  # → lambda: "api", path: /admin/users, controller: "admin/users"
+    end
+
+    scope path: 'v2', module: 'v2' do
+      resources :widgets                # → lambda: "api", path: /v2/widgets, controller: "v2/widgets"
+    end
+  end
+end
+```
+
+**ActionRouter** now accepts `gateway:` keyword (preferred):
+
+```ruby
+ROUTER = Belt::ActionRouter.new(routes: Routes::API, gateway: 'api')
+```
+
+**100% backward compatible:** `namespace :api do` at top level still works (aliased to `gateway`), and `ActionRouter.new(namespace: 'api')` still works.
+
+## 0.2.18
+
+### New generator: `belt generate auth`
+
+Scaffolds Cognito user pool infrastructure for authentication. Creates the user pool, client, and wires `cognito_user_pool_arns` into the conveyor-belt resource automatically.
+
+```bash
+belt g auth                    # Single pool: "main"
+belt g auth web mobile         # Multiple pools (e.g., web + mobile clients)
+belt g auth web android ios    # Three pools
+belt destroy auth              # Remove generated files
+```
+
+What it generates:
+- `infrastructure/modules/app/cognito.tf` — User pool + client with sensible defaults (password policy, email verification, deletion protection in prod)
+- `infrastructure/modules/app/cognito_outputs.tf` — Pool ID, ARN, and client ID outputs
+- Patches `main.tf` to pass `cognito_user_pool_arns` to the conveyor-belt resource
+
+Multiple pools are supported out of the box — each gets a suffixed name (e.g., `myapp-prod-web`, `myapp-prod-mobile`) and its own set of outputs.
+
 ## 0.2.12
 
 ### Rename: `routes.tf.rb` → `routes.rb`, `schema.tf.rb` → `contracts.rb`

data/README.md

@@ -105,7 +105,7 @@ require "belt"
 
 include Belt::LambdaHandler
 
-ROUTER = Belt::ActionRouter.new(routes: Routes::API, namespace: "api")
+ROUTER = Belt::ActionRouter.new(routes: Routes::API, gateway: "api")
 
 def execute(path:, body:, event:)
   ROUTER.route(event: event, body: body)
@@ -140,7 +140,7 @@ Define routes in `infrastructure/routes.tf.rb`:
 
 ```ruby
 Belt.application.routes.draw do
-  namespace :api do
+  gateway :api do
     resources :posts, only: [:index, :show, :create]
   end
 end
@@ -170,6 +170,45 @@ The provider will:
 - Generate IAM policies for DynamoDB table access
 - Set up CloudWatch log groups
 
+### Route DSL Keywords
+
+The routes DSL has four keywords that map to infrastructure and code organization:
+
+| Keyword | Purpose | Affects Lambda? |
+|---------|---------|-----------------|
+| `gateway` | Creates an API Gateway + default Lambda | Yes — sets the default Lambda for all routes inside |
+| `function` | Routes to a different Lambda | Yes — overrides the gateway's default |
+| `namespace` | Adds path prefix + controller module | No — Rails-like code organization only |
+| `scope` | Flexible path/module/auth grouping | No — grouping and shared options only |
+
+**Example combining all four:**
+
+```ruby
+Belt.application.routes.draw do
+  gateway :api, auth: :cognito do
+    resources :posts                    # → lambda: api, path: /posts, controller: posts
+
+    namespace :admin do
+      resources :users                  # → lambda: api, path: /admin/users, controller: admin/users
+    end
+
+    function :worker do
+      resources :jobs                   # → lambda: worker, path: /jobs, controller: jobs
+
+      namespace :internal do
+        resources :tasks                # → lambda: worker, path: /internal/tasks, controller: internal/tasks
+      end
+    end
+
+    scope path: 'v2', module: 'legacy' do
+      resources :widgets                # → lambda: api, path: /v2/widgets, controller: legacy/widgets
+    end
+  end
+end
+```
+
+**Key point:** `namespace` and `scope` are purely organizational — they affect URL paths and controller module resolution but never change which Lambda handles the request. Use `function` when you need routes to go to a different Lambda.
+
 ## BeltController Features
 
 ### Callbacks
@@ -423,7 +462,7 @@ The command expects `infrastructure/routes.tf.rb` in the current working directo
 
 ```ruby
 Belt.application.routes.draw do
-  namespace :api do
+  gateway :api do
     resources :posts, only: [:index, :show, :create, :destroy]
     resource :profile, only: [:show, :update]
     get "health", action: :health

data/lib/belt/action_router.rb

@@ -7,28 +7,39 @@ module Belt
   # Routes incoming requests to controllers based on a route manifest.
   #
   # Usage:
-  #   ROUTER = Belt::ActionRouter.new(routes: MY_ROUTES, namespace: "api")
+  #   ROUTER = Belt::ActionRouter.new(routes: MY_ROUTES, gateway: "api")
   #   response = ROUTER.route(event: event, body: body)
   #
   class ActionRouter
     class RouteNotFound < StandardError; end
 
-    def initialize(routes:, namespace:)
-      @namespace = namespace.to_s
-      @namespace_module_name = "#{@namespace.split('_').map(&:capitalize).join}Controllers"
+    def initialize(routes:, gateway: nil, namespace: nil)
+      # Accept `gateway:` (preferred) or legacy `namespace:` keyword
+      gw = gateway || namespace
+      raise ArgumentError, 'Belt::ActionRouter requires a gateway: (or legacy namespace:) argument' unless gw
+
+      @gateway = gw.to_s
+      @gateway_module_name = "#{@gateway.split('_').map(&:capitalize).join}Controllers"
       @routes = build_route_table(routes)
     end
 
     def route(event:, body:)
       method = event['httpMethod']
       full_path = event['path']
-      match_path = strip_namespace_prefix(full_path)
+      match_path = strip_gateway_prefix(full_path)
 
       route_info = find_route(method, match_path)
 
       unless route_info
-        Belt::Observability::Logger.instance&.warn('Route not found', method: method, path: full_path)
-        return error_response('Not found', 404, event)
+        # Fallback: serve the Belt welcome page for GET / when no explicit root route exists.
+        # This handles the case where API Gateway delivers the request (e.g. via a catch-all
+        # integration or proxy route) but the route manifest doesn't include GET /.
+        if method == 'GET' && root_path?(match_path)
+          route_info = { verb: 'GET', pattern: '/', segments: [], controller: 'welcome', action: 'show' }
+        else
+          Belt::Observability::Logger.instance&.warn('Route not found', method: method, path: full_path)
+          return error_response('Not found', 404, event)
+        end
       end
 
       path_params = extract_path_params(route_info[:pattern], match_path)
@@ -56,10 +67,14 @@ module Belt
 
     private
 
-    def strip_namespace_prefix(path)
+    def root_path?(path)
+      path == '/' || path.empty?
+    end
+
+    def strip_gateway_prefix(path)
       return '/' if path.nil?
 
-      prefix = "/#{@namespace}"
+      prefix = "/#{@gateway}"
       if path.start_with?(prefix)
         stripped = path.sub(prefix, '')
         stripped.empty? ? '/' : stripped
@@ -127,15 +142,15 @@ module Belt
       return false if name.start_with?('/') || name.end_with?('/')
       return false if name.include?('\\')
 
-      # Allow only lowercase letters, digits, underscores, and a single forward slash for nesting
+      # Allow only lowercase letters, digits, underscores, and forward slashes for nesting
       name.match?(%r{\A[a-z][a-z0-9_]*(/[a-z][a-z0-9_]*)?\z})
     end
 
     def resolve_controller(controller_name)
-      # Try namespace module first (app's own controllers)
+      # Try gateway module first (app's own controllers)
       begin
-        namespace_module = Object.const_get(@namespace_module_name)
-        return resolve_from_module(namespace_module, controller_name)
+        gateway_module = Object.const_get(@gateway_module_name)
+        return resolve_from_module(gateway_module, controller_name)
       rescue NameError
         # Fall through to controller_paths lookup
       end
@@ -144,13 +159,13 @@ module Belt
       resolve_from_paths(controller_name)
     end
 
-    def resolve_from_module(namespace_module, controller_name)
+    def resolve_from_module(gateway_module, controller_name)
       if controller_name.include?('/')
         parts = controller_name.split('/')
-        parent = namespace_module.const_get(parts[0].split('_').map(&:capitalize).join)
+        parent = gateway_module.const_get(parts[0].split('_').map(&:capitalize).join)
         parent.const_get("#{parts[1].split('_').map(&:capitalize).join}Controller")
       else
-        namespace_module.const_get("#{controller_name.split('_').map(&:capitalize).join}Controller")
+        gateway_module.const_get("#{controller_name.split('_').map(&:capitalize).join}Controller")
       end
     end
 
@@ -176,9 +191,9 @@ module Belt
         class_name = "#{controller_name.split(%r{[_/]}).map(&:capitalize).join}Controller"
         return Object.const_get(class_name) if Object.const_defined?(class_name)
 
-        # Try under namespace module (e.g., BrablogControllers::PostsController)
-        if Object.const_defined?(@namespace_module_name)
-          ns = Object.const_get(@namespace_module_name)
+        # Try under gateway module (e.g., ApiControllers::PostsController)
+        if Object.const_defined?(@gateway_module_name)
+          ns = Object.const_get(@gateway_module_name)
           return ns.const_get(class_name) if ns.const_defined?(class_name)
         end
       end

data/lib/belt/cli/app_detection.rb

@@ -3,19 +3,21 @@
 module Belt
   module CLI
     module AppDetection
-      # Detects the primary namespace from the route definitions.
+      # Detects the primary gateway from the route definitions.
       # Used by generators to determine controller directory and route file naming.
       def detect_namespace
         routes_file = find_routes_file_path
         if routes_file && File.exist?(routes_file)
-          match = File.read(routes_file).match(/namespace :(\w+)/)
+          content = File.read(routes_file)
+          # Prefer `gateway :name` but fall back to legacy `namespace :name` at top-level
+          match = content.match(/^\s*gateway :(\w+)/) || content.match(/^\s*namespace :(\w+)/)
           return match[1] if match
         end
         File.basename(Dir.pwd)
       end
 
       # Detects the application name.
-      # Prefers terraform.tfvars app_name, then falls back to directory name.
+      # Priority: terraform.tfvars app_name > variables.tf default > directory name.
       def detect_app_name
         # Check any environment tfvars for the app_name
         Dir.glob('infrastructure/*/terraform.tfvars').each do |f|
@@ -24,6 +26,10 @@ module Belt
           return match[1] if match
         end
 
+        # Check variables.tf for a default app_name value
+        name = detect_app_name_from_variables_tf
+        return name if name
+
         # Fall back to directory name
         File.basename(Dir.pwd)
       end
@@ -65,6 +71,27 @@ module Belt
       def find_schema_file_path
         find_contracts_file_path
       end
+
+      private
+
+      # Parses `variable "app_name" { default = "..." }` from any environment's variables.tf.
+      # This handles the common pattern where app_name is a Terraform variable with a default
+      # rather than being set directly in terraform.tfvars.
+      def detect_app_name_from_variables_tf
+        Dir.glob('infrastructure/*/variables.tf').each do |f|
+          content = File.read(f)
+          # Match the app_name variable block and extract its default value
+          next unless content.match?(/variable\s+"app_name"/)
+
+          # Extract default from within the variable block
+          block_match = content.match(/variable\s+"app_name"\s*\{([^}]*)\}/m)
+          next unless block_match
+
+          default_match = block_match[1].match(/default\s*=\s*"([^"]+)"/)
+          return default_match[1] if default_match
+        end
+        nil
+      end
     end
   end
 end