belt 0.2.17 → 0.3.15

data/lib/templates/generate/auth/cognito.tf.erb

@@ -0,0 +1,71 @@
+# Cognito User Pool — authentication for <%= @app_name %>
+# Generated by: belt generate auth
+
+<% @pools.each do |pool| -%>
+resource "aws_cognito_user_pool" "<%= pool[:name] %>" {
+  name = "${var.app_name}-${var.environment}<%= pool[:suffix] %>"
+
+  password_policy {
+    minimum_length    = 8
+    require_lowercase = true
+    require_numbers   = true
+    require_symbols   = false
+    require_uppercase = true
+  }
+
+  # Admin-only signup — users cannot self-register.
+  # Remove this block to allow public sign-up.
+<% unless @signup -%>
+  admin_create_user_config {
+    allow_admin_create_user_only = true
+  }
+
+<% end -%>
+  auto_verified_attributes = ["email"]
+
+  account_recovery_setting {
+    recovery_mechanism {
+      name     = "verified_email"
+      priority = 1
+    }
+  }
+
+  schema {
+    name                = "email"
+    attribute_data_type = "String"
+    required            = true
+    mutable             = true
+
+    string_attribute_constraints {
+      min_length = 1
+      max_length = 256
+    }
+  }
+
+  deletion_protection = var.environment == "prod" ? "ACTIVE" : "INACTIVE"
+}
+
+resource "aws_cognito_user_pool_client" "<%= pool[:name] %>" {
+  name         = "${var.app_name}-${var.environment}<%= pool[:suffix] %>-client"
+  user_pool_id = aws_cognito_user_pool.<%= pool[:name] %>.id
+
+  explicit_auth_flows = [
+    "ALLOW_USER_SRP_AUTH",
+    "ALLOW_USER_PASSWORD_AUTH",
+    "ALLOW_REFRESH_TOKEN_AUTH"
+  ]
+
+  prevent_user_existence_errors = "ENABLED"
+
+  token_validity_units {
+    access_token  = "hours"
+    id_token      = "hours"
+    refresh_token = "days"
+  }
+
+  access_token_validity  = 1
+  id_token_validity      = 1
+  refresh_token_validity = 30
+}
+
+<% end -%>

data/lib/templates/generate/auth/cognito_outputs.tf.erb

@@ -0,0 +1,19 @@
+# Cognito outputs — generated by: belt generate auth
+
+<% @pools.each do |pool| -%>
+output "cognito_user_pool_id<%= pool[:suffix] %>" {
+  description = "Cognito User Pool ID<%= pool[:label] %>"
+  value       = aws_cognito_user_pool.<%= pool[:name] %>.id
+}
+
+output "cognito_user_pool_arn<%= pool[:suffix] %>" {
+  description = "Cognito User Pool ARN<%= pool[:label] %>"
+  value       = aws_cognito_user_pool.<%= pool[:name] %>.arn
+}
+
+output "cognito_client_id<%= pool[:suffix] %>" {
+  description = "Cognito User Pool Client ID<%= pool[:label] %>"
+  value       = aws_cognito_user_pool_client.<%= pool[:name] %>.id
+}
+
+<% end -%>

data/lib/templates/generate/auth/frontend/ConfirmEmail.jsx

@@ -0,0 +1,55 @@
+import { useState } from 'react'
+import { confirmSignUp } from '../../lib/auth'
+
+export default function ConfirmEmail() {
+  const params = new URLSearchParams(window.location.search)
+  const [email, setEmail] = useState(params.get('email') || '')
+  const [code, setCode] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [confirmed, setConfirmed] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      await confirmSignUp(email, code)
+      setConfirmed(true)
+    } catch (err) {
+      setError(err.message || 'Confirmation failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (confirmed) {
+    return (
+      <div className="auth-page">
+        <div className="auth-form">
+          <h2>Email Verified! ✓</h2>
+          <p>Your account is ready.</p>
+          <a href="/login" className="auth-btn">Sign In</a>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Verify Email</h2>
+        <p>Enter the code sent to your email.</p>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required />
+        <input type="text" placeholder="Verification code" value={code}
+          onChange={e => setCode(e.target.value)} required autoFocus />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Verifying...' : 'Verify'}
+        </button>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/Login.jsx

@@ -0,0 +1,79 @@
+import { useState } from 'react'
+import { signIn, completeNewPassword } from '../../lib/auth'
+import './auth.css'
+
+export default function Login({ onLogin }) {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [newPassword, setNewPassword] = useState('')
+  const [error, setError] = useState('')
+  const [challenge, setChallenge] = useState(null)
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      const result = await signIn(email, password)
+      if (result.challenge === 'NEW_PASSWORD_REQUIRED') {
+        setChallenge(result)
+      } else {
+        onLogin()
+      }
+    } catch (err) {
+      setError(err.message || 'Sign in failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  async function handleNewPassword(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      await completeNewPassword(email, newPassword, challenge.session)
+      onLogin()
+    } catch (err) {
+      setError(err.message || 'Password change failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (challenge) {
+    return (
+      <div className="auth-page">
+        <form className="auth-form" onSubmit={handleNewPassword}>
+          <h2>Set New Password</h2>
+          <p>Please set a permanent password for your account.</p>
+          {error && <div className="auth-error">{error}</div>}
+          <input type="password" placeholder="New password" value={newPassword}
+            onChange={e => setNewPassword(e.target.value)} required autoFocus />
+          <button type="submit" disabled={loading}>
+            {loading ? 'Saving...' : 'Set Password'}
+          </button>
+        </form>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Sign In</h2>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required autoFocus />
+        <input type="password" placeholder="Password" value={password}
+          onChange={e => setPassword(e.target.value)} required />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Signing in...' : 'Sign In'}
+        </button>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/ProtectedRoute.jsx

@@ -0,0 +1,9 @@
+import { isAuthenticated } from '../lib/auth'
+import { Navigate } from 'react-router-dom'
+
+export default function ProtectedRoute({ children }) {
+  if (!isAuthenticated()) {
+    return <Navigate to="/login" replace />
+  }
+  return children
+}

data/lib/templates/generate/auth/frontend/SignUp.jsx

@@ -0,0 +1,58 @@
+import { useState } from 'react'
+import { signUp } from '../../lib/auth'
+
+export default function SignUp() {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [needsConfirmation, setNeedsConfirmation] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      const result = await signUp(email, password)
+      if (result.needsConfirmation) setNeedsConfirmation(true)
+    } catch (err) {
+      setError(err.message || 'Sign up failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (needsConfirmation) {
+    return (
+      <div className="auth-page">
+        <div className="auth-form">
+          <h2>Check Your Email</h2>
+          <p>We sent a verification code to <strong>{email}</strong>.</p>
+          <a href={`/confirm?email=${encodeURIComponent(email)}`} className="auth-btn">
+            Enter Code
+          </a>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Create Account</h2>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required autoFocus />
+        <input type="password" placeholder="Password (8+ characters)" value={password}
+          onChange={e => setPassword(e.target.value)} required minLength={8} />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Creating...' : 'Create Account'}
+        </button>
+        <p className="auth-link">
+          Already have an account? <a href="/login">Sign in</a>
+        </p>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/apiClient.js

@@ -0,0 +1,34 @@
+import { getToken } from './auth'
+
+const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3000'
+
+export async function apiClient(path, options = {}) {
+  const { method = 'GET', body, headers = {} } = options
+
+  const token = getToken()
+  const config = {
+    method,
+    headers: {
+      Accept: 'application/json',
+      ...(token ? { Authorization: token } : {}),
+      ...headers
+    }
+  }
+
+  if (body !== undefined && body !== null) {
+    config.headers['Content-Type'] = 'application/json'
+    config.body = JSON.stringify(body)
+  }
+
+  const response = await fetch(`${API_URL}${path}`, config)
+  const data = await response.json()
+
+  if (response.status === 401) {
+    window.location.href = '/login'
+    throw new Error('Unauthorized')
+  }
+
+  if (!response.ok) throw new Error(data.error || `Request failed: ${response.status}`)
+
+  return data
+}

data/lib/templates/generate/auth/frontend/auth.css

@@ -0,0 +1,157 @@
+.auth-page {
+  --auth-bg: #f6f8fa;
+  --auth-card-bg: #ffffff;
+  --auth-border: #d0d7de;
+  --auth-text: #1f2328;
+  --auth-muted: #656d76;
+  --auth-input-bg: #f6f8fa;
+  --auth-btn: #2da44e;
+  --auth-btn-hover: #2c974b;
+  --auth-btn-disabled-bg: #94d3a2;
+  --auth-btn-disabled-text: #fff;
+  --auth-error-bg: rgba(248, 81, 73, 0.08);
+  --auth-error-border: rgba(248, 81, 73, 0.4);
+  --auth-error-text: #cf222e;
+  --auth-link: #0969da;
+  --auth-focus: #0969da;
+}
+
+@media (prefers-color-scheme: dark) {
+  .auth-page {
+    --auth-bg: #0d1117;
+    --auth-card-bg: #161b22;
+    --auth-border: #30363d;
+    --auth-text: #e6edf3;
+    --auth-muted: #8b949e;
+    --auth-input-bg: #0d1117;
+    --auth-btn: #238636;
+    --auth-btn-hover: #2ea043;
+    --auth-btn-disabled-bg: #21262d;
+    --auth-btn-disabled-text: #484f58;
+    --auth-error-bg: rgba(248, 81, 73, 0.1);
+    --auth-error-border: rgba(248, 81, 73, 0.4);
+    --auth-error-text: #f85149;
+    --auth-link: #58a6ff;
+    --auth-focus: #58a6ff;
+  }
+}
+
+.auth-page {
+  min-height: 100vh;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: var(--auth-bg);
+  padding: 1rem;
+}
+
+.auth-form {
+  background: var(--auth-card-bg);
+  border: 1px solid var(--auth-border);
+  border-radius: 12px;
+  padding: 2.5rem;
+  width: 100%;
+  max-width: 380px;
+  box-shadow: 0 4px 16px rgba(0, 0, 0, 0.1);
+}
+
+.auth-form h2 {
+  color: var(--auth-text);
+  font-size: 1.5rem;
+  margin: 0 0 0.5rem;
+  text-align: center;
+}
+
+.auth-form p {
+  color: var(--auth-muted);
+  font-size: 0.85rem;
+  text-align: center;
+  margin: 0 0 1.5rem;
+}
+
+.auth-form input {
+  display: block;
+  width: 100%;
+  padding: 0.75rem 1rem;
+  margin-bottom: 0.75rem;
+  background: var(--auth-input-bg);
+  border: 1px solid var(--auth-border);
+  border-radius: 8px;
+  color: var(--auth-text);
+  font-size: 0.9rem;
+  outline: none;
+  transition: border-color 0.2s;
+  box-sizing: border-box;
+}
+
+.auth-form input:focus {
+  border-color: var(--auth-focus);
+}
+
+.auth-form input::placeholder {
+  color: var(--auth-muted);
+}
+
+.auth-form button {
+  display: block;
+  width: 100%;
+  padding: 0.75rem;
+  margin-top: 0.5rem;
+  background: var(--auth-btn);
+  border: none;
+  border-radius: 8px;
+  color: #fff;
+  font-size: 0.9rem;
+  font-weight: 600;
+  cursor: pointer;
+  transition: background 0.2s;
+}
+
+.auth-form button:hover {
+  background: var(--auth-btn-hover);
+}
+
+.auth-form button:disabled {
+  background: var(--auth-btn-disabled-bg);
+  color: var(--auth-btn-disabled-text);
+  cursor: not-allowed;
+}
+
+.auth-error {
+  background: var(--auth-error-bg);
+  border: 1px solid var(--auth-error-border);
+  border-radius: 8px;
+  color: var(--auth-error-text);
+  padding: 0.6rem 0.75rem;
+  font-size: 0.8rem;
+  margin-bottom: 1rem;
+  text-align: center;
+}
+
+.auth-link {
+  color: var(--auth-muted);
+  font-size: 0.8rem;
+  text-align: center;
+  margin-top: 1.25rem !important;
+}
+
+.auth-link a {
+  color: var(--auth-link);
+  text-decoration: none;
+}
+
+.auth-link a:hover {
+  text-decoration: underline;
+}
+
+.auth-btn {
+  display: inline-block;
+  padding: 0.6rem 1.5rem;
+  background: var(--auth-btn);
+  border-radius: 8px;
+  color: #fff;
+  text-decoration: none;
+  font-weight: 600;
+  font-size: 0.85rem;
+  margin-top: 1rem;
+}

data/lib/templates/generate/auth/frontend/auth.js

@@ -0,0 +1,134 @@
+import {
+  CognitoUserPool,
+  CognitoUser,
+  AuthenticationDetails,
+  CognitoUserAttribute
+} from 'amazon-cognito-identity-js'
+
+const REGION = import.meta.env.VITE_AWS_REGION
+const CLIENT_ID = import.meta.env.VITE_COGNITO_CLIENT_ID
+const USER_POOL_ID = import.meta.env.VITE_COGNITO_USER_POOL_ID
+
+// amazon-cognito-identity-js uses SRP (Secure Remote Password) by default.
+// The password is NEVER sent over the wire — only the SRP_A proof is
+// transmitted, so credentials can't leak into request logs or proxies.
+const userPool = new CognitoUserPool({
+  UserPoolId: USER_POOL_ID,
+  ClientId: CLIENT_ID
+})
+
+let idToken = null
+let refreshToken = null
+
+export function getToken() { return idToken }
+export function isAuthenticated() { return idToken !== null }
+
+export function signIn(username, password) {
+  const cognitoUser = new CognitoUser({ Username: username, Pool: userPool })
+  const authDetails = new AuthenticationDetails({ Username: username, Password: password })
+
+  return new Promise((resolve, reject) => {
+    cognitoUser.authenticateUser(authDetails, {
+      onSuccess: (session) => {
+        setTokens({
+          IdToken: session.getIdToken().getJwtToken(),
+          RefreshToken: session.getRefreshToken().getToken()
+        })
+        resolve({ success: true })
+      },
+      onFailure: (err) => reject(err),
+      newPasswordRequired: (_userAttributes, requiredAttributes) => {
+        // Stash the user + the attributes Cognito actually requires so
+        // completeNewPassword can continue the SRP session and supply exactly
+        // what the pool asks for — no more, no less.
+        pendingUser = cognitoUser
+        pendingRequiredAttributes = requiredAttributes || []
+        resolve({ challenge: 'NEW_PASSWORD_REQUIRED' })
+      }
+    })
+  })
+}
+
+// Holds the CognitoUser mid-challenge for the NEW_PASSWORD_REQUIRED flow,
+// plus the list of attributes Cognito flagged as required for the challenge.
+let pendingUser = null
+let pendingRequiredAttributes = []
+
+export function completeNewPassword(email, newPassword) {
+  if (!pendingUser) {
+    return Promise.reject(new Error('No pending password challenge. Sign in again.'))
+  }
+
+  // Only supply attributes Cognito actually asks for in this challenge.
+  //   - If the pool requires `email` and the user doesn't have it yet, it shows
+  //     up in requiredAttributes → we send it (username is the email). Skipping
+  //     it would fail with "Invalid attributes given, email is missing".
+  //   - If the user already has `email` (e.g. admin-created with it), it is NOT
+  //     in requiredAttributes → we must NOT send it, or Cognito rejects with
+  //     "Cannot modify an already provided email".
+  const attributes = {}
+  if (pendingRequiredAttributes.includes('email')) {
+    attributes.email = email
+  }
+
+  return new Promise((resolve, reject) => {
+    pendingUser.completeNewPasswordChallenge(newPassword, attributes, {
+      onSuccess: (session) => {
+        setTokens({
+          IdToken: session.getIdToken().getJwtToken(),
+          RefreshToken: session.getRefreshToken().getToken()
+        })
+        pendingUser = null
+        pendingRequiredAttributes = []
+        resolve({ success: true })
+      },
+      onFailure: (err) => {
+        pendingUser = null
+        pendingRequiredAttributes = []
+        reject(err)
+      }
+    })
+  })
+}
+
+export function signUp(email, password) {
+  const attributes = [new CognitoUserAttribute({ Name: 'email', Value: email })]
+
+  return new Promise((resolve, reject) => {
+    userPool.signUp(email, password, attributes, null, (err) => {
+      if (err) return reject(err)
+      resolve({ needsConfirmation: true })
+    })
+  })
+}
+
+export function confirmSignUp(email, code) {
+  const cognitoUser = new CognitoUser({ Username: email, Pool: userPool })
+
+  return new Promise((resolve, reject) => {
+    cognitoUser.confirmRegistration(code, true, (err) => {
+      if (err) return reject(err)
+      resolve({ success: true })
+    })
+  })
+}
+
+export function signOut() {
+  const cognitoUser = userPool.getCurrentUser()
+  if (cognitoUser) cognitoUser.signOut()
+  idToken = null
+  refreshToken = null
+  localStorage.removeItem('idToken')
+  localStorage.removeItem('refreshToken')
+}
+
+function setTokens(authResult) {
+  idToken = authResult.IdToken
+  refreshToken = authResult.RefreshToken
+  localStorage.setItem('idToken', idToken)
+  if (refreshToken) localStorage.setItem('refreshToken', refreshToken)
+}
+
+// Restore on page load
+const stored = localStorage.getItem('idToken')
+if (stored) idToken = stored

data/lib/templates/generate/model.rb.erb

@@ -4,13 +4,11 @@ class <%= @class_name %> < ApplicationRecord
 <% @references.each do |ref| -%>
   belongs_to :<%= ref[:referenced_model] %>
 <% end -%>
-<% if @references.any? && (@regular_fields.any? || @references.any?) -%>
+<% if @references.any? && @regular_fields.any? -%>
 
 <% end -%>
-<% @references.each do |ref| -%>
-  attr_accessor :<%= ref[:referenced_model] %>_id
-<% end -%>
-<% @regular_fields.each do |field| -%>
-  attr_accessor :<%= field[:name] %>
+<% all_accessors = @regular_fields.map { |f| ":#{f[:name]}" } -%>
+<% if all_accessors.any? -%>
+  attr_accessor <%= all_accessors.join(', ') %>
 <% end -%>
 end