belt 0.2.18 → 0.2.20

data/lib/belt/cli/index_command.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require_relative 'tables_command'
+require_relative '../inflector'
+
+module Belt
+  module CLI
+    class IndexCommand
+      MODULE_DIR = 'infrastructure/modules/app'
+      DYNAMODB_TF = File.join(MODULE_DIR, 'dynamodb.tf')
+
+      def self.run(args)
+        action = args.shift
+
+        case action
+        when 'add', nil
+          add(args)
+        when 'remove', 'rm'
+          remove(args)
+        when '--help', '-h'
+          puts usage
+        else
+          # Treat first arg as table name if no subcommand
+          add([action] + args)
+        end
+      end
+
+      def self.usage
+        <<~USAGE
+          Usage: belt generate index <table> <IndexName> --partition-key <key> [--sort-key <key>]
+                 belt destroy index <table> <IndexName>
+
+          Add or remove a Global Secondary Index (GSI) from dynamodb.tf.
+
+          Examples:
+            belt generate index messages ConversationIndex --partition-key conversation_id
+            belt generate index messages RecentByUserIndex --partition-key user_id --sort-key created_at
+            belt destroy index messages ConversationIndex
+
+          Note: After modifying indexes, run `belt deploy` to apply changes to AWS.
+                Adding a GSI to an existing table takes ~5-10 minutes (AWS limitation).
+        USAGE
+      end
+
+      def self.add(args)
+        table, index_name, partition_key, sort_key = parse_add_args(args)
+        new(table, index_name, partition_key: partition_key, sort_key: sort_key).add
+      end
+
+      def self.remove(args)
+        table = args.shift
+        index_name = args.shift
+
+        if table.nil? || index_name.nil?
+          abort "Usage: belt destroy index <table> <IndexName>\n\n" \
+                'Example: belt destroy index messages ConversationIndex'
+        end
+
+        new(table, index_name).remove
+      end
+
+      def self.parse_add_args(args)
+        table = args.shift
+        index_name = args.shift
+        partition_key = nil
+        sort_key = nil
+
+        i = 0
+        while i < args.length
+          case args[i]
+          when '--partition-key', '-p'
+            i += 1
+            partition_key = args[i]
+          when '--sort-key', '-s'
+            i += 1
+            sort_key = args[i]
+          end
+          i += 1
+        end
+
+        if table.nil? || index_name.nil? || partition_key.nil?
+          abort "Usage: belt generate index <table> <IndexName> --partition-key <key> [--sort-key <key>]\n\n" \
+                'Example: belt generate index messages ConversationIndex --partition-key conversation_id'
+        end
+
+        [table, index_name, partition_key, sort_key]
+      end
+
+      def initialize(table, index_name, partition_key: nil, sort_key: nil)
+        @table = table
+        @index_name = index_name
+        @partition_key = partition_key
+        @sort_key = sort_key
+      end
+
+      def add
+        validate_tf_exists!
+
+        content = File.read(DYNAMODB_TF)
+        table_resource = "aws_dynamodb_table\" \"#{@table}\""
+
+        unless content.include?(table_resource)
+          abort "Error: Table '#{@table}' not found in #{DYNAMODB_TF}.\n" \
+                'Run `belt setup tables` first to generate the table.'
+        end
+
+        if content.include?("name            = \"#{@index_name}\"")
+          puts "  skip    #{@index_name} (already exists on #{@table})"
+          return
+        end
+
+        dynamo_pk = Belt::Inflector.camelize_lower(@partition_key)
+        dynamo_sk = @sort_key ? Belt::Inflector.camelize_lower(@sort_key) : nil
+
+        # Build the GSI block
+        gsi_block = build_gsi_block(dynamo_pk, dynamo_sk)
+
+        # Build attribute blocks for new keys
+        attr_blocks = build_attribute_blocks(content, dynamo_pk, dynamo_sk)
+
+        # Insert into the table resource
+        insert_gsi(content, gsi_block, attr_blocks)
+
+        puts "  create  #{@index_name} on #{@table} (partition: #{dynamo_pk}#{", sort: #{dynamo_sk}" if dynamo_sk})"
+        puts "\n  Run `belt deploy` to apply. Adding a GSI to an existing table takes ~5-10 min."
+      end
+
+      def remove
+        validate_tf_exists!
+
+        content = File.read(DYNAMODB_TF)
+
+        unless content.include?("name            = \"#{@index_name}\"")
+          abort "Error: Index '#{@index_name}' not found in #{DYNAMODB_TF}."
+        end
+
+        # Remove the GSI block
+        content.sub!(/\n\s*global_secondary_index \{\n\s*name\s*=\s*"#{Regexp.escape(@index_name)}".*?\n\s*\}/m, '')
+
+        File.write(DYNAMODB_TF, content)
+        puts "  remove  #{@index_name} from #{@table}"
+        puts "\n  Run `belt deploy` to apply."
+      end
+
+      private
+
+      def validate_tf_exists!
+        return if File.exist?(DYNAMODB_TF)
+
+        abort "Error: #{DYNAMODB_TF} not found.\nRun `belt setup tables` first."
+      end
+
+      def build_gsi_block(dynamo_pk, dynamo_sk)
+        lines = []
+        lines << '  global_secondary_index {'
+        lines << "    name            = \"#{@index_name}\""
+        lines << "    hash_key        = \"#{dynamo_pk}\""
+        lines << "    range_key       = \"#{dynamo_sk}\"" if dynamo_sk
+        lines << '    projection_type = "ALL"'
+        lines << '  }'
+        lines.join("\n")
+      end
+
+      def build_attribute_blocks(content, dynamo_pk, dynamo_sk)
+        blocks = []
+        [dynamo_pk, dynamo_sk].compact.each do |key|
+          next if content.include?("name = \"#{key}\"")
+
+          blocks << "\n  attribute {\n    name = \"#{key}\"\n    type = \"S\"\n  }"
+        end
+        blocks.join
+      end
+
+      def insert_gsi(content, gsi_block, attr_blocks)
+        # Find the table's resource block and insert before point_in_time_recovery
+        table_pattern = /resource "aws_dynamodb_table" "#{Regexp.escape(@table)}" \{.*?point_in_time_recovery/m
+
+        content.sub!(table_pattern) do |match|
+          # Insert attributes after last existing attribute block
+          unless attr_blocks.empty?
+            match.sub!(/(  attribute \{.*?\n  \})(?!.*attribute)/m) { |attr_match| "#{attr_match}#{attr_blocks}" }
+          end
+
+          # Insert GSI before point_in_time_recovery
+          match.sub('point_in_time_recovery', "#{gsi_block}\n\n  point_in_time_recovery")
+        end
+
+        File.write(DYNAMODB_TF, content)
+      end
+    end
+  end
+end

data/lib/belt/cli/lambda_config_command.rb

@@ -34,7 +34,7 @@ module Belt
       SUPPORTED_KEYS = %w[
         timeout memory_size env_vars env_keys
         s3_buckets dynamodb_tables sns_triggers sqs_triggers
-        reserved_concurrency ephemeral_storage
+        reserved_concurrency ephemeral_storage iam_policy_arns
       ].freeze
 
       def self.run(args)
@@ -112,6 +112,7 @@ module Belt
             sqs_triggers         SQS queue triggers
             reserved_concurrency Reserved concurrency limit
             ephemeral_storage    Ephemeral storage in MB (512-10240)
+            iam_policy_arns      Additional IAM policy ARNs (supports ref())
         HELP
       end
 

data/lib/belt/cli/routes_command/route_inference.rb

@@ -14,9 +14,10 @@ module Belt
           non_param = segments.reject { |s| s.start_with?(':', '{') }
           return gateway.name if non_param.empty?
 
-          # Nested resources (/posts/{id}/comments) and scoped resources (/admin/users):
-          # join non-param segments → posts/comments, admin/users
-          return non_param.map { |s| s.gsub('-', '_') }.join('/') if route.resource? && non_param.length > 1
+          # Nested resources (/posts/{id}/comments): use the last non-param segment
+          # as the controller name (matches Rails — nesting affects URL, not controller lookup).
+          # Scoped resources (/admin/users) still use the full path when controller is explicitly set.
+          return non_param.last.gsub('-', '_') if route.resource? && non_param.length > 1
 
           # For non-resource routes with a single segment (e.g., post '/signup' in :onboarding),
           # the segment is the action name, not the controller. Use the gateway name as controller.

data/lib/belt/cli/routes_command.rb

@@ -250,18 +250,8 @@ module Belt
       def output_concise(routes)
         return puts('No routes defined.') if routes.empty?
 
-        multi_gateway = routes.map { |r| r[:gateway] }.uniq.length > 1
         verb_w = [routes.map { |r| r[:verb].length }.max, 6].max
         path_w = [routes.map { |r| r[:path].length }.max, 4].max
-
-        if multi_gateway
-          output_concise_multi_gateway(routes, verb_w, path_w)
-        else
-          output_concise_single_gateway(routes, verb_w, path_w)
-        end
-      end
-
-      def output_concise_multi_gateway(routes, verb_w, path_w)
         gw_w = [routes.map { |r| r[:gateway].to_s.length }.max, 7].max
         lam_w = [routes.map { |r| r[:lambda].length }.max, 6].max
 
@@ -278,15 +268,6 @@ module Belt
         end
       end
 
-      def output_concise_single_gateway(routes, verb_w, path_w)
-        puts "#{'VERB'.ljust(verb_w)}  #{'PATH'.ljust(path_w)}  CONTROLLER#ACTION"
-        puts '-' * (verb_w + path_w + 30)
-
-        routes.each do |r|
-          puts "#{r[:verb].ljust(verb_w)}  #{r[:path].ljust(path_w)}  #{r[:controller]}##{r[:action]}"
-        end
-      end
-
       def route_specificity(path, verb)
         segments = path.split('/').reject(&:empty?)
         param_count = segments.count { |s| s.start_with?('{') }

data/lib/belt/cli/views_command.rb

@@ -75,10 +75,11 @@ module Belt
         end
       end
 
-      def initialize(name, fields, force: false)
+      def initialize(name, fields, force: false, quiet: false)
         @name = name.downcase.gsub(/[^a-z0-9_]/, '_')
         @fields = fields
         @force = force
+        @quiet = quiet
         @overwrite_all = false
         @singular_name = Belt::Inflector.singularize(@name)
         @resource_name = Belt::Inflector.pluralize(@singular_name)
@@ -103,14 +104,7 @@ module Belt
 
         inject_routes
 
-        puts "\n✓ Views for '#{@singular_name}' generated!"
-        puts "\nFiles created:"
-        puts "  #{pages_dir}/#{@plural_class_name}Index.jsx"
-        puts "  #{pages_dir}/#{@class_name}Show.jsx"
-        puts "  #{pages_dir}/#{@class_name}New.jsx"
-        puts "  #{pages_dir}/#{@class_name}Edit.jsx"
-        puts "  #{pages_dir}/#{@class_name}Form.jsx"
-        puts '  frontend/src/App.jsx (updated)'
+        puts "\n✓ Views for '#{@singular_name}' generated!" unless @quiet
       end
 
       private

data/lib/belt/cli.rb

@@ -6,6 +6,7 @@ require_relative 'cli/env_resolver'
 require_relative 'cli/new_command'
 require_relative 'cli/generate_command'
 require_relative 'cli/destroy_command'
+require_relative 'cli/index_command'
 require_relative 'cli/frontend_command'
 require_relative 'cli/frontend_setup_command'
 require_relative 'cli/frontend_deploy_command'

data/lib/belt/inflector.rb

@@ -42,6 +42,14 @@ module Belt
       word.to_s.split('_').map(&:capitalize).join
     end
 
+    # "conversation_id" → "conversationId"
+    def camelize_lower(word)
+      parts = word.to_s.split('_')
+      return word if parts.empty?
+
+      parts.first + parts[1..].map(&:capitalize).join
+    end
+
     # "BlogPost" → "blog_post"
     def underscore(word)
       word.to_s

data/lib/belt/route_dsl.rb

@@ -65,8 +65,9 @@ module Belt
       resource_name = name.to_s
       singular = @gateway.send(:singularize, resource_name)
       param_name = options[:param] || "#{singular}_id"
+      # Auto-add this resource's table before merging inherited tables
+      options = options.merge(tables: [resource_name.to_sym]) unless options.key?(:tables)
       options = merge_inherited_options(options)
-      options = @gateway.send(:auto_infer_tables, resource_name, options)
       resource_options = options.merge(route_type: :resources)
       actions = @gateway.send(:determine_actions, options)
 
@@ -156,7 +157,7 @@ module Belt
     def initialize(name, options = {})
       @name = name.to_s
       @routes = []
-      @default_auth = options[:auth] || :cognito
+      @default_auth = options[:auth] || :none
       @default_lambda = options[:lambda] || name
       @default_cors = options.fetch(:cors, true)
       @default_tables = Array(options[:tables] || [])

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.18'
+  VERSION = '0.2.20'
 end

data/lib/templates/generate/auth/cognito.tf.erb

@@ -13,6 +13,14 @@ resource "aws_cognito_user_pool" "<%= pool[:name] %>" {
     require_uppercase = true
   }
 
+  # Admin-only signup — users cannot self-register.
+  # Remove this block to allow public sign-up.
+<% unless @signup -%>
+  admin_create_user_config {
+    allow_admin_create_user_only = true
+  }
+
+<% end -%>
   auto_verified_attributes = ["email"]
 
   account_recovery_setting {
@@ -43,6 +51,9 @@ resource "aws_cognito_user_pool_client" "<%= pool[:name] %>" {
 
   explicit_auth_flows = [
     "ALLOW_USER_SRP_AUTH",
+<% if @signup -%>
+    "ALLOW_USER_PASSWORD_AUTH",
+<% end -%>
     "ALLOW_REFRESH_TOKEN_AUTH"
   ]
 

data/lib/templates/generate/auth/frontend/ConfirmEmail.jsx

@@ -0,0 +1,55 @@
+import { useState } from 'react'
+import { confirmSignUp } from '../../lib/auth'
+
+export default function ConfirmEmail() {
+  const params = new URLSearchParams(window.location.search)
+  const [email, setEmail] = useState(params.get('email') || '')
+  const [code, setCode] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [confirmed, setConfirmed] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      await confirmSignUp(email, code)
+      setConfirmed(true)
+    } catch (err) {
+      setError(err.message || 'Confirmation failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (confirmed) {
+    return (
+      <div className="auth-page">
+        <div className="auth-form">
+          <h2>Email Verified! ✓</h2>
+          <p>Your account is ready.</p>
+          <a href="/login" className="auth-btn">Sign In</a>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Verify Email</h2>
+        <p>Enter the code sent to your email.</p>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required />
+        <input type="text" placeholder="Verification code" value={code}
+          onChange={e => setCode(e.target.value)} required autoFocus />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Verifying...' : 'Verify'}
+        </button>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/Login.jsx

@@ -0,0 +1,79 @@
+import { useState } from 'react'
+import { signIn, completeNewPassword } from '../../lib/auth'
+import './auth.css'
+
+export default function Login({ onLogin }) {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [newPassword, setNewPassword] = useState('')
+  const [error, setError] = useState('')
+  const [challenge, setChallenge] = useState(null)
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      const result = await signIn(email, password)
+      if (result.challenge === 'NEW_PASSWORD_REQUIRED') {
+        setChallenge(result)
+      } else {
+        onLogin()
+      }
+    } catch (err) {
+      setError(err.message || 'Sign in failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  async function handleNewPassword(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      await completeNewPassword(email, newPassword, challenge.session)
+      onLogin()
+    } catch (err) {
+      setError(err.message || 'Password change failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (challenge) {
+    return (
+      <div className="auth-page">
+        <form className="auth-form" onSubmit={handleNewPassword}>
+          <h2>Set New Password</h2>
+          <p>Please set a permanent password for your account.</p>
+          {error && <div className="auth-error">{error}</div>}
+          <input type="password" placeholder="New password" value={newPassword}
+            onChange={e => setNewPassword(e.target.value)} required autoFocus />
+          <button type="submit" disabled={loading}>
+            {loading ? 'Saving...' : 'Set Password'}
+          </button>
+        </form>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Sign In</h2>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required autoFocus />
+        <input type="password" placeholder="Password" value={password}
+          onChange={e => setPassword(e.target.value)} required />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Signing in...' : 'Sign In'}
+        </button>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/ProtectedRoute.jsx

@@ -0,0 +1,9 @@
+import { isAuthenticated } from '../lib/auth'
+import { Navigate } from 'react-router-dom'
+
+export default function ProtectedRoute({ children }) {
+  if (!isAuthenticated()) {
+    return <Navigate to="/login" replace />
+  }
+  return children
+}

data/lib/templates/generate/auth/frontend/SignUp.jsx

@@ -0,0 +1,58 @@
+import { useState } from 'react'
+import { signUp } from '../../lib/auth'
+
+export default function SignUp() {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [needsConfirmation, setNeedsConfirmation] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      const result = await signUp(email, password)
+      if (result.needsConfirmation) setNeedsConfirmation(true)
+    } catch (err) {
+      setError(err.message || 'Sign up failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (needsConfirmation) {
+    return (
+      <div className="auth-page">
+        <div className="auth-form">
+          <h2>Check Your Email</h2>
+          <p>We sent a verification code to <strong>{email}</strong>.</p>
+          <a href={`/confirm?email=${encodeURIComponent(email)}`} className="auth-btn">
+            Enter Code
+          </a>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Create Account</h2>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required autoFocus />
+        <input type="password" placeholder="Password (8+ characters)" value={password}
+          onChange={e => setPassword(e.target.value)} required minLength={8} />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Creating...' : 'Create Account'}
+        </button>
+        <p className="auth-link">
+          Already have an account? <a href="/login">Sign in</a>
+        </p>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/apiClient.js

@@ -0,0 +1,34 @@
+import { getToken } from './auth'
+
+const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3000'
+
+export async function apiClient(path, options = {}) {
+  const { method = 'GET', body, headers = {} } = options
+
+  const token = getToken()
+  const config = {
+    method,
+    headers: {
+      Accept: 'application/json',
+      ...(token ? { Authorization: token } : {}),
+      ...headers
+    }
+  }
+
+  if (body !== undefined && body !== null) {
+    config.headers['Content-Type'] = 'application/json'
+    config.body = JSON.stringify(body)
+  }
+
+  const response = await fetch(`${API_URL}${path}`, config)
+  const data = await response.json()
+
+  if (response.status === 401) {
+    window.location.href = '/login'
+    throw new Error('Unauthorized')
+  }
+
+  if (!response.ok) throw new Error(data.error || `Request failed: ${response.status}`)
+
+  return data
+}