belt 0.2.9 → 0.2.11

data/lib/belt/cli/setup_command.rb

@@ -38,11 +38,12 @@ module Belt
         end
       end
 
-      def initialize(args = [])
+      def initialize(args = [], quiet: false)
         @app_name = detect_app_name
         @env_name = nil
         @custom_bucket = nil
         @select_mode = false
+        @quiet = quiet
 
         parse_args(args)
 
@@ -67,7 +68,7 @@ module Belt
         @bucket_name = interactive_bucket_selection if @select_mode
         setup_or_verify_bucket
         apply_lifecycle(@bucket_name)
-        puts '  ensure  lifecycle rules (90-day noncurrent expiration)'
+        say '  ensure  lifecycle rules (90-day noncurrent expiration)'
         update_backend_config
         print_success_message
       end
@@ -81,12 +82,12 @@ module Belt
       end
 
       def verify_existing_bucket
-        puts "Found existing bucket: #{@bucket_name}"
+        say "Found existing bucket: #{@bucket_name}"
         audit = audit_bucket_security(@bucket_name)
-        print_security_audit(audit)
+        print_security_audit(audit) unless @quiet
 
         if audit.values.all?
-          puts "\n✓ Bucket '#{@bucket_name}' passes all security checks"
+          say "\n✓ Bucket '#{@bucket_name}' passes all security checks"
         else
           prompt_and_harden(audit)
         end
@@ -94,6 +95,12 @@ module Belt
 
       def prompt_and_harden(audit)
         puts "\n⚠ Bucket '#{@bucket_name}' has security issues."
+        # Auto-harden during belt new (quiet); interactive otherwise
+        if @quiet
+          harden_bucket(@bucket_name, audit)
+          return
+        end
+
         print "\nApply security hardening? [Y/n] "
         response = $stdin.gets&.strip&.downcase
         if response.nil? || response.empty? || response == 'y'
@@ -105,13 +112,15 @@ module Belt
       end
 
       def create_new_bucket
-        puts "Creating state bucket: #{@bucket_name} (#{@region})"
+        say "Creating state bucket: #{@bucket_name} (#{@region})"
         create_bucket(@bucket_name)
-        puts "  create  s3://#{@bucket_name}"
+        say "  create  s3://#{@bucket_name}"
         harden_bucket(@bucket_name, {})
       end
 
       def print_success_message
+        return if @quiet
+
         puts "\n✓ State bucket '#{@bucket_name}' is ready!"
         if @env_name
           puts "\n  cd infrastructure/#{@env_name} && terraform init"
@@ -120,6 +129,9 @@ module Belt
         end
       end
 
+      # Expose for quiet callers (e.g. belt new) that print their own summary
+      attr_reader :bucket_name
+
       private
 
       def parse_args(args)
@@ -138,8 +150,15 @@ module Belt
         end
       end
 
+      # One shared state bucket per AWS account (all belt apps use it).
+      # Account ID keeps the name globally unique — S3 names are a global namespace.
+      # Pattern: belt-terraform-state-<account_id>
       def resolve_bucket_name
-        @custom_bucket || 'belt-terraform-state'
+        return @custom_bucket if @custom_bucket
+        return "belt-terraform-state-#{@aws_account_id}" if @aws_account_id
+
+        # Placeholder until credentials are available (belt setup state re-resolves)
+        'belt-terraform-state'
       end
 
       # --- Interactive selection ---
@@ -238,9 +257,11 @@ module Belt
       end
 
       def run!(*args)
-        return if system(*args)
+        output, status = Open3.capture2e(*args)
+        return if status.success?
 
         puts "\n✗ Command failed: #{args.shelljoin}"
+        puts output.strip unless output.strip.empty?
         exit 1
       end
 
@@ -249,6 +270,10 @@ module Belt
         status.success? ? output : nil
       end
 
+      def say(message)
+        puts message unless @quiet
+      end
+
       # --- Backend config ---
 
       def update_backend_config
@@ -268,7 +293,7 @@ module Belt
           updated = content.gsub(/bucket\s*=\s*"[^"]+"/, "bucket  = \"#{@bucket_name}\"")
           if updated != content
             File.write(backend_file, updated)
-            puts "  update  #{backend_file} → bucket = \"#{@bucket_name}\""
+            say "  update  #{backend_file} → bucket = \"#{@bucket_name}\""
           end
         end
       end

data/lib/belt/cli.rb

@@ -21,6 +21,8 @@ require_relative 'cli/routes_command'
 require_relative 'cli/lambda_config_command'
 require_relative 'cli/tasks_command'
 require_relative 'cli/console_command'
+require_relative 'cli/doctor_command'
+require_relative 'cli/plugin_command'
 
 module Belt
   module CLI
@@ -33,6 +35,8 @@ module Belt
       %w[console c] => Belt::CLI::ConsoleCommand,
       %w[tasks --tasks -T] => Belt::CLI::TasksCommand,
       'setup' => Belt::CLI::SetupCommand,
+      'doctor' => Belt::CLI::DoctorCommand,
+      'plugin' => Belt::CLI::PluginCommand,
       'deploy' => Belt::CLI::DeployCommand,
       'frontend' => Belt::CLI::FrontendEnvCommand,
       %w[server s] => Belt::CLI::ServerCommand,
@@ -114,6 +118,8 @@ module Belt
           setup state                                 Create/select S3 state bucket
           setup tables <env>                          Generate DynamoDB tables from schema
           setup frontend <env>                        Generate S3 + CloudFront infrastructure
+          doctor                                      Check system dependencies and AWS config
+          plugin new <name>                           Scaffold a new Belt plugin gem
           init [environment] <env>                    terraform init for environment
           plan [environment] <env>                    terraform plan for environment
           apply [environment] <env>                   terraform apply for environment
@@ -133,6 +139,7 @@ module Belt
 
         Examples:
           belt new blog --frontend react
+          belt new blog --frontend react -v   # list every created file
           belt generate scaffold post title:string content:text status:string
           belt destroy scaffold post
           belt generate frontend react
@@ -145,6 +152,7 @@ module Belt
           belt apply wups
           belt tasks                    # list all rake tasks
           belt lambda:build_layer       # run a rake task directly
+          belt plugin new messaging     # scaffold a belt-messaging style plugin gem
       USAGE
     end
   end

data/lib/belt/configuration.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Belt
+  # Runtime configuration for Belt apps (set in lambda/config/environment.rb).
+  #
+  #   Belt.configure do |config|
+  #     config.default_format = :json  # or :html
+  #   end
+  #
+  # Note: infrastructure/<env>/belt.rb uses a separate sandboxed DSL for CLI
+  # deploy/backup settings — it does not share this object.
+  class Configuration
+    VALID_FORMATS = %i[json html].freeze
+
+    def initialize
+      @default_format = :json
+    end
+
+    attr_reader :default_format
+
+    def default_format=(value)
+      format = value.to_sym
+      unless VALID_FORMATS.include?(format)
+        raise ArgumentError, "default_format must be :json or :html (got #{value.inspect})"
+      end
+
+      @default_format = format
+    end
+  end
+end

data/lib/belt/controllers/welcome_controller.rb

@@ -6,23 +6,90 @@ module Belt
   # Gem-embedded welcome controller that serves the default "it works!" page.
   # Resolved via the ActionRouter's Belt:: namespace fallback when no app-defined
   # WelcomeController exists. Gets replaced once the user defines their own root route.
+  #
+  # Dual format:
+  #   - Browser / no Accept preference → HTML hero + stack check
+  #   - Accept: application/json (SPA / apiClient) → JSON payload for the React shell
+  #
+  # The hero image (lib/belt/assets/belt-default.jpg) is the single source of truth —
+  # HTML embeds it, and JSON returns the same bytes as a data URI so the SPA matches.
   class WelcomeController < BeltController::Base
     skip_before_action :authenticate!
 
     ASSETS_DIR = File.expand_path('../assets', __dir__)
+    # Scaffold gives model + controller + routes + schema (not model-only).
+    SCAFFOLD_HINT_CMD = 'belt generate scaffold Post title content:text'
 
     def show
       @title = ENV.fetch('WELCOME_TITLE', 'Welcome to Belt')
       @subtitle = ENV.fetch('WELCOME_SUBTITLE', 'API Gateway → Lambda → DynamoDB — all connected.')
-      @css = welcome_css
-      @background_image = background_image_base64
       @dynamodb_connected = dynamodb_connected?
+      @scaffold_hint_cmd = SCAFFOLD_HINT_CMD
+
+      return success_response(welcome_payload) if wants_json?
 
+      @css = welcome_css
+      @background_image = background_image_base64
       render
     end
 
     private
 
+    def welcome_payload
+      {
+        title: @title,
+        subtitle: @subtitle,
+        # Same gem asset as the HTML welcome page — edit belt-default.jpg once.
+        background_image: "data:image/jpeg;base64,#{background_image_base64}",
+        stack: {
+          api_gateway: true,
+          lambda: true,
+          dynamodb: @dynamodb_connected
+        },
+        # One tip only (was duplicated as dynamodb_hint + first next_step).
+        next_steps: [
+          "Scaffold a resource: #{SCAFFOLD_HINT_CMD}",
+          'Deploy: belt deploy',
+          'This page will be replaced once you define your own root route.'
+        ]
+      }
+    end
+
+    # SPA apiClient and fetch(..., { headers: { Accept: "application/json" } })
+    def wants_json?
+      return true if params['format'].to_s == 'json'
+
+      accept = header_value('Accept') || header_value('accept') || ''
+      return false if accept.empty?
+
+      # Prefer JSON when it's listed and not beaten by an explicit HTML preference
+      json_q = accept_quality(accept, 'application/json')
+      html_q = accept_quality(accept, 'text/html')
+      json_q.positive? && json_q >= html_q
+    end
+
+    def header_value(name)
+      headers = event.is_a?(Hash) ? event['headers'] : nil
+      return nil unless headers.is_a?(Hash)
+
+      headers[name] || headers[name.downcase] || headers[name.split('-').map(&:capitalize).join('-')]
+    end
+
+    def accept_quality(accept, media_type)
+      accept.split(',').each do |part|
+        type, *params = part.strip.split(';').map(&:strip)
+        # Exact type only — do not treat */* as JSON (curl/browsers send that by default)
+        next unless type == media_type
+
+        q = 1.0
+        params.each do |p|
+          q = p.split('=', 2).last.to_f if p.start_with?('q=')
+        end
+        return q
+      end
+      0.0
+    end
+
     def dynamodb_connected?
       return false unless defined?(Aws::DynamoDB::Client)
 

data/lib/belt/helpers/cors_origin.rb

@@ -3,10 +3,16 @@
 module Belt
   module Helpers
     module CorsOrigin
+      # Maximum length for an Origin header to prevent ReDoS or memory abuse.
+      MAX_ORIGIN_LENGTH = 253
+
       def self.resolve_origin(request_origin)
         allowed = allowed_origins
         return nil if allowed.empty?
-        return request_origin if request_origin && matches_allowed?(request_origin, allowed)
+
+        if request_origin && valid_origin?(request_origin) && matches_allowed?(request_origin, allowed)
+          return request_origin
+        end
 
         # Don't return a wildcard pattern as a literal origin — use '*' instead
         first = allowed.first
@@ -18,7 +24,7 @@ module Belt
 
         allowed.any? do |pattern|
           if pattern.include?('*')
-            regex = Regexp.new("\\A#{Regexp.escape(pattern).gsub('\*', '[^.]+')}\\z")
+            regex = Regexp.new("\\A#{Regexp.escape(pattern).gsub('\*', '[a-z0-9\\-]+')}\\z")
             regex.match?(origin)
           else
             pattern == origin
@@ -26,6 +32,17 @@ module Belt
         end
       end
 
+      # Validate that the origin looks like a legitimate URL scheme+host.
+      # Rejects origins with path components, whitespace, or unexpected characters.
+      def self.valid_origin?(origin)
+        return false if origin.nil? || origin.empty?
+        return false if origin.length > MAX_ORIGIN_LENGTH
+        return false unless origin.match?(%r{\A https?://[a-z0-9\-.:]+\z}ix)
+
+        # Reject origins with user-info, paths, queries, or fragments
+        !origin.include?('@') && !origin.include?('?') && !origin.include?('#')
+      end
+
       def self.origin_from_event(event)
         return nil unless event.is_a?(Hash)
 

data/lib/belt/helpers/response.rb

@@ -2,41 +2,79 @@
 
 require_relative 'error_logging'
 require_relative 'cors_origin'
+require_relative '../http_status'
 
 module Belt
   module Helpers
     module Response
+      # Maximum request body size (10 MB). Bodies larger than this are rejected
+      # to prevent memory exhaustion attacks on Lambda functions.
+      MAX_REQUEST_BODY_SIZE = 10 * 1024 * 1024
+
       def cors_headers(event = nil)
         event = @event if event.nil? && instance_variable_defined?(:@event)
         origin = CorsOrigin.resolve_origin(CorsOrigin.origin_from_event(event))
+        allow_headers = 'Content-Type,Accept,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'
         headers = {
-          'Access-Control-Allow-Headers' => 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token',
+          'Access-Control-Allow-Headers' => allow_headers,
           'Access-Control-Allow-Methods' => 'GET,POST,PUT,DELETE,PATCH,OPTIONS',
           'Access-Control-Max-Age' => '300',
-          'Content-Type' => 'application/json'
+          'Content-Type' => 'application/json',
+          'X-Content-Type-Options' => 'nosniff',
+          'Vary' => 'Origin'
         }
         headers['Access-Control-Allow-Origin'] = origin if origin
         headers
       end
 
+      # JSON success. Status accepts Integer or Symbol (:created, :ok, …).
       def success_response(body, status_code = 200)
-        { statusCode: status_code, headers: cors_headers, body: JSON.generate(body) }
+        { statusCode: resolve_status(status_code), headers: cors_headers, body: JSON.generate(body) }
       end
 
+      # JSON error. Status accepts Integer or Symbol (:unprocessable_entity, :not_found, …).
       def error_response(message, status_code = 400, error_details = nil)
         body = { error: message }
         if error_details
           body[:details] = error_details.is_a?(Hash) ? error_details : { message: error_details.to_s }
         end
-        { statusCode: status_code, headers: cors_headers, body: JSON.generate(body) }
+        { statusCode: resolve_status(status_code), headers: cors_headers, body: JSON.generate(body) }
       end
 
       def html_response(html, status_code = 200)
         event = @event if instance_variable_defined?(:@event)
         origin = CorsOrigin.resolve_origin(CorsOrigin.origin_from_event(event))
-        headers = { 'Content-Type' => 'text/html; charset=utf-8' }
+        headers = {
+          'Content-Type' => 'text/html; charset=utf-8',
+          'X-Content-Type-Options' => 'nosniff',
+          'X-Frame-Options' => 'DENY',
+          'Referrer-Policy' => 'strict-origin-when-cross-origin'
+        }
         headers['Access-Control-Allow-Origin'] = origin if origin
-        { statusCode: status_code, headers: headers, body: html }
+        { statusCode: resolve_status(status_code), headers: headers, body: html }
+      end
+
+      # Empty-body response (Rails-style). Useful for destroy / create-without-body.
+      #
+      #   head :created      # 201, empty body
+      #   head :no_content   # 204
+      #   head 201
+      #
+      def head(status = :no_content)
+        { statusCode: resolve_status(status), headers: cors_headers, body: '' }
+      end
+
+      # Set the status used by implicit assigns / HTML render (when you don't
+      # call success_response / render yourself).
+      #
+      #   def create
+      #     @post = Post.create!(...)
+      #     response_status :created
+      #   end
+      #   # → 201 + { post: {...} }
+      #
+      def response_status(status)
+        @__response_status = resolve_status(status)
       end
 
       def handle_error_and_respond(error, message, context = {}, status_code = 500)
@@ -56,6 +94,10 @@ module Belt
 
       private
 
+      def resolve_status(status)
+        Belt::HttpStatus.resolve(status)
+      end
+
       def verbose_errors_enabled?
         env = ENV['ENVIRONMENT']&.downcase || ''
         env.start_with?('dev') || env == 'local' || env == 'test'

data/lib/belt/http_status.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Belt
+  # Rails/Rack-style symbolic HTTP status codes.
+  # Mirrors the common subset of Rack::Utils::SYMBOL_TO_STATUS_CODE so apps
+  # can write `head :created` / `success_response(body, :created)` without
+  # taking a rack dependency.
+  module HttpStatus
+    SYMBOL_TO_STATUS_CODE = {
+      continue: 100,
+      switching_protocols: 101,
+      processing: 102,
+      ok: 200,
+      created: 201,
+      accepted: 202,
+      non_authoritative_information: 203,
+      no_content: 204,
+      reset_content: 205,
+      partial_content: 206,
+      multi_status: 207,
+      already_reported: 208,
+      im_used: 226,
+      multiple_choices: 300,
+      moved_permanently: 301,
+      found: 302,
+      see_other: 303,
+      not_modified: 304,
+      use_proxy: 305,
+      temporary_redirect: 307,
+      permanent_redirect: 308,
+      bad_request: 400,
+      unauthorized: 401,
+      payment_required: 402,
+      forbidden: 403,
+      not_found: 404,
+      method_not_allowed: 405,
+      not_acceptable: 406,
+      proxy_authentication_required: 407,
+      request_timeout: 408,
+      conflict: 409,
+      gone: 410,
+      length_required: 411,
+      precondition_failed: 412,
+      payload_too_large: 413,
+      uri_too_long: 414,
+      unsupported_media_type: 415,
+      range_not_satisfiable: 416,
+      expectation_failed: 417,
+      unprocessable_entity: 422,
+      locked: 423,
+      failed_dependency: 424,
+      upgrade_required: 426,
+      precondition_required: 428,
+      too_many_requests: 429,
+      request_header_fields_too_large: 431,
+      unavailable_for_legal_reasons: 451,
+      internal_server_error: 500,
+      not_implemented: 501,
+      bad_gateway: 502,
+      service_unavailable: 503,
+      gateway_timeout: 504,
+      http_version_not_supported: 505,
+      variant_also_negotiates: 506,
+      insufficient_storage: 507,
+      loop_detected: 508,
+      not_extended: 510,
+      network_authentication_required: 511
+    }.freeze
+
+    module_function
+
+    # Resolve a status to an integer code.
+    # Accepts Integer (200), String ("201"), or Symbol (:created).
+    def resolve(status)
+      case status
+      when Integer
+        status
+      when String
+        Integer(status)
+      when Symbol
+        SYMBOL_TO_STATUS_CODE.fetch(status) do
+          raise ArgumentError, "Unknown HTTP status symbol: #{status.inspect}"
+        end
+      else
+        raise ArgumentError, "status must be Integer, String, or Symbol (got #{status.class})"
+      end
+    end
+  end
+end

data/lib/belt/lambda_handler.rb

@@ -76,11 +76,8 @@ module Belt
 
         return { statusCode: 200, headers: cors_headers(event), body: '{}' } if event['httpMethod'] == 'OPTIONS'
 
-        begin
-          body = JSON.parse(event['body'] || '{}')
-        rescue JSON::ParserError
-          return error_response('Invalid JSON in request body')
-        end
+        body = parse_request_body(event)
+        return body if body.is_a?(Hash) && body[:statusCode]
 
         begin
           result = execute(path: event['path'], body: body, event: event)
@@ -107,6 +104,18 @@ module Belt
 
     private
 
+    def parse_request_body(event)
+      raw_body = event['body'] || '{}'
+
+      if raw_body.bytesize > Belt::Helpers::Response::MAX_REQUEST_BODY_SIZE
+        return error_response('Request body too large', 413)
+      end
+
+      JSON.parse(raw_body)
+    rescue JSON::ParserError
+      error_response('Invalid JSON in request body', 400)
+    end
+
     def init_observability(context:)
       service_name = ENV['ACTION'] || context.function_name.split('-').last
 

data/lib/belt/rendering.rb

@@ -54,6 +54,7 @@ module Belt
     #   render layout: false           — skip layout (default: no layout)
     #
     def render(options = {})
+      # Status may be Integer or Symbol (:created, :ok, …)
       status = options.fetch(:status, 200)
 
       html = if options.key?(:inline)

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.9'
+  VERSION = '0.2.11'
 end

data/lib/belt/views/welcome/show.html.erb

@@ -12,39 +12,39 @@
     <div class="overlay">
       <h1><%= h(@title) %></h1>
       <p class="subtitle"><%= h(@subtitle) %></p>
-    </div>
-  </div>
-  <div class="container">
-    <div class="stack-check">
-      <div class="check-item check-pass">
-        <span class="icon">✓</span>
-        <span>API Gateway</span>
-      </div>
-      <div class="arrow">→</div>
-      <div class="check-item check-pass">
-        <span class="icon">✓</span>
-        <span>Lambda</span>
+
+      <div class="stack-check">
+        <div class="check-item check-pass">
+          <span class="icon">✓</span>
+          <span>API Gateway</span>
+        </div>
+        <div class="arrow">→</div>
+        <div class="check-item check-pass">
+          <span class="icon">✓</span>
+          <span>Lambda</span>
+        </div>
+        <div class="arrow">→</div>
+        <%- if @dynamodb_connected -%>
+        <div class="check-item check-pass">
+          <span class="icon">✓</span>
+          <span>DynamoDB</span>
+        </div>
+        <%- else -%>
+        <div class="check-item check-neutral">
+          <span class="icon">○</span>
+          <span>DynamoDB</span>
+        </div>
+        <%- end -%>
       </div>
-      <div class="arrow">→</div>
-      <%- if @dynamodb_connected -%>
-      <div class="check-item check-pass">
-        <span class="icon">✓</span>
-        <span>DynamoDB</span>
+
+      <div class="next-steps">
+        <h2>Next Steps</h2>
+        <ol>
+          <li>Scaffold a resource: <code><%= h(@scaffold_hint_cmd) %></code></li>
+          <li>Deploy: <code>belt deploy</code></li>
+          <li>This page will be replaced once you define your own root route.</li>
+        </ol>
       </div>
-      <%- else -%>
-      <div class="check-item check-warn">
-        <span class="icon">⚠</span>
-        <span>DynamoDB</span>
-      </div>
-      <%- end -%>
-    </div>
-    <div class="next-steps">
-      <h2>Next Steps</h2>
-      <ol>
-        <li>Generate a resource: <code>belt g resource post title:string body:text</code></li>
-        <li>Deploy: <code>belt deploy</code></li>
-        <li>This page will be replaced once you define your own root route.</li>
-      </ol>
     </div>
   </div>
 </body>

data/lib/belt.rb

@@ -2,6 +2,8 @@
 
 require_relative 'belt/version'
 require_relative 'belt/root'
+require_relative 'belt/configuration'
+require_relative 'belt/http_status'
 require_relative 'belt/parameters'
 require_relative 'belt/observability'
 require_relative 'belt/lambda_handler'
@@ -18,6 +20,20 @@ module Belt
   class << self
     attr_reader :controller_paths
 
+    # Runtime configuration (lambda/config/environment.rb). Separate from the
+    # CLI sandboxed DSL in infrastructure/<env>/belt.rb.
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def configure
+      yield configuration
+    end
+
+    def reset_configuration!
+      @configuration = Configuration.new
+    end
+
     # Auto-discover lambda/controllers dirs in all loaded gems
     def gem_controller_paths
       @gem_controller_paths ||= discover_gem_paths('lambda/controllers')