belt 0.3.14 → 0.3.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55308d608d7b85464c0b0861a0aa5e38ea9787ff931cf2ed9ee698d62d0bcbe8
-  data.tar.gz: daa931d9c87236b78510a870d6a651377233d185812b8bf557a4a4afd23d6f01
+  metadata.gz: 905825783d5bdb3201165a5d28cbc3b01b5e64d1169bce94958840332bff5845
+  data.tar.gz: 17eea521ef730f560451370e2b4e556448a697919649879203d3f05e1979f202
 SHA512:
-  metadata.gz: 1b1b6ac554fca615222bffd1e9089fc6e96ad089a9081b6dc83f48a7ea73477662373e57ad33d4f51aad41991fb747f67575bc68c8e8a4a9b88715f2c7af4764
-  data.tar.gz: cf04548387af38ae1b49375ecb782fcd51878c679fbf8340f083b82c26b6900524cdf89dfc196b12d21918dd0b145e3a1de8624d7b44a118cc61eea2197aa49d
+  metadata.gz: f4e65fe4b40d4f075783b8abbc7793293b618c8638d94e5aff1adc3e23dc6e4e1fadfc8841213e89bb7db1e14c86a9767f99ac0ebaf2c3580a4007b653922dce
+  data.tar.gz: e73a504ff45c5d8946ddaa606ffc20f1584b11a287d1564dcd90c59e2ade80af446694b6d2e616d867fe5bd28dd712e33e45a3eaa2a4c523baee53f54a3b22a1

data/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.3.16
+
+### Enhancement
+
+- **`belt generate auth --ses-email` for custom email domains**: By default,
+  Cognito sends verification emails from `no-reply@verificationemail.com`.
+  The new `--ses-email` flag configures Cognito to use Amazon SES instead,
+  allowing you to send from your own domain (e.g., `noreply@yourapp.com`).
+  
+  The generator creates:
+  - `cognito_variables.tf` with variables for SES email ARN, from address, and
+    optional reply-to address
+  - `email_configuration` block in `cognito.tf` with `DEVELOPER` sending mode
+  - Example variable values in environment tfvars files
+  
+  Prerequisites:
+  1. Verify your domain or email address in Amazon SES
+  2. Move out of SES sandbox for production use
+  
+  Usage: `belt g auth --ses-email`
+
+## 0.3.15
+
+### Bug Fix
+
+- **`belt generate auth` NEW_PASSWORD_REQUIRED challenge sent `email` even when
+  the user already had it**: The 0.3.14 fix always passed `{ email }` to
+  `completeNewPasswordChallenge`. That fixed pools where `email` was missing, but
+  broke the common case where the user already has `email` set (e.g. created via
+  `admin-create-user` with an email) — Cognito rejects that with a 400
+  `NotAuthorizedException: Cannot modify an already provided email`. The template
+  now reads the `requiredAttributes` list Cognito provides in the
+  `newPasswordRequired` callback and supplies `email` **only when Cognito actually
+  requires it**. Users with email already set complete the challenge without
+  re-sending it; users missing email still get it supplied. Handles both cases.
+
 ## 0.3.14
 
 ### Bug Fix

data/lib/belt/cli/auth_command.rb

@@ -21,10 +21,11 @@ module Belt
 
         force = args.delete('--force') || args.delete('-f')
         signup = args.delete('--signup')
+        ses_email = args.delete('--ses-email')
         frontend_name = FrontendRegistry.extract_flag!(args, '--frontend')
         pools = parse_pools(args)
 
-        new(pools: pools, force: force, signup: signup, frontend_name: frontend_name).generate
+        new(pools: pools, force: force, signup: signup, ses_email: ses_email, frontend_name: frontend_name).generate
       end
 
       def self.destroy(_args)
@@ -39,6 +40,7 @@ module Belt
 
           Options:
             --signup           Allow public user registration (generates frontend views)
+            --ses-email        Use Amazon SES for emails (custom from address/domain)
             --frontend NAME    Target frontend when several exist
             --force, -f        Overwrite existing cognito.tf (skip collision check)
 
@@ -49,6 +51,7 @@ module Belt
           Examples:
             belt g auth                        # Admin-only, single pool
             belt g auth --signup               # Public signup with frontend views
+            belt g auth --ses-email            # Custom email domain via SES
             belt g auth web                    # Named pool: "web"
             belt g auth web mobile             # Two pools
             belt g auth --force                # Overwrite existing
@@ -71,6 +74,19 @@ module Belt
             frontend/src/pages/auth/Login.jsx              Login page
             frontend/src/components/ProtectedRoute.jsx     Route guard component
 
+          With --ses-email:
+            Uses Amazon SES instead of Cognito's default email service. Allows sending
+            from your custom domain (e.g., noreply@yourapp.com) instead of verificationemail.com.
+
+            Prerequisites:
+              1. Verify your domain or email address in Amazon SES
+              2. Request production access (move out of SES sandbox) for production use
+
+            After generation, set these variables in your tfvars:
+              cognito_ses_email_arn  = "arn:aws:ses:us-east-1:123456789:identity/yourapp.com"
+              cognito_from_email     = "noreply@yourapp.com"
+              cognito_reply_to_email = "support@yourapp.com"  # optional
+
           It also patches:
             infrastructure/modules/app/main.tf             Adds cognito_user_pool_arns to conveyor_belt
 
@@ -89,10 +105,12 @@ module Belt
         names.map(&:downcase).map { |n| n.gsub(/[^a-z0-9_]/, '_') }
       end
 
-      def initialize(pools:, force: false, signup: false, frontend_name: nil, skip_frontend_resolve: false)
+      def initialize(pools:, force: false, signup: false, ses_email: false, frontend_name: nil,
+                     skip_frontend_resolve: false)
         @pool_names = pools
         @force = force
         @signup = signup
+        @ses_email = ses_email
         @app_name = detect_app_name
         @pools = build_pool_metadata
         @frontend = skip_frontend_resolve ? nil : resolve_frontend(frontend_name)
@@ -104,6 +122,7 @@ module Belt
 
         write_cognito_tf
         write_cognito_outputs_tf
+        write_cognito_variables_tf if @ses_email
         patch_main_tf
         patch_env_outputs
         generate_frontend_auth if frontend?
@@ -114,14 +133,29 @@ module Belt
 
       def print_next_steps
         puts "\nNext steps:"
-        puts '  1. Add auth: :cognito to your routes namespace:'
+        step = 1
+
+        if @ses_email
+          puts "  #{step}. Configure SES email variables in your tfvars files:"
+          puts ''
+          puts '       # Verify your domain in SES first, then add:'
+          puts '       cognito_ses_email_arn  = "arn:aws:ses:REGION:ACCOUNT:identity/yourdomain.com"'
+          puts '       cognito_from_email     = "noreply@yourdomain.com"'
+          puts '       cognito_reply_to_email = "support@yourdomain.com"  # optional'
+          puts ''
+          step += 1
+        end
+
+        puts "  #{step}. Add auth: :cognito to your routes namespace:"
         puts ''
         puts '       namespace :api, auth: :cognito do'
         puts '         # your resources...'
         puts '       end'
         puts ''
+        step += 1
+
         if frontend?
-          puts "  2. Wire auth into your #{@frontend.src_dir}/App.jsx:"
+          puts "  #{step}. Wire auth into your #{@frontend.src_dir}/App.jsx:"
           puts ''
           puts "       import Login from './pages/auth/Login'"
           puts "       import ProtectedRoute from './components/ProtectedRoute'"
@@ -132,12 +166,11 @@ module Belt
           puts '       // Wrap protected routes:'
           puts '       <Route path="/*" element={<ProtectedRoute><YourApp /></ProtectedRoute>} />'
           puts ''
-          puts '  3. Deploy: belt deploy'
-          print_create_user_step(4) unless @signup
-        else
-          puts '  2. Deploy: belt deploy'
-          print_create_user_step(3) unless @signup
+          step += 1
         end
+        puts "  #{step}. Deploy: belt deploy"
+        step += 1
+        print_create_user_step(step) unless @signup
       end
 
       def print_create_user_step(step_num)
@@ -154,6 +187,7 @@ module Belt
 
         cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
         cognito_outputs_tf = File.join(MODULE_DIR, 'cognito_outputs.tf')
+        cognito_variables_tf = File.join(MODULE_DIR, 'cognito_variables.tf')
 
         if File.exist?(cognito_tf)
           FileUtils.rm(cognito_tf)
@@ -167,6 +201,12 @@ module Belt
           puts "  remove  #{cognito_outputs_tf}"
         end
 
+        if File.exist?(cognito_variables_tf)
+          FileUtils.rm(cognito_variables_tf)
+          removed << cognito_variables_tf
+          puts "  remove  #{cognito_variables_tf}"
+        end
+
         unpatch_main_tf
         removed << File.join(MODULE_DIR, 'main.tf') if @main_tf_patched
 
@@ -275,6 +315,92 @@ module Belt
         puts "  create  #{dest}"
       end
 
+      def write_cognito_variables_tf
+        dest = File.join(MODULE_DIR, 'cognito_variables.tf')
+        content = <<~HCL
+          # Cognito SES email configuration variables
+          # Generated by: belt generate auth --ses-email
+          #
+          # Set these in your environment tfvars (e.g., infrastructure/dev/terraform.tfvars):
+          #   cognito_ses_email_arn  = "arn:aws:ses:us-east-1:123456789:identity/yourapp.com"
+          #   cognito_from_email     = "noreply@yourapp.com"
+          #   cognito_reply_to_email = "support@yourapp.com"  # optional
+
+          variable "cognito_ses_email_arn" {
+            description = "ARN of verified SES email address or domain for Cognito emails"
+            type        = string
+          }
+
+          variable "cognito_from_email" {
+            description = "From email address for Cognito emails (e.g., noreply@yourapp.com)"
+            type        = string
+          }
+
+          variable "cognito_reply_to_email" {
+            description = "Reply-to email address for Cognito emails (optional)"
+            type        = string
+            default     = ""
+          }
+        HCL
+
+        File.write(dest, content)
+        puts "  create  #{dest}"
+
+        # Also patch the environment tfvars examples
+        patch_env_vars_for_ses
+      end
+
+      def patch_env_vars_for_ses
+        # Find environment directories (e.g., infrastructure/dev/, infrastructure/prod/)
+        env_dirs = Dir.glob('infrastructure/*/terraform.tfvars')
+                      .reject { |f| f.include?('modules') }
+
+        env_dirs.each do |tfvars_file|
+          content = File.read(tfvars_file)
+          next if content.include?('cognito_ses_email_arn')
+
+          domain = detect_domain_from_tfvars(tfvars_file)
+          ses_vars = build_ses_vars_block(domain)
+
+          File.write(tfvars_file, content + ses_vars)
+          env_name = File.basename(File.dirname(tfvars_file))
+          puts "  update  #{tfvars_file} (added SES email variables for #{env_name})"
+        end
+      end
+
+      def detect_domain_from_tfvars(tfvars_file)
+        return nil unless File.exist?(tfvars_file)
+
+        match = File.read(tfvars_file).match(/^\s*domain\s*=\s*"([^"]+)"/)
+        match[1] if match
+      end
+
+      def build_ses_vars_block(domain)
+        if domain
+          # User has a domain configured — provide smart defaults
+          <<~HCL
+
+            # Cognito SES email configuration (generated by: belt g auth --ses-email)
+            # Sends emails from your domain instead of verificationemail.com
+            # Prerequisites: 1) Verify domain in SES  2) Request SES production access for prod
+            cognito_ses_email_arn  = "arn:aws:ses:REGION:ACCOUNT:identity/#{domain}"
+            cognito_from_email     = "noreply@#{domain}"
+            # cognito_reply_to_email = "support@#{domain}"
+          HCL
+        else
+          # No domain configured — provide placeholder examples
+          <<~HCL
+
+            # Cognito SES email configuration (generated by: belt g auth --ses-email)
+            # Uncomment and configure to send emails from your domain instead of verificationemail.com
+            # Prerequisites: 1) Verify domain in SES  2) Request SES production access for prod
+            # cognito_ses_email_arn  = "arn:aws:ses:REGION:ACCOUNT:identity/yourdomain.com"
+            # cognito_from_email     = "noreply@yourdomain.com"
+            # cognito_reply_to_email = "support@yourdomain.com"
+          HCL
+        end
+      end
+
       def patch_main_tf
         main_tf = File.join(MODULE_DIR, 'main.tf')
         return unless File.exist?(main_tf)

data/lib/belt/cli/destroy_command.rb

@@ -135,7 +135,7 @@ module Belt
         HELP
       end
 
-      # rubocop:disable Metrics/ParameterLists -- keyword options for destroy flags
+      # -- keyword options for destroy flags
       def initialize(generator, name, fields, force: false, skip_terraform: false, frontend_name: nil)
         @generator = generator
         @name = name&.downcase&.gsub(/[^a-z0-9_]/, '_')
@@ -150,7 +150,6 @@ module Belt
         @removed = []
         @updated = []
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def destroy
         case @generator

data/lib/belt/cli/frontend_registry.rb

@@ -15,7 +15,7 @@ module Belt
                   :url_output, :cloudfront_domain_output
       attr_accessor :default, :path
 
-      # rubocop:disable Metrics/ParameterLists -- keyword options from YAML config
+      # -- keyword options from YAML config
       def initialize(name:, path:, dist: nil, bucket_output: nil, distribution_output: nil,
                      url_output: nil, cloudfront_domain_output: nil, default: false)
         @name = name.to_s
@@ -28,7 +28,6 @@ module Belt
         @url_output = url_output || default_output('url')
         @cloudfront_domain_output = cloudfront_domain_output
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def default?
         @default

data/lib/belt/cli/generate_command.rb

@@ -278,7 +278,7 @@ module Belt
         puts "\n#{info[:notes]}" if info[:notes]
       end
 
-      # rubocop:disable Metrics/ParameterLists -- keyword options for generator flags
+      # -- keyword options for generator flags
       def initialize(generator, name, fields, skip_views: false, force: false, frontend_name: nil)
         @generator = generator
         @name = name.downcase.gsub(/[^a-z0-9_]/, '_')
@@ -293,7 +293,6 @@ module Belt
         @class_name = Belt::Inflector.classify(@singular_name)
         @references, @regular_fields = @fields.partition { |f| f[:type] == 'references' }
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def generate
         case @generator

data/lib/belt/cli/new_command.rb

@@ -82,7 +82,7 @@ module Belt
         ).generate
       end
 
-      # rubocop:disable Metrics/ParameterLists -- keyword options for generator flags
+      # -- keyword options for generator flags
       def initialize(app_name, frontend: nil, bucket: nil, environments: nil, domain: nil, verbose: false)
         @app_name = app_name.gsub(/[^a-z0-9_-]/i, '_').downcase
         @module_name = @app_name.split(/[-_]/).map(&:capitalize).join
@@ -94,7 +94,6 @@ module Belt
         @resolved_bucket = nil
         @state_setup_succeeded = false
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def generate
         if Dir.exist?(@app_name)

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.3.14'
+  VERSION = '0.3.16'
 end

data/lib/templates/generate/auth/cognito.tf.erb

@@ -30,6 +30,17 @@ resource "aws_cognito_user_pool" "<%= pool[:name] %>" {
     }
   }
 
+<% if @ses_email -%>
+  # SES email configuration — sends from your verified domain
+  # Requires: verified domain or email in SES, out of sandbox for prod
+  email_configuration {
+    email_sending_account  = "DEVELOPER"
+    source_arn             = var.cognito_ses_email_arn
+    from_email_address     = var.cognito_from_email
+    reply_to_email_address = var.cognito_reply_to_email != "" ? var.cognito_reply_to_email : null
+  }
+
+<% end -%>
   schema {
     name                = "email"
     attribute_data_type = "String"

data/lib/templates/generate/auth/frontend/auth.js

@@ -37,41 +37,54 @@ export function signIn(username, password) {
         resolve({ success: true })
       },
       onFailure: (err) => reject(err),
-      newPasswordRequired: () => {
-        // Stash the user so completeNewPassword can continue the SRP session.
+      newPasswordRequired: (_userAttributes, requiredAttributes) => {
+        // Stash the user + the attributes Cognito actually requires so
+        // completeNewPassword can continue the SRP session and supply exactly
+        // what the pool asks for — no more, no less.
         pendingUser = cognitoUser
+        pendingRequiredAttributes = requiredAttributes || []
         resolve({ challenge: 'NEW_PASSWORD_REQUIRED' })
       }
     })
   })
 }
 
-// Holds the CognitoUser mid-challenge for the NEW_PASSWORD_REQUIRED flow.
+// Holds the CognitoUser mid-challenge for the NEW_PASSWORD_REQUIRED flow,
+// plus the list of attributes Cognito flagged as required for the challenge.
 let pendingUser = null
+let pendingRequiredAttributes = []
 
 export function completeNewPassword(email, newPassword) {
   if (!pendingUser) {
     return Promise.reject(new Error('No pending password challenge. Sign in again.'))
   }
 
-  // Pools that require `email` reject the NEW_PASSWORD_REQUIRED challenge with
-  // "Invalid attributes given, email is missing" unless we supply it here.
-  // Admin-created users hitting this challenge don't have email set yet, so we
-  // pass the username (which is the email) as the required attribute.
-  const requiredAttributes = { email }
+  // Only supply attributes Cognito actually asks for in this challenge.
+  //   - If the pool requires `email` and the user doesn't have it yet, it shows
+  //     up in requiredAttributes → we send it (username is the email). Skipping
+  //     it would fail with "Invalid attributes given, email is missing".
+  //   - If the user already has `email` (e.g. admin-created with it), it is NOT
+  //     in requiredAttributes → we must NOT send it, or Cognito rejects with
+  //     "Cannot modify an already provided email".
+  const attributes = {}
+  if (pendingRequiredAttributes.includes('email')) {
+    attributes.email = email
+  }
 
   return new Promise((resolve, reject) => {
-    pendingUser.completeNewPasswordChallenge(newPassword, requiredAttributes, {
+    pendingUser.completeNewPasswordChallenge(newPassword, attributes, {
       onSuccess: (session) => {
         setTokens({
           IdToken: session.getIdToken().getJwtToken(),
           RefreshToken: session.getRefreshToken().getToken()
         })
         pendingUser = null
+        pendingRequiredAttributes = []
         resolve({ success: true })
       },
       onFailure: (err) => {
         pendingUser = null
+        pendingRequiredAttributes = []
         reject(err)
       }
     })

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.3.14
+  version: 0.3.16
 platform: ruby
 authors:
 - Stowzilla