belt 0.3.15 → 0.3.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 491ae37769b6a21cfd1823301d425d0af0b3f1e3c19952b909febebc7f2c3b32
-  data.tar.gz: a2427f68a34d38be0cf3af42ac33a8d3c3d190f36505c54ef531219cd0c3fb66
+  metadata.gz: d0f68a846160c9f0b0c3ecd69a74a3bf500531098cd29bf77b6a21cea22ece7a
+  data.tar.gz: 55278ed99e4a8c886e55d12e83ed313aad88ff2953a3258b870e818c22a22a91
 SHA512:
-  metadata.gz: 895fb4f7238141ba4752cdfc9200c44b2ef870bbc61585a436d3a9e36f39c689e8429d97ad4cf0101d92cbea06b3771864c1d31e4892dae54448a2f0e8ec138b
-  data.tar.gz: 4b2fee884c2f7ad9ba78bd7a46dacf75d1d5c8aa5da43d151ab7d03889aa740dd60a12a1fce5c18467f7c3bbb54aacb886a55efdcc58a997ed6367148ea37f15
+  metadata.gz: f22fef0b437a5e67f680ae5fc0a72ed9bc286006d635e3bddc68d886722cbdae8040953a8248972c2dbcd545d1eefcef3ce83dfb25c4caae6919afa2e1fafdc0
+  data.tar.gz: c3e96290df0527f0b6da7c07469d8672c1dd41fcde7832cd2edb0997665b60f5ed69bd253f4189d23a24f28c910dc152d1572a7916aed0bca5a6eb5aea3bcb8c

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.3.16
+
+### Enhancement
+
+- **`belt generate auth --ses-email` for custom email domains**: By default,
+  Cognito sends verification emails from `no-reply@verificationemail.com`.
+  The new `--ses-email` flag configures Cognito to use Amazon SES instead,
+  allowing you to send from your own domain (e.g., `noreply@yourapp.com`).
+  
+  The generator creates:
+  - `cognito_variables.tf` with variables for SES email ARN, from address, and
+    optional reply-to address
+  - `email_configuration` block in `cognito.tf` with `DEVELOPER` sending mode
+  - Example variable values in environment tfvars files
+  
+  Prerequisites:
+  1. Verify your domain or email address in Amazon SES
+  2. Move out of SES sandbox for production use
+  
+  Usage: `belt g auth --ses-email`
+
 ## 0.3.15
 
 ### Bug Fix

data/lib/belt/cli/auth_command.rb

@@ -21,10 +21,11 @@ module Belt
 
         force = args.delete('--force') || args.delete('-f')
         signup = args.delete('--signup')
+        ses_email = args.delete('--ses-email')
         frontend_name = FrontendRegistry.extract_flag!(args, '--frontend')
         pools = parse_pools(args)
 
-        new(pools: pools, force: force, signup: signup, frontend_name: frontend_name).generate
+        new(pools: pools, force: force, signup: signup, ses_email: ses_email, frontend_name: frontend_name).generate
       end
 
       def self.destroy(_args)
@@ -39,6 +40,7 @@ module Belt
 
           Options:
             --signup           Allow public user registration (generates frontend views)
+            --ses-email        Use Amazon SES for emails (custom from address/domain)
             --frontend NAME    Target frontend when several exist
             --force, -f        Overwrite existing cognito.tf (skip collision check)
 
@@ -49,6 +51,7 @@ module Belt
           Examples:
             belt g auth                        # Admin-only, single pool
             belt g auth --signup               # Public signup with frontend views
+            belt g auth --ses-email            # Custom email domain via SES
             belt g auth web                    # Named pool: "web"
             belt g auth web mobile             # Two pools
             belt g auth --force                # Overwrite existing
@@ -71,6 +74,19 @@ module Belt
             frontend/src/pages/auth/Login.jsx              Login page
             frontend/src/components/ProtectedRoute.jsx     Route guard component
 
+          With --ses-email:
+            Uses Amazon SES instead of Cognito's default email service. Allows sending
+            from your custom domain (e.g., noreply@yourapp.com) instead of verificationemail.com.
+
+            Prerequisites:
+              1. Verify your domain or email address in Amazon SES
+              2. Request production access (move out of SES sandbox) for production use
+
+            After generation, set these variables in your tfvars:
+              cognito_ses_email_arn  = "arn:aws:ses:us-east-1:123456789:identity/yourapp.com"
+              cognito_from_email     = "noreply@yourapp.com"
+              cognito_reply_to_email = "support@yourapp.com"  # optional
+
           It also patches:
             infrastructure/modules/app/main.tf             Adds cognito_user_pool_arns to conveyor_belt
 
@@ -89,10 +105,12 @@ module Belt
         names.map(&:downcase).map { |n| n.gsub(/[^a-z0-9_]/, '_') }
       end
 
-      def initialize(pools:, force: false, signup: false, frontend_name: nil, skip_frontend_resolve: false)
+      def initialize(pools:, force: false, signup: false, ses_email: false, frontend_name: nil,
+                     skip_frontend_resolve: false)
         @pool_names = pools
         @force = force
         @signup = signup
+        @ses_email = ses_email
         @app_name = detect_app_name
         @pools = build_pool_metadata
         @frontend = skip_frontend_resolve ? nil : resolve_frontend(frontend_name)
@@ -104,6 +122,7 @@ module Belt
 
         write_cognito_tf
         write_cognito_outputs_tf
+        write_cognito_variables_tf if @ses_email
         patch_main_tf
         patch_env_outputs
         generate_frontend_auth if frontend?
@@ -114,14 +133,29 @@ module Belt
 
       def print_next_steps
         puts "\nNext steps:"
-        puts '  1. Add auth: :cognito to your routes namespace:'
+        step = 1
+
+        if @ses_email
+          puts "  #{step}. Configure SES email variables in your tfvars files:"
+          puts ''
+          puts '       # Verify your domain in SES first, then add:'
+          puts '       cognito_ses_email_arn  = "arn:aws:ses:REGION:ACCOUNT:identity/yourdomain.com"'
+          puts '       cognito_from_email     = "noreply@yourdomain.com"'
+          puts '       cognito_reply_to_email = "support@yourdomain.com"  # optional'
+          puts ''
+          step += 1
+        end
+
+        puts "  #{step}. Add auth: :cognito to your routes namespace:"
         puts ''
         puts '       namespace :api, auth: :cognito do'
         puts '         # your resources...'
         puts '       end'
         puts ''
+        step += 1
+
         if frontend?
-          puts "  2. Wire auth into your #{@frontend.src_dir}/App.jsx:"
+          puts "  #{step}. Wire auth into your #{@frontend.src_dir}/App.jsx:"
           puts ''
           puts "       import Login from './pages/auth/Login'"
           puts "       import ProtectedRoute from './components/ProtectedRoute'"
@@ -132,12 +166,11 @@ module Belt
           puts '       // Wrap protected routes:'
           puts '       <Route path="/*" element={<ProtectedRoute><YourApp /></ProtectedRoute>} />'
           puts ''
-          puts '  3. Deploy: belt deploy'
-          print_create_user_step(4) unless @signup
-        else
-          puts '  2. Deploy: belt deploy'
-          print_create_user_step(3) unless @signup
+          step += 1
         end
+        puts "  #{step}. Deploy: belt deploy"
+        step += 1
+        print_create_user_step(step) unless @signup
       end
 
       def print_create_user_step(step_num)
@@ -154,6 +187,7 @@ module Belt
 
         cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
         cognito_outputs_tf = File.join(MODULE_DIR, 'cognito_outputs.tf')
+        cognito_variables_tf = File.join(MODULE_DIR, 'cognito_variables.tf')
 
         if File.exist?(cognito_tf)
           FileUtils.rm(cognito_tf)
@@ -167,6 +201,12 @@ module Belt
           puts "  remove  #{cognito_outputs_tf}"
         end
 
+        if File.exist?(cognito_variables_tf)
+          FileUtils.rm(cognito_variables_tf)
+          removed << cognito_variables_tf
+          puts "  remove  #{cognito_variables_tf}"
+        end
+
         unpatch_main_tf
         removed << File.join(MODULE_DIR, 'main.tf') if @main_tf_patched
 
@@ -275,6 +315,92 @@ module Belt
         puts "  create  #{dest}"
       end
 
+      def write_cognito_variables_tf
+        dest = File.join(MODULE_DIR, 'cognito_variables.tf')
+        content = <<~HCL
+          # Cognito SES email configuration variables
+          # Generated by: belt generate auth --ses-email
+          #
+          # Set these in your environment tfvars (e.g., infrastructure/dev/terraform.tfvars):
+          #   cognito_ses_email_arn  = "arn:aws:ses:us-east-1:123456789:identity/yourapp.com"
+          #   cognito_from_email     = "noreply@yourapp.com"
+          #   cognito_reply_to_email = "support@yourapp.com"  # optional
+
+          variable "cognito_ses_email_arn" {
+            description = "ARN of verified SES email address or domain for Cognito emails"
+            type        = string
+          }
+
+          variable "cognito_from_email" {
+            description = "From email address for Cognito emails (e.g., noreply@yourapp.com)"
+            type        = string
+          }
+
+          variable "cognito_reply_to_email" {
+            description = "Reply-to email address for Cognito emails (optional)"
+            type        = string
+            default     = ""
+          }
+        HCL
+
+        File.write(dest, content)
+        puts "  create  #{dest}"
+
+        # Also patch the environment tfvars examples
+        patch_env_vars_for_ses
+      end
+
+      def patch_env_vars_for_ses
+        # Find environment directories (e.g., infrastructure/dev/, infrastructure/prod/)
+        env_dirs = Dir.glob('infrastructure/*/terraform.tfvars')
+                      .reject { |f| f.include?('modules') }
+
+        env_dirs.each do |tfvars_file|
+          content = File.read(tfvars_file)
+          next if content.include?('cognito_ses_email_arn')
+
+          domain = detect_domain_from_tfvars(tfvars_file)
+          ses_vars = build_ses_vars_block(domain)
+
+          File.write(tfvars_file, content + ses_vars)
+          env_name = File.basename(File.dirname(tfvars_file))
+          puts "  update  #{tfvars_file} (added SES email variables for #{env_name})"
+        end
+      end
+
+      def detect_domain_from_tfvars(tfvars_file)
+        return nil unless File.exist?(tfvars_file)
+
+        match = File.read(tfvars_file).match(/^\s*domain\s*=\s*"([^"]+)"/)
+        match[1] if match
+      end
+
+      def build_ses_vars_block(domain)
+        if domain
+          # User has a domain configured — provide smart defaults
+          <<~HCL
+
+            # Cognito SES email configuration (generated by: belt g auth --ses-email)
+            # Sends emails from your domain instead of verificationemail.com
+            # Prerequisites: 1) Verify domain in SES  2) Request SES production access for prod
+            cognito_ses_email_arn  = "arn:aws:ses:REGION:ACCOUNT:identity/#{domain}"
+            cognito_from_email     = "noreply@#{domain}"
+            # cognito_reply_to_email = "support@#{domain}"
+          HCL
+        else
+          # No domain configured — provide placeholder examples
+          <<~HCL
+
+            # Cognito SES email configuration (generated by: belt g auth --ses-email)
+            # Uncomment and configure to send emails from your domain instead of verificationemail.com
+            # Prerequisites: 1) Verify domain in SES  2) Request SES production access for prod
+            # cognito_ses_email_arn  = "arn:aws:ses:REGION:ACCOUNT:identity/yourdomain.com"
+            # cognito_from_email     = "noreply@yourdomain.com"
+            # cognito_reply_to_email = "support@yourdomain.com"
+          HCL
+        end
+      end
+
       def patch_main_tf
         main_tf = File.join(MODULE_DIR, 'main.tf')
         return unless File.exist?(main_tf)

data/lib/belt/cli/destroy_command.rb

@@ -135,7 +135,7 @@ module Belt
         HELP
       end
 
-      # rubocop:disable Metrics/ParameterLists -- keyword options for destroy flags
+      # -- keyword options for destroy flags
       def initialize(generator, name, fields, force: false, skip_terraform: false, frontend_name: nil)
         @generator = generator
         @name = name&.downcase&.gsub(/[^a-z0-9_]/, '_')
@@ -150,7 +150,6 @@ module Belt
         @removed = []
         @updated = []
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def destroy
         case @generator

data/lib/belt/cli/environment_command.rb

@@ -59,13 +59,11 @@ module Belt
         return if @quiet || !@announce
 
         puts "\n✓ Environment '#{@env_name}' created!"
-        puts "\nNext steps:"
-        puts "  cd #{dest_dir}"
-        puts '  terraform init'
-        puts '  terraform plan'
-        puts '  terraform apply'
-        puts "\nTo configure a custom domain, set `domain` in #{dest_dir}/terraform.tfvars:"
-        puts '  domain = "myapp.com"'
+        puts "\nReview your settings in #{dest_dir}/terraform.tfvars:"
+        puts '  environment = "..."   # environment name (defaults to directory name)'
+        puts '  domain      = "..."   # your domain (e.g., "myapp.com")'
+        puts "\nThen deploy:"
+        puts "  belt deploy #{@env_name}"
       end
 
       private

data/lib/belt/cli/frontend_registry.rb

@@ -15,7 +15,7 @@ module Belt
                   :url_output, :cloudfront_domain_output
       attr_accessor :default, :path
 
-      # rubocop:disable Metrics/ParameterLists -- keyword options from YAML config
+      # -- keyword options from YAML config
       def initialize(name:, path:, dist: nil, bucket_output: nil, distribution_output: nil,
                      url_output: nil, cloudfront_domain_output: nil, default: false)
         @name = name.to_s
@@ -28,7 +28,6 @@ module Belt
         @url_output = url_output || default_output('url')
         @cloudfront_domain_output = cloudfront_domain_output
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def default?
         @default

data/lib/belt/cli/generate_command.rb

@@ -278,7 +278,7 @@ module Belt
         puts "\n#{info[:notes]}" if info[:notes]
       end
 
-      # rubocop:disable Metrics/ParameterLists -- keyword options for generator flags
+      # -- keyword options for generator flags
       def initialize(generator, name, fields, skip_views: false, force: false, frontend_name: nil)
         @generator = generator
         @name = name.downcase.gsub(/[^a-z0-9_]/, '_')
@@ -293,7 +293,6 @@ module Belt
         @class_name = Belt::Inflector.classify(@singular_name)
         @references, @regular_fields = @fields.partition { |f| f[:type] == 'references' }
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def generate
         case @generator

data/lib/belt/cli/new_command.rb

@@ -82,7 +82,7 @@ module Belt
         ).generate
       end
 
-      # rubocop:disable Metrics/ParameterLists -- keyword options for generator flags
+      # -- keyword options for generator flags
       def initialize(app_name, frontend: nil, bucket: nil, environments: nil, domain: nil, verbose: false)
         @app_name = app_name.gsub(/[^a-z0-9_-]/i, '_').downcase
         @module_name = @app_name.split(/[-_]/).map(&:capitalize).join
@@ -94,7 +94,6 @@ module Belt
         @resolved_bucket = nil
         @state_setup_succeeded = false
       end
-      # rubocop:enable Metrics/ParameterLists
 
       def generate
         if Dir.exist?(@app_name)

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.3.15'
+  VERSION = '0.3.17'
 end

data/lib/templates/generate/auth/cognito.tf.erb

@@ -30,6 +30,17 @@ resource "aws_cognito_user_pool" "<%= pool[:name] %>" {
     }
   }
 
+<% if @ses_email -%>
+  # SES email configuration — sends from your verified domain
+  # Requires: verified domain or email in SES, out of sandbox for prod
+  email_configuration {
+    email_sending_account  = "DEVELOPER"
+    source_arn             = var.cognito_ses_email_arn
+    from_email_address     = var.cognito_from_email
+    reply_to_email_address = var.cognito_reply_to_email != "" ? var.cognito_reply_to_email : null
+  }
+
+<% end -%>
   schema {
     name                = "email"
     attribute_data_type = "String"

data/lib/templates/module/dns.tf.erb

@@ -35,9 +35,12 @@ resource "aws_acm_certificate" "app" {
 }
 
 # DNS validation record for the certificate
+# Key by resource_record_name (not domain_name) because ACM uses the same
+# validation CNAME for both base domain and wildcard — keying by domain_name
+# creates duplicate records that Route 53 rejects.
 resource "aws_route53_record" "cert_validation" {
   for_each = local.dns_enabled ? {
-    for dvo in aws_acm_certificate.app[0].domain_validation_options : dvo.domain_name => {
+    for dvo in aws_acm_certificate.app[0].domain_validation_options : dvo.resource_record_name => {
       name   = dvo.resource_record_name
       type   = dvo.resource_record_type
       record = dvo.resource_record_value

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.3.15
+  version: 0.3.17
 platform: ruby
 authors:
 - Stowzilla