belt 0.3.34 → 0.3.35

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01f5648c9621e3feace4ceafc8f6683575c9f52a17ec59c60c2eb1f9202f3f65
-  data.tar.gz: 86a781e22c010419b21f09d00115db32ad9c13f40bf5be02a391ae146fd70ec6
+  metadata.gz: b880627c5b6f7d73fe1957bfeff61f0b601d8520f3b57053193bef5891b2ef9c
+  data.tar.gz: 2069b8d810cc8bf3ef0ec8cd4c15b2baf95719bc7f546875b3dc0987e26ca8d3
 SHA512:
-  metadata.gz: 6f3aca3d970a65d95fc9028b9eb7bb8117043e7c00fffaf481fbe3bf80d4a603c501f6321e438934c6cc8622e897c84034657fb01f6cc9c8ac2c3ae9b7604404
-  data.tar.gz: 50f18ff13e6cb0767a57bc7af4b1963de6bd4681fdd2030db8e5ed34872bc031bf4761bf23065a27e7115bb6f405ece4c0078a30dd86ba17b077cb3b0d6eb8cd
+  metadata.gz: 1e2583c0ec4320dc90e00a72c48b8f04d208cfc0f4dc561306b6630495456ca9cf81c18d396804f4bbf9267ac6512238187ac864e5af6c1e2559c2a2bfccf89b
+  data.tar.gz: 9cf50f3894ef696c965183d9b45f572cc4cc245817e9b6f30ae3fdefe67613b0b3ba762f78bb34dc68587c22fc3f01eb1cbf44c5c8a817c3cb6d26aa5dd24d15

data/lib/belt/cli/cognito_sharer.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require 'tempfile'
+require_relative 'nested_environment'
+
+module Belt
+  module CLI
+    # Points a nested environment's Lambdas at the parent Cognito pool.
+    #
+    # Nested envs still *create* their own pool when the app's terraform isn't
+    # the Belt-generated auth template. After apply we rewrite COGNITO_* env
+    # vars so login and JWT checks use the parent. Destroy only tears down the
+    # nested pool — the parent pool is never in the child's terraform state.
+    class CognitoSharer
+      POOL_KEY = /cognito.*pool.?id/i
+      CLIENT_KEY = /cognito.*client/i
+      ISSUER_KEY = /cognito.*issuer/i
+
+      def initialize(nested_env)
+        @nested = nested_env
+      end
+
+      # rubocop:disable Naming/PredicateMethod
+      def run
+        # rubocop:enable Naming/PredicateMethod
+        pool_id = @nested.parent_cognito_pool_id
+        unless pool_id
+          puts '  ⚠  Could not read parent Cognito pool ID — nested env will use its own pool'
+          reason = @nested.last_output_error
+          detail = if reason && !reason.empty?
+                     "terraform output for '#{@nested.parent}' failed: #{reason.lines.first&.strip}"
+                   else
+                     "no cognito_user_pool_id output found in '#{@nested.parent}'"
+                   end
+          puts "     (#{detail})"
+          return false
+        end
+
+        names = lambda_function_names
+        if names.empty?
+          puts '  ℹ  No Lambda functions found to rewire for Cognito'
+          return true
+        end
+
+        puts "  🔑 Sharing parent '#{@nested.parent}' Cognito pool (#{pool_id})"
+
+        names.each { |name| rewire_function(name, pool_id) }
+        true
+      end
+
+      private
+
+      def lambda_function_names
+        funcs = @nested.child_outputs['lambda_functions']
+        names = case funcs
+                when Hash then funcs.values
+                when Array then funcs
+                else []
+                end
+        names.map { |value| value.to_s.split(':').last }.reject(&:empty?).uniq
+      end
+
+      def rewire_function(function_name, pool_id)
+        wait_until_ready(function_name)
+
+        config = aws_json('lambda', 'get-function-configuration',
+                          '--function-name', function_name, '--output', 'json')
+        unless config
+          puts "    ⚠  #{function_name}: could not read configuration"
+          return
+        end
+
+        variables = config.dig('Environment', 'Variables')
+        unless variables.is_a?(Hash) && variables.any?
+          puts "    skip  #{function_name} (no environment variables)"
+          return
+        end
+
+        updated = rewrite_variables(variables, pool_id)
+        if updated == variables
+          puts "    skip  #{function_name} (already on parent pool)"
+          return
+        end
+
+        if update_environment(function_name, updated)
+          puts "    rewire  #{function_name}"
+        else
+          puts "    ⚠  #{function_name}: failed to update Cognito env vars"
+        end
+      end
+
+      def rewrite_variables(variables, pool_id)
+        client_id = @nested.parent_cognito_client_id
+        issuer = @nested.parent_issuer
+        child_pool = @nested.child_cognito_pool_id
+        child_client = @nested.child_cognito_client_id
+
+        variables.each_with_object({}) do |(key, value), hash|
+          hash[key] = new_value_for(key, value, pool_id: pool_id, client_id: client_id,
+                                                issuer: issuer, child_pool: child_pool,
+                                                child_client: child_client)
+        end
+      end
+
+      def new_value_for(key, value, pool_id:, client_id:, issuer:, child_pool:, child_client:)
+        return pool_id if key.match?(POOL_KEY) || (child_pool && value == child_pool)
+        return client_id if client_id && (key.match?(CLIENT_KEY) || value == child_client)
+        return issuer if issuer && key.match?(ISSUER_KEY)
+
+        value
+      end
+
+      def update_environment(function_name, variables)
+        payload = { 'FunctionName' => function_name, 'Environment' => { 'Variables' => variables } }
+        Tempfile.create(['belt-cognito', '.json']) do |file|
+          file.write(JSON.generate(payload))
+          file.flush
+          _output, status = Open3.capture2(
+            'aws', 'lambda', 'update-function-configuration',
+            '--cli-input-json', "file://#{file.path}",
+            '--output', 'json'
+          )
+          status.success?
+        end
+      end
+
+      def wait_until_ready(function_name)
+        30.times do
+          output, status = Open3.capture2(
+            'aws', 'lambda', 'get-function-configuration',
+            '--function-name', function_name,
+            '--query', 'LastUpdateStatus',
+            '--output', 'text'
+          )
+          return unless status.success?
+
+          case output.strip
+          when 'Successful' then return
+          when 'Failed' then return
+          else
+            sleep 1
+          end
+        end
+      end
+
+      def aws_json(*)
+        output, status = Open3.capture2('aws', *)
+        return nil unless status.success?
+
+        JSON.parse(output)
+      rescue JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/belt/cli/deploy_command.rb

@@ -11,6 +11,9 @@ require_relative 'backup_runner'
 require_relative 'environment_config'
 require_relative 'path_gem_materializer'
 require_relative 'zip_artifact_builder'
+require_relative 'nested_environment'
+require_relative 'cognito_sharer'
+require_relative 'dynamo_copier'
 
 module Belt
   module CLI
@@ -99,6 +102,7 @@ module Belt
             6. terraform plan    (preview changes)
             7. Prompt for confirmation (unless --auto)
             8. terraform apply   (deploy changes)
+            9. Nested envs: share parent Cognito + copy DynamoDB if empty
 
           Options:
             --auto, --yes, -y    Skip confirmation prompt (auto-approve)
@@ -172,6 +176,8 @@ module Belt
         puts "\n✅ Deployed #{@env} successfully!"
         print_outputs(env_dir)
 
+        run_nested_env_hooks
+
         deploy_frontend_if_exists
 
         puts "\n   Run `belt server` to view your app locally (auto-connects to the deployed API)."
@@ -727,6 +733,15 @@ module Belt
         FileUtils.rm_f('tfplan')
       end
 
+      def run_nested_env_hooks
+        nested = NestedEnvironment.for(@env, infra_dir: @infra_dir)
+        return unless nested
+
+        puts "\n━━━ nested environment (parent: #{nested.parent}) ━━━"
+        CognitoSharer.new(nested).run
+        DynamoCopier.new(nested, app_name: detect_app_name_for_backup).run
+      end
+
       def deploy_frontend_if_exists
         require_relative 'frontend_registry'
         require_relative 'frontend_deploy_command'

data/lib/belt/cli/dynamo_copier.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require 'tempfile'
+require_relative 'nested_environment'
+
+module Belt
+  module CLI
+    # Copies DynamoDB items from a parent environment into a nested child.
+    #
+    # Copy is skipped when the child table already has any items, so a PR
+    # sync / second deploy will not clobber test data. If a copy fails the
+    # child table is wiped (it was empty when we started) so the next deploy
+    # retries.
+    class DynamoCopier
+      BATCH_SIZE = 25
+      MAX_RETRIES = 8
+
+      def initialize(nested_env, app_name:)
+        @nested = nested_env
+        @app_name = app_name
+        @errors = []
+      end
+
+      # rubocop:disable Naming/PredicateMethod
+      def run
+        # rubocop:enable Naming/PredicateMethod
+        pairs = table_pairs
+        if pairs.empty?
+          puts '  ℹ  No parent DynamoDB tables found to copy'
+          return true
+        end
+
+        puts "  💾 Copying DynamoDB data from '#{@nested.parent}' (empty tables only)"
+
+        copied = 0
+        skipped = 0
+        pairs.each do |parent_table, child_table|
+          result = copy_pair(parent_table, child_table)
+          case result
+          when :copied then copied += 1
+          when :skipped then skipped += 1
+          end
+        end
+
+        puts "     copied #{copied}, skipped #{skipped}" \
+             "#{", #{@errors.size} error(s)" if @errors.any?}"
+        @errors.empty?
+      end
+
+      private
+
+      def copy_pair(parent_table, child_table)
+        short = suffix_for(child_table, child_prefixes)
+
+        unless table_exists?(child_table)
+          puts "    ⚠  #{short}: child table missing — skip"
+          return :skipped
+        end
+
+        if table_has_items?(child_table)
+          puts "    skip  #{short} (already has data)"
+          return :skipped
+        end
+
+        items = scan_items(parent_table)
+        if items.nil?
+          fail_table(short, "failed to scan parent #{parent_table}")
+          return :failed
+        end
+
+        if items.empty?
+          puts "    skip  #{short} (parent empty)"
+          return :skipped
+        end
+
+        begin
+          write_items(child_table, items)
+          puts "    copy  #{short} (#{items.size} item#{'s' if items.size != 1})"
+          :copied
+        rescue StandardError => e
+          wipe_table(child_table)
+          fail_table(short, e.message)
+          :failed
+        end
+      end
+
+      def table_pairs
+        parent_tables = tables_with_prefixes(parent_prefixes)
+        child_tables = tables_with_prefixes(child_prefixes)
+        pairs = {}
+
+        parent_tables.each do |parent_table|
+          suffix = suffix_for(parent_table, parent_prefixes)
+          next if suffix.empty?
+
+          child_prefixes.each do |prefix|
+            candidate = "#{prefix}#{suffix}"
+            next unless child_tables.include?(candidate)
+
+            pairs[parent_table] = candidate
+            break
+          end
+        end
+
+        pairs
+      end
+
+      def parent_prefixes
+        @parent_prefixes ||= prefixes_for(@nested.parent)
+      end
+
+      def child_prefixes
+        @child_prefixes ||= prefixes_for(@nested.env)
+      end
+
+      def prefixes_for(env_name)
+        raw = "#{@app_name}-#{env_name}-"
+        sanitized = raw.tr('_', '-').downcase
+        [raw, sanitized].uniq
+      end
+
+      def suffix_for(table_name, prefixes)
+        prefixes.each do |prefix|
+          return table_name.delete_prefix(prefix) if table_name.start_with?(prefix)
+        end
+        table_name
+      end
+
+      def tables_with_prefixes(prefixes)
+        all_tables.select { |name| prefixes.any? { |prefix| name.start_with?(prefix) } }
+      end
+
+      def all_tables
+        @all_tables ||= list_all_tables
+      end
+
+      def list_all_tables
+        names = []
+        start_name = nil
+        loop do
+          args = ['dynamodb', 'list-tables', '--output', 'json']
+          args += ['--exclusive-start-table-name', start_name] if start_name
+          data = aws_json(*args)
+          return names if data.nil?
+
+          names.concat(Array(data['TableNames']))
+          start_name = data['LastEvaluatedTableName']
+          break if start_name.nil? || start_name.empty?
+        end
+        names
+      end
+
+      def table_exists?(name)
+        all_tables.include?(name)
+      end
+
+      def table_has_items?(table_name)
+        data = aws_json('dynamodb', 'scan', '--table-name', table_name,
+                        '--select', 'COUNT', '--limit', '1', '--output', 'json')
+        return false if data.nil?
+
+        data.fetch('Count', 0).to_i.positive?
+      end
+
+      def scan_items(table_name)
+        items = []
+        start_key = nil
+        loop do
+          args = ['dynamodb', 'scan', '--table-name', table_name, '--output', 'json']
+          args += ['--exclusive-start-key', JSON.generate(start_key)] if start_key
+          data = aws_json(*args)
+          return nil if data.nil?
+
+          items.concat(Array(data['Items']))
+          start_key = data['LastEvaluatedKey']
+          break if start_key.nil? || start_key.empty?
+        end
+        items
+      end
+
+      def write_items(table_name, items)
+        items.each_slice(BATCH_SIZE) do |batch|
+          request = {
+            table_name => batch.map { |item| { 'PutRequest' => { 'Item' => item } } }
+          }
+          write_batch(request)
+        end
+      end
+
+      def write_batch(request_items, attempt = 0)
+        data = batch_write(request_items)
+        raise "batch-write-item failed for #{request_items.keys.join(', ')}" if data.nil?
+
+        unprocessed = data['UnprocessedItems']
+        return if unprocessed.nil? || unprocessed.empty?
+        raise "unprocessed items after #{MAX_RETRIES} retries" if attempt >= MAX_RETRIES
+
+        sleep(0.2 * (2**attempt))
+        write_batch(unprocessed, attempt + 1)
+      end
+
+      def batch_write(request_items)
+        Tempfile.create(['belt-dynamo', '.json']) do |file|
+          file.write(JSON.generate(request_items))
+          file.flush
+          aws_json('dynamodb', 'batch-write-item',
+                   '--request-items', "file://#{file.path}",
+                   '--output', 'json')
+        end
+      end
+
+      def wipe_table(table_name)
+        items = scan_items(table_name)
+        return if items.nil? || items.empty?
+
+        keys = key_attribute_names(table_name)
+        return if keys.empty?
+
+        items.each_slice(BATCH_SIZE) do |batch|
+          request = {
+            table_name => batch.map do |item|
+              { 'DeleteRequest' => { 'Key' => item.slice(*keys) } }
+            end
+          }
+          batch_write(request)
+        end
+      rescue StandardError
+        nil
+      end
+
+      def key_attribute_names(table_name)
+        data = aws_json('dynamodb', 'describe-table', '--table-name', table_name, '--output', 'json')
+        return [] if data.nil?
+
+        Array(data.dig('Table', 'KeySchema')).map { |key| key['AttributeName'] }.compact
+      end
+
+      def fail_table(short, message)
+        @errors << "#{short}: #{message}"
+        puts "    ⚠  #{short}: #{message} (will retry on next deploy if table is empty)"
+      end
+
+      def aws_json(*)
+        output, status = Open3.capture2('aws', *)
+        return nil unless status.success?
+
+        JSON.parse(output)
+      rescue JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/belt/cli/frontend_env_map.rb

@@ -3,6 +3,7 @@
 require 'fileutils'
 require 'open3'
 require 'yaml'
+require_relative 'nested_environment'
 
 module Belt
   module CLI
@@ -164,11 +165,40 @@ module Belt
       end
 
       def read_tf_output(name)
-        return nil unless Dir.exist?(@env_dir)
+        dirs_for(name).each do |dir|
+          value = read_tf_output_from(dir, name)
+          return value if value
+        end
+        nil
+      end
+
+      # Nested envs share the parent Cognito pool. Cognito terraform outputs
+      # (pool id, client id, issuer, domain) are read from the parent so the
+      # SPA logs in with the same users. API/frontend URLs still come from the
+      # nested env itself.
+      def dirs_for(name)
+        dirs = []
+        dirs << parent_env_dir if cognito_output?(name) && parent_env_dir
+        dirs << @env_dir
+        dirs.compact.uniq.select { |dir| Dir.exist?(dir) }
+      end
+
+      def cognito_output?(name)
+        name.to_s.downcase.include?('cognito')
+      end
+
+      def parent_env_dir
+        return @parent_env_dir if defined?(@parent_env_dir)
+
+        infra_dir = File.dirname(@env_dir)
+        nested = NestedEnvironment.for(@env_name, infra_dir: infra_dir)
+        @parent_env_dir = nested&.parent_dir
+      end
 
+      def read_tf_output_from(dir, name)
         output, status = Open3.capture2(
           'terraform', 'output', '-raw', name,
-          chdir: @env_dir,
+          chdir: dir,
           err: File::NULL
         )
         return nil unless status.success?

data/lib/belt/cli/nested_environment.rb

@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require_relative 'environment_config'
+
+module Belt
+  module CLI
+    # A nested environment (e.g. fizzy123 under dev). Nested envs share the
+    # parent's Cognito pool and get a one-time DynamoDB copy on first deploy.
+    class NestedEnvironment
+      PARENT_TFVARS = /^\s*parent_environment\s*=\s*"([^"]+)"/
+
+      attr_reader :env, :parent, :infra_dir
+
+      # Populated by terraform_outputs when a read fails so callers (e.g.
+      # CognitoSharer) can explain *why* the parent pool couldn't be read
+      # instead of emitting a vague warning.
+      attr_reader :last_output_error
+
+      def self.parent_of(env, infra_dir:)
+        path = File.join(infra_dir, env, 'terraform.tfvars')
+        return nil unless File.file?(path)
+
+        match = File.read(path).match(PARENT_TFVARS)
+        parent = match && match[1]
+        parent.nil? || parent.empty? ? nil : parent
+      end
+
+      def self.for(env, infra_dir:)
+        parent = parent_of(env, infra_dir: infra_dir)
+        return nil unless parent
+        return nil unless Dir.exist?(File.join(infra_dir, parent))
+
+        new(env: env, parent: parent, infra_dir: infra_dir)
+      end
+
+      def initialize(env:, parent:, infra_dir:)
+        @env = env
+        @parent = parent
+        @infra_dir = infra_dir
+      end
+
+      def env_dir
+        File.join(@infra_dir, @env)
+      end
+
+      def parent_dir
+        File.join(@infra_dir, @parent)
+      end
+
+      def child_outputs
+        @child_outputs ||= terraform_outputs(env_dir)
+      end
+
+      def parent_outputs
+        # Read the parent under the parent's own AWS profile — a nested env may
+        # deploy with a different profile than its parent, and `terraform
+        # output` hits the S3 backend, so it needs the parent's credentials.
+        @parent_outputs ||= with_parent_profile { terraform_outputs(parent_dir) }
+      end
+
+      def parent_cognito_pool_id
+        pick_output(parent_outputs, %w[cognito_user_pool_id user_pool_id cognito_pool_id])
+      end
+
+      def parent_cognito_client_id
+        pick_output(parent_outputs, %w[cognito_user_pool_client_id cognito_client_id user_pool_client_id])
+      end
+
+      def parent_cognito_region
+        pick_output(parent_outputs, %w[cognito_region aws_region]) || ENV['AWS_REGION'] || 'us-east-1'
+      end
+
+      def child_cognito_pool_id
+        pick_output(child_outputs, %w[cognito_user_pool_id user_pool_id cognito_pool_id])
+      end
+
+      def child_cognito_client_id
+        pick_output(child_outputs, %w[cognito_user_pool_client_id cognito_client_id user_pool_client_id])
+      end
+
+      def parent_issuer
+        pool_id = parent_cognito_pool_id
+        return nil unless pool_id
+
+        "https://cognito-idp.#{parent_cognito_region}.amazonaws.com/#{pool_id}"
+      end
+
+      private
+
+      def pick_output(outputs, keys)
+        keys.each do |key|
+          val = outputs[key]
+          return val if val.is_a?(String) && !val.empty?
+        end
+        nil
+      end
+
+      def terraform_outputs(dir)
+        return {} unless Dir.exist?(dir)
+
+        output, err, status = run_output(dir)
+
+        # A fresh worktree (or a parent that was only ever deployed elsewhere)
+        # may not have an initialized backend yet. `terraform output` then
+        # fails with "Backend initialization required". Init once and retry
+        # before giving up so the parent's outputs are actually readable.
+        if !status.success? && backend_not_initialized?(err)
+          init_backend(dir)
+          output, err, status = run_output(dir)
+        end
+
+        unless status.success?
+          @last_output_error = err.to_s.strip
+          return {}
+        end
+
+        parse_outputs(output)
+      rescue JSON::ParserError, Errno::ENOENT => e
+        @last_output_error = e.message
+        {}
+      end
+
+      def run_output(dir)
+        Open3.capture3('terraform', 'output', '-json', chdir: dir)
+      end
+
+      def backend_not_initialized?(err)
+        err.to_s.match?(/backend initialization|terraform init|Backend reinitialization/i)
+      end
+
+      def init_backend(dir)
+        Open3.capture3('terraform', 'init', '-input=false', chdir: dir)
+      end
+
+      def parse_outputs(output)
+        parsed = JSON.parse(output)
+        parsed.each_with_object({}) do |(key, spec), hash|
+          hash[key] = spec.is_a?(Hash) && spec.key?('value') ? spec['value'] : spec
+        end
+      end
+
+      # Apply the parent env's AWS profile (from its belt.rb) for the duration
+      # of the block, then restore whatever profile the child deploy set.
+      def with_parent_profile
+        parent_profile = EnvironmentConfig.load(@parent, infra_dir: @infra_dir).aws_profile
+        return yield if parent_profile.nil? || parent_profile.empty?
+
+        previous = ENV.fetch('AWS_PROFILE', nil)
+        ENV['AWS_PROFILE'] = parent_profile
+        begin
+          yield
+        ensure
+          if previous.nil?
+            ENV.delete('AWS_PROFILE')
+          else
+            ENV['AWS_PROFILE'] = previous
+          end
+        end
+      end
+    end
+  end
+end

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.3.34'
+  VERSION = '0.3.35'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.3.34
+  version: 0.3.35
 platform: ruby
 authors:
 - Stowzilla
@@ -108,12 +108,14 @@ files:
 - lib/belt/cli/backup_config.rb
 - lib/belt/cli/backup_runner.rb
 - lib/belt/cli/bucket_security.rb
+- lib/belt/cli/cognito_sharer.rb
 - lib/belt/cli/console_command.rb
 - lib/belt/cli/contracts_command.rb
 - lib/belt/cli/deploy_command.rb
 - lib/belt/cli/destroy_command.rb
 - lib/belt/cli/dns_command.rb
 - lib/belt/cli/doctor_command.rb
+- lib/belt/cli/dynamo_copier.rb
 - lib/belt/cli/env_resolver.rb
 - lib/belt/cli/environment_command.rb
 - lib/belt/cli/environment_config.rb
@@ -129,6 +131,7 @@ files:
 - lib/belt/cli/index_command.rb
 - lib/belt/cli/lambda_config_command.rb
 - lib/belt/cli/logs_command.rb
+- lib/belt/cli/nested_environment.rb
 - lib/belt/cli/new_command.rb
 - lib/belt/cli/path_gem_materializer.rb
 - lib/belt/cli/plugin_command.rb