belt 0.5.3 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2267465d1ad5fcc7e7e8b7d7c6be91919275a8bd6bc541c82c9751ac2265ab27
-  data.tar.gz: 12c71c5a5db0520f26ee6df68fbbbbd5403105cb9ab2c08da2719d6513a6269e
+  metadata.gz: 66c35b71a47f74ba7805bce24b37eb02fa6ded7246872df30a951a35be22d21f
+  data.tar.gz: 5ddc3bb756fdf782da5074abb72bd0c7275c6a90f4ba98c81963b92cb9cd6bb9
 SHA512:
-  metadata.gz: 7716c4d8eebea928388accc998fb38f00ffedf9c5cd8585ef6e8540d2a524e5a139002d434b1a5644e3b656c394692438715b39e87d7e9682b05b948273a8213
-  data.tar.gz: 7259396f97e7e750c9b6f19092535deb3552e98a2d9af927f01a0bfef09352b0164ad9febf1de4572ca132ad82686d60f101c5b640a32013d88019395e0dd70a
+  metadata.gz: 44320ad96e29e29a6bb9b88d2de94822f982dad01e92bc639204c38d2bb7a306463b7b570ac8c35cbf13cc00a223a55442b52171ac64f3357de98a9662a5e3e9
+  data.tar.gz: 8e176982bec58892623685d2b3bfd02cde1ab22d9fcac2c6eb1bfe58f5ae27f02d28b708cced560b803379b36bcd2bea5463fce749bde4ebd9b169cbfff878ba

data/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.6.1
+
+### Fixed
+
+- **`before_action` now halts the request when it produces a response.** The docs said
+  a callback could halt by calling `error_response`, but `dispatch` ignored callback
+  output and ran the action anyway, so the action's response replaced the error. A
+  guard like `error_response('Forbidden', 403) unless admin?` let everyone through.
+  Now, once a callback calls a response helper (`error_response`, `success_response`,
+  `html_response`, `head`, `render`) or returns a response, the remaining callbacks, the
+  action and the `after_action`s are skipped and that response is returned
+  (Rails-style). Apps that worked around this with inline guards in each action keep
+  working; the inline checks are now redundant.
+
+## 0.6.0
+
+### Added
+
+- **Ruby 4.0.** New apps and environments now run on the `ruby4.0` Lambda runtime.
+  The generated `infrastructure/<env>/main.tf` sets `ruby_version = "4.0"` on the
+  conveyor-belt provider (one setting for runtime + gem build image), and both
+  generated `main.tf` files now pin conveyor-belt `~> 0.0.16`, the first release that
+  migrates already-deployed functions when `ruby_version` changes. Belt, activeitem,
+  lambda_loadout, belt-pay and belt-messaging all pass their suites on Ruby 4.0. CI now
+  tests 3.3, 3.4 and 4.0. Existing apps: see [UPGRADING.md](UPGRADING.md#ruby-34--40).
+
+### Fixed
+
+- **`belt deploy <env> --rebuild` builds gems for the runtime the function actually
+  runs.** It used to look for `ruby_version` in `terraform state show conveyor_belt.main`,
+  but that's a provider setting and never appears in resource state, so `--rebuild`
+  always compiled in `build-ruby3.4`. On a `ruby4.0` function that ships a
+  `vendor/bundle/ruby/3.4.0` bundle Ruby 4 can't load. Image selection is now: resource
+  `docker_build_image` → the live function's runtime → `ruby_version` in the env's
+  `main.tf` → `build-ruby3.4`.
+- Removed `runtime: ruby3.3` from the `config/lambda/*.yml` examples in the docs.
+  conveyor-belt ignores that key; the runtime comes from the provider's `ruby_version`.
+
 ## 0.5.3
 
 ### Fixed

data/lib/belt/authentication/controller.rb

@@ -88,9 +88,7 @@ module Belt
         false
       end
 
-      # before_action guard. Raises, because Belt discards before_action return values
-      # (see BeltController::Base#run_before_actions) — returning a response hash would
-      # let the action run anyway. Belt maps the error to 401.
+      # before_action guard. Raises NotAuthenticated, which Belt maps to 401.
       def authenticate_user!
         raise NotAuthenticated, 'Authentication required' unless user_signed_in?
       end

data/lib/belt/cli/deploy_command.rb

@@ -490,7 +490,7 @@ module Belt
         begin
           puts '  📦 Building Lambda package...'
           assemble_package(lambda_dir, build_dir)
-          build_gems(build_dir)
+          build_gems(build_dir, function_name)
           zip_file = create_zip(build_dir)
 
           puts '  🚀 Deploying to AWS...'
@@ -572,13 +572,13 @@ module Belt
         puts ''
       end
 
-      def build_gems(build_dir)
+      def build_gems(build_dir, function_name)
         puts '    🐳 Building gems in Docker (Lambda-compatible)...'
 
         uid = Process.uid
         gid = Process.gid
 
-        image = detect_docker_build_image
+        image = detect_docker_build_image(function_name)
 
         docker_cmd = [
           'docker', 'run', '--rm',
@@ -606,35 +606,58 @@ module Belt
         puts '    ✅ Gems installed'
       end
 
-      # Reads docker_build_image from the conveyor_belt Terraform resource state.
-      # Falls back to DEFAULT_DOCKER_BUILD_IMAGE if state is unavailable or attribute not set.
-      def detect_docker_build_image
+      # Picks the image gems are compiled in. Native extensions and the
+      # vendor/bundle/ruby/<abi> path must match the function's runtime, so:
+      #   1. docker_build_image on the conveyor_belt resource (fully custom)
+      #   2. the live function's runtime (ruby4.0 → build-ruby4.0)
+      #   3. ruby_version in the env's conveyor-belt provider block
+      #   4. DEFAULT_DOCKER_BUILD_IMAGE
+      def detect_docker_build_image(function_name)
         env_dir = File.join(@infra_dir, @env)
-        return DEFAULT_DOCKER_BUILD_IMAGE unless Dir.exist?(File.join(env_dir, '.terraform'))
+
+        image = docker_build_image_from_state(env_dir)
+        if image
+          puts "    📦 Using custom build image: #{image}"
+          return image
+        end
+
+        version = ruby_version_from_lambda(function_name) || ruby_version_from_provider(env_dir)
+        return DEFAULT_DOCKER_BUILD_IMAGE unless version
+
+        image = "public.ecr.aws/sam/build-ruby#{version}:latest-x86_64"
+        puts "    📦 Using build image for Ruby #{version}: #{image}"
+        image
+      end
+
+      def docker_build_image_from_state(env_dir)
+        return nil unless Dir.exist?(File.join(env_dir, '.terraform'))
 
         Dir.chdir(env_dir) do
           output, status = Open3.capture2('terraform', 'state', 'show', 'conveyor_belt.main')
-          if status.success?
-            # Prefer explicit docker_build_image if set
-            image_match = output.match(/docker_build_image\s*=\s*"([^"]+)"/)
-            if image_match
-              image = image_match[1]
-              puts "    📦 Using custom build image: #{image}"
-              return image
-            end
+          return nil unless status.success?
 
-            # Otherwise derive from ruby_version
-            version_match = output.match(/ruby_version\s*=\s*"([^"]+)"/)
-            if version_match
-              version = version_match[1]
-              image = "public.ecr.aws/sam/build-ruby#{version}:latest-x86_64"
-              puts "    📦 Using build image for Ruby #{version}: #{image}"
-              return image
-            end
-          end
+          output[/docker_build_image\s*=\s*"([^"]+)"/, 1]
         end
+      end
+
+      # "ruby4.0" → "4.0"
+      def ruby_version_from_lambda(function_name)
+        output, status = Open3.capture2(
+          'aws', 'lambda', 'get-function-configuration',
+          '--function-name', function_name,
+          '--query', 'Runtime',
+          '--output', 'text'
+        )
+        return nil unless status.success?
+
+        output.strip[/\Aruby(\d+\.\d+)\z/, 1]
+      end
+
+      def ruby_version_from_provider(env_dir)
+        main_tf = File.join(env_dir, 'main.tf')
+        return nil unless File.exist?(main_tf)
 
-        DEFAULT_DOCKER_BUILD_IMAGE
+        File.read(main_tf)[/^\s*ruby_version\s*=\s*"([^"]+)"/, 1]
       end
 
       def strip_vendor_fat(build_dir)

data/lib/belt/cli/environment_command.rb

@@ -4,6 +4,7 @@ require 'fileutils'
 require 'erb'
 require_relative 'app_detection'
 require_relative 'environment_config'
+require_relative '../version'
 require_relative 'frontend_registry'
 require_relative 'frontend_setup_command'
 

data/lib/belt/cli/new_command.rb

@@ -5,6 +5,7 @@ require 'erb'
 require 'json'
 require 'open3'
 require_relative 'setup_command'
+require_relative '../version'
 
 module Belt
   module CLI

data/lib/belt/docs/authentication.md

@@ -71,8 +71,8 @@ end
 ```
 
 `authenticate_user!` raises `Belt::Authentication::NotAuthenticated`, which Belt already
-maps to **401**. It has to raise: `before_action` cannot halt the chain by returning a
-response — return values are discarded and the action runs anyway.
+maps to **401**. (Your own guards can also halt by calling a response helper, e.g.
+`error_response('Forbidden', 403) unless admin?`.)
 
 | Method | |
 |---|---|

data/lib/belt/docs/controllers.md

@@ -96,8 +96,19 @@ class ApplicationController < BeltController::Base
 end
 ```
 
-Callbacks run in definition order. `before_action` can halt the request by
-calling a response helper (e.g., `error_response`).
+Callbacks run in definition order. A `before_action` halts the request by
+calling a response helper (`error_response`, `success_response`, `head`,
+`render`, …). The remaining callbacks, the action and the `after_action`s are
+skipped, and that response is returned:
+
+```ruby
+def require_admin!
+  error_response('Forbidden', 403) unless admin?
+end
+```
+
+Raising works too: the exception goes through `rescue_from` as usual (e.g.
+`Belt::AuthenticationError` → 401).
 
 ## Strong Parameters
 

data/lib/belt/docs/deployment.md

@@ -67,13 +67,26 @@ The Lambda entry point is specified in `config/lambda/<name>.yml`:
 
 ```yaml
 handler: lambda/<name>.lambda_handler
-runtime: ruby3.3
 timeout: 30
 memory: 256
 environment:
   ENVIRONMENT: ${var.environment}
 ```
 
+The Ruby version is set once per environment, on the conveyor-belt provider in
+`infrastructure/<env>/main.tf` — it drives both the Lambda runtime and the image
+gems are compiled in:
+
+```hcl
+provider "conveyor-belt" {
+  environment  = var.environment
+  aws_region   = var.aws_region
+  ruby_version = "4.0" # → runtime ruby4.0, build image build-ruby4.0
+}
+```
+
+See [UPGRADING.md](../../../UPGRADING.md#ruby-34--40) to move an existing app.
+
 ## Route Manifests
 
 Before deploying, generate the route manifest used at runtime:

data/lib/belt/docs/lambda_handler.md

@@ -67,7 +67,6 @@ Configure via `config/lambda/<name>.yml`:
 
 ```yaml
 handler: lambda/api.lambda_handler
-runtime: ruby3.3
 timeout: 30
 memory: 256
 layers:

data/lib/belt/version.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.5.3'
+  VERSION = '0.6.1'
+
+  # Ruby version new apps run on in Lambda. Rendered into the conveyor-belt
+  # provider block (`ruby_version`) by `belt new` / `belt generate environment`.
+  LAMBDA_RUBY_VERSION = '4.0'
 end

data/lib/belt_controller/base.rb

@@ -9,12 +9,15 @@ require_relative '../belt/helpers/error_logging'
 require_relative '../belt/helpers/cors_origin'
 require_relative '../belt/rendering'
 require_relative 'implicit_response'
+require_relative 'callback_halting'
 
 module BeltController
   class Base
     include Belt::Helpers::Response
     include Belt::Rendering
     include ImplicitResponse
+    # Must come after Belt::Helpers::Response / Belt::Rendering (wraps their helpers).
+    include CallbackHalting
     # Cognito identity: current_user, authenticate_user!, cognito_admin?.
     # Inert unless the app declares `cognito_authenticatable` on a model.
     include Belt::Authentication::Controller
@@ -139,7 +142,11 @@ module BeltController
         raise Belt::ActionNotFound, "The action '#{action_sym}' could not be found for #{self.class.name}"
       end
 
-      run_before_actions(action_sym)
+      # A before_action that produced a response halts the request (Rails-style):
+      # the action and after_actions don't run.
+      halted = run_before_actions(action_sym)
+      return halted if halted
+
       # Snapshot ivars so we only auto-serialize assigns set by the action (Rails-style)
       @__assigns_before = instance_variables
       result = send(action_sym)
@@ -178,14 +185,17 @@ module BeltController
 
     private
 
+    # Returns the halting response if a callback produced one, else nil.
     def run_before_actions(action_sym)
       self.class.all_before_actions.each do |callback|
         next if callback[:only] && !callback[:only].include?(action_sym)
         next if callback[:except]&.include?(action_sym)
         next if should_skip_callback?(callback[:method], action_sym)
 
-        send(callback[:method])
+        response = run_halting_callback(callback[:method])
+        return response if response
       end
+      nil
     end
 
     def run_after_actions(action_sym)

data/lib/belt_controller/callback_halting.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module BeltController
+  # Rails-style halting for before_action callbacks.
+  #
+  # A before_action halts the request by producing a response. Either form works:
+  #
+  #   def require_admin!
+  #     error_response('Forbidden', 403) unless admin?
+  #   end
+  #
+  #   def require_admin!
+  #     return if admin?
+  #
+  #     error_response('Forbidden', 403)
+  #     Belt::Observability::Logger.warn('non-admin hit admin route')
+  #   end
+  #
+  # Once a callback halts, the remaining callbacks, the action and the
+  # after_actions are skipped, and that response is returned.
+  #
+  # Belt's response helpers are pure (they build and return a hash), so we
+  # record any response built while a callback is running. That catches the
+  # second form, where the response isn't the callback's return value.
+  # Included by BeltController::Base after the response helpers so these
+  # wrappers sit in front of them in the ancestor chain.
+  module CallbackHalting
+    # render builds its response via html_response, so it's covered too.
+    %i[success_response error_response html_response head].each do |helper|
+      define_method(helper) do |*args|
+        response = super(*args)
+        @__callback_response = response if @__running_callback
+        response
+      end
+    end
+
+    private
+
+    # Run one before_action. Returns the response it produced (halt), or nil.
+    # A returned response wins over one that was only built along the way.
+    def run_halting_callback(method_name)
+      @__callback_response = nil
+      @__running_callback = true
+      result = send(method_name)
+      lambda_response?(result) ? result : @__callback_response
+    ensure
+      @__running_callback = false
+    end
+  end
+end

data/lib/templates/environment/main.tf.erb

@@ -10,7 +10,7 @@ terraform {
     }
     conveyor-belt = {
       source  = "stowzilla/conveyor-belt"
-      version = "~> 0.0.1"
+      version = "~> 0.0.16"
     }
   }
 }
@@ -30,6 +30,10 @@ provider "aws" {
 provider "conveyor-belt" {
   environment = var.environment
   aws_region  = var.aws_region
+
+  # Lambda runtime (ruby<version>) and the Docker image gems are compiled in.
+  # Changing it on a deployed environment migrates every function on the next apply.
+  ruby_version = "<%= Belt::LAMBDA_RUBY_VERSION %>"
 }
 
 module "app" {

data/lib/templates/module/main.tf.erb

@@ -13,7 +13,7 @@ terraform {
     }
     conveyor-belt = {
       source  = "stowzilla/conveyor-belt"
-      version = "~> 0.0.2"
+      version = "~> 0.0.16"
     }
   }
 }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.5.3
+  version: 0.6.1
 platform: ruby
 authors:
 - Stowzilla
@@ -192,6 +192,7 @@ files:
 - lib/belt/version.rb
 - lib/belt/views/welcome/show.html.erb
 - lib/belt_controller/base.rb
+- lib/belt_controller/callback_halting.rb
 - lib/belt_controller/implicit_response.rb
 - lib/templates/dns/backend.tf.erb
 - lib/templates/dns/belt.rb.erb