belt 0.6.0 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62b1b84b58bb017a4a127a871136dfc32b02217314bf5fc5f2b1baceb599063b
-  data.tar.gz: 2bd29c90f7380f4efa4014cc079fefacef86ed9407b19f71fb06fc0ead217bff
+  metadata.gz: 05d5db875d229ad413bf8af05004a92961776b347db0884ded768f35fcfe245e
+  data.tar.gz: d6f1590f52f2a04b9457b82cf0c0cad094b96b8e04e112672df37d1e5ccf173b
 SHA512:
-  metadata.gz: be2982d7fc1cc0bbac0a61369029801e2c95ccbb3539ca2effaa649f506cbda151d0e1b4f55284534a30d13331e36c7c215236eef5f5417c288bf282757d0afb
-  data.tar.gz: ab198a8c848feb617046b1dbe73d5887252253617da7420ecd5935a56925bd18473430dbf2f54b5f9302e7c9bee777f21416b19ea28ac37d8bdc377aa6730222
+  metadata.gz: 5b9c29157f8d7b698c8f68c807564299f881b220473ef4a51194352092f5a8967dfce0495fb12bc24a813b4ab2e077358c3800151ccf8737059888560a62ad97
+  data.tar.gz: 6629a4a02a92e571d1e835ba0f12894f8bad945eb89bf79a2bc4696538378f45dfd7b5f5e3fc4090d9e61120c51d032b2fab5d5e2bdc17cfdfe81d25950061db

data/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.6.2
+
+### Fixed
+
+- **First deploy of a new env with a `domain` no longer fails at plan.** The generated
+  module keyed `aws_route53_record.cert_validation` by the ACM validation CNAME name,
+  which is unknown until the cert exists, so `belt plan`/`belt deploy` on a brand-new
+  standalone env failed with `Invalid for_each argument` and needed a `-target` apply
+  of the cert first. The record is now `aws_route53_record.acm_validation`, keyed by
+  the env's domain (known at plan). A `removed` block forgets old `cert_validation`
+  instances without deleting the live CNAME. The module now needs Terraform >= 1.7.
+  Existing apps: see [UPGRADING.md](UPGRADING.md#acm-validation-record-062).
+
+## 0.6.1
+
+### Fixed
+
+- **`before_action` now halts the request when it produces a response.** The docs said
+  a callback could halt by calling `error_response`, but `dispatch` ignored callback
+  output and ran the action anyway, so the action's response replaced the error. A
+  guard like `error_response('Forbidden', 403) unless admin?` let everyone through.
+  Now, once a callback calls a response helper (`error_response`, `success_response`,
+  `html_response`, `head`, `render`) or returns a response, the remaining callbacks, the
+  action and the `after_action`s are skipped and that response is returned
+  (Rails-style). Apps that worked around this with inline guards in each action keep
+  working; the inline checks are now redundant.
+
 ## 0.6.0
 
 ### Added

data/lib/belt/authentication/controller.rb

@@ -88,9 +88,7 @@ module Belt
         false
       end
 
-      # before_action guard. Raises, because Belt discards before_action return values
-      # (see BeltController::Base#run_before_actions) — returning a response hash would
-      # let the action run anyway. Belt maps the error to 401.
+      # before_action guard. Raises NotAuthenticated, which Belt maps to 401.
       def authenticate_user!
         raise NotAuthenticated, 'Authentication required' unless user_signed_in?
       end

data/lib/belt/docs/authentication.md

@@ -71,8 +71,8 @@ end
 ```
 
 `authenticate_user!` raises `Belt::Authentication::NotAuthenticated`, which Belt already
-maps to **401**. It has to raise: `before_action` cannot halt the chain by returning a
-response — return values are discarded and the action runs anyway.
+maps to **401**. (Your own guards can also halt by calling a response helper, e.g.
+`error_response('Forbidden', 403) unless admin?`.)
 
 | Method | |
 |---|---|

data/lib/belt/docs/controllers.md

@@ -96,8 +96,19 @@ class ApplicationController < BeltController::Base
 end
 ```
 
-Callbacks run in definition order. `before_action` can halt the request by
-calling a response helper (e.g., `error_response`).
+Callbacks run in definition order. A `before_action` halts the request by
+calling a response helper (`error_response`, `success_response`, `head`,
+`render`, …). The remaining callbacks, the action and the `after_action`s are
+skipped, and that response is returned:
+
+```ruby
+def require_admin!
+  error_response('Forbidden', 403) unless admin?
+end
+```
+
+Raising works too: the exception goes through `rescue_from` as usual (e.g.
+`Belt::AuthenticationError` → 401).
 
 ## Strong Parameters
 

data/lib/belt/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.6.0'
+  VERSION = '0.6.2'
 
   # Ruby version new apps run on in Lambda. Rendered into the conveyor-belt
   # provider block (`ruby_version`) by `belt new` / `belt generate environment`.

data/lib/belt_controller/base.rb

@@ -9,12 +9,15 @@ require_relative '../belt/helpers/error_logging'
 require_relative '../belt/helpers/cors_origin'
 require_relative '../belt/rendering'
 require_relative 'implicit_response'
+require_relative 'callback_halting'
 
 module BeltController
   class Base
     include Belt::Helpers::Response
     include Belt::Rendering
     include ImplicitResponse
+    # Must come after Belt::Helpers::Response / Belt::Rendering (wraps their helpers).
+    include CallbackHalting
     # Cognito identity: current_user, authenticate_user!, cognito_admin?.
     # Inert unless the app declares `cognito_authenticatable` on a model.
     include Belt::Authentication::Controller
@@ -139,7 +142,11 @@ module BeltController
         raise Belt::ActionNotFound, "The action '#{action_sym}' could not be found for #{self.class.name}"
       end
 
-      run_before_actions(action_sym)
+      # A before_action that produced a response halts the request (Rails-style):
+      # the action and after_actions don't run.
+      halted = run_before_actions(action_sym)
+      return halted if halted
+
       # Snapshot ivars so we only auto-serialize assigns set by the action (Rails-style)
       @__assigns_before = instance_variables
       result = send(action_sym)
@@ -178,14 +185,17 @@ module BeltController
 
     private
 
+    # Returns the halting response if a callback produced one, else nil.
     def run_before_actions(action_sym)
       self.class.all_before_actions.each do |callback|
         next if callback[:only] && !callback[:only].include?(action_sym)
         next if callback[:except]&.include?(action_sym)
         next if should_skip_callback?(callback[:method], action_sym)
 
-        send(callback[:method])
+        response = run_halting_callback(callback[:method])
+        return response if response
       end
+      nil
     end
 
     def run_after_actions(action_sym)

data/lib/belt_controller/callback_halting.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module BeltController
+  # Rails-style halting for before_action callbacks.
+  #
+  # A before_action halts the request by producing a response. Either form works:
+  #
+  #   def require_admin!
+  #     error_response('Forbidden', 403) unless admin?
+  #   end
+  #
+  #   def require_admin!
+  #     return if admin?
+  #
+  #     error_response('Forbidden', 403)
+  #     Belt::Observability::Logger.warn('non-admin hit admin route')
+  #   end
+  #
+  # Once a callback halts, the remaining callbacks, the action and the
+  # after_actions are skipped, and that response is returned.
+  #
+  # Belt's response helpers are pure (they build and return a hash), so we
+  # record any response built while a callback is running. That catches the
+  # second form, where the response isn't the callback's return value.
+  # Included by BeltController::Base after the response helpers so these
+  # wrappers sit in front of them in the ancestor chain.
+  module CallbackHalting
+    # render builds its response via html_response, so it's covered too.
+    %i[success_response error_response html_response head].each do |helper|
+      define_method(helper) do |*args|
+        response = super(*args)
+        @__callback_response = response if @__running_callback
+        response
+      end
+    end
+
+    private
+
+    # Run one before_action. Returns the response it produced (halt), or nil.
+    # A returned response wins over one that was only built along the way.
+    def run_halting_callback(method_name)
+      @__callback_response = nil
+      @__running_callback = true
+      result = send(method_name)
+      lambda_response?(result) ? result : @__callback_response
+    ensure
+      @__running_callback = false
+    end
+  end
+end

data/lib/templates/module/dns.tf.erb

@@ -62,33 +62,45 @@ resource "aws_acm_certificate" "app" {
   }
 }
 
-# DNS validation record for the certificate
-# Key by resource_record_name (not domain_name) because ACM uses the same
-# validation CNAME for both base domain and wildcard — keying by domain_name
-# creates duplicate records that Route 53 rejects.
-# Use ellipsis (...) to group duplicates, then take the first element since
-# they're identical anyway.
-resource "aws_route53_record" "cert_validation" {
-  for_each = local.dns_enabled && !local.is_nested ? {
-    for dvo in aws_acm_certificate.app[0].domain_validation_options : dvo.resource_record_name => {
-      name   = dvo.resource_record_name
-      type   = dvo.resource_record_type
-      record = dvo.resource_record_value
-    }...
-  } : {}
+# DNS validation record for the certificate.
+# ACM issues one identical validation CNAME for both the base domain and the
+# wildcard, so one record covers the cert. Key it by app_domain (known at plan)
+# rather than by anything from domain_validation_options: those values are
+# unknown until the cert exists, and for_each over them fails the first plan
+# of a new env with "Invalid for_each argument".
+resource "aws_route53_record" "acm_validation" {
+  for_each = local.dns_enabled && !local.is_nested ? toset([local.app_domain]) : toset([])
 
   zone_id         = aws_route53_zone.app[0].zone_id
-  name            = each.value[0].name
-  type            = each.value[0].type
+  name            = local.acm_validation_options[each.key].resource_record_name
+  type            = local.acm_validation_options[each.key].resource_record_type
   ttl             = 300
-  records         = [each.value[0].record]
+  records         = [local.acm_validation_options[each.key].resource_record_value]
   allow_overwrite = true
 }
 
+locals {
+  acm_validation_options = local.dns_enabled && !local.is_nested ? {
+    for dvo in aws_acm_certificate.app[0].domain_validation_options : dvo.domain_name => dvo
+  } : {}
+}
+
+# Older Belt modules created this record as cert_validation, keyed by the
+# validation CNAME name. Forget those instances without deleting them:
+# acm_validation upserts the same CNAME (allow_overwrite), and a delete would
+# pull the record ACM needs for renewal. No-op for envs that never had it.
+removed {
+  from = aws_route53_record.cert_validation
+
+  lifecycle {
+    destroy = false
+  }
+}
+
 resource "aws_acm_certificate_validation" "app" {
   count                   = local.dns_enabled && !local.is_nested ? 1 : 0
   certificate_arn         = aws_acm_certificate.app[0].arn
-  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
+  validation_record_fqdns = [for record in aws_route53_record.acm_validation : record.fqdn]
 }
 
 # =============================================================================

data/lib/templates/module/main.tf.erb

@@ -2,6 +2,9 @@
 # Environments call this module with different variables.
 
 terraform {
+  # >= 1.7 for the removed block in dns.tf
+  required_version = ">= 1.7"
+
   required_providers {
     aws = {
       source  = "hashicorp/aws"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.2
 platform: ruby
 authors:
 - Stowzilla
@@ -192,6 +192,7 @@ files:
 - lib/belt/version.rb
 - lib/belt/views/welcome/show.html.erb
 - lib/belt_controller/base.rb
+- lib/belt_controller/callback_halting.rb
 - lib/belt_controller/implicit_response.rb
 - lib/templates/dns/backend.tf.erb
 - lib/templates/dns/belt.rb.erb