belt 0.2.17 → 0.2.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e1813b72986b167b9449f438b18331cc2e9be46cffa58bd059c403f3c35703e
-  data.tar.gz: 26c3aae3c049bbebff471d6a8a514114a26f8b2d0fdf4671cb154ae9a056798f
+  metadata.gz: b5e83d99ec1a6a02931418e3ade22cb51b291028884529e25abbd74f7c23a41f
+  data.tar.gz: 938cc1a121a468de4dcb838c04fa44b7a01b78e5165a5da5f805cb330c88d59d
 SHA512:
-  metadata.gz: 23bbf9977c0cd765c7a1630e7a74ed480db6d62ee07c22e95e6a491a3a9c04d824b8463b0ef63ae4c4b343e13e96ff26c9edb5c86c8005fce7f0a167b6894c64
-  data.tar.gz: e7f625fe93dcb125289530e2a3bdb9dee8c37938eeea41bc9154a31aca6b47675a6336e39c986f3a801719f4cf22052bad40968ff6e1b9a82936140f74432f4a
+  metadata.gz: d581ff695fda0a3288f809d0c52805091dd9de73a69af5b21f4675a0f65f3d04431f72e18db3f099f6299a3a9f5b0045323218a60a54982d58312021c9bcedbd
+  data.tar.gz: 59927af373dde4560edbaede9b9d8f81f43b229804479d0ff874ea67193b1a97bcf67e51afc388f66b3359fc7105df1ac0b2aef61a166d29fbcd43d509881004

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.2.18
+
+### New generator: `belt generate auth`
+
+Scaffolds Cognito user pool infrastructure for authentication. Creates the user pool, client, and wires `cognito_user_pool_arns` into the conveyor-belt resource automatically.
+
+```bash
+belt g auth                    # Single pool: "main"
+belt g auth web mobile         # Multiple pools (e.g., web + mobile clients)
+belt g auth web android ios    # Three pools
+belt destroy auth              # Remove generated files
+```
+
+What it generates:
+- `infrastructure/modules/app/cognito.tf` — User pool + client with sensible defaults (password policy, email verification, deletion protection in prod)
+- `infrastructure/modules/app/cognito_outputs.tf` — Pool ID, ARN, and client ID outputs
+- Patches `main.tf` to pass `cognito_user_pool_arns` to the conveyor-belt resource
+
+Multiple pools are supported out of the box — each gets a suffixed name (e.g., `myapp-prod-web`, `myapp-prod-mobile`) and its own set of outputs.
+
 ## 0.2.12
 
 ### Rename: `routes.tf.rb` → `routes.rb`, `schema.tf.rb` → `contracts.rb`

data/lib/belt/cli/auth_command.rb

@@ -0,0 +1,244 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'erb'
+require_relative 'app_detection'
+
+module Belt
+  module CLI
+    class AuthCommand
+      TEMPLATE_DIR = File.expand_path('../../templates/generate/auth', __dir__)
+      MODULE_DIR = 'infrastructure/modules/app'
+
+      include AppDetection
+
+      def self.run(args)
+        if args.include?('--help') || args.include?('-h')
+          print_help
+          exit 0
+        end
+
+        force = args.delete('--force') || args.delete('-f')
+        pools = parse_pools(args)
+
+        new(pools: pools, force: force).generate
+      end
+
+      def self.destroy(_args)
+        new(pools: [], force: false).remove
+      end
+
+      def self.print_help
+        puts <<~HELP
+          Generate Cognito user pool infrastructure for authentication.
+
+          Usage: belt generate auth [pool_names...] [options]
+
+          Options:
+            --force, -f     Overwrite existing cognito.tf (skip collision check)
+
+          Arguments:
+            pool_names      Optional pool names for multiple user pools.
+                            If omitted, generates a single pool named "main".
+
+          Examples:
+            belt g auth                        # Single pool: "main"
+            belt g auth web                    # Single pool: "web"
+            belt g auth web mobile             # Two pools: "web" and "mobile"
+            belt g auth web android ios        # Three pools: "web", "android", "ios"
+            belt g auth --force                # Overwrite existing
+
+          What this generates:
+            infrastructure/modules/app/cognito.tf          User pool + client resources
+            infrastructure/modules/app/cognito_outputs.tf  Pool ID, ARN, and client ID outputs
+
+          It also patches:
+            infrastructure/modules/app/main.tf             Adds cognito_user_pool_arns to conveyor_belt
+
+          After running:
+            1. Review the generated Cognito config in cognito.tf
+            2. Customize password policy, MFA, triggers as needed
+            3. Run `belt apply <env>` to deploy
+
+          To remove:
+            belt destroy auth
+        HELP
+      end
+
+      # Parse pool names from args. Default to ["main"] if none provided.
+      def self.parse_pools(args)
+        names = args.reject { |a| a.start_with?('-') }
+        names = ['main'] if names.empty?
+        names.map(&:downcase).map { |n| n.gsub(/[^a-z0-9_]/, '_') }
+      end
+
+      def initialize(pools:, force: false)
+        @pool_names = pools
+        @force = force
+        @app_name = detect_app_name
+        @pools = build_pool_metadata
+      end
+
+      def generate
+        check_collision! unless @force
+        ensure_module_dir!
+
+        write_cognito_tf
+        write_cognito_outputs_tf
+        patch_main_tf
+
+        puts "\n✓ Auth generated!"
+        puts "\nNext steps:"
+        puts '  1. Review infrastructure/modules/app/cognito.tf'
+        puts '  2. Customize password policy, MFA, or Lambda triggers as needed'
+        puts '  3. Run `belt apply <env>` to deploy'
+      end
+
+      def remove
+        removed = []
+
+        cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
+        cognito_outputs_tf = File.join(MODULE_DIR, 'cognito_outputs.tf')
+
+        if File.exist?(cognito_tf)
+          FileUtils.rm(cognito_tf)
+          removed << cognito_tf
+          puts "  remove  #{cognito_tf}"
+        end
+
+        if File.exist?(cognito_outputs_tf)
+          FileUtils.rm(cognito_outputs_tf)
+          removed << cognito_outputs_tf
+          puts "  remove  #{cognito_outputs_tf}"
+        end
+
+        unpatch_main_tf
+        removed << File.join(MODULE_DIR, 'main.tf') if @main_tf_patched
+
+        if removed.empty?
+          puts '  Nothing to remove — auth was not generated.'
+        else
+          puts "\n✓ Auth destroyed!"
+        end
+      end
+
+      private
+
+      def build_pool_metadata
+        if @pool_names.length == 1 && @pool_names.first == 'main'
+          [{ name: 'main', suffix: '', label: '' }]
+        else
+          @pool_names.map do |name|
+            { name: name, suffix: "-#{name}", label: " (#{name})" }
+          end
+        end
+      end
+
+      def check_collision!
+        cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
+        return unless File.exist?(cognito_tf)
+
+        puts "\n✗ Auth already exists at #{cognito_tf}"
+        puts "\nTo overwrite, run again with --force:"
+        puts "  belt g auth #{@pool_names.join(' ')} --force"
+        exit 1
+      end
+
+      def ensure_module_dir!
+        FileUtils.mkdir_p(MODULE_DIR)
+      end
+
+      def write_cognito_tf
+        dest = File.join(MODULE_DIR, 'cognito.tf')
+        write_template('cognito.tf.erb', dest)
+        puts "  create  #{dest}"
+      end
+
+      def write_cognito_outputs_tf
+        dest = File.join(MODULE_DIR, 'cognito_outputs.tf')
+        write_template('cognito_outputs.tf.erb', dest)
+        puts "  create  #{dest}"
+      end
+
+      def patch_main_tf
+        main_tf = File.join(MODULE_DIR, 'main.tf')
+        return unless File.exist?(main_tf)
+
+        content = File.read(main_tf)
+
+        if content.include?('cognito_user_pool_arns')
+          puts "  skip    #{main_tf} (cognito_user_pool_arns already present)"
+          return
+        end
+
+        return unless content.match?(/^resource "conveyor_belt"/)
+
+        arns = @pools.map { |p| "aws_cognito_user_pool.#{p[:name]}.arn" }
+        arn_value = build_arn_value(arns)
+
+        insert_cognito_into_resource(content, main_tf, arn_value)
+      end
+
+      def build_arn_value(arns)
+        if arns.length == 1
+          "[#{arns.first}]"
+        else
+          "[\n    #{arns.join(",\n    ")}\n  ]"
+        end
+      end
+
+      def insert_cognito_into_resource(content, main_tf, arn_value)
+        lines = content.lines
+        brace_depth = 0
+        insert_index = nil
+        in_resource = false
+
+        lines.each_with_index do |line, idx|
+          if line.match?(/^resource "conveyor_belt"/)
+            in_resource = true
+            brace_depth = 0
+          end
+
+          next unless in_resource
+
+          brace_depth += line.count('{') - line.count('}')
+
+          next unless brace_depth <= 0
+
+          insert_index = idx
+          break
+        end
+
+        return unless insert_index
+
+        cognito_line = "\n  cognito_user_pool_arns = #{arn_value}\n"
+        lines.insert(insert_index, cognito_line)
+        File.write(main_tf, lines.join)
+        puts "  update  #{main_tf} (added cognito_user_pool_arns)"
+      end
+
+      def unpatch_main_tf
+        main_tf = File.join(MODULE_DIR, 'main.tf')
+        @main_tf_patched = false
+        return unless File.exist?(main_tf)
+
+        content = File.read(main_tf)
+        return unless content.include?('cognito_user_pool_arns')
+
+        # Remove the cognito_user_pool_arns line(s) — could be single or multi-line
+        updated = content.gsub(/\n\s*cognito_user_pool_arns\s*=\s*\[[^\]]*\]\n/, "\n")
+        return if updated == content
+
+        File.write(main_tf, updated)
+        puts "  update  #{main_tf} (removed cognito_user_pool_arns)"
+        @main_tf_patched = true
+      end
+
+      def write_template(template_name, dest_path)
+        template_path = File.join(TEMPLATE_DIR, template_name)
+        content = ERB.new(File.read(template_path), trim_mode: '-').result(binding)
+        File.write(dest_path, content)
+      end
+    end
+  end
+end

data/lib/belt/cli/destroy_command.rb

@@ -2,6 +2,7 @@
 
 require 'fileutils'
 require_relative 'app_detection'
+require_relative 'auth_command'
 require_relative 'generator_registry'
 require_relative 'tables_command'
 require_relative '../inflector'
@@ -9,7 +10,7 @@ require_relative '../inflector'
 module Belt
   module CLI
     class DestroyCommand
-      GENERATORS = %w[scaffold resource model controller environment frontend views].freeze
+      GENERATORS = %w[scaffold resource model controller environment frontend views auth].freeze
 
       include AppDetection
 
@@ -51,6 +52,8 @@ module Belt
           new(generator, name, [], **flags).destroy
         when 'frontend'
           new(generator, nil, []).destroy
+        when 'auth'
+          Belt::CLI::AuthCommand.destroy(args)
         when 'views'
           name = args.shift
           if name.nil? || name.empty?
@@ -98,6 +101,7 @@ module Belt
             resource      Alias for scaffold
             model         Remove an ActiveItem model
             controller    Remove a controller
+            auth          Remove Cognito user pool infrastructure
             environment   Remove a deployment environment and tear down infrastructure
             frontend      Remove the frontend/ directory
             views         Remove React pages for a resource

data/lib/belt/cli/generate_command.rb

@@ -3,6 +3,7 @@
 require 'fileutils'
 require 'erb'
 require_relative 'app_detection'
+require_relative 'auth_command'
 require_relative 'environment_command'
 require_relative 'frontend_command'
 require_relative 'tables_command'
@@ -14,7 +15,7 @@ module Belt
   module CLI
     class GenerateCommand
       TEMPLATE_DIR = File.expand_path('../../templates/generate', __dir__)
-      GENERATORS = %w[scaffold resource model controller environment frontend views].freeze
+      GENERATORS = %w[scaffold resource model controller environment frontend views auth].freeze
 
       include AppDetection
 
@@ -126,6 +127,8 @@ module Belt
 
         return Belt::CLI::ViewsCommand.run(args) if generator == 'views'
 
+        return Belt::CLI::AuthCommand.run(args) if generator == 'auth'
+
         name = args.shift
         if name.nil? || name.empty?
           print_generator_help(generator)
@@ -192,6 +195,7 @@ module Belt
             scaffold      Generate model, controller, routes, schema, and views (full REST resource)
             model         Generate an ActiveItem model
             controller    Generate a controller
+            auth          Generate Cognito user pool infrastructure
             environment   Create a new deployment environment
             frontend      Scaffold a frontend app (react, vue, svelte)
             views         Generate React pages for a resource

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.17'
+  VERSION = '0.2.18'
 end

data/lib/templates/generate/auth/cognito.tf.erb

@@ -0,0 +1,62 @@
+# Cognito User Pool — authentication for <%= @app_name %>
+# Generated by: belt generate auth
+
+<% @pools.each do |pool| -%>
+resource "aws_cognito_user_pool" "<%= pool[:name] %>" {
+  name = "${var.app_name}-${var.environment}<%= pool[:suffix] %>"
+
+  password_policy {
+    minimum_length    = 8
+    require_lowercase = true
+    require_numbers   = true
+    require_symbols   = false
+    require_uppercase = true
+  }
+
+  auto_verified_attributes = ["email"]
+
+  account_recovery_setting {
+    recovery_mechanism {
+      name     = "verified_email"
+      priority = 1
+    }
+  }
+
+  schema {
+    name                = "email"
+    attribute_data_type = "String"
+    required            = true
+    mutable             = true
+
+    string_attribute_constraints {
+      min_length = 1
+      max_length = 256
+    }
+  }
+
+  deletion_protection = var.environment == "prod" ? "ACTIVE" : "INACTIVE"
+}
+
+resource "aws_cognito_user_pool_client" "<%= pool[:name] %>" {
+  name         = "${var.app_name}-${var.environment}<%= pool[:suffix] %>-client"
+  user_pool_id = aws_cognito_user_pool.<%= pool[:name] %>.id
+
+  explicit_auth_flows = [
+    "ALLOW_USER_SRP_AUTH",
+    "ALLOW_REFRESH_TOKEN_AUTH"
+  ]
+
+  prevent_user_existence_errors = "ENABLED"
+
+  token_validity_units {
+    access_token  = "hours"
+    id_token      = "hours"
+    refresh_token = "days"
+  }
+
+  access_token_validity  = 1
+  id_token_validity      = 1
+  refresh_token_validity = 30
+}
+
+<% end -%>

data/lib/templates/generate/auth/cognito_outputs.tf.erb

@@ -0,0 +1,19 @@
+# Cognito outputs — generated by: belt generate auth
+
+<% @pools.each do |pool| -%>
+output "cognito_user_pool_id<%= pool[:suffix] %>" {
+  description = "Cognito User Pool ID<%= pool[:label] %>"
+  value       = aws_cognito_user_pool.<%= pool[:name] %>.id
+}
+
+output "cognito_user_pool_arn<%= pool[:suffix] %>" {
+  description = "Cognito User Pool ARN<%= pool[:label] %>"
+  value       = aws_cognito_user_pool.<%= pool[:name] %>.arn
+}
+
+output "cognito_client_id<%= pool[:suffix] %>" {
+  description = "Cognito User Pool Client ID<%= pool[:label] %>"
+  value       = aws_cognito_user_pool_client.<%= pool[:name] %>.id
+}
+
+<% end -%>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.2.17
+  version: 0.2.18
 platform: ruby
 authors:
 - Stowzilla
@@ -76,6 +76,7 @@ files:
 - lib/belt/assets/welcome.css
 - lib/belt/cli.rb
 - lib/belt/cli/app_detection.rb
+- lib/belt/cli/auth_command.rb
 - lib/belt/cli/backup_config.rb
 - lib/belt/cli/backup_runner.rb
 - lib/belt/cli/bucket_security.rb
@@ -141,6 +142,8 @@ files:
 - lib/templates/frontend/react/src/pages/Home.jsx.erb
 - lib/templates/frontend/react/vite.config.js
 - lib/templates/frontend_infra/frontend.tf.erb
+- lib/templates/generate/auth/cognito.tf.erb
+- lib/templates/generate/auth/cognito_outputs.tf.erb
 - lib/templates/generate/controller.rb.erb
 - lib/templates/generate/model.rb.erb
 - lib/templates/module/dns.tf.erb