belt 0.2.18 → 0.2.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b5e83d99ec1a6a02931418e3ade22cb51b291028884529e25abbd74f7c23a41f
-  data.tar.gz: 938cc1a121a468de4dcb838c04fa44b7a01b78e5165a5da5f805cb330c88d59d
+  metadata.gz: 7f706cafa79246d178c2aee6bfb05536bcb5f03111a24f13624e769ef7d9916a
+  data.tar.gz: a99d09c6d472d4826acf78dee6a4fded952c8745071b63c6ea4f54dbfd6b0aef
 SHA512:
-  metadata.gz: d581ff695fda0a3288f809d0c52805091dd9de73a69af5b21f4675a0f65f3d04431f72e18db3f099f6299a3a9f5b0045323218a60a54982d58312021c9bcedbd
-  data.tar.gz: 59927af373dde4560edbaede9b9d8f81f43b229804479d0ff874ea67193b1a97bcf67e51afc388f66b3359fc7105df1ac0b2aef61a166d29fbcd43d509881004
+  metadata.gz: 2009deb03f2f725c4e960e73abf7745b8a9fdd5899ea76178b3942f21c504fe76338912ba57f05b913db3a18494f635c508e4696a3c347e40ddcb973e4c61541
+  data.tar.gz: b84417ce5814e266715b5dc54b4a965261f8011fee552f9f594c82137751565ff29b20f17444b2be986abfd79c02059b935ae5aa97fcbdbbfdcc79ffafa0421b

data/lib/belt/cli/auth_command.rb

@@ -19,9 +19,10 @@ module Belt
         end
 
         force = args.delete('--force') || args.delete('-f')
+        signup = args.delete('--signup')
         pools = parse_pools(args)
 
-        new(pools: pools, force: force).generate
+        new(pools: pools, force: force, signup: signup).generate
       end
 
       def self.destroy(_args)
@@ -35,6 +36,7 @@ module Belt
           Usage: belt generate auth [pool_names...] [options]
 
           Options:
+            --signup        Allow public user registration (generates frontend views)
             --force, -f     Overwrite existing cognito.tf (skip collision check)
 
           Arguments:
@@ -42,26 +44,38 @@ module Belt
                             If omitted, generates a single pool named "main".
 
           Examples:
-            belt g auth                        # Single pool: "main"
-            belt g auth web                    # Single pool: "web"
-            belt g auth web mobile             # Two pools: "web" and "mobile"
-            belt g auth web android ios        # Three pools: "web", "android", "ios"
+            belt g auth                        # Admin-only, single pool
+            belt g auth --signup               # Public signup with frontend views
+            belt g auth web                    # Named pool: "web"
+            belt g auth web mobile             # Two pools
             belt g auth --force                # Overwrite existing
 
           What this generates:
             infrastructure/modules/app/cognito.tf          User pool + client resources
             infrastructure/modules/app/cognito_outputs.tf  Pool ID, ARN, and client ID outputs
 
+          With --signup (when frontend/ exists):
+            frontend/src/lib/auth.js                       Auth module (signIn, signUp, etc.)
+            frontend/src/lib/apiClient.js                  API client with Authorization header
+            frontend/src/pages/auth/Login.jsx              Login page
+            frontend/src/pages/auth/SignUp.jsx             Registration page
+            frontend/src/pages/auth/ConfirmEmail.jsx       Email verification page
+            frontend/src/components/ProtectedRoute.jsx     Route guard component
+
+          Without --signup (admin-only, default):
+            frontend/src/lib/auth.js                       Auth module (signIn only)
+            frontend/src/lib/apiClient.js                  API client with Authorization header
+            frontend/src/pages/auth/Login.jsx              Login page
+            frontend/src/components/ProtectedRoute.jsx     Route guard component
+
           It also patches:
             infrastructure/modules/app/main.tf             Adds cognito_user_pool_arns to conveyor_belt
 
           After running:
             1. Review the generated Cognito config in cognito.tf
-            2. Customize password policy, MFA, triggers as needed
-            3. Run `belt apply <env>` to deploy
-
-          To remove:
-            belt destroy auth
+            2. Add auth: :cognito to your routes namespace
+            3. Run `belt deploy` to create the user pool
+            4. Create your account (admin-only): aws cognito-idp admin-create-user ...
         HELP
       end
 
@@ -72,9 +86,10 @@ module Belt
         names.map(&:downcase).map { |n| n.gsub(/[^a-z0-9_]/, '_') }
       end
 
-      def initialize(pools:, force: false)
+      def initialize(pools:, force: false, signup: false)
         @pool_names = pools
         @force = force
+        @signup = signup
         @app_name = detect_app_name
         @pools = build_pool_metadata
       end
@@ -86,12 +101,14 @@ module Belt
         write_cognito_tf
         write_cognito_outputs_tf
         patch_main_tf
+        generate_frontend_auth if frontend?
 
         puts "\n✓ Auth generated!"
         puts "\nNext steps:"
         puts '  1. Review infrastructure/modules/app/cognito.tf'
         puts '  2. Customize password policy, MFA, or Lambda triggers as needed'
         puts '  3. Run `belt apply <env>` to deploy'
+        puts '  4. Create your account: aws cognito-idp admin-create-user ...' unless @signup
       end
 
       def remove
@@ -134,6 +151,54 @@ module Belt
         end
       end
 
+      def frontend?
+        Dir.exist?('frontend/src')
+      end
+
+      def generate_frontend_auth
+        frontend_template_dir = File.join(TEMPLATE_DIR, 'frontend')
+
+        # Generate auth lib files
+        lib_dir = 'frontend/src/lib'
+        FileUtils.mkdir_p(lib_dir)
+        copy_frontend_file(frontend_template_dir, 'auth.js', File.join(lib_dir, 'auth.js'))
+        copy_frontend_file(frontend_template_dir, 'apiClient.js', File.join(lib_dir, 'apiClient.js'))
+
+        pages_dir = 'frontend/src/pages/auth'
+        FileUtils.mkdir_p(pages_dir)
+        copy_frontend_file(frontend_template_dir, 'Login.jsx', File.join(pages_dir, 'Login.jsx'))
+        if @signup
+          # Generate auth pages
+          copy_frontend_file(frontend_template_dir, 'SignUp.jsx', File.join(pages_dir, 'SignUp.jsx'))
+          copy_frontend_file(frontend_template_dir, 'ConfirmEmail.jsx', File.join(pages_dir, 'ConfirmEmail.jsx'))
+        end
+
+        # Generate ProtectedRoute component
+        components_dir = 'frontend/src/components'
+        FileUtils.mkdir_p(components_dir)
+        copy_frontend_file(frontend_template_dir, 'ProtectedRoute.jsx',
+                           File.join(components_dir, 'ProtectedRoute.jsx'))
+
+        install_cognito_sdk
+      end
+
+      def copy_frontend_file(template_dir, filename, dest)
+        src = File.join(template_dir, filename)
+        FileUtils.cp(src, dest)
+        puts "  create  #{dest}"
+      end
+
+      def install_cognito_sdk
+        puts "\n  Installing @aws-sdk/client-cognito-identity-provider..."
+        success = system('npm', 'install', '@aws-sdk/client-cognito-identity-provider',
+                         '--prefix', 'frontend', '--no-fund', '--no-audit', '--silent')
+        if success
+          puts '  ✓      npm dependency installed'
+        else
+          puts '  ⚠      npm install failed — run: cd frontend && npm install @aws-sdk/client-cognito-identity-provider'
+        end
+      end
+
       def check_collision!
         cognito_tf = File.join(MODULE_DIR, 'cognito.tf')
         return unless File.exist?(cognito_tf)

data/lib/belt/route_dsl.rb

@@ -156,7 +156,7 @@ module Belt
     def initialize(name, options = {})
       @name = name.to_s
       @routes = []
-      @default_auth = options[:auth] || :cognito
+      @default_auth = options[:auth] || :none
       @default_lambda = options[:lambda] || name
       @default_cors = options.fetch(:cors, true)
       @default_tables = Array(options[:tables] || [])

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.18'
+  VERSION = '0.2.19'
 end

data/lib/templates/generate/auth/cognito.tf.erb

@@ -13,6 +13,14 @@ resource "aws_cognito_user_pool" "<%= pool[:name] %>" {
     require_uppercase = true
   }
 
+  # Admin-only signup — users cannot self-register.
+  # Remove this block to allow public sign-up.
+<% unless @signup -%>
+  admin_create_user_config {
+    allow_admin_create_user_only = true
+  }
+
+<% end -%>
   auto_verified_attributes = ["email"]
 
   account_recovery_setting {
@@ -43,6 +51,9 @@ resource "aws_cognito_user_pool_client" "<%= pool[:name] %>" {
 
   explicit_auth_flows = [
     "ALLOW_USER_SRP_AUTH",
+<% if @signup -%>
+    "ALLOW_USER_PASSWORD_AUTH",
+<% end -%>
     "ALLOW_REFRESH_TOKEN_AUTH"
   ]
 

data/lib/templates/generate/auth/frontend/ConfirmEmail.jsx

@@ -0,0 +1,55 @@
+import { useState } from 'react'
+import { confirmSignUp } from '../lib/auth'
+
+export default function ConfirmEmail() {
+  const params = new URLSearchParams(window.location.search)
+  const [email, setEmail] = useState(params.get('email') || '')
+  const [code, setCode] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [confirmed, setConfirmed] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      await confirmSignUp(email, code)
+      setConfirmed(true)
+    } catch (err) {
+      setError(err.message || 'Confirmation failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (confirmed) {
+    return (
+      <div className="auth-page">
+        <div className="auth-form">
+          <h2>Email Verified! ✓</h2>
+          <p>Your account is ready.</p>
+          <a href="/login" className="auth-btn">Sign In</a>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Verify Email</h2>
+        <p>Enter the code sent to your email.</p>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required />
+        <input type="text" placeholder="Verification code" value={code}
+          onChange={e => setCode(e.target.value)} required autoFocus />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Verifying...' : 'Verify'}
+        </button>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/Login.jsx

@@ -0,0 +1,81 @@
+import { useState } from 'react'
+import { signIn, completeNewPassword } from '../lib/auth'
+
+export default function Login({ onLogin }) {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [newPassword, setNewPassword] = useState('')
+  const [error, setError] = useState('')
+  const [challenge, setChallenge] = useState(null)
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      const result = await signIn(email, password)
+      if (result.challenge === 'NEW_PASSWORD_REQUIRED') {
+        setChallenge(result)
+      } else {
+        onLogin()
+      }
+    } catch (err) {
+      setError(err.message || 'Sign in failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  async function handleNewPassword(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      await completeNewPassword(email, newPassword, challenge.session)
+      onLogin()
+    } catch (err) {
+      setError(err.message || 'Password change failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (challenge) {
+    return (
+      <div className="auth-page">
+        <form className="auth-form" onSubmit={handleNewPassword}>
+          <h2>Set New Password</h2>
+          <p>Please set a permanent password for your account.</p>
+          {error && <div className="auth-error">{error}</div>}
+          <input type="password" placeholder="New password" value={newPassword}
+            onChange={e => setNewPassword(e.target.value)} required autoFocus />
+          <button type="submit" disabled={loading}>
+            {loading ? 'Saving...' : 'Set Password'}
+          </button>
+        </form>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Sign In</h2>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required autoFocus />
+        <input type="password" placeholder="Password" value={password}
+          onChange={e => setPassword(e.target.value)} required />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Signing in...' : 'Sign In'}
+        </button>
+        <p className="auth-link">
+          Don't have an account? <a href="/signup">Sign up</a>
+        </p>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/ProtectedRoute.jsx

@@ -0,0 +1,9 @@
+import { isAuthenticated } from '../lib/auth'
+import { Navigate } from 'react-router-dom'
+
+export default function ProtectedRoute({ children }) {
+  if (!isAuthenticated()) {
+    return <Navigate to="/login" replace />
+  }
+  return children
+}

data/lib/templates/generate/auth/frontend/SignUp.jsx

@@ -0,0 +1,58 @@
+import { useState } from 'react'
+import { signUp } from '../lib/auth'
+
+export default function SignUp() {
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+  const [needsConfirmation, setNeedsConfirmation] = useState(false)
+
+  async function handleSubmit(e) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+
+    try {
+      const result = await signUp(email, password)
+      if (result.needsConfirmation) setNeedsConfirmation(true)
+    } catch (err) {
+      setError(err.message || 'Sign up failed')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  if (needsConfirmation) {
+    return (
+      <div className="auth-page">
+        <div className="auth-form">
+          <h2>Check Your Email</h2>
+          <p>We sent a verification code to <strong>{email}</strong>.</p>
+          <a href={`/confirm?email=${encodeURIComponent(email)}`} className="auth-btn">
+            Enter Code
+          </a>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="auth-page">
+      <form className="auth-form" onSubmit={handleSubmit}>
+        <h2>Create Account</h2>
+        {error && <div className="auth-error">{error}</div>}
+        <input type="email" placeholder="Email" value={email}
+          onChange={e => setEmail(e.target.value)} required autoFocus />
+        <input type="password" placeholder="Password (8+ characters)" value={password}
+          onChange={e => setPassword(e.target.value)} required minLength={8} />
+        <button type="submit" disabled={loading}>
+          {loading ? 'Creating...' : 'Create Account'}
+        </button>
+        <p className="auth-link">
+          Already have an account? <a href="/login">Sign in</a>
+        </p>
+      </form>
+    </div>
+  )
+}

data/lib/templates/generate/auth/frontend/apiClient.js

@@ -0,0 +1,34 @@
+import { getToken } from './auth'
+
+const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:3000'
+
+export async function apiClient(path, options = {}) {
+  const { method = 'GET', body, headers = {} } = options
+
+  const token = getToken()
+  const config = {
+    method,
+    headers: {
+      Accept: 'application/json',
+      ...(token ? { Authorization: token } : {}),
+      ...headers
+    }
+  }
+
+  if (body !== undefined && body !== null) {
+    config.headers['Content-Type'] = 'application/json'
+    config.body = JSON.stringify(body)
+  }
+
+  const response = await fetch(`${API_URL}${path}`, config)
+  const data = await response.json()
+
+  if (response.status === 401) {
+    window.location.href = '/login'
+    throw new Error('Unauthorized')
+  }
+
+  if (!response.ok) throw new Error(data.error || `Request failed: ${response.status}`)
+
+  return data
+}

data/lib/templates/generate/auth/frontend/auth.js

@@ -0,0 +1,80 @@
+import {
+  CognitoIdentityProviderClient,
+  InitiateAuthCommand,
+  RespondToAuthChallengeCommand,
+  SignUpCommand,
+  ConfirmSignUpCommand
+} from '@aws-sdk/client-cognito-identity-provider'
+
+const REGION = import.meta.env.VITE_AWS_REGION
+const CLIENT_ID = import.meta.env.VITE_COGNITO_CLIENT_ID
+
+const client = new CognitoIdentityProviderClient({ region: REGION })
+
+let idToken = null
+let refreshToken = null
+
+export function getToken() { return idToken }
+export function isAuthenticated() { return idToken !== null }
+
+export async function signIn(username, password) {
+  const response = await client.send(new InitiateAuthCommand({
+    AuthFlow: 'USER_PASSWORD_AUTH',
+    ClientId: CLIENT_ID,
+    AuthParameters: { USERNAME: username, PASSWORD: password }
+  }))
+
+  if (response.ChallengeName === 'NEW_PASSWORD_REQUIRED') {
+    return { challenge: 'NEW_PASSWORD_REQUIRED', session: response.Session }
+  }
+
+  setTokens(response.AuthenticationResult)
+  return { success: true }
+}
+
+export async function signUp(email, password) {
+  await client.send(new SignUpCommand({
+    ClientId: CLIENT_ID,
+    Username: email,
+    Password: password
+  }))
+  return { needsConfirmation: true }
+}
+
+export async function confirmSignUp(email, code) {
+  await client.send(new ConfirmSignUpCommand({
+    ClientId: CLIENT_ID,
+    Username: email,
+    ConfirmationCode: code
+  }))
+  return { success: true }
+}
+
+export async function completeNewPassword(username, newPassword, session) {
+  const response = await client.send(new RespondToAuthChallengeCommand({
+    ChallengeName: 'NEW_PASSWORD_REQUIRED',
+    ClientId: CLIENT_ID,
+    Session: session,
+    ChallengeResponses: { USERNAME: username, NEW_PASSWORD: newPassword }
+  }))
+  setTokens(response.AuthenticationResult)
+  return { success: true }
+}
+
+export function signOut() {
+  idToken = null
+  refreshToken = null
+  localStorage.removeItem('idToken')
+  localStorage.removeItem('refreshToken')
+}
+
+function setTokens(authResult) {
+  idToken = authResult.IdToken
+  refreshToken = authResult.RefreshToken
+  localStorage.setItem('idToken', idToken)
+  if (refreshToken) localStorage.setItem('refreshToken', refreshToken)
+}
+
+// Restore on page load
+const stored = localStorage.getItem('idToken')
+if (stored) idToken = stored

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.2.18
+  version: 0.2.19
 platform: ruby
 authors:
 - Stowzilla
@@ -144,6 +144,12 @@ files:
 - lib/templates/frontend_infra/frontend.tf.erb
 - lib/templates/generate/auth/cognito.tf.erb
 - lib/templates/generate/auth/cognito_outputs.tf.erb
+- lib/templates/generate/auth/frontend/ConfirmEmail.jsx
+- lib/templates/generate/auth/frontend/Login.jsx
+- lib/templates/generate/auth/frontend/ProtectedRoute.jsx
+- lib/templates/generate/auth/frontend/SignUp.jsx
+- lib/templates/generate/auth/frontend/apiClient.js
+- lib/templates/generate/auth/frontend/auth.js
 - lib/templates/generate/controller.rb.erb
 - lib/templates/generate/model.rb.erb
 - lib/templates/module/dns.tf.erb