specweave 0.21.1 → 0.21.3

package/plugins/specweave/iac-templates/firebase/iam.tf.hbs

@@ -0,0 +1,75 @@
+# IAM Roles and Permissions for Firebase
+# Project: {{projectName}}
+
+###############################
+# Cloud Functions Service Account Permissions
+###############################
+
+# Firebase Admin SDK access (already granted in main.tf)
+# Includes Firestore, Storage, Auth access
+
+{{#if databaseName}}
+# Firestore access for Cloud Functions
+resource "google_project_iam_member" "{{snakeCase functionName}}_firestore" {
+  project = var.project_id
+  role    = "roles/datastore.user"
+  member  = "serviceAccount:${google_service_account.{{snakeCase functionName}}.email}"
+}
+{{/if}}
+
+# Cloud Logging access
+resource "google_project_iam_member" "{{snakeCase functionName}}_logging" {
+  project = var.project_id
+  role    = "roles/logging.logWriter"
+  member  = "serviceAccount:${google_service_account.{{snakeCase functionName}}.email}"
+}
+
+# Cloud Storage access
+resource "google_project_iam_member" "{{snakeCase functionName}}_storage" {
+  project = var.project_id
+  role    = "roles/storage.objectAdmin"
+  member  = "serviceAccount:${google_service_account.{{snakeCase functionName}}.email}"
+}
+
+{{#if enableAuth}}
+# Firebase Authentication access
+resource "google_project_iam_member" "{{snakeCase functionName}}_auth" {
+  project = var.project_id
+  role    = "roles/firebaseauth.admin"
+  member  = "serviceAccount:${google_service_account.{{snakeCase functionName}}.email}"
+}
+{{/if}}
+
+###############################
+# Firebase Hosting Permissions
+###############################
+
+# Service account for Firebase Hosting deployment (via Firebase CLI)
+resource "google_service_account" "hosting_deployer" {
+  account_id   = "{{kebabCase projectName}}-hosting-deploy"
+  display_name = "Firebase Hosting Deployer"
+  description  = "Service account for deploying to Firebase Hosting via CI/CD"
+}
+
+resource "google_project_iam_member" "hosting_deployer_firebase" {
+  project = var.project_id
+  role    = "roles/firebase.admin"
+  member  = "serviceAccount:${google_service_account.hosting_deployer.email}"
+}
+
+resource "google_project_iam_member" "hosting_deployer_hosting" {
+  project = var.project_id
+  role    = "roles/firebasehosting.admin"
+  member  = "serviceAccount:${google_service_account.hosting_deployer.email}"
+}
+
+###############################
+# Additional IAM Bindings (Optional)
+###############################
+
+# For Secret Manager integration (uncomment if needed):
+# resource "google_project_iam_member" "functions_secret_accessor" {
+#   project = var.project_id
+#   role    = "roles/secretmanager.secretAccessor"
+#   member  = "serviceAccount:${google_service_account.{{snakeCase functionName}}.email}"
+# }

package/plugins/specweave/iac-templates/firebase/main.tf.hbs

@@ -0,0 +1,297 @@
+# Firebase with Hosting, Cloud Functions, and Firestore
+# Generated by SpecWeave Serverless Intelligence
+# Platform: Firebase
+# Project: {{projectName}}
+# Environment: {{environment}}
+
+terraform {
+  required_version = ">= 1.0"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 5.0"
+    }
+    google-beta = {
+      source  = "hashicorp/google-beta"
+      version = "~> 5.0"
+    }
+  }
+}
+
+###############################
+# Firebase Project
+###############################
+
+resource "google_firebase_project" "{{snakeCase projectName}}" {
+  provider = google-beta
+  project  = var.project_id
+}
+
+###############################
+# Firebase Web App
+###############################
+
+resource "google_firebase_web_app" "{{snakeCase projectName}}" {
+  provider     = google-beta
+  project      = var.project_id
+  display_name = "{{projectName}} ({{environment}})"
+
+  depends_on = [google_firebase_project.{{snakeCase projectName}}]
+}
+
+# Firebase App Configuration
+data "google_firebase_web_app_config" "{{snakeCase projectName}}" {
+  provider   = google-beta
+  web_app_id = google_firebase_web_app.{{snakeCase projectName}}.app_id
+}
+
+###############################
+# Firebase Hosting
+###############################
+
+resource "google_firebase_hosting_site" "{{snakeCase projectName}}" {
+  provider = google-beta
+  project  = var.project_id
+  site_id  = "{{kebabCase projectName}}-{{environment}}"
+
+  depends_on = [google_firebase_project.{{snakeCase projectName}}]
+}
+
+# Hosting Release (manually deploy via Firebase CLI)
+# firebase deploy --only hosting
+
+{{#if databaseName}}
+###############################
+# Firestore Database
+###############################
+
+resource "google_firestore_database" "{{snakeCase databaseName}}" {
+  provider    = google-beta
+  project     = var.project_id
+  name        = "(default)"
+  location_id = var.firestore_location
+
+  # Database type
+  type = "FIRESTORE_NATIVE"
+
+  # Concurrency mode
+  concurrency_mode = {{#if (eq environment "prod")}}"OPTIMISTIC"{{else}}"PESSIMISTIC"{{/if}}
+
+  # App Engine integration
+  app_engine_integration_mode = "DISABLED"
+
+  {{#if (eq environment "prod")}}
+  # Point-in-time recovery for production
+  point_in_time_recovery_enablement = "POINT_IN_TIME_RECOVERY_ENABLED"
+  {{/if}}
+
+  depends_on = [google_firebase_project.{{snakeCase projectName}}]
+}
+
+# Firestore Security Rules
+resource "google_firebaserules_ruleset" "{{snakeCase databaseName}}" {
+  provider = google-beta
+  project  = var.project_id
+
+  source {
+    files {
+      name = "firestore.rules"
+      content = <<-EOT
+        rules_version = '2';
+        service cloud.firestore {
+          match /databases/{database}/documents {
+            // Default: Authenticated users can read/write their own data
+            match /users/{userId} {
+              allow read, write: if request.auth != null && request.auth.uid == userId;
+            }
+
+            // Public read, authenticated write
+            match /items/{itemId} {
+              allow read: if true;
+              allow write: if request.auth != null;
+            }
+
+            {{#if (eq environment "prod")}}
+            // Production: Strict validation
+            match /{document=**} {
+              allow read, write: if false; // Deny by default
+            }
+            {{else}}
+            // Dev/Staging: More permissive for testing
+            match /{document=**} {
+              allow read: if true;
+              allow write: if request.auth != null;
+            }
+            {{/if}}
+          }
+        }
+      EOT
+    }
+  }
+
+  depends_on = [google_firestore_database.{{snakeCase databaseName}}]
+}
+
+# Deploy security rules
+resource "google_firebaserules_release" "{{snakeCase databaseName}}" {
+  provider     = google-beta
+  project      = var.project_id
+  name         = "cloud.firestore"
+  ruleset_name = google_firebaserules_ruleset.{{snakeCase databaseName}}.name
+
+  lifecycle {
+    replace_triggered_by = [
+      google_firebaserules_ruleset.{{snakeCase databaseName}}
+    ]
+  }
+}
+{{/if}}
+
+{{#if enableAuth}}
+###############################
+# Firebase Authentication
+###############################
+
+# Enable Email/Password provider
+resource "google_identity_platform_config" "{{snakeCase projectName}}_auth" {
+  provider = google-beta
+  project  = var.project_id
+
+  sign_in {
+    allow_duplicate_emails = false
+
+    email {
+      enabled           = true
+      password_required = true
+    }
+
+    {{#if enableGoogleAuth}}
+    # Google OAuth
+    # Configure OAuth client in GCP Console first
+    {{/if}}
+  }
+
+  {{#if (eq environment "prod")}}
+  # Production: Enable advanced security
+  blocking_functions {
+    triggers {
+      event_type = "beforeSignIn"
+      function_uri = "https://{{region}}-{{projectId}}.cloudfunctions.net/beforeSignIn"
+    }
+  }
+  {{/if}}
+
+  depends_on = [google_firebase_project.{{snakeCase projectName}}]
+}
+{{/if}}
+
+###############################
+# Cloud Storage for Firebase
+###############################
+
+resource "google_firebase_storage_bucket" "{{snakeCase projectName}}" {
+  provider  = google-beta
+  project   = var.project_id
+  bucket_id = "${var.project_id}.appspot.com"
+
+  depends_on = [google_firebase_project.{{snakeCase projectName}}]
+}
+
+# Storage Security Rules
+resource "google_firebaserules_ruleset" "storage" {
+  provider = google-beta
+  project  = var.project_id
+
+  source {
+    files {
+      name = "storage.rules"
+      content = <<-EOT
+        rules_version = '2';
+        service firebase.storage {
+          match /b/{bucket}/o {
+            // Authenticated users can upload to their own folder
+            match /users/{userId}/{allPaths=**} {
+              allow read, write: if request.auth != null && request.auth.uid == userId;
+            }
+
+            // Public read for public assets
+            match /public/{allPaths=**} {
+              allow read: if true;
+              allow write: if request.auth != null;
+            }
+
+            {{#if (eq environment "prod")}}
+            // Production: Strict file size limits
+            match /{allPaths=**} {
+              allow read: if request.auth != null;
+              allow write: if request.auth != null
+                         && request.resource.size < 10 * 1024 * 1024; // 10MB limit
+            }
+            {{else}}
+            // Dev/Staging: More permissive
+            match /{allPaths=**} {
+              allow read, write: if request.auth != null;
+            }
+            {{/if}}
+          }
+        }
+      EOT
+    }
+  }
+
+  depends_on = [google_firebase_storage_bucket.{{snakeCase projectName}}]
+}
+
+# Deploy storage rules
+resource "google_firebaserules_release" "storage" {
+  provider     = google-beta
+  project      = var.project_id
+  name         = "firebase.storage/${var.project_id}.appspot.com"
+  ruleset_name = google_firebaserules_ruleset.storage.name
+
+  lifecycle {
+    replace_triggered_by = [
+      google_firebaserules_ruleset.storage
+    ]
+  }
+}
+
+###############################
+# Cloud Functions for Firebase
+###############################
+
+# Note: Cloud Functions for Firebase are typically deployed via Firebase CLI
+# firebase deploy --only functions
+
+# Storage bucket for function code
+resource "google_storage_bucket" "{{snakeCase functionName}}_source" {
+  name          = "{{kebabCase projectName}}-functions-{{environment}}"
+  location      = var.region
+  force_destroy = {{#if (eq environment "prod")}}false{{else}}true{{/if}}
+
+  uniform_bucket_level_access = true
+
+  versioning {
+    enabled = {{#if (eq environment "prod")}}true{{else}}false{{/if}}
+  }
+
+  labels = {
+    environment = var.environment
+    project     = var.project_name
+    managed_by  = "terraform"
+  }
+}
+
+# Service account for Cloud Functions
+resource "google_service_account" "{{snakeCase functionName}}" {
+  account_id   = "{{kebabCase functionName}}-{{environment}}"
+  display_name = "Service Account for Firebase Functions ({{environment}})"
+  description  = "Managed by Terraform"
+}
+
+# Grant Firebase Admin SDK access
+resource "google_project_iam_member" "{{snakeCase functionName}}_firebase_admin" {
+  project = var.project_id
+  role    = "roles/firebase.admin"
+  member  = "serviceAccount:${google_service_account.{{snakeCase functionName}}.email}"
+}

package/plugins/specweave/iac-templates/firebase/outputs.tf.hbs

@@ -0,0 +1,67 @@
+# Terraform Outputs for Firebase
+# Project: {{projectName}}
+
+output "firebase_project_id" {
+  description = "Firebase project ID"
+  value       = google_firebase_project.{{snakeCase projectName}}.project
+}
+
+output "web_app_id" {
+  description = "Firebase Web App ID"
+  value       = google_firebase_web_app.{{snakeCase projectName}}.app_id
+}
+
+output "web_app_api_key" {
+  description = "Firebase Web App API Key"
+  value       = data.google_firebase_web_app_config.{{snakeCase projectName}}.api_key
+  sensitive   = true
+}
+
+output "web_app_auth_domain" {
+  description = "Firebase Auth Domain"
+  value       = data.google_firebase_web_app_config.{{snakeCase projectName}}.auth_domain
+}
+
+output "hosting_site_id" {
+  description = "Firebase Hosting Site ID"
+  value       = google_firebase_hosting_site.{{snakeCase projectName}}.site_id
+}
+
+output "hosting_url" {
+  description = "Firebase Hosting URL"
+  value       = "https://${google_firebase_hosting_site.{{snakeCase projectName}}.site_id}.web.app"
+}
+
+{{#if databaseName}}
+output "firestore_database_name" {
+  description = "Firestore database name"
+  value       = google_firestore_database.{{snakeCase databaseName}}.name
+}
+
+output "firestore_rules_deployed" {
+  description = "Firestore security rules deployment status"
+  value       = google_firebaserules_release.{{snakeCase databaseName}}.name
+}
+{{/if}}
+
+output "storage_bucket" {
+  description = "Firebase Storage bucket"
+  value       = google_firebase_storage_bucket.{{snakeCase projectName}}.bucket_id
+}
+
+output "storage_rules_deployed" {
+  description = "Storage security rules deployment status"
+  value       = google_firebaserules_release.storage.name
+}
+
+output "functions_service_account_email" {
+  description = "Service account for Cloud Functions"
+  value       = google_service_account.{{snakeCase functionName}}.email
+}
+
+{{#if enableAuth}}
+output "auth_enabled" {
+  description = "Firebase Authentication status"
+  value       = "enabled"
+}
+{{/if}}

package/plugins/specweave/iac-templates/firebase/provider.tf.hbs

@@ -0,0 +1,26 @@
+# Firebase Provider Configuration
+# Project: {{projectName}}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+
+  default_labels = {
+    project     = var.project_name
+    environment = var.environment
+    managed_by  = "terraform"
+    created_by  = "specweave"
+  }
+}
+
+provider "google-beta" {
+  project = var.project_id
+  region  = var.region
+
+  default_labels = {
+    project     = var.project_name
+    environment = var.environment
+    managed_by  = "terraform"
+    created_by  = "specweave"
+  }
+}

package/plugins/specweave/iac-templates/firebase/variables.tf.hbs

@@ -0,0 +1,68 @@
+# Terraform Variables for Firebase
+# Project: {{projectName}}
+
+variable "project_id" {
+  description = "GCP project ID (must be a Firebase project)"
+  type        = string
+  default     = "{{#if projectId}}{{projectId}}{{else}}my-firebase-project{{/if}}"
+}
+
+variable "region" {
+  description = "GCP region for Cloud Functions"
+  type        = string
+  default     = "{{#if region}}{{region}}{{else}}us-central1{{/if}}"
+}
+
+variable "firestore_location" {
+  description = "Firestore location"
+  type        = string
+  default     = "{{#if firestoreLocation}}{{firestoreLocation}}{{else}}us-central{{/if}}"
+}
+
+variable "environment" {
+  description = "Environment name (dev, staging, prod)"
+  type        = string
+  default     = "{{environment}}"
+  validation {
+    condition     = contains(["dev", "staging", "prod"], var.environment)
+    error_message = "Environment must be dev, staging, or prod."
+  }
+}
+
+variable "project_name" {
+  description = "Project name"
+  type        = string
+  default     = "{{projectName}}"
+}
+
+variable "function_name" {
+  description = "Cloud Functions name"
+  type        = string
+  default     = "{{functionName}}"
+}
+
+{{#if databaseName}}
+variable "database_name" {
+  description = "Firestore database name"
+  type        = string
+  default     = "{{databaseName}}"
+}
+{{/if}}
+
+{{#if enableAuth}}
+variable "enable_auth" {
+  description = "Enable Firebase Authentication"
+  type        = bool
+  default     = true
+}
+{{/if}}
+
+variable "labels" {
+  description = "Additional labels to apply to resources"
+  type        = map(string)
+  default     = {
+    project     = "{{projectName}}"
+    environment = "{{environment}}"
+    managed_by  = "terraform"
+  }
+}