@izara_project/izara-core-generate-service-code 1.0.65 → 1.0.67

package/src/emit/custom/templates/triggerCache/TriggerCacheComplete_Main.ejs

@@ -0,0 +1,35 @@
+import { triggeredCacheSharedLibV2 } from '@izara_project/izara-core-library-trigger-cache';
+
+export default async function <%- functionName %>(
+  _izContext,
+  requestParams,
+  callingFlowConfig = {}
+) {
+  try {
+    _izContext.logger.debug('<%- functionName %> requestParams', requestParams);
+    _izContext.logger.debug('<%- functionName %> callingFlowConfig', callingFlowConfig);
+
+    //(<beforeCheckTriggeredCache>)
+    //(</beforeCheckTriggeredCache>)
+
+    const checkTriggerResetedV2 = await triggeredCacheSharedLibV2.checkTriggerResetedV2(
+      _izContext,
+      { serviceTag: process.env.iz_serviceTag, flowTag: '<%- flowTag %>' },
+      //(<identifiers>)
+      {},
+      //(</identifiers>)
+      //(<uniqueRequestId>)
+      //(</uniqueRequestId>)
+      //(<settings>)
+      //(</settings>)
+    );
+
+    _izContext.logger.debug('<%- functionName %> checkTriggerResetedV2', checkTriggerResetedV2);
+
+    //(<endpointHook>)
+    //(</endpointHook>)
+  } catch (error) {
+    _izContext.logger.error('<%- functionName %> failed', error);
+    throw error;
+  }
+}

package/src/emit/custom/templates/triggerCache/TriggerCache_Main.ejs

@@ -0,0 +1,16 @@
+export default async function <%- functionName %>(
+  _izContext,
+  requestParams,
+  callingFlowConfig = {}
+) {
+  try {
+    _izContext.logger.debug('<%- functionName %> requestParams', requestParams);
+    _izContext.logger.debug('<%- functionName %> callingFlowConfig', callingFlowConfig);
+
+    //(<endpointHook>)
+    //(</endpointHook>)
+  } catch (error) {
+    _izContext.logger.error('<%- functionName %> failed', error);
+    throw error;
+  }
+}

package/src/emit/function/functionYamlArtifact.js

@@ -0,0 +1,125 @@
+export function createSqsFunctionYamlArtifact({ functionName, handlerPath, roleName, queueName, fileName, flowTag, flowStepName, targetCompleteStepName }) {
+  if (![functionName, handlerPath, roleName, queueName, fileName].every(value => typeof value === 'string' && value !== '')) {
+    throw new TypeError('Function descriptor must include functionName, handlerPath, roleName, queueName, and fileName');
+  }
+  return {
+    path: `app/sls_yaml/generatedCode/source/${fileName}`,
+    content: renderSqsFunctionYaml({ functionName, handlerPath, roleName, queueName, flowTag, flowStepName })
+  };
+}
+
+export function renderSqsFunctionYaml({ functionName, handlerPath, roleName, queueName, flowTag, flowStepName, targetCompleteStepName }) {
+  if (![functionName, handlerPath, roleName, queueName].every(value => typeof value === 'string' && value !== '')) {
+    throw new TypeError('SQS function descriptor must include functionName, handlerPath, roleName, and queueName');
+  }
+  return `${functionName}:
+  handler: ${handlerPath}
+  name: \${self:custom.iz_resourcePrefix}${functionName}
+  role: ${roleName}
+${environmentSetting(functionName, flowTag, flowStepName, targetCompleteStepName)}${functionSetting(functionName)}
+  events:
+    - sqs:
+        arn: arn:aws:sqs:\${self:custom.iz_region}:\${self:custom.iz_accountId}:\${self:custom.iz_resourcePrefix}${queueName}
+        batchSize: 10
+${completionFilter(functionName)}`;
+}
+
+export function renderApiFunctionYaml({ functionName, handlerPath, roleName, routes = [], flowTag, flowStepName }) {
+  if (!Array.isArray(routes)) {
+    throw new TypeError('API function routes must be an array');
+  }
+  const routeEvents = routes.flatMap(({ path, upperName }) => {
+    if (typeof path !== 'string' || path === '' || typeof upperName !== 'string' || upperName === '') {
+      throw new TypeError('API function routes must include path and upperName');
+    }
+    return [
+      `    - httpApi:\n        path: ${path}\n        method: post\n        #<#${upperName}AppLevelAuthorizer#>\n        # authorizer: authorizerServiceSchema\n        #<#/${upperName}AppLevelAuthorizer#>`,
+      `    - httpApi:\n        path: ${path}/{targetUserId}\n        method: post\n        #<#${upperName}UserLevelAuthorizer#>\n        # authorizer: authorizerIdentifiers\n        #<#/${upperName}UserLevelAuthorizer#>`
+    ];
+  }).join('\n');
+  return `${functionName}:
+  handler: ${handlerPath}
+  name: \${self:custom.iz_resourcePrefix}${functionName}
+  role: ${roleName}
+${environmentSetting(functionName, flowTag, flowStepName)}${functionSetting(functionName)}
+  events:
+${routeEvents ? `${routeEvents}\n` : ''}`;
+}
+
+export function renderWbsFunctionYaml({ functionName, handlerPath, roleName, routeName, flowTag, flowStepName }) {
+  if (![functionName, handlerPath, roleName, routeName].every(value => typeof value === 'string' && value !== '')) {
+    throw new TypeError('WebSocket function descriptor must include functionName, handlerPath, roleName, and routeName');
+  }
+  return `${functionName}:
+  handler: ${handlerPath}
+  name: \${self:custom.iz_resourcePrefix}${functionName}
+  role: ${roleName}
+${environmentSetting(functionName, flowTag, flowStepName)}${functionSetting(functionName)}
+  events:
+    - websocket:
+        route: ${routeName}
+        # authorizer: \${self:custom.iz_authorizerAppLevel}
+        # identifierResource: 'route.request.header.Auth'
+`;
+}
+
+export function renderInvFunctionYaml({ functionName, handlerPath, roleName, flowTag, flowStepName }) {
+  return `${functionName}:
+  handler: ${handlerPath}
+  name: \${self:custom.iz_resourcePrefix}${functionName}
+  role: ${roleName}
+${environmentSetting(functionName, flowTag, flowStepName)}${functionSetting(functionName)}
+`;
+}
+
+export function renderEventBridgeFunctionYaml({ functionName, handlerPath, roleName, flowTag, flowStepName, schedules = [] }) {
+  if (![functionName, handlerPath, roleName, flowTag].every(value => typeof value === 'string' && value !== '') || !Array.isArray(schedules)) {
+    throw new TypeError('EventBridge function descriptor must include functionName, handlerPath, roleName, flowTag, and schedules');
+  }
+  if (!schedules.every(schedule => (
+    typeof schedule?.name === 'string' && schedule.name !== '' &&
+    Array.isArray(schedule.rate) && typeof schedule.rate[0] === 'string' && schedule.rate[0] !== ''
+  ))) {
+    throw new TypeError('Each EventBridge schedule must include a name and first rate value');
+  }
+  return `\${self:custom.iz_resourcePrefix}${functionName}:
+  handler: ${handlerPath}
+  role: ${roleName}
+${environmentSetting(functionName, flowTag, flowStepName)}${functionSetting(functionName)}
+  description: ${flowTag} (EventBridge Schedule)
+${schedules.length === 0 ? '' : `  events:\n${schedules.map(schedule => `    - schedule:\n        name: \${self:custom.iz_resourcePrefix}${schedule.name}\n        description: '${schedule.description ?? ''}'\n        rate: ${schedule.rate?.[0]}\n        enabled: true`).join('\n')}\n`}`;
+}
+
+function environmentSetting(functionName, flowTag, flowStepName, targetCompleteStepName) {
+  if (flowTag === undefined && flowStepName === undefined && targetCompleteStepName === undefined) return '';
+  let envs = [];
+  if (flowTag !== undefined) envs.push(`    iz_flowTag: ${flowTag === '' ? "''" : flowTag}`);
+  if (flowStepName !== undefined) envs.push(`    iz_flowStepName: ${flowStepName === '' ? "''" : flowStepName}`);
+  if (targetCompleteStepName !== undefined) envs.push(`    iz_targetCompleteStepName: ${flowTag}${targetCompleteStepName}`);
+  
+  if (envs.length === 0) return '';
+  return `  environment:
+${envs.join('\n')}
+    #<#${functionName}Environment#>
+    #<#/${functionName}Environment#>\n`;
+}
+
+function functionSetting(functionName) {
+  return `  #<#${functionName}FunctionSetting#>\n  #<#/${functionName}FunctionSetting#>`;
+}
+
+function completionFilter(functionName) {
+  if (!functionName.endsWith('CompleteHdrSqs')) return '';
+  return `        filterPatterns:
+          - body:
+              MessageAttributes:
+                callingFlow:
+                  Value:
+                    - \${self:custom.iz_resourcePrefix}${functionName}
+          - body:
+              MessageAttributes:
+                callingFlow:
+                  Value:
+                    - exists: false
+`;
+}

package/src/emit/rbac/emitDynamicRbacFlowSchemas.js

@@ -0,0 +1,117 @@
+import ejs from 'ejs';
+import { readFile } from 'node:fs/promises';
+import { rbacFlowTag } from './rbacFlowTag.js';
+
+const RBAC_FLOW_DEFINITIONS = [
+  { flowTag: 'CreateTargetRole', event: ['ownTopic'] },
+  { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
+  { flowTag: 'DeleteTargetRole', event: ['ownTopic'] },
+  { flowTag: 'CreateRolePermissions', event: ['ownTopic'] },
+  { flowTag: 'ListRolePermissions', event: ['lambdaSyncApi'] },
+  { flowTag: 'DeleteRolePermissions', event: ['ownTopic'] },
+  { flowTag: 'CreateUserRole', event: ['ownTopic'] },
+  { flowTag: 'ListUserInRoles', event: ['lambdaSyncApi'] },
+  { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] }
+];
+const TEMPLATE_URL = new URL('./templates/', import.meta.url);
+
+export const dynamicRbacFlowSchemaPaths = RBAC_FLOW_DEFINITIONS.map(
+  ({ flowTag }) => `app/src/schemas/FlowSchemas/generateCode/${flowTag}.js`
+);
+
+export function rbacFlowSchemaManagedPaths(objects = []) {
+  if (!Array.isArray(objects)) {
+    throw new TypeError('objects must be an array');
+  }
+  return [
+    ...dynamicRbacFlowSchemaPaths,
+    ...objects.filter(hasRbacAddOn).map(object => `app/src/schemas/FlowSchemas/generateCode/${rbacFlowTag(object)}.js`)
+  ];
+}
+
+export async function emitDynamicRbacFlowSchemas({ objects, serviceTag }) {
+  if (!Array.isArray(objects)) {
+    throw new TypeError('objects must be an array');
+  }
+
+  const rbacObjects = objects.filter(hasRbacAddOn);
+  if (rbacObjects.length === 0) {
+    return [];
+  }
+  if (typeof serviceTag !== 'string' || serviceTag.trim() === '') {
+    throw new TypeError('GenerationRequest.serviceTag is required when generating RBAC schemas');
+  }
+
+  return Promise.all([
+    ...RBAC_FLOW_DEFINITIONS.map(({ flowTag, event }) => artifact(
+      flowTag,
+      createSharedRbacFlow(flowTag, event)
+    )),
+    ...rbacObjects.map(object => {
+      const flowTag = rbacFlowTag(object);
+      return artifact(flowTag, createUserRbacFlow(flowTag, serviceTag, object.objectType));
+    })
+  ]);
+}
+
+function hasRbacAddOn(object) {
+  return Array.isArray(object?.addOnDataStructure)
+    && object.addOnDataStructure.some(addOn => addOn?.type === 'rbac');
+}
+
+async function artifact(flowTag, flow) {
+  return {
+    path: `app/src/schemas/FlowSchemas/generateCode/${flowTag}.js`,
+    content: ejs.render(
+      await readFile(new URL('DynamicRbacFlowSchema.ejs', TEMPLATE_URL), 'utf8'),
+      { flowTag, flow }
+    )
+  };
+}
+
+function createSharedRbacFlow(flowTag, event) {
+  return {
+    flowTag,
+    fileName: 'flow-rbac',
+    initiateBy: 'system',
+    statusType: 'none',
+    event,
+    outputTopic: true,
+    stepProperties: {
+      returnResult: { propertyName: 'returnResult', type: 'object' }
+    },
+    flowSteps: [
+      {
+        stepName: 'start',
+        properties: [],
+        messageAttributes: [],
+        returnValues: {
+          properties: ['returnResult'],
+          messageAttributes: []
+        }
+      }
+    ]
+  };
+}
+
+function createUserRbacFlow(flowTag, serviceTag, objectType) {
+  return {
+    flowTag,
+    fileName: 'flow-rbac',
+    objType: { serviceTag, objectType },
+    event: ['lambdaSyncInv'],
+    initiateBy: 'system',
+    handleObj: 'one',
+    statusType: 'none',
+    stepMessageAttributes: {
+      userId: { propertyName: 'x-correlation-base-user-id', type: 'string' },
+      correlationId: { propertyName: 'x-correlation-id', type: 'string' }
+    },
+    flowSteps: [
+      {
+        stepName: 'start',
+        messageAttributes: ['userId', 'correlationId']
+      }
+    ]
+  };
+}

package/src/emit/rbac/emitRbacApplicationArtifacts.js

@@ -0,0 +1,270 @@
+import ejs from 'ejs';
+import { readFile } from 'node:fs/promises';
+
+import {
+  renderApiFunctionYaml,
+  renderInvFunctionYaml,
+  renderSqsFunctionYaml,
+  renderWbsFunctionYaml
+} from '../function/functionYamlArtifact.js';
+import { rbacFlowTag } from './rbacFlowTag.js';
+
+const FLOW_RBAC_YAML_PATH = 'app/sls_yaml/generatedCode/source/flow-rbac.yml';
+const CRUD_TEMPLATE_URL = new URL('../crud/templates/', import.meta.url);
+const RBAC_TEMPLATE_URL = new URL('./templates/', import.meta.url);
+
+export async function emitRbacApplicationArtifacts(objects) {
+  if (!Array.isArray(objects)) {
+    throw new TypeError('objects must be an array');
+  }
+  if (!objects.some(hasRbacAddOn)) {
+    return [];
+  }
+
+  const handlers = await Promise.all([
+    createTargetRoleHandler(),
+    ...LIST_DEFINITIONS.map(createListHandler),
+    ...MUTATION_DEFINITIONS.map(createMutationHandler),
+    ...USER_ROLE_MUTATIONS.map(createUserRoleMutationHandler),
+    ...objects.filter(hasRbacAddOn).map(createUserRbacFlowHandler)
+  ]);
+  return [
+    ...handlers.flatMap(handler => handler.artifacts),
+    {
+      path: FLOW_RBAC_YAML_PATH,
+      content: handlers.flatMap(handler => handler.functions).map(renderFunctionYaml).join('\n')
+    }
+  ];
+}
+
+const LIST_DEFINITIONS = [
+  { flowTag: 'ListTargetRole', tableName: 'TargetRoles', requestProperty: 'userId', useContextUserId: true },
+  { flowTag: 'ListRolePermissions', tableName: 'RolePermissions', requestProperty: 'roleIdKey' },
+  { flowTag: 'ListUserInRoles', tableName: 'RoleUsers', requestProperty: 'roleIdKey' }
+];
+const MUTATION_DEFINITIONS = [
+  { flowTag: 'CreateRolePermissions', tableName: 'RolePermissions', method: 'putItem', fields: ['roleIdKey', 'flowTypeConcat', 'parameterGroups'] },
+  { flowTag: 'DeleteRolePermissions', tableName: 'RolePermissions', method: 'deleteItem', fields: ['roleIdKey', 'flowTypeConcat'] },
+  { flowTag: 'DeleteTargetRole', tableName: 'TargetRoles', method: 'deleteItem', fields: ['targetId', 'roleIdKey'] }
+];
+const USER_ROLE_MUTATIONS = [
+  { flowTag: 'CreateUserRole', operation: 'Put' },
+  { flowTag: 'DeleteUserFromRole', operation: 'Delete' }
+];
+
+export function rbacApplicationManagedPaths(objects = []) {
+  if (!Array.isArray(objects)) {
+    throw new TypeError('objects must be an array');
+  }
+  return [
+    'app/src/generatedCode/FlowRbac/CreateTargetRole/source/ProcessCreateTargetRole_Main.js',
+    'app/src/generatedCode/FlowRbac/CreateTargetRole/source/ProcessCreateTargetRole_HdrSqs.js',
+    'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_Main.js',
+    'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrWbs.js',
+    ...LIST_DEFINITIONS.flatMap(({ flowTag }) => [
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/Process${flowTag}_Main.js`,
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/Process${flowTag}_HdrSqs.js`,
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/Process${flowTag}_HdrApi.js`
+    ]),
+    ...MUTATION_DEFINITIONS.flatMap(({ flowTag }) => [
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/Process${flowTag}_Main.js`,
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/Process${flowTag}_HdrSqs.js`,
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/${flowTag}_Main.js`,
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/${flowTag}_HdrWbs.js`
+    ]),
+    ...USER_ROLE_MUTATIONS.flatMap(({ flowTag }) => [
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/Process${flowTag}_Main.js`,
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/Process${flowTag}_HdrSqs.js`,
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/${flowTag}_Main.js`,
+      `app/src/generatedCode/FlowRbac/${flowTag}/source/${flowTag}_HdrWbs.js`
+    ]),
+    ...objects.filter(hasRbacAddOn).flatMap(object => {
+      const flowTag = rbacFlowTag(object);
+      const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
+      return [
+        `${sourcePath}/Process${flowTag}_Main.js`,
+        `${sourcePath}/Process${flowTag}_HdrInv.js`
+      ];
+    }),
+    FLOW_RBAC_YAML_PATH
+  ];
+}
+
+function hasRbacAddOn(object) {
+  return Array.isArray(object?.addOnDataStructure)
+    && object.addOnDataStructure.some(addOn => addOn?.type === 'rbac');
+}
+
+async function createTargetRoleHandler() {
+  const sourcePath = 'app/src/generatedCode/FlowRbac/CreateTargetRole/source';
+  const webSocket = await createWebSocketEntry('CreateTargetRole', sourcePath, 'src/generatedCode/FlowRbac/CreateTargetRole/source');
+  return {
+    artifacts: [
+      {
+        path: 'app/src/generatedCode/FlowRbac/CreateTargetRole/source/ProcessCreateTargetRole_Main.js',
+        content: await renderRbacTemplate('CreateTargetRole_Main.ejs')
+      },
+      {
+        path: 'app/src/generatedCode/FlowRbac/CreateTargetRole/source/ProcessCreateTargetRole_HdrSqs.js',
+        content: await renderRbacTemplate('CreateTargetRole_HdrSqs.ejs')
+      },
+      ...webSocket.artifacts
+    ],
+    functions: [
+      {
+        functionName: 'ProcessCreateTargetRoleHdrSqs',
+        handlerPath: 'src/generatedCode/FlowRbac/CreateTargetRole/source/ProcessCreateTargetRole_HdrSqs.main',
+        roleName: 'FlowRbacRole',
+        queueName: 'ProcessCreateTargetRoleHdrSqs',
+        flowTag: 'CreateTargetRole',
+        flowStepName: ''
+      },
+      ...webSocket.functions
+    ]
+  };
+}
+
+async function createListHandler(definition) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${definition.flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${definition.flowTag}/source`;
+  return {
+    artifacts: [
+      { path: `${sourcePath}/Process${definition.flowTag}_Main.js`, content: await renderRbacTemplate('ListRbac_Main.ejs', { ...definition, useContextUserId: definition.useContextUserId ?? false }) },
+      { path: `${sourcePath}/Process${definition.flowTag}_HdrSqs.js`, content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', definition) },
+      { path: `${sourcePath}/Process${definition.flowTag}_HdrApi.js`, content: await renderRbacTemplate('ListRbac_HdrApi.ejs', definition) }
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `Process${definition.flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/Process${definition.flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `Process${definition.flowTag}HdrSqs`,
+        flowTag: definition.flowTag,
+        flowStepName: ''
+      },
+      {
+        type: 'api',
+        functionName: `Process${definition.flowTag}HdrApi`,
+        handlerPath: `${handlerPath}/Process${definition.flowTag}_HdrApi.main`,
+        roleName: 'FlowRbacRole',
+        flowTag: definition.flowTag,
+        flowStepName: ''
+      }
+    ]
+  };
+}
+
+async function createMutationHandler(definition) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${definition.flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${definition.flowTag}/source`;
+  const webSocket = await createWebSocketEntry(definition.flowTag, sourcePath, handlerPath);
+  return {
+    artifacts: [
+      { path: `${sourcePath}/Process${definition.flowTag}_Main.js`, content: await renderRbacTemplate('RbacMutation_Main.ejs', definition) },
+      { path: `${sourcePath}/Process${definition.flowTag}_HdrSqs.js`, content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', definition) },
+      ...webSocket.artifacts
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `Process${definition.flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/Process${definition.flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `Process${definition.flowTag}HdrSqs`,
+        flowTag: definition.flowTag,
+        flowStepName: ''
+      },
+      ...webSocket.functions
+    ]
+  };
+}
+
+async function createUserRoleMutationHandler(definition) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${definition.flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${definition.flowTag}/source`;
+  const webSocket = await createWebSocketEntry(definition.flowTag, sourcePath, handlerPath);
+  return {
+    artifacts: [
+      { path: `${sourcePath}/Process${definition.flowTag}_Main.js`, content: await renderRbacTemplate('UserRoleMutation_Main.ejs', definition) },
+      { path: `${sourcePath}/Process${definition.flowTag}_HdrSqs.js`, content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', definition) },
+      ...webSocket.artifacts
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `Process${definition.flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/Process${definition.flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `Process${definition.flowTag}HdrSqs`,
+        flowTag: definition.flowTag,
+        flowStepName: ''
+      },
+      ...webSocket.functions
+    ]
+  };
+}
+
+async function createUserRbacFlowHandler(object) {
+  const flowTag = rbacFlowTag(object);
+  const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${flowTag}/source`;
+  return {
+    artifacts: [
+      { path: `${sourcePath}/Process${flowTag}_Main.js`, content: await renderRbacTemplate('UserRbacFlow_Main.ejs', { flowTag }) },
+      { path: `${sourcePath}/Process${flowTag}_HdrInv.js`, content: await renderRbacTemplate('UserRbacFlow_HdrInv.ejs', { flowTag }) }
+    ],
+    functions: [{
+      type: 'inv',
+      functionName: `Process${flowTag}HdrInv`,
+      handlerPath: `${handlerPath}/Process${flowTag}_HdrInv.main`,
+      roleName: 'FlowRbacRole',
+      flowTag: flowTag,
+      flowStepName: ''
+    }]
+  };
+}
+
+function renderFunctionYaml(descriptor) {
+  if (descriptor.type === 'api') return renderApiFunctionYaml(descriptor);
+  if (descriptor.type === 'inv') return renderInvFunctionYaml(descriptor);
+  if (descriptor.type === 'wbs') return renderWbsFunctionYaml(descriptor);
+  return renderSqsFunctionYaml(descriptor);
+}
+
+async function createWebSocketEntry(flowTag, sourcePath, handlerPath) {
+  const mainFileName = `${flowTag}_Main`;
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/${mainFileName}.js`,
+        content: await renderCrudTemplate('FlowMain_Wbs.ejs', { flowTag, functionName: flowTag, upperCaseFlowTag: flowTag })
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrWbs.js`,
+        content: await renderCrudTemplate('FlowEndpoint_HdrWbs.ejs', { flowTag, functionName: flowTag, mainFileName, upperCaseFlowTag: flowTag, route: flowTag })
+      }
+    ],
+    functions: [{
+      type: 'wbs',
+      functionName: `${flowTag}HdrWbs`,
+      handlerPath: `${handlerPath}/${flowTag}_HdrWbs.main`,
+      roleName: 'FlowRbacRole',
+      routeName: flowTag,
+      flowTag: flowTag,
+      flowStepName: ''
+    }]
+  };
+}
+
+function renderCrudTemplate(templateName, data) {
+  return renderTemplate(CRUD_TEMPLATE_URL, templateName, data);
+}
+
+function renderRbacTemplate(templateName, data = {}) {
+  return renderTemplate(RBAC_TEMPLATE_URL, templateName, data);
+}
+
+async function renderTemplate(templateUrl, templateName, data) {
+  return ejs.render(await readFile(new URL(templateName, templateUrl), 'utf8'), data);
+}

package/src/emit/rbac/generateCreateTargetRoleHandler.js

@@ -0,0 +1,19 @@
+import { buildGenerationPlan } from '../../plan/buildGenerationPlan.js';
+import { commitArtifacts } from '../../output/commitArtifacts.js';
+import { compileProject } from '../../compile/compileProject.js';
+import { loadLocalSchemaDirectory } from '../../compile/loadSchemas.js';
+import {
+  emitRbacApplicationArtifacts,
+  rbacApplicationManagedPaths
+} from './emitRbacApplicationArtifacts.js';
+
+export async function generateCreateTargetRoleHandler(rootPath, options = {}) {
+  const project = compileProject({ ...options, rootPath });
+  const objects = await loadLocalSchemaDirectory(project, 'ObjectSchemas');
+  const artifacts = await emitRbacApplicationArtifacts(objects);
+  const files = await commitArtifacts(buildGenerationPlan(project, artifacts, {
+    managedPaths: rbacApplicationManagedPaths(),
+    managedScope: 'rbac-application'
+  }));
+  return { project, files };
+}

package/src/emit/rbac/generateDynamicRbacFlowSchemas.js

@@ -0,0 +1,21 @@
+import { buildGenerationPlan } from '../../plan/buildGenerationPlan.js';
+import { commitArtifacts } from '../../output/commitArtifacts.js';
+import { compileProject } from '../../compile/compileProject.js';
+import { loadLocalSchemaDirectory } from '../../compile/loadSchemas.js';
+import {
+  emitDynamicRbacFlowSchemas,
+  rbacFlowSchemaManagedPaths
+} from './emitDynamicRbacFlowSchemas.js';
+
+export async function generateDynamicRbacFlowSchemas(rootPath, options = {}) {
+  const project = compileProject({ ...options, rootPath });
+  const objects = await loadLocalSchemaDirectory(project, 'ObjectSchemas');
+  const plan = buildGenerationPlan(
+    project,
+    await emitDynamicRbacFlowSchemas({ objects, serviceTag: project.serviceTag }),
+    { managedPaths: rbacFlowSchemaManagedPaths(objects), managedScope: 'rbac-flow-schemas' }
+  );
+  const files = await commitArtifacts(plan);
+
+  return { project, files };
+}

package/src/emit/rbac/rbacFlowTag.js

@@ -0,0 +1,7 @@
+export function rbacFlowTag(object) {
+  const objectType = object?.objectType;
+  if (typeof objectType !== 'string' || objectType.trim() === '') {
+    throw new TypeError('RBAC ObjectSchema.objectType must be a non-empty string');
+  }
+  return `${objectType[0].toUpperCase()}${objectType.slice(1)}RbacFlow`;
+}

package/src/emit/rbac/templates/CreateTargetRole_HdrSqs.ejs

@@ -0,0 +1,24 @@
+import { middlewareHandler as middleware } from '@izara_project/izara-middleware';
+import { recordHandlerSharedLib } from '@izara_project/izara-core-library-record-handler';
+import callingFlowSharedLib from '@izara_project/izara-core-library-calling-flow';
+import ProcessCreateTargetRole from './ProcessCreateTargetRole_Main.js';
+
+middleware.setValidatorSchema(recordHandlerSharedLib.baseValidatorSchema());
+
+export const main = middleware.wrap(async event => Promise.all(event.Records.map(async record => {
+  await recordHandlerSharedLib.validateRecord(
+    record,
+    'ProcessCreateTargetRoleHdrSqs',
+    {},
+    null
+  );
+  return recordHandlerSharedLib.recordHandler(
+    record,
+    ProcessCreateTargetRole,
+    'ProcessCreateTargetRoleHdrSqs',
+    [
+      record.body.Message,
+      callingFlowSharedLib.addCallingFlowToPassOnProperties(record.body.Message)
+    ]
+  );
+})));

package/src/emit/rbac/templates/CreateTargetRole_Main.ejs

@@ -0,0 +1,25 @@
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { identifierUuid } from '@izara_project/izara-shared-core';
+import { consts } from '@izara_project/izara-core-library-core';
+
+export default async function ProcessCreateTargetRole(_izContext, requestParams) {
+  try {
+    const userId = _izContext.correlationIds.get(consts.BASE_USER_ID);
+    const { roleName } = requestParams;
+    const roleId = identifierUuid();
+    await dynamodbSharedLib.putItem(
+      _izContext,
+      dynamodbSharedLib.tableName(_izContext, 'TargetRoles'),
+      { targetId: userId, roleIdKey: `${userId}_${roleId}`, roleName }
+    );
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: { roleId } },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(_izContext, 'CreateTargetRole_Out')
+    });
+  } catch (error) {
+    _izContext.logger.error('[Rbac:ProcessCreateTargetRole] error:', error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/DynamicRbacFlowSchema.ejs

@@ -0,0 +1,5 @@
+/**
+ * GENERATED RBAC FLOW SCHEMA
+ * Action: <%- flowTag %>
+ */
+export default <%- JSON.stringify(flow, null, 2) %>;