@izara_project/izara-core-generate-service-code 1.0.66 → 1.0.68

package/src/emit/resource/emitResourceArtifacts.js

@@ -1,37 +1,122 @@
 import ejs from 'ejs';
 import { readFile } from 'node:fs/promises';
 
-import { customFlowRoleName, flowExtTopicSteps, generatedOwnTopicFlows, supportedCustomFlows, triggerCacheFlows, triggerCacheQueueNames } from '../custom/customFlows.js';
+import {
+  customFlowRoleName,
+  flowDsqSteps,
+  flowExtTopicSteps,
+  generatedOwnTopicFlows,
+  supportedCustomFlows
+} from '../custom/customFlows.js';
 import { hasSystemWebSocket } from '../system/emitSystemWebSocketArtifacts.js';
 
 const TEMPLATE_URL = new URL('./templates/', import.meta.url);
 const RESOURCE_ROOT = 'resource/sls_yaml/generatedCode/source';
 const APP_ROOT = 'app/sls_yaml/generatedCode/source';
+const INITIAL_SETUP_ROOT = 'app/initial_setup/generatedCode/source';
 const CRUD_ACTIONS = ['Create', 'Update', 'Delete', 'Get'];
-const RELATIONSHIP_ACTIONS = ['CreateRelationship', 'UpdateRelationship', 'DeleteRelationship', 'GetRelationship', 'ChangeRelationship', 'MoveRelationship'];
-const RBAC_ACTIONS = ['CreateTargetRole', 'ListTargetRole', 'DeleteTargetRole', 'CreateRolePermissions', 'ListRolePermissions', 'DeleteRolePermissions', 'CreateUserRole', 'ListUserInRoles', 'DeleteUserFromRole'];
-const SYSTEM_TABLES = ['WebSocketTask', 'UserUploadRecords', 'RegisterRecords', 'AwaitingMultipleSteps', 'AwaitingMultipleStepByPending', 'FindDataMain', 'LogicalResultsMain', 'LogicalResultsData', 'AwaitingStep', 'TargetRoles', 'RolePermissions', 'RoleUsers', 'UserRoles'];
-const RBAC_TABLES = ['TargetRoles', 'RolePermissions', 'RoleUsers', 'UserRoles', 'WebSocketTask'];
-const LEGACY_PROCESS_QUEUES = ['FindDataHdrSqs', 'ProcessLogicalHdrSqs', 'PaginateProcessLogicalHdrDsq', 'PaginateProcessLogicalHdrSqs'];
-const DYNAMO_ACTIONS = ['dynamodb:DeleteItem', 'dynamodb:GetItem', 'dynamodb:PutItem', 'dynamodb:Query', 'dynamodb:UpdateItem'];
-const SQS_CONSUMER_ACTIONS = ['sqs:DeleteMessage', 'sqs:GetQueueAttributes', 'sqs:ReceiveMessage'];
+const RELATIONSHIP_ACTIONS = [
+  'CreateRelationship',
+  'UpdateRelationship',
+  'DeleteRelationship',
+  'GetRelationship',
+  'ChangeRelationship',
+  'MoveRelationship'
+];
+const RBAC_ACTIONS = [
+  'CreateTargetRole',
+  'ListTargetRole',
+  'DeleteTargetRole',
+  'CreateRolePermissions',
+  'ListRolePermissions',
+  'DeleteRolePermissions',
+  'CreateUserRole',
+  'ListUserInRoles',
+  'DeleteUserFromRole'
+];
+const SYSTEM_TABLES = [
+  'WebSocketTask',
+  'UserUploadRecords',
+  'RegisterRecords',
+  'AwaitingMultipleSteps',
+  'AwaitingMultipleStepByPending',
+  'FindDataMain',
+  'LogicalResultsMain',
+  'LogicalResultsData',
+  'AwaitingStep',
+  'TargetRoles',
+  'RolePermissions',
+  'RoleUsers',
+  'UserRoles'
+];
+const RBAC_TABLES = [
+  'TargetRoles',
+  'RolePermissions',
+  'RoleUsers',
+  'UserRoles',
+  'WebSocketTask'
+];
+const LEGACY_PROCESS_QUEUES = [
+  'FindDataHdrSqs',
+  'ProcessLogicalHdrSqs',
+  'PaginateProcessLogicalHdrDsq',
+  'PaginateProcessLogicalHdrSqs'
+];
+const DYNAMO_ACTIONS = [
+  'dynamodb:DeleteItem',
+  'dynamodb:GetItem',
+  'dynamodb:PutItem',
+  'dynamodb:Query',
+  'dynamodb:UpdateItem'
+];
+const SQS_CONSUMER_ACTIONS = [
+  'sqs:DeleteMessage',
+  'sqs:GetQueueAttributes',
+  'sqs:ReceiveMessage'
+];
 
-export async function emitResourceArtifacts({ objects, relationships, flows = [] }) {
+export async function emitResourceArtifacts({
+  objects,
+  relationships,
+  flows = []
+}) {
   if (![objects, relationships, flows].every(Array.isArray)) {
     throw new TypeError('objects, relationships, and flows must be arrays');
   }
   const state = createResourceState({ objects, relationships, flows });
-  const [inSqs, out, dynamo, iam] = await Promise.all([
+  const [inSqs, out, dynamo, iam, lambdaRoleConfig, s3] = await Promise.all([
     renderInSqs(state),
     renderOut(state),
     renderDynamo(state),
-    renderIam(state)
+    renderIam(state),
+    renderLambdaRoleConfig(state),
+    renderS3(state)
   ]);
   return [
-    { path: `${RESOURCE_ROOT}/generated-sns-in-sqs.yml`, content: normalizeYaml(inSqs) },
-    { path: `${RESOURCE_ROOT}/generated-sns-out.yml`, content: normalizeYaml(out) },
-    { path: `${RESOURCE_ROOT}/generated-dynamoDB-table.yml`, content: normalizeYaml(dynamo) },
-    { path: `${APP_ROOT}/generate-shared-resource.yml`, content: normalizeYaml(iam) }
+    {
+      path: `${RESOURCE_ROOT}/generated-sns-in-sqs.yml`,
+      content: normalizeYaml(inSqs)
+    },
+    {
+      path: `${RESOURCE_ROOT}/generated-sns-out.yml`,
+      content: normalizeYaml(out)
+    },
+    {
+      path: `${RESOURCE_ROOT}/generated-dynamoDB-table.yml`,
+      content: normalizeYaml(dynamo)
+    },
+    {
+      path: `${RESOURCE_ROOT}/generated-s3.yml`,
+      content: normalizeYaml(s3)
+    },
+    {
+      path: `${APP_ROOT}/generate-shared-resource.yml`,
+      content: normalizeYaml(iam)
+    },
+    {
+      path: `${INITIAL_SETUP_ROOT}/generatedLambdaRoleServiceConfig.js`,
+      content: lambdaRoleConfig
+    }
   ];
 }
 
@@ -39,33 +124,49 @@ export const resourceArtifactPaths = [
   `${RESOURCE_ROOT}/generated-sns-in-sqs.yml`,
   `${RESOURCE_ROOT}/generated-sns-out.yml`,
   `${RESOURCE_ROOT}/generated-dynamoDB-table.yml`,
-  `${APP_ROOT}/generate-shared-resource.yml`
+  `${RESOURCE_ROOT}/generated-s3.yml`,
+  `${APP_ROOT}/generate-shared-resource.yml`,
+  `${INITIAL_SETUP_ROOT}/generatedLambdaRoleServiceConfig.js`
 ];
 
 function createResourceState({ objects, relationships, flows }) {
   const crud = objects.some(isCrudObject);
   const rbac = objects.some(hasRbacAddOn);
-  const ownTopics = new Set(flows.filter(flow => includesEvent(flow, 'ownTopic')).map(flow => upperFirst(flow.flowTag)));
+  const ownTopics = new Set(
+    flows
+      .filter(flow => includesEvent(flow, 'ownTopic'))
+      .map(flow => upperFirst(flow.flowTag))
+  );
   const sqsQueues = new Set([
     ...LEGACY_PROCESS_QUEUES,
-    ...flows.filter(flow => includesEvent(flow, 'extTopic')).map(flow => `Process${upperFirst(flow.flowTag)}HdrSqs`)
+    ...flows
+      .filter(flow => includesEvent(flow, 'extTopic'))
+      .map(flow => `Process${upperFirst(flow.flowTag)}HdrSqs`)
   ]);
-  const triggerCache = triggerCacheFlows(flows);
-  const triggerCacheQueues = [...new Set(triggerCache.flatMap(triggerCacheQueueNames))].map(queueName => ({
-    queueName,
-    resourceQueueName: queueName.replaceAll('_', '')
-  }));
-  flowExtTopicSteps(flows).forEach(({ flowTag, stepName }) => sqsQueues.add(`${flowTag}${stepName}HdrSqs`));
-  flows.filter(flow => includesEvent(flow, 's3')).forEach(flow => {
-    const tag = upperFirst(flow.flowTag);
-    sqsQueues.add(`${tag}CreatePreSignUrlHdrSqs`);
-    sqsQueues.add(`${tag}ReservedLimitHdrSqs`);
-    sqsQueues.add(`${tag}ConfirmAfterUploadHdrSqs`);
-  });
-  const dsqQueues = new Set(flows.filter(flow => includesEvent(flow, 'dsq')).map(flow => `Process${upperFirst(flow.flowTag)}HdrDsq`));
+  flowExtTopicSteps(flows).forEach(({ flowTag, stepName }) =>
+    sqsQueues.add(`${flowTag}${stepName}HdrSqs`)
+  );
+  flows
+    .filter(flow => includesEvent(flow, 's3'))
+    .forEach(flow => {
+      const tag = upperFirst(flow.flowTag);
+      sqsQueues.add(`${tag}CreatePreSignUrlHdrSqs`);
+      sqsQueues.add(`${tag}ReservedLimitHdrSqs`);
+      sqsQueues.add(`${tag}ConfirmAfterUploadHdrSqs`);
+    });
+  const dsqQueues = new Set(
+    flows
+      .filter(flow => includesEvent(flow, 'dsq'))
+      .map(flow => `${upperFirst(flow.flowTag)}HdrDsq`)
+  );
+  flowDsqSteps(flows).forEach(({ flowTag, stepName }) =>
+    dsqQueues.add(`${flowTag}${stepName}HdrDsq`)
+  );
   if (crud) {
     CRUD_ACTIONS.forEach(action => ownTopics.add(action));
-    ['Create', 'Update', 'Delete'].forEach(action => sqsQueues.add(`${action}CompleteHdrSqs`));
+    ['Create', 'Update', 'Delete'].forEach(action =>
+      sqsQueues.add(`${action}CompleteHdrSqs`)
+    );
   }
   if (relationships.length > 0) {
     RELATIONSHIP_ACTIONS.forEach(action => {
@@ -79,75 +180,157 @@ function createResourceState({ objects, relationships, flows }) {
       ownTopics.add(action);
       sqsQueues.add(`Process${action}HdrSqs`);
     });
-    objects.filter(hasRbacAddOn).forEach(object => sqsQueues.add(`Process${upperFirst(object.objectType)}RbacFlowHdrInv`));
+    objects
+      .filter(hasRbacAddOn)
+      .forEach(object => {
+        const flowTag = upperFirst(object.objectType) + 'RbacFlow';
+        ownTopics.add(flowTag);
+      });
   }
   const beforeLogicalByAction = new Map();
-  for (const flow of flows.filter(flow => flow?.generatedCodeConfig?.codeHookTag === 'beforeLogical')) {
+  for (const flow of flows.filter(
+    flow => flow?.generatedCodeConfig?.codeHookTag === 'beforeLogical'
+  )) {
     const action = upperFirst(flow.generatedCodeConfig.generatedCodeTag);
     if (!action || !flow.flowTag) continue;
     const flowTags = beforeLogicalByAction.get(action) ?? new Set();
     flowTags.add(flow.flowTag);
     beforeLogicalByAction.set(action, flowTags);
   }
-  const beforeLogical = [...beforeLogicalByAction].map(([action, flowTags]) => ({ action, flowTags: [...flowTags].sort() }));
-  const customRoles = [...new Set([
-    ...supportedCustomFlows(flows).map(flow => customFlowRoleName(flow.flowTag)),
-    ...generatedOwnTopicFlows(flows).map(flow => customFlowRoleName(flow.flowTag)),
-    ...flowExtTopicSteps(flows).map(({ flow }) => customFlowRoleName(flow.flowTag)),
-    ...triggerCache.map(flow => customFlowRoleName(flow.flowTag))
-  ])];
-  const websocket = hasSystemWebSocket(flows, { includeRelationshipOwnTopic: relationships.length > 0 });
+  const beforeLogical = [...beforeLogicalByAction].map(
+    ([action, flowTags]) => ({ action, flowTags: [...flowTags].sort() })
+  );
+  const customRoles = [
+    ...new Set([
+      ...supportedCustomFlows(flows).map(flow =>
+        customFlowRoleName(flow.flowTag)
+      ),
+      ...generatedOwnTopicFlows(flows).map(flow =>
+        customFlowRoleName(flow.flowTag)
+      ),
+      ...flowExtTopicSteps(flows).map(({ flow }) =>
+        customFlowRoleName(flow.flowTag)
+      ),
+      ...flowDsqSteps(flows).map(({ flow }) => customFlowRoleName(flow.flowTag))
+    ])
+  ];
+  const websocket = hasSystemWebSocket(flows, {
+    includeRelationshipOwnTopic: true
+  });
   const webSocketRoles = new Set(websocket ? ['WebSocketMainRole'] : []);
   if (crud) webSocketRoles.add('FlowObjectsRole');
   if (relationships.length > 0) webSocketRoles.add('FlowRelationshipRole');
   if (rbac) webSocketRoles.add('FlowRbacRole');
   [...supportedCustomFlows(flows), ...generatedOwnTopicFlows(flows)]
-    .filter(flow => includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3'))
+    .filter(
+      flow => includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3')
+    )
     .forEach(flow => webSocketRoles.add(customFlowRoleName(flow.flowTag)));
   const outTopics = new Set([
     ...ownTopics,
     ...beforeLogical.map(({ action }) => action),
-    ...flows.filter(flow => flow?.outputTopic && upperFirst(flow.flowTag)).map(flow => upperFirst(flow.flowTag))
+    ...flows
+      .filter(flow => flow?.outputTopic && upperFirst(flow.flowTag))
+      .map(flow => upperFirst(flow.flowTag))
   ]);
   const objectTableNames = [...collectTables(objects).keys()];
   const relationshipTableNames = [...collectTables(relationships).keys()];
-  const tableMap = new Map([...collectTables(objects), ...collectTables(relationships)]);
+  const tableMap = new Map([
+    ...collectTables(objects),
+    ...collectTables(relationships)
+  ]);
+  const externalDynamoTables = objects.flatMap(
+    object => object.externalDynamoResources ?? []
+  );
+  const s3Buckets = flows
+    .filter(flow => includesEvent(flow, 's3') && flow.createBucket === true)
+    .map(flow => flow.bucketName)
+    .filter(Boolean);
   return {
     crud,
     rbac,
     relationships: relationships.length > 0,
     ownTopics: [...ownTopics].filter(Boolean).sort(),
     sqsQueues: [...sqsQueues].filter(Boolean).sort(),
-    triggerCacheQueues,
     dsqQueues: [...dsqQueues].filter(Boolean).sort(),
     beforeLogical,
     customRoles,
     websocket,
     webSocketRoles,
     webSocketSubscriptions: websocket
-      ? [...outTopics].filter(topic => (
-        flows.some(flow => flow?.outputTopic && upperFirst(flow.flowTag) === topic) ||
-        (relationships.length > 0 && topic !== 'GetRelationship' && RELATIONSHIP_ACTIONS.includes(topic))
-      )).sort()
+      ? [...outTopics]
+          .filter(
+            topic =>
+              flows.some(
+                flow =>
+                  (flow?.outputTopic ||
+                    (includesEvent(flow, 'ownTopic') &&
+                      flow.initiateBy === 'user')) &&
+                  upperFirst(flow.flowTag) === topic
+              ) ||
+              (relationships.length > 0 &&
+                topic !== 'GetRelationship' &&
+                RELATIONSHIP_ACTIONS.includes(topic))
+          )
+          .sort()
       : [],
     outTopics: [...outTopics].filter(Boolean).sort(),
-    tables: [...tableMap.entries()].map(([tableName, keys]) => ({ tableName, ...keys })),
+    tables: [...tableMap.entries()].map(([tableName, keys]) => ({
+      tableName,
+      ...keys
+    })),
     allTableNames: [...new Set([...SYSTEM_TABLES, ...tableMap.keys()])].sort(),
     objectTableNames,
     relationshipTableNames,
-    objectTablesByType: new Map(objects.map(object => [object.objectType, Object.values(object.storageResources ?? {}).find(resource => resource?.storageType === 'dynamoDB')?.tableName]).filter(([, tableName]) => tableName)),
+    externalDynamoTables,
+    objectTablesByType: new Map(
+      objects
+        .map(object => [
+          object.objectType,
+          Object.values(object.storageResources ?? {}).find(
+            resource => resource?.storageType === 'dynamoDB'
+          )?.tableName
+        ])
+        .filter(([, tableName]) => tableName)
+    ),
+    s3Buckets,
     flows
   };
 }
 
+async function renderS3(state) {
+  if (state.s3Buckets.length === 0) return 'Resources:';
+  const template = await readFile(new URL('S3Bucket_Yaml.ejs', TEMPLATE_URL), 'utf8');
+  const chunks = await Promise.all(
+    state.s3Buckets.map(bucketName => ejs.render(template, { bucketName }))
+  );
+  return `Resources:\n${chunks.join('\n')}`;
+}
+
 async function renderInSqs(state) {
   const chunks = await Promise.all([
-    ...state.ownTopics.map(queueName => render('ResourceYaml.ejs', { queueName })),
-    ...state.sqsQueues.map(queueName => render('ResourceSqsYaml.ejs', { queueName })),
-    ...state.triggerCacheQueues.map(queue => render('ResourceSqsYaml.ejs', queue)),
-    ...state.dsqQueues.map(queueName => render('ResourceSqsYaml.ejs', { queueName })),
-    ...state.beforeLogical.map(({ action, flowTags }) => render('ResourceBeforeLogicalYaml.ejs', { queueName: `${action}BeforeLogical`, flowTags })),
-    ...(state.websocket ? [render('ResourceSqsYaml.ejs', { queueName: 'WebSocketCompleteHdrSqs' })] : [])
+    ...state.ownTopics.map(queueName =>
+      render('ResourceYaml.ejs', { queueName })
+    ),
+    ...state.sqsQueues.map(queueName =>
+      render('ResourceSqsYaml.ejs', { queueName })
+    ),
+    ...state.dsqQueues.map(queueName =>
+      render('ResourceSqsYaml.ejs', { queueName })
+    ),
+    ...state.beforeLogical.map(({ action, flowTags }) =>
+      render('ResourceBeforeLogicalYaml.ejs', {
+        queueName: `${action}BeforeLogical`,
+        flowTags
+      })
+    ),
+    ...(state.websocket
+      ? [
+          render('ResourceSqsYaml.ejs', {
+            queueName: 'WebSocketCompleteHdrSqs'
+          })
+        ]
+      : [])
   ]);
   return `Resources:\n${chunks.join('\n')}\n${state.webSocketSubscriptions.map(renderWebSocketSubscription).join('\n')}`;
 }
@@ -171,19 +354,62 @@ async function renderIam(state) {
   if (state.rbac) roles.push('FlowRbacRole');
   if (state.websocket) roles.push('WebSocketMainRole');
   roles.push(...state.customRoles);
-  return render('SharedResource_Yaml.ejs', { roles: roles.sort().map(roleName => ({ roleName, statements: roleStatements(state, roleName) })) });
+  return render('SharedResource_Yaml.ejs', {
+    roles: roles.sort().map(roleName => ({
+      roleName,
+      statements: roleStatements(state, roleName)
+    }))
+  });
+}
+
+async function renderLambdaRoleConfig(state) {
+  const s3Flows = state.flows
+    .filter(flow => includesEvent(flow, 's3'))
+    .map(flow => ({
+      roleName: upperFirst(flow.flowTag)
+    }));
+  return render('GeneratedLambdaRoleServiceConfig.ejs', {
+    crud: state.crud,
+    relationships: state.relationships,
+    s3Flows
+  });
 }
 
 function roleStatements(state, roleName) {
   const statements = [];
   if (roleNeedsSchemaRead(state, roleName)) {
-    statements.push({ action: ['s3:GetObject'], resource: ['arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/perServiceSchemas/*'] });
+    statements.push({
+      action: ['s3:GetObject'],
+      resource: [
+        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/perServiceSchemas/*'
+      ]
+    });
   }
-  addStatement(statements, dynamoActionsForRole(roleName), dynamoArns(roleTableNames(state, roleName)));
-  addStatement(statements, SQS_CONSUMER_ACTIONS, queueArns(roleQueueNames(state, roleName)));
-  addStatement(statements, ['sns:Publish'], topicArns(roleTopicNames(state, roleName)));
+  addStatement(
+    statements,
+    dynamoActionsForRole(roleName),
+    [
+      ...dynamoArns(roleTableNames(state, roleName)),
+      ...externalDynamoArns(roleExternalDynamoTables(state, roleName))
+    ]
+  );
+  addStatement(
+    statements,
+    SQS_CONSUMER_ACTIONS,
+    queueArns(roleQueueNames(state, roleName))
+  );
+  addStatement(
+    statements,
+    ['sns:Publish'],
+    topicArns(roleTopicNames(state, roleName))
+  );
   if (state.webSocketRoles.has(roleName)) {
-    statements.push({ action: ['execute-api:ManageConnections'], resource: ['arn:aws:execute-api:${self:custom.iz_region}:${self:custom.iz_accountId}:${self:custom.iz_webSocketHostId}/*'] });
+    statements.push({
+      action: ['execute-api:ManageConnections'],
+      resource: [
+        'arn:aws:execute-api:${self:custom.iz_region}:${self:custom.iz_accountId}:*/*'
+      ]
+    });
   }
   return statements;
 }
@@ -199,15 +425,39 @@ function roleNeedsSchemaRead(state, roleName) {
 
 function roleTableNames(state, roleName) {
   if (roleName === 'RegisterRole') return [];
-  if (roleName === 'WebSocketMainRole') return ['UserUploadRecords', 'WebSocketTask'];
-  if (roleName === 'FlowObjectsRole') return [...state.objectTableNames, 'WebSocketTask'];
-  if (roleName === 'FlowRelationshipRole') return [...state.objectTableNames, ...state.relationshipTableNames, 'AwaitingMultipleSteps', 'WebSocketTask'];
+  if (roleName === 'WebSocketMainRole')
+    return ['UserUploadRecords', 'WebSocketTask'];
+  if (roleName === 'FlowObjectsRole')
+    return [
+      ...state.objectTableNames,
+      'AwaitingMultipleSteps',
+      'AwaitingMultipleStepByPending',
+      'WebSocketTask'
+    ];
+  if (roleName === 'FlowRelationshipRole')
+    return [
+      ...state.objectTableNames,
+      ...state.relationshipTableNames,
+      'AwaitingMultipleSteps',
+      'AwaitingMultipleStepByPending',
+      'WebSocketTask'
+    ];
   if (roleName === 'FlowRbacRole') return RBAC_TABLES;
-  if (roleName === 'ProcFindDataRole') return [...state.objectTableNames, ...state.relationshipTableNames, 'FindDataMain', 'LogicalResultsMain', 'LogicalResultsData'];
-  const flow = state.flows.find(candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName);
+  if (roleName === 'ProcFindDataRole')
+    return [
+      ...state.objectTableNames,
+      ...state.relationshipTableNames,
+      'FindDataMain',
+      'LogicalResultsMain',
+      'LogicalResultsData'
+    ];
+  const flow = state.flows.find(
+    candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+  );
   if (!flow) return [];
   const tables = [];
-  if (includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3')) tables.push('WebSocketTask');
+  if (includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3'))
+    tables.push('WebSocketTask');
   if (includesEvent(flow, 's3')) tables.push('UserUploadRecords');
   if (flow.statusType === 'storedCache') {
     const object = state.objectTablesByType.get(flow.objType?.objectType);
@@ -217,56 +467,152 @@ function roleTableNames(state, roleName) {
 }
 
 function dynamoActionsForRole(roleName) {
-  if (roleName === 'ProcFindDataRole') return ['dynamodb:GetItem', 'dynamodb:Query'];
-  if (roleName === 'WebSocketMainRole') return ['dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:Query'];
-  if (roleName === 'FlowRbacRole') return [...DYNAMO_ACTIONS, 'dynamodb:TransactWriteItems'];
+  if (roleName === 'ProcFindDataRole')
+    return ['dynamodb:GetItem', 'dynamodb:Query'];
+  if (roleName === 'WebSocketMainRole')
+    return ['dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:Query'];
+  if (roleName === 'FlowRbacRole')
+    return [...DYNAMO_ACTIONS, 'dynamodb:TransactWriteItems'];
   return DYNAMO_ACTIONS;
 }
 
 function roleQueueNames(state, roleName) {
   if (roleName === 'ProcFindDataRole') return LEGACY_PROCESS_QUEUES;
-  if (roleName === 'WebSocketMainRole') return state.websocket ? ['WebSocketCompleteHdrSqs'] : [];
-  if (roleName === 'FlowObjectsRole') return [
-    ...CRUD_ACTIONS.map(action => `${action}HdrSqs`),
-    ...CRUD_ACTIONS.filter(action => action !== 'Get').map(action => `${action}CompleteHdrSqs`),
-    ...state.beforeLogical.filter(({ action }) => CRUD_ACTIONS.includes(action)).map(({ action }) => `${action}BeforeLogicalHdrSqs`)
-  ];
-  if (roleName === 'FlowRelationshipRole') return [
-    ...RELATIONSHIP_ACTIONS.flatMap(action => [`${action}HdrSqs`, `${action}CompleteHdrSqs`]),
-    'GetRelationshipHdrDsq'
-  ];
-  if (roleName === 'FlowRbacRole') return RBAC_ACTIONS.flatMap(action => [`${action}HdrSqs`, `Process${action}HdrSqs`]);
-  const flow = state.flows.find(candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName);
+  if (roleName === 'WebSocketMainRole')
+    return state.websocket ? ['WebSocketCompleteHdrSqs'] : [];
+  if (roleName === 'FlowObjectsRole')
+    return [
+      ...CRUD_ACTIONS.map(action => `${action}HdrSqs`),
+      ...CRUD_ACTIONS.filter(action => action !== 'Get').map(
+        action => `${action}CompleteHdrSqs`
+      ),
+      ...state.beforeLogical
+        .filter(({ action }) => CRUD_ACTIONS.includes(action))
+        .map(({ action }) => `${action}BeforeLogicalHdrSqs`)
+    ];
+  if (roleName === 'FlowRelationshipRole')
+    return [
+      ...RELATIONSHIP_ACTIONS.flatMap(action => [
+        `${action}HdrSqs`,
+        `${action}CompleteHdrSqs`
+      ]),
+      'GetRelationshipHdrDsq'
+    ];
+  if (roleName === 'FlowRbacRole')
+    return RBAC_ACTIONS.flatMap(action => [
+      `${action}HdrSqs`,
+      `Process${action}HdrSqs`
+    ]);
+  const flow = state.flows.find(
+    candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+  );
   if (!flow) return [];
   const tag = upperFirst(flow.flowTag);
   return [
-    ...(includesEvent(flow, 'extTopic') ? [`Process${tag}HdrSqs`] : []),
+    ...(includesEvent(flow, 'extTopic') ? [`${tag}HdrSqs`] : []),
     ...(includesEvent(flow, 'ownTopic') ? [`${tag}HdrSqs`] : []),
-    ...flowExtTopicSteps([flow]).map(({ flowTag, stepName }) => `${flowTag}${stepName}HdrSqs`),
-    ...state.sqsQueues.filter(queueName => includesEvent(flow, 's3') && queueName.startsWith(tag)),
-    ...(flow.statusType === 'triggerCache' ? triggerCacheQueueNames(flow) : [])
+    ...(includesEvent(flow, 'dsq') ? [`${tag}HdrDsq`] : []),
+    ...flowExtTopicSteps([flow]).map(
+      ({ flowTag, stepName }) => `${flowTag}${stepName}HdrSqs`
+    ),
+    ...flowDsqSteps([flow]).map(
+      ({ flowTag, stepName }) => `${flowTag}${stepName}HdrDsq`
+    ),
+    ...state.sqsQueues.filter(
+      queueName => includesEvent(flow, 's3') && queueName.startsWith(tag)
+    )
   ];
 }
 
 function roleTopicNames(state, roleName) {
   if (roleName === 'ProcFindDataRole') return [];
-  if (roleName === 'FlowObjectsRole') return state.outTopics.filter(topic => CRUD_ACTIONS.includes(topic));
-  if (roleName === 'FlowRelationshipRole') return state.outTopics.filter(topic => RELATIONSHIP_ACTIONS.includes(topic));
-  if (roleName === 'FlowRbacRole') return state.outTopics.filter(topic => RBAC_ACTIONS.includes(topic));
-  const flow = state.flows.find(candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName);
-  return flow ? state.outTopics.filter(topic => topic === upperFirst(flow.flowTag)) : [];
+  if (roleName === 'FlowObjectsRole')
+    return state.outTopics.filter(topic => CRUD_ACTIONS.includes(topic));
+  if (roleName === 'FlowRelationshipRole')
+    return state.outTopics.filter(topic =>
+      RELATIONSHIP_ACTIONS.includes(topic)
+    );
+  if (roleName === 'FlowRbacRole')
+    return state.outTopics.filter(topic => RBAC_ACTIONS.includes(topic));
+  const flow = state.flows.find(
+    candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+  );
+  return flow
+    ? state.outTopics.filter(topic => topic === upperFirst(flow.flowTag))
+    : [];
 }
 
 function dynamoArns(tableNames) {
-  return [...new Set(tableNames)].sort().map(tableName => `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${'${self:custom.iz_resourcePrefix}'}${tableName}`);
+  return [...new Set(tableNames)]
+    .sort()
+    .map(
+      tableName =>
+        `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${'${self:custom.iz_resourcePrefix}'}${tableName}`
+    );
+}
+
+/**
+ * Generates DynamoDB ARNs for tables that belong to a parent service
+ * (via extendObjType). Uses the parent serviceTag instead of the
+ * current service's resourcePrefix, because those tables are owned
+ * by a different CloudFormation stack.
+ *
+ * ARN format:
+ *   ...table/{parentServiceTag}_{iz_stage}_{tableName}
+ */
+function externalDynamoArns(externalTables) {
+  const seen = new Set();
+  const unique = [];
+  for (const table of externalTables) {
+    const dedupeKey = `${table.serviceTag}::${table.tableName}`;
+    if (!seen.has(dedupeKey)) {
+      seen.add(dedupeKey);
+      unique.push(table);
+    }
+  }
+  return unique
+    .sort((a, b) =>
+      `${a.serviceTag}_${a.tableName}`.localeCompare(
+        `${b.serviceTag}_${b.tableName}`
+      )
+    )
+    .map(
+      ({ serviceTag, tableName }) =>
+        `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${serviceTag}${'${self:custom.iz_stage}'}${tableName}`
+    );
+}
+
+/**
+ * Returns the external DynamoDB table references (cross-service)
+ * that should be accessible from a given IAM role.
+ */
+function roleExternalDynamoTables(state, roleName) {
+  if (
+    roleName === 'FlowObjectsRole' ||
+    roleName === 'FlowRelationshipRole' ||
+    roleName === 'ProcFindDataRole'
+  ) {
+    return state.externalDynamoTables;
+  }
+  return [];
 }
 
 function queueArns(queueNames) {
-  return [...new Set(queueNames)].sort().map(queueName => `arn:aws:sqs:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_resourcePrefix}'}${queueName}`);
+  return [...new Set(queueNames)]
+    .sort()
+    .map(
+      queueName =>
+        `arn:aws:sqs:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_resourcePrefix}'}${queueName}`
+    );
 }
 
 function topicArns(topicNames) {
-  return [...new Set(topicNames)].sort().map(topic => `arn:aws:sns:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_serviceTag}'}_${'${self:custom.iz_stage}'}_${topic}_Out`);
+  return [...new Set(topicNames)]
+    .sort()
+    .map(
+      topic =>
+        `arn:aws:sns:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_serviceTag}'}_${'${self:custom.iz_stage}'}_${topic}_Out`
+    );
 }
 
 function renderWebSocketSubscription(topicName) {
@@ -277,11 +623,27 @@ function collectTables(schemas) {
   const tables = new Map();
   for (const schema of schemas) {
     if (!schema?.storageResources) continue;
-    const identifiers = Array.isArray(schema.identifiers) ? schema.identifiers : [];
-    const pk = keyName(identifiers.find(identifier => identifier.type === 'partitionKey' || identifier.type === 'identifier')) ?? 'PK';
-    const sk = keyName(identifiers.find(identifier => identifier.type === 'sortKey'));
+    const identifiers = Array.isArray(schema.identifiers)
+      ? schema.identifiers
+      : [];
+    const pk =
+      keyName(
+        identifiers.find(
+          identifier =>
+            identifier.type === 'partitionKey' ||
+            identifier.type === 'identifier'
+        )
+      ) ?? 'PK';
+    const sk = keyName(
+      identifiers.find(identifier => identifier.type === 'sortKey')
+    );
     for (const resource of Object.values(schema.storageResources)) {
-      if (resource?.storageType === 'dynamoDB' && resource.tableName && !tables.has(resource.tableName)) tables.set(resource.tableName, { pk, sk });
+      if (
+        resource?.storageType === 'dynamoDB' &&
+        resource.tableName &&
+        !tables.has(resource.tableName)
+      )
+        tables.set(resource.tableName, { pk, sk });
     }
   }
   return tables;
@@ -289,12 +651,41 @@ function collectTables(schemas) {
 
 function keyName(identifier) {
   if (!identifier) return undefined;
-  return identifier.name ?? identifier.fieldName ?? (Array.isArray(identifier.fieldNames) ? identifier.fieldNames.join(identifier.deliminator ?? '_') : undefined);
+  return (
+    identifier.name ??
+    identifier.fieldName ??
+    (Array.isArray(identifier.fieldNames)
+      ? identifier.fieldNames.join(identifier.deliminator ?? '_')
+      : undefined)
+  );
 }
 
-function isCrudObject(object) { return object?.generatedBy === 'userGenerated' || object?.generatedBy === 'systemGenerated'; }
-function hasRbacAddOn(object) { return Array.isArray(object?.addOnDataStructure) && object.addOnDataStructure.some(addOn => addOn?.type === 'rbac'); }
-function includesEvent(flow, event) { return Array.isArray(flow?.event) && flow.event.includes(event); }
-function upperFirst(value) { return typeof value === 'string' && value ? value[0].toUpperCase() + value.slice(1) : ''; }
-function normalizeYaml(content) { return `${content.trimEnd()}\n`; }
-async function render(templateName, data) { return ejs.render(await readFile(new URL(templateName, TEMPLATE_URL), 'utf8'), { resourceQueueName: data.queueName, ...data }); }
+function isCrudObject(object) {
+  return (
+    object?.generatedBy === 'userGenerated' ||
+    object?.generatedBy === 'systemGenerated'
+  );
+}
+function hasRbacAddOn(object) {
+  return (
+    Array.isArray(object?.addOnDataStructure) &&
+    object.addOnDataStructure.some(addOn => addOn?.type === 'rbac')
+  );
+}
+function includesEvent(flow, event) {
+  return Array.isArray(flow?.event) && flow.event.includes(event);
+}
+function upperFirst(value) {
+  return typeof value === 'string' && value
+    ? value[0].toUpperCase() + value.slice(1)
+    : '';
+}
+function normalizeYaml(content) {
+  return `${content.trimEnd()}\n`;
+}
+async function render(templateName, data) {
+  return ejs.render(
+    await readFile(new URL(templateName, TEMPLATE_URL), 'utf8'),
+    { resourceQueueName: data.queueName, ...data }
+  );
+}