@izara_project/izara-core-generate-service-code 1.0.67 → 1.0.69

package/src/emit/resource/emitResourceArtifacts.js

@@ -1,4 +1,4 @@
-import ejs from 'ejs';
+import ejsLib from 'ejs';
 import { readFile } from 'node:fs/promises';
 
 import {
@@ -13,6 +13,7 @@ import { hasSystemWebSocket } from '../system/emitSystemWebSocketArtifacts.js';
 const TEMPLATE_URL = new URL('./templates/', import.meta.url);
 const RESOURCE_ROOT = 'resource/sls_yaml/generatedCode/source';
 const APP_ROOT = 'app/sls_yaml/generatedCode/source';
+const INITIAL_SETUP_ROOT = 'app/initial_setup/generatedCode/source';
 const CRUD_ACTIONS = ['Create', 'Update', 'Delete', 'Get'];
 const RELATIONSHIP_ACTIONS = [
   'CreateRelationship',
@@ -83,13 +84,15 @@ export async function emitResourceArtifacts({
     throw new TypeError('objects, relationships, and flows must be arrays');
   }
   const state = createResourceState({ objects, relationships, flows });
-  const [inSqs, out, dynamo, iam] = await Promise.all([
+  const [inSqs, out, dynamo, iam, lambdaRoleConfig, s3] = await Promise.all([
     renderInSqs(state),
     renderOut(state),
     renderDynamo(state),
-    renderIam(state)
+    renderIam(state),
+    renderLambdaRoleConfig(state),
+    renderS3(state)
   ]);
-  return [
+  const artifacts = [
     {
       path: `${RESOURCE_ROOT}/generated-sns-in-sqs.yml`,
       content: normalizeYaml(inSqs)
@@ -105,15 +108,28 @@ export async function emitResourceArtifacts({
     {
       path: `${APP_ROOT}/generate-shared-resource.yml`,
       content: normalizeYaml(iam)
+    },
+    {
+      path: `${INITIAL_SETUP_ROOT}/generatedLambdaRoleServiceConfig.js`,
+      content: lambdaRoleConfig
     }
   ];
+  if (state.s3Buckets.length > 0) {
+    artifacts.push({
+      path: `${RESOURCE_ROOT}/generated-s3.yml`,
+      content: normalizeYaml(s3)
+    });
+  }
+  return artifacts;
 }
 
 export const resourceArtifactPaths = [
   `${RESOURCE_ROOT}/generated-sns-in-sqs.yml`,
   `${RESOURCE_ROOT}/generated-sns-out.yml`,
   `${RESOURCE_ROOT}/generated-dynamoDB-table.yml`,
-  `${APP_ROOT}/generate-shared-resource.yml`
+  `${RESOURCE_ROOT}/generated-s3.yml`,
+  `${APP_ROOT}/generate-shared-resource.yml`,
+  `${INITIAL_SETUP_ROOT}/generatedLambdaRoleServiceConfig.js`
 ];
 
 function createResourceState({ objects, relationships, flows }) {
@@ -121,61 +137,60 @@ function createResourceState({ objects, relationships, flows }) {
   const rbac = objects.some(hasRbacAddOn);
   const ownTopics = new Set(
     flows
-      .filter(flow => includesEvent(flow, 'ownTopic'))
-      .map(flow => upperFirst(flow.flowTag))
+      .filter((flow) => includesEvent(flow, 'ownTopic'))
+      .map((flow) => upperFirst(flow.flowTag))
   );
   const sqsQueues = new Set([
     ...LEGACY_PROCESS_QUEUES,
     ...flows
-      .filter(flow => includesEvent(flow, 'extTopic'))
-      .map(flow => `Process${upperFirst(flow.flowTag)}HdrSqs`)
+      .filter((flow) => includesEvent(flow, 'extTopic'))
+      .map((flow) => `Process${upperFirst(flow.flowTag)}HdrSqs`)
   ]);
-  flowExtTopicSteps(flows).forEach(({ flowTag, stepName }) =>
-    sqsQueues.add(`${flowTag}${stepName}HdrSqs`)
-  );
-  flows
-    .filter(flow => includesEvent(flow, 's3'))
-    .forEach(flow => {
-      const tag = upperFirst(flow.flowTag);
-      sqsQueues.add(`${tag}CreatePreSignUrlHdrSqs`);
-      sqsQueues.add(`${tag}ReservedLimitHdrSqs`);
-      sqsQueues.add(`${tag}ConfirmAfterUploadHdrSqs`);
-    });
+  for (const { flowTag, stepName } of flowExtTopicSteps(flows)) {
+    sqsQueues.add(`${flowTag}${stepName}HdrSqs`);
+  }
+  for (const flow of flows.filter((flow) => includesEvent(flow, 's3'))) {
+    const tag = upperFirst(flow.flowTag);
+    sqsQueues.add(`${tag}CreatePreSignUrlHdrSqs`);
+    sqsQueues.add(`${tag}ReservedLimitHdrSqs`);
+    sqsQueues.add(`${tag}ConfirmAfterUploadHdrSqs`);
+  }
   const dsqQueues = new Set(
     flows
-      .filter(flow => includesEvent(flow, 'dsq'))
-      .map(flow => `${upperFirst(flow.flowTag)}HdrDsq`)
-  );
-  flowDsqSteps(flows).forEach(({ flowTag, stepName }) =>
-    dsqQueues.add(`${flowTag}${stepName}HdrDsq`)
+      .filter((flow) => includesEvent(flow, 'dsq'))
+      .map((flow) => `${upperFirst(flow.flowTag)}HdrDsq`)
   );
+  for (const { flowTag, stepName } of flowDsqSteps(flows)) {
+    dsqQueues.add(`${flowTag}${stepName}HdrDsq`);
+  }
   if (crud) {
-    CRUD_ACTIONS.forEach(action => ownTopics.add(action));
-    ['Create', 'Update', 'Delete'].forEach(action =>
-      sqsQueues.add(`${action}CompleteHdrSqs`)
-    );
+    for (const action of CRUD_ACTIONS) {
+      ownTopics.add(action);
+    }
+    for (const action of ['Create', 'Update', 'Delete']) {
+      sqsQueues.add(`${action}CompleteHdrSqs`);
+    }
   }
   if (relationships.length > 0) {
-    RELATIONSHIP_ACTIONS.forEach(action => {
+    for (const action of RELATIONSHIP_ACTIONS) {
       ownTopics.add(action);
       sqsQueues.add(`${action}CompleteHdrSqs`);
-    });
+    }
     dsqQueues.add('GetRelationshipHdrDsq');
   }
   if (rbac) {
-    RBAC_ACTIONS.forEach(action => {
+    for (const action of RBAC_ACTIONS) {
       ownTopics.add(action);
       sqsQueues.add(`Process${action}HdrSqs`);
-    });
-    objects
-      .filter(hasRbacAddOn)
-      .forEach(object =>
-        sqsQueues.add(`Process${upperFirst(object.objectType)}RbacFlowHdrInv`)
-      );
+    }
+    for (const object of objects.filter(hasRbacAddOn)) {
+      const flowTag = upperFirst(object.objectType) + 'RbacFlow';
+      ownTopics.add(flowTag);
+    }
   }
   const beforeLogicalByAction = new Map();
   for (const flow of flows.filter(
-    flow => flow?.generatedCodeConfig?.codeHookTag === 'beforeLogical'
+    (flow) => flow?.generatedCodeConfig?.codeHookTag === 'beforeLogical'
   )) {
     const action = upperFirst(flow.generatedCodeConfig.generatedCodeTag);
     if (!action || !flow.flowTag) continue;
@@ -188,38 +203,43 @@ function createResourceState({ objects, relationships, flows }) {
   );
   const customRoles = [
     ...new Set([
-      ...supportedCustomFlows(flows).map(flow =>
+      ...supportedCustomFlows(flows).map((flow) =>
         customFlowRoleName(flow.flowTag)
       ),
-      ...generatedOwnTopicFlows(flows).map(flow =>
+      ...generatedOwnTopicFlows(flows).map((flow) =>
         customFlowRoleName(flow.flowTag)
       ),
       ...flowExtTopicSteps(flows).map(({ flow }) =>
         customFlowRoleName(flow.flowTag)
       ),
-      ...flowDsqSteps(flows).map(({ flow }) =>
-        customFlowRoleName(flow.flowTag)
-      )
+      ...flowDsqSteps(flows).map(({ flow }) => customFlowRoleName(flow.flowTag))
     ])
   ];
   const websocket = hasSystemWebSocket(flows, {
     includeRelationshipOwnTopic: true
   });
-  const webSocketRoles = new Set(websocket ? ['WebSocketMainRole'] : []);
+  const webSocketRoles = new Set();
+  if (websocket) {
+    webSocketRoles.add('WebSocketMainRole');
+  }
   if (crud) webSocketRoles.add('FlowObjectsRole');
   if (relationships.length > 0) webSocketRoles.add('FlowRelationshipRole');
   if (rbac) webSocketRoles.add('FlowRbacRole');
-  [...supportedCustomFlows(flows), ...generatedOwnTopicFlows(flows)]
-    .filter(
-      flow => includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3')
-    )
-    .forEach(flow => webSocketRoles.add(customFlowRoleName(flow.flowTag)));
+  const filteredWsFlows = [
+    ...supportedCustomFlows(flows),
+    ...generatedOwnTopicFlows(flows)
+  ].filter(
+    (flow) => includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3')
+  );
+  for (const flow of filteredWsFlows) {
+    webSocketRoles.add(customFlowRoleName(flow.flowTag));
+  }
   const outTopics = new Set([
     ...ownTopics,
     ...beforeLogical.map(({ action }) => action),
     ...flows
-      .filter(flow => flow?.outputTopic && upperFirst(flow.flowTag))
-      .map(flow => upperFirst(flow.flowTag))
+      .filter((flow) => flow?.outputTopic && upperFirst(flow.flowTag))
+      .map((flow) => upperFirst(flow.flowTag))
   ]);
   const objectTableNames = [...collectTables(objects).keys()];
   const relationshipTableNames = [...collectTables(relationships).keys()];
@@ -227,9 +247,37 @@ function createResourceState({ objects, relationships, flows }) {
     ...collectTables(objects),
     ...collectTables(relationships)
   ]);
+  const externalDynamoTables = objects.flatMap(
+    (object) => object.externalDynamoResources ?? []
+  );
+  const s3Buckets = flows
+    .filter((flow) => includesEvent(flow, 's3') && flow.createBucket === true)
+    .map((flow) => flow.bucketName)
+    .filter(Boolean);
+  const s3FlowTags = flows
+    .filter((flow) => includesEvent(flow, 's3'))
+    .map((flow) => upperFirst(flow.flowTag));
+  const s3Subscriptions = flows
+    .filter((flow) => includesEvent(flow, 's3'))
+    .map((flow) => {
+      const tag = upperFirst(flow.flowTag);
+      const topicName = flow.outputTopic
+        ? flow.outputTopic.startsWith('Out')
+          ? flow.outputTopic
+          : `Out${upperFirst(flow.outputTopic)}`
+        : flow.s3Subscription?.topicName || 'OutCreate';
+      const queueName =
+        flow.s3Subscription?.queueName || `${tag}ReservedLimitHdrSqs`;
+      const subscriptionName =
+        flow.s3Subscription?.subscriptionName ||
+        `Subscription${topicName}To${queueName}`;
+      return { subscriptionName, topicName, queueName };
+    });
   return {
     crud,
     rbac,
+    s3Subscriptions,
+    s3FlowTags,
     relationships: relationships.length > 0,
     ownTopics: [...ownTopics].filter(Boolean).sort(),
     sqsQueues: [...sqsQueues].filter(Boolean).sort(),
@@ -241,9 +289,13 @@ function createResourceState({ objects, relationships, flows }) {
     webSocketSubscriptions: websocket
       ? [...outTopics]
           .filter(
-            topic =>
+            (topic) =>
               flows.some(
-                flow => (flow?.outputTopic || (includesEvent(flow, 'ownTopic') && flow.initiateBy === 'user')) && upperFirst(flow.flowTag) === topic
+                (flow) =>
+                  (flow?.outputTopic ||
+                    (includesEvent(flow, 'ownTopic') &&
+                      flow.initiateBy === 'user')) &&
+                  upperFirst(flow.flowTag) === topic
               ) ||
               (relationships.length > 0 &&
                 topic !== 'GetRelationship' &&
@@ -259,29 +311,43 @@ function createResourceState({ objects, relationships, flows }) {
     allTableNames: [...new Set([...SYSTEM_TABLES, ...tableMap.keys()])].sort(),
     objectTableNames,
     relationshipTableNames,
+    externalDynamoTables,
     objectTablesByType: new Map(
       objects
-        .map(object => [
+        .map((object) => [
           object.objectType,
           Object.values(object.storageResources ?? {}).find(
-            resource => resource?.storageType === 'dynamoDB'
+            (resource) => resource?.storageType === 'dynamoDB'
           )?.tableName
         ])
         .filter(([, tableName]) => tableName)
     ),
+    s3Buckets,
     flows
   };
 }
 
+async function renderS3(state) {
+  if (state.s3Buckets.length === 0) return 'Resources:';
+  const template = await readFile(
+    new URL('S3Bucket_Yaml.ejs', TEMPLATE_URL),
+    'utf8'
+  );
+  const chunks = await Promise.all(
+    state.s3Buckets.map((bucketName) => ejsLib.render(template, { bucketName }))
+  );
+  return `Resources:\n${chunks.join('\n')}`;
+}
+
 async function renderInSqs(state) {
   const chunks = await Promise.all([
-    ...state.ownTopics.map(queueName =>
+    ...state.ownTopics.map((queueName) =>
       render('ResourceYaml.ejs', { queueName })
     ),
-    ...state.sqsQueues.map(queueName =>
+    ...state.sqsQueues.map((queueName) =>
       render('ResourceSqsYaml.ejs', { queueName })
     ),
-    ...state.dsqQueues.map(queueName =>
+    ...state.dsqQueues.map((queueName) =>
       render('ResourceSqsYaml.ejs', { queueName })
     ),
     ...state.beforeLogical.map(({ action, flowTags }) =>
@@ -298,17 +364,39 @@ async function renderInSqs(state) {
         ]
       : [])
   ]);
-  return `Resources:\n${chunks.join('\n')}\n${state.webSocketSubscriptions.map(renderWebSocketSubscription).join('\n')}`;
+  const webSocketSubscriptions = await Promise.all(
+    state.webSocketSubscriptions.map((topicName) =>
+      renderWebSocketSubscription(topicName)
+    )
+  );
+  const s3Subscriptions = await Promise.all(
+    (state.s3Subscriptions ?? []).map(
+      ({ subscriptionName, topicName, queueName }) =>
+        render('S3Subscription_Yaml.ejs', {
+          subscriptionName,
+          topicName,
+          queueName
+        })
+    )
+  );
+  const parts = [chunks.join('\n')];
+  if (webSocketSubscriptions.length > 0) {
+    parts.push(webSocketSubscriptions.join('\n'));
+  }
+  if (s3Subscriptions.length > 0) {
+    parts.push(s3Subscriptions.join('\n'));
+  }
+  return `Resources:\n${parts.join('\n')}`;
 }
 
 async function renderOut(state) {
-  return `Resources:\n${(await Promise.all(state.outTopics.map(topicName => render('FlowOut_Yaml.ejs', { topicName })))).join('\n')}`;
+  return `Resources:\n${(await Promise.all(state.outTopics.map((topicName) => render('FlowOut_Yaml.ejs', { topicName })))).join('\n')}`;
 }
 
 async function renderDynamo(state) {
   const [system, ...tables] = await Promise.all([
     render('SystemDynamoDB_Yaml.ejs', {}),
-    ...state.tables.map(table => render('DynamoDBTable_Yaml.ejs', table))
+    ...state.tables.map((table) => render('DynamoDBTable_Yaml.ejs', table))
   ]);
   return `${system}\n${tables.join('\n')}`;
 }
@@ -321,13 +409,26 @@ async function renderIam(state) {
   if (state.websocket) roles.push('WebSocketMainRole');
   roles.push(...state.customRoles);
   return render('SharedResource_Yaml.ejs', {
-    roles: roles.sort().map(roleName => ({
+    roles: roles.sort().map((roleName) => ({
       roleName,
       statements: roleStatements(state, roleName)
     }))
   });
 }
 
+async function renderLambdaRoleConfig(state) {
+  const s3Flows = state.flows
+    .filter((flow) => includesEvent(flow, 's3'))
+    .map((flow) => ({
+      roleName: upperFirst(flow.flowTag)
+    }));
+  return render('GeneratedLambdaRoleServiceConfig.ejs', {
+    crud: state.crud,
+    relationships: state.relationships,
+    s3Flows
+  });
+}
+
 function roleStatements(state, roleName) {
   const statements = [];
   if (roleNeedsSchemaRead(state, roleName)) {
@@ -338,11 +439,10 @@ function roleStatements(state, roleName) {
       ]
     });
   }
-  addStatement(
-    statements,
-    dynamoActionsForRole(roleName),
-    dynamoArns(roleTableNames(state, roleName))
-  );
+  addStatement(statements, dynamoActionsForRole(roleName), [
+    ...dynamoArns(roleTableNames(state, roleName)),
+    ...externalDynamoArns(roleExternalDynamoTables(state, roleName))
+  ]);
   addStatement(
     statements,
     SQS_CONSUMER_ACTIONS,
@@ -402,7 +502,7 @@ function roleTableNames(state, roleName) {
       'LogicalResultsData'
     ];
   const flow = state.flows.find(
-    candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
   );
   if (!flow) return [];
   const tables = [];
@@ -427,68 +527,91 @@ function dynamoActionsForRole(roleName) {
 }
 
 function roleQueueNames(state, roleName) {
-  if (roleName === 'ProcFindDataRole') return LEGACY_PROCESS_QUEUES;
-  if (roleName === 'WebSocketMainRole')
-    return state.websocket ? ['WebSocketCompleteHdrSqs'] : [];
-  if (roleName === 'FlowObjectsRole')
+  if (roleName === 'ProcFindDataRole') {
+    return LEGACY_PROCESS_QUEUES;
+  }
+  if (roleName === 'WebSocketMainRole') {
+    if (state.websocket) {
+      return ['WebSocketCompleteHdrSqs'];
+    }
+    return [];
+  }
+  if (roleName === 'FlowObjectsRole') {
     return [
-      ...CRUD_ACTIONS.map(action => `${action}HdrSqs`),
-      ...CRUD_ACTIONS.filter(action => action !== 'Get').map(
-        action => `${action}CompleteHdrSqs`
+      ...CRUD_ACTIONS.map((action) => `${action}HdrSqs`),
+      ...CRUD_ACTIONS.filter((action) => action !== 'Get').map(
+        (action) => `${action}CompleteHdrSqs`
       ),
       ...state.beforeLogical
         .filter(({ action }) => CRUD_ACTIONS.includes(action))
         .map(({ action }) => `${action}BeforeLogicalHdrSqs`)
     ];
-  if (roleName === 'FlowRelationshipRole')
+  }
+  if (roleName === 'FlowRelationshipRole') {
     return [
-      ...RELATIONSHIP_ACTIONS.flatMap(action => [
+      ...RELATIONSHIP_ACTIONS.flatMap((action) => [
         `${action}HdrSqs`,
         `${action}CompleteHdrSqs`
       ]),
       'GetRelationshipHdrDsq'
     ];
-  if (roleName === 'FlowRbacRole')
-    return RBAC_ACTIONS.flatMap(action => [
+  }
+  if (roleName === 'FlowRbacRole') {
+    return RBAC_ACTIONS.flatMap((action) => [
       `${action}HdrSqs`,
       `Process${action}HdrSqs`
     ]);
+  }
   const flow = state.flows.find(
-    candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
   );
-  if (!flow) return [];
+  if (!flow) {
+    return [];
+  }
   const tag = upperFirst(flow.flowTag);
-  return [
-    ...(includesEvent(flow, 'extTopic') ? [`${tag}HdrSqs`] : []),
-    ...(includesEvent(flow, 'ownTopic') ? [`${tag}HdrSqs`] : []),
-    ...(includesEvent(flow, 'dsq') ? [`${tag}HdrDsq`] : []),
+  const queueList = [];
+  if (includesEvent(flow, 'extTopic')) {
+    queueList.push(`${tag}HdrSqs`);
+  }
+  if (includesEvent(flow, 'ownTopic')) {
+    queueList.push(`${tag}HdrSqs`);
+  }
+  if (includesEvent(flow, 'dsq')) {
+    queueList.push(`${tag}HdrDsq`);
+  }
+  queueList.push(
     ...flowExtTopicSteps([flow]).map(
       ({ flowTag, stepName }) => `${flowTag}${stepName}HdrSqs`
-    ),
+    )
+  );
+  queueList.push(
     ...flowDsqSteps([flow]).map(
       ({ flowTag, stepName }) => `${flowTag}${stepName}HdrDsq`
-    ),
+    )
+  );
+  queueList.push(
     ...state.sqsQueues.filter(
-      queueName => includesEvent(flow, 's3') && queueName.startsWith(tag)
+      (queueName) => includesEvent(flow, 's3') && queueName.startsWith(tag)
     )
-  ];
+  );
+  return queueList;
 }
 
 function roleTopicNames(state, roleName) {
   if (roleName === 'ProcFindDataRole') return [];
   if (roleName === 'FlowObjectsRole')
-    return state.outTopics.filter(topic => CRUD_ACTIONS.includes(topic));
+    return state.outTopics.filter((topic) => CRUD_ACTIONS.includes(topic));
   if (roleName === 'FlowRelationshipRole')
-    return state.outTopics.filter(topic =>
+    return state.outTopics.filter((topic) =>
       RELATIONSHIP_ACTIONS.includes(topic)
     );
   if (roleName === 'FlowRbacRole')
-    return state.outTopics.filter(topic => RBAC_ACTIONS.includes(topic));
+    return state.outTopics.filter((topic) => RBAC_ACTIONS.includes(topic));
   const flow = state.flows.find(
-    candidate => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
   );
   return flow
-    ? state.outTopics.filter(topic => topic === upperFirst(flow.flowTag))
+    ? state.outTopics.filter((topic) => topic === upperFirst(flow.flowTag))
     : [];
 }
 
@@ -496,16 +619,62 @@ function dynamoArns(tableNames) {
   return [...new Set(tableNames)]
     .sort()
     .map(
-      tableName =>
+      (tableName) =>
         `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${'${self:custom.iz_resourcePrefix}'}${tableName}`
     );
 }
 
+/**
+ * Generates DynamoDB ARNs for tables that belong to a parent service
+ * (via extendObjType). Uses the parent serviceTag instead of the
+ * current service's resourcePrefix, because those tables are owned
+ * by a different CloudFormation stack.
+ *
+ * ARN format:
+ *   ...table/{parentServiceTag}_{iz_stage}_{tableName}
+ */
+function externalDynamoArns(externalTables) {
+  const seen = new Set();
+  const unique = [];
+  for (const table of externalTables) {
+    const dedupeKey = `${table.serviceTag}::${table.tableName}`;
+    if (!seen.has(dedupeKey)) {
+      seen.add(dedupeKey);
+      unique.push(table);
+    }
+  }
+  return unique
+    .sort((a, b) =>
+      `${a.serviceTag}_${a.tableName}`.localeCompare(
+        `${b.serviceTag}_${b.tableName}`
+      )
+    )
+    .map(
+      ({ serviceTag, tableName }) =>
+        `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${serviceTag}${'${self:custom.iz_stage}'}${tableName}`
+    );
+}
+
+/**
+ * Returns the external DynamoDB table references (cross-service)
+ * that should be accessible from a given IAM role.
+ */
+function roleExternalDynamoTables(state, roleName) {
+  if (
+    roleName === 'FlowObjectsRole' ||
+    roleName === 'FlowRelationshipRole' ||
+    roleName === 'ProcFindDataRole'
+  ) {
+    return state.externalDynamoTables;
+  }
+  return [];
+}
+
 function queueArns(queueNames) {
   return [...new Set(queueNames)]
     .sort()
     .map(
-      queueName =>
+      (queueName) =>
         `arn:aws:sqs:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_resourcePrefix}'}${queueName}`
     );
 }
@@ -514,13 +683,13 @@ function topicArns(topicNames) {
   return [...new Set(topicNames)]
     .sort()
     .map(
-      topic =>
+      (topic) =>
         `arn:aws:sns:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_serviceTag}'}_${'${self:custom.iz_stage}'}_${topic}_Out`
     );
 }
 
 function renderWebSocketSubscription(topicName) {
-  return `##===== WebSocket completion subscription\n  SubscriptionToOut${topicName}WebSocketComplete:\n    Type: AWS::SNS::Subscription\n    Properties:\n      TopicArn: !Ref Out${topicName}\n      Endpoint: "arn:aws:sqs:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_resourcePrefix}'}WebSocketCompleteHdrSqs"\n      Protocol: "sqs"`;
+  return render('WebSocketSubscription_Yaml.ejs', { topicName });
 }
 
 function collectTables(schemas) {
@@ -533,13 +702,13 @@ function collectTables(schemas) {
     const pk =
       keyName(
         identifiers.find(
-          identifier =>
+          (identifier) =>
             identifier.type === 'partitionKey' ||
             identifier.type === 'identifier'
         )
       ) ?? 'PK';
     const sk = keyName(
-      identifiers.find(identifier => identifier.type === 'sortKey')
+      identifiers.find((identifier) => identifier.type === 'sortKey')
     );
     for (const resource of Object.values(schema.storageResources)) {
       if (
@@ -554,13 +723,13 @@ function collectTables(schemas) {
 }
 
 function keyName(identifier) {
-  if (!identifier) return undefined;
+  if (!identifier) return null;
   return (
     identifier.name ??
     identifier.fieldName ??
     (Array.isArray(identifier.fieldNames)
       ? identifier.fieldNames.join(identifier.deliminator ?? '_')
-      : undefined)
+      : null)
   );
 }
 
@@ -573,7 +742,7 @@ function isCrudObject(object) {
 function hasRbacAddOn(object) {
   return (
     Array.isArray(object?.addOnDataStructure) &&
-    object.addOnDataStructure.some(addOn => addOn?.type === 'rbac')
+    object.addOnDataStructure.some((addOn) => addOn?.type === 'rbac')
   );
 }
 function includesEvent(flow, event) {
@@ -588,7 +757,7 @@ function normalizeYaml(content) {
   return `${content.trimEnd()}\n`;
 }
 async function render(templateName, data) {
-  return ejs.render(
+  return ejsLib.render(
     await readFile(new URL(templateName, TEMPLATE_URL), 'utf8'),
     { resourceQueueName: data.queueName, ...data }
   );