@izara_project/izara-core-generate-service-code 1.0.78 → 1.0.79

package/src/emit/rbac/emitRbacApplicationArtifacts.js

@@ -17,11 +17,12 @@ export async function emitRbacApplicationArtifacts(objects) {
   if (!Array.isArray(objects)) {
     throw new TypeError('objects must be an array');
   }
-  if (!objects.some(hasRbacAddOn)) {
+  const rbacObjects = objects.filter(hasRbacAddOn);
+  if (rbacObjects.length === 0) {
     return [];
   }
-
   const hasSelfRbac = objects.some(hasSelfRbacAddOn);
+  const flowTags = [...new Set(rbacObjects.map(rbacFlowTag))];
   const handlers = await Promise.all([
     ...(hasSelfRbac
       ? [
@@ -31,7 +32,7 @@ export async function emitRbacApplicationArtifacts(objects) {
           ...USER_ROLE_MUTATIONS.map(createUserRoleMutationHandler)
         ]
       : []),
-    ...objects.filter(hasRbacAddOn).map(createUserRbacFlowHandler)
+    ...flowTags.map(createUserRbacFlowHandler)
   ]);
   return [
     ...handlers.flatMap((handler) => handler.artifacts),
@@ -93,6 +94,10 @@ const STATIC_RBAC_APPLICATION_PATHS = [
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrSqs.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_WbsMain.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js',
+  'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_WbsMain.js',
+  'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_HdrWbs.js',
   ...LIST_DEFINITIONS.flatMap(({ flowTag }) => [
     `app/src/generatedCode/FlowRbac/${flowTag}/source/${flowTag}_Main.js`,
     `app/src/generatedCode/FlowRbac/${flowTag}/source/${flowTag}_HdrSqs.js`,
@@ -118,12 +123,15 @@ export function rbacApplicationManagedPaths(objects = []) {
     throw new TypeError('objects must be an array');
   }
   const rbacObjects = objects.filter(hasRbacAddOn);
-  const sourcePaths = rbacObjects.flatMap((object) => {
-    const flowTag = rbacFlowTag(object);
+  const flowTags = [...new Set(rbacObjects.map(rbacFlowTag))];
+  const sourcePaths = flowTags.flatMap((flowTag) => {
     const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
-    return [`${sourcePath}/${flowTag}_Main.js`, `${sourcePath}/${flowTag}_HdrSqs.js`];
+    return [
+      `${sourcePath}/${flowTag}_Main.js`,
+      `${sourcePath}/${flowTag}_HdrSqs.js`
+    ];
   });
-  return [...STATIC_RBAC_APPLICATION_PATHS, ...sourcePaths];
+  return [...new Set([...STATIC_RBAC_APPLICATION_PATHS, ...sourcePaths])];
 }
 
 async function createTargetRoleHandler() {
@@ -276,8 +284,11 @@ async function createUserRoleMutationHandler(definition) {
   };
 }
 
-async function createUserRbacFlowHandler(object) {
-  const flowTag = rbacFlowTag(object);
+async function createUserRbacFlowHandler(flowTagOrObject) {
+  const flowTag =
+    typeof flowTagOrObject === 'string'
+      ? flowTagOrObject
+      : rbacFlowTag(flowTagOrObject);
   const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
   const handlerPath = `src/generatedCode/FlowRbac/${flowTag}/source`;
   return {
@@ -374,11 +385,5 @@ function hasSelfRbacAddOn(object) {
 }
 
 function hasRbacAddOn(object) {
-  const selfHasRbac = hasSelfRbacAddOn(object);
-  const belongToHasRbac =
-    Array.isArray(object?.belongToSchema?.addOnDataStructure) &&
-    object.belongToSchema.addOnDataStructure.some(
-      (addOn) => addOn?.type === 'rbac'
-    );
-  return selfHasRbac || belongToHasRbac;
+  return hasSelfRbacAddOn(object);
 }

package/src/emit/rbac/rbacFlowTag.js

@@ -1,9 +1,4 @@
 export function rbacFlowTag(object) {
-  const objectType = object?.objectType;
-  if (typeof objectType !== 'string' || objectType.trim() === '') {
-    throw new TypeError(
-      'RBAC ObjectSchema.objectType must be a non-empty string'
-    );
-  }
-  return `${objectType[0].toUpperCase()}${objectType.slice(1)}RbacFlow`;
+  return 'ValidatorRbac';
 }
+

package/src/emit/rbac/templates/UserRbacFlow_Main.ejs

@@ -16,22 +16,121 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
-import { coreConsts } from '@izara_project/izara-core-library-core';
+import { consts } from '@izara_project/izara-core-library-core';
 import { sns } from '@izara_project/izara-core-library-external-request';
 import snsSharedLib from '@izara_project/izara-core-library-sns';
 
+// ── L1 Cache (In-Memory per Lambda Container Instance) ────────────────────────
+const L1_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const l1Cache = new Map();
+
+function _getL1Cache(key) {
+  const entry = l1Cache.get(key);
+  if (!entry) return null;
+  if (entry.expiresAt < Date.now()) {
+    l1Cache.delete(key);
+    return null;
+  }
+  return entry;
+}
+
+function _setL1Cache(key, value) {
+  if (l1Cache.size > 500) {
+    const oldestKey = l1Cache.keys().next().value;
+    if (oldestKey) l1Cache.delete(oldestKey);
+  }
+  l1Cache.set(key, {
+    ...value,
+    expiresAt: Date.now() + L1_TTL_MS
+  });
+}
+
+// ── L2 Cache (Shared DynamoDB TTL Cache) ──────────────────────────────────────
+const L2_TTL_SECONDS = 5 * 60; // 5 minutes
+
+async function _getL2Cache(_izContext, userId, cacheSubKey) {
+  try {
+    const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
+    const result = await dynamodbSharedLib.getItem(_izContext, tableName, {
+      userId,
+      cacheKey: cacheSubKey
+    });
+    if (result && result.ttlTimestamp && result.ttlTimestamp > Math.floor(Date.now() / 1000)) {
+      return {
+        returnValue: {
+          permission: Boolean(result.permission),
+          roleIdKey: result.roleIdKey || '',
+          rbacType: result.rbacType || 'target'
+        },
+        errorsFound: [],
+        status: 'Completed'
+      };
+    }
+  } catch (error) {
+    // If L2 cache table does not exist or fails, safely ignore and continue to DB
+  }
+  return null;
+}
+
+async function _setL2Cache(_izContext, userId, cacheSubKey, value) {
+  try {
+    const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
+    const ttlTimestamp = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
+    await dynamodbSharedLib.putItem(_izContext, tableName, {
+      userId,
+      cacheKey: cacheSubKey,
+      permission: value.returnValue ? value.returnValue.permission : value.permission,
+      roleIdKey: value.returnValue ? value.returnValue.roleIdKey : value.roleIdKey,
+      rbacType: 'target',
+      ttlTimestamp
+    });
+  } catch (error) {
+    // Safely ignore L2 write errors if table is not configured
+  }
+}
+
 export default async function <%- flowTag %>(_izContext, requestParams = {}) {
-  const userId = _izContext.correlationIds.get(coreConsts.BASE_USER_ID);
-  const targetId = _izContext.correlationIds.get(coreConsts.TARGET_ID);
+  const userId = _izContext.correlationIds.get(consts.BASE_USER_ID);
+  const targetId = _izContext.correlationIds.get(consts.TARGET_ID);
   if (!userId || !targetId) {
     throw new Error('Missing required request parameters: userId or targetId');
   }
 
-  const { flowTypeConcat, inputParameterGroups } = requestParams;
+  const { flowTypeConcat, inputParameterGroups, parentFlowId } = requestParams;
   if (!flowTypeConcat) {
     throw new Error('Missing flowTypeConcat in requestParams');
   }
 
+  _izContext.logger.debug('[<%- flowTag %>] requestParams:', {
+    userId,
+    targetId,
+    flowTypeConcat,
+    inputParameterGroups
+  });
+
+  const cacheSubKey = `${targetId}#${flowTypeConcat}#${JSON.stringify(inputParameterGroups || {})}`;
+  const fullCacheKey = `${userId}:${cacheSubKey}`;
+
+  // 1. Check L1 In-Memory Cache
+  const l1Hit = _getL1Cache(fullCacheKey);
+  if (l1Hit) {
+    _izContext.logger.debug('[<%- flowTag %>] L1 Cache hit:', l1Hit);
+    await _publicMessageOut(_izContext, { ...l1Hit, parentFlowId });
+    return;
+  }
+
+  // 2. Check L2 Shared DynamoDB Cache
+  const l2Hit = await _getL2Cache(_izContext, userId, cacheSubKey);
+  if (l2Hit) {
+    _izContext.logger.debug('[<%- flowTag %>] L2 Cache hit:', l2Hit);
+    _setL1Cache(fullCacheKey, l2Hit);
+    await _publicMessageOut(_izContext, { ...l2Hit, parentFlowId });
+    return;
+  }
+
+  _izContext.logger.debug('[<%- flowTag %>] Cache miss — querying DynamoDB');
+
+  // 3. Fallback to DB Query
   const userRolesResult = await dynamodbSharedLib.query(
     _izContext,
     dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
@@ -45,6 +144,8 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     userRoles = userRolesResult.Items;
   }
 
+  _izContext.logger.debug('[<%- flowTag %>] userRoles fetched:', { userRoles });
+
   const targetIdPrefix = `${targetId}_`;
   const targetRoles = [];
   for (const role of userRoles) {
@@ -53,11 +154,25 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     }
   }
 
+  _izContext.logger.debug('[<%- flowTag %>] targetRoles filtered:', {
+    targetIdPrefix,
+    targetRoles
+  });
+
   if (targetRoles.length === 0) {
-    await _publicMessageOut(_izContext, {
-      permission: false,
-      roleIdKey: ''
-    });
+    _izContext.logger.debug('[<%- flowTag %>] no targetRoles found, permission denied');
+    const result = {
+      returnValue: {
+        permission: false,
+        roleIdKey: '',
+        rbacType: 'target'
+      },
+      errorsFound: [],
+      status: 'Completed'
+    };
+    _setL1Cache(fullCacheKey, result);
+    await _setL2Cache(_izContext, userId, cacheSubKey, result);
+    await _publicMessageOut(_izContext, { ...result, parentFlowId });
     return;
   }
 
@@ -74,6 +189,10 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     })
   );
 
+  _izContext.logger.debug('[<%- flowTag %>] rolePermissions fetched:', {
+    rolePermissions
+  });
+
   let matched = null;
   for (const permission of rolePermissions) {
     if (permission && permission.permission === true) {
@@ -88,17 +207,25 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     }
   }
 
-  if (matched) {
-    await _publicMessageOut(_izContext, {
-      permission: true,
-      roleIdKey: matched.roleIdKey
-    });
-  } else {
-    await _publicMessageOut(_izContext, {
-      permission: false,
-      roleIdKey: ''
-    });
-  }
+  const cacheResult = {
+    returnValue: {
+      permission: Boolean(matched),
+      roleIdKey: matched ? matched.roleIdKey : '',
+      rbacType: 'target'
+    },
+    errorsFound: [],
+    status: 'Completed'
+  };
+
+  _izContext.logger.debug('[<%- flowTag %>] validation result:', cacheResult);
+
+  // Store in L1 & L2 Cache
+  _setL1Cache(fullCacheKey, cacheResult);
+  await _setL2Cache(_izContext, userId, cacheSubKey, cacheResult);
+
+  await _publicMessageOut(_izContext, { ...cacheResult, parentFlowId });
+
+  return 'Completed';
 }
 
 async function _publicMessageOut(_izContext, message) {
@@ -108,8 +235,8 @@ async function _publicMessageOut(_izContext, message) {
   );
 
   await sns.publishAsync(_izContext, {
-    topicArn: topicOut,
-    message: JSON.stringify(message)
+    TopicArn: topicOut,
+    Message: JSON.stringify(message)
   });
 }
 

package/src/emit/relationship/emitDynamicRelationshipFlowSchemas.js

@@ -49,11 +49,12 @@ function createDynamicRelationshipFlow(action) {
   const outputTopic = action !== 'GetRelationship';
   const flowSteps = [
     {
-      stepName: 'start',
+      stepName: 'Start',
       ...(outputTopic
         ? {
             nextSteps: [
               {
+                targetType: 'ownTopic',
                 stepName: 'Complete'
               }
             ]
@@ -78,7 +79,8 @@ function createDynamicRelationshipFlow(action) {
       event: ['extTopic'],
       previousSteps: [
         {
-          stepName: 'start'
+          sourceType: 'ownTopic',
+          stepName: 'Start'
         }
       ],
       properties: [

package/src/emit/relationship/templates/ChangeRelationship_Main.ejs

@@ -64,7 +64,7 @@ import { consts as coreConsts } from '@izara_project/izara-core-library-core';
 export default async function <%- functionName %>(
   _izContext,
   requestParams,
-  callingFlowConfig = {}
+  callingFlowConfig = {},
   //(<additionalParams>)
   //(</additionalParams>)
 ) {

package/src/emit/relationship/templates/CreateRelationship_Main.ejs

@@ -61,7 +61,7 @@ const { PREFIX, TOPIC_NAME_GENERATE_CODE, TOPIC_NAME_GRAPH_HANDLER } = consts;
 export default async function createRelationship(
   _izContext,
   requestParams,
-  callingFlowConfig = {}
+  callingFlowConfig = {},
   //(<additionalParams>)
   //(</additionalParams>)
 ) {

package/src/emit/relationship/templates/DeleteRelationship_Main.ejs

@@ -61,7 +61,7 @@ const { PREFIX, TOPIC_NAME_GENERATE_CODE, TOPIC_NAME_GRAPH_HANDLER } = consts;
 export default async function deleteRelationship(
   _izContext,
   requestParams,
-  callingFlowConfig = {}
+  callingFlowConfig = {},
   //(<additionalParams>)
   //(</additionalParams>)
 ) {

package/src/emit/relationship/templates/GetRelationship_Main.ejs

@@ -59,7 +59,7 @@ const { PREFIX, TOPIC_NAME_GENERATE_CODE, TOPIC_NAME_GRAPH_HANDLER } = consts;
 export default async function getRelationship(
   _izContext,
   requestParams,
-  callingFlowConfig = {}
+  callingFlowConfig = {},
   //(<additionalParams>)
   //(</additionalParams>)
 ) {

package/src/emit/relationship/templates/MoveRelationship_Main.ejs

@@ -69,7 +69,7 @@ import { consts as coreConsts } from '@izara_project/izara-core-library-core';
 export default async function moveRelationship(
   _izContext,
   requestParams,
-  callingFlowConfig = {}
+  callingFlowConfig = {},
   //(<additionalParams>)
   //(</additionalParams>)
 ) {

package/src/emit/relationship/templates/UpdateRelationship_Main.ejs

@@ -62,7 +62,7 @@ const { PREFIX, TOPIC_NAME_GENERATE_CODE, TOPIC_NAME_GRAPH_HANDLER } = consts;
 export default async function updateRelationship(
   _izContext,
   requestParams,
-  callingFlowConfig = {}
+  callingFlowConfig = {},
   //(<additionalParams>)
   //(</additionalParams>)
 ) {