@izara_project/izara-core-generate-service-code 1.0.78 → 1.0.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@izara_project/izara-core-generate-service-code",
-  "version": "1.0.78",
+  "version": "1.0.80",
   "description": "Code for locally generating per service files",
   "homepage": "https://bitbucket.org/izara-core-support-services/izara-core-support-services-generate-service-code#readme",
   "repository": {
@@ -13,7 +13,7 @@
   "exports": "./index.js",
   "main": "index.js",
   "scripts": {
-    "test": "jest",
+    "test": "node --test",
     "format:ejs": "node scripts/format-ejs.js"
   },
   "jest": {

package/src/compile/flowValidator.js

@@ -0,0 +1,163 @@
+export function validateFlowSchema(flowSchema) {
+  if (!flowSchema || typeof flowSchema !== 'object') {
+    throw new TypeError('flowSchema must be an object');
+  }
+
+  const steps = flowSchema.flowSteps;
+  if (!Array.isArray(steps) || steps.length === 0) {
+    throw new Error(
+      'FlowSchema validation error: flowSteps must be a non-empty array'
+    );
+  }
+
+  const entryStep = steps[0];
+  if (
+    !entryStep ||
+    typeof entryStep !== 'object' ||
+    entryStep.stepName !== 'Start'
+  ) {
+    throw new Error(
+      "FlowSchema validation error: Entry step flowSteps[0] must have stepName fixed to 'Start'"
+    );
+  }
+
+  if (
+    entryStep.previousSteps &&
+    Array.isArray(entryStep.previousSteps) &&
+    entryStep.previousSteps.length > 0
+  ) {
+    throw new Error(
+      "FlowSchema validation error: Entry step flowSteps[0] must not define 'previousSteps'"
+    );
+  }
+
+  if (entryStep.event) {
+    throw new Error(
+      "FlowSchema validation error: Entry step flowSteps[0] must not define step-level 'event'"
+    );
+  }
+
+  for (let idx = 0; idx < steps.length; idx++) {
+    const step = steps[idx];
+    if (!step || typeof step !== 'object') {
+      throw new Error(
+        `FlowSchema validation error: flowSteps[${idx}] must be an object`
+      );
+    }
+
+    if (Array.isArray(step.nextSteps) && step.nextSteps.length > 0) {
+      for (let nIdx = 0; nIdx < step.nextSteps.length; nIdx++) {
+        const item = step.nextSteps[nIdx];
+        if (!item || typeof item !== 'object') {
+          throw new Error(
+            `FlowSchema validation error: flowSteps[${idx}].nextSteps[${nIdx}] must be an object`
+          );
+        }
+        if (
+          item.targetType !== 'ownTopic' &&
+          item.targetType !== 'extTopic' &&
+          item.targetType !== 'lambdaSyncInv'
+        ) {
+          throw new Error(
+            `FlowSchema validation error: flowSteps[${idx}].nextSteps[${nIdx}] must have targetType ('ownTopic' | 'extTopic' | 'lambdaSyncInv')`
+          );
+        }
+        if (item.targetType === 'ownTopic') {
+          if (
+            typeof item.stepName !== 'string' ||
+            item.stepName.trim() === ''
+          ) {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].nextSteps[${nIdx}] ownTopic target requires non-empty 'stepName'`
+            );
+          }
+        } else if (item.targetType === 'extTopic') {
+          if (
+            typeof item.serviceTag !== 'string' ||
+            item.serviceTag.trim() === ''
+          ) {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].nextSteps[${nIdx}] extTopic target requires non-empty 'serviceTag'`
+            );
+          }
+          if (
+            typeof item.topicName !== 'string' ||
+            item.topicName.trim() === ''
+          ) {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].nextSteps[${nIdx}] extTopic target requires non-empty 'topicName'`
+            );
+          }
+          if (
+            !Array.isArray(item.toStepNames) ||
+            item.toStepNames.length === 0
+          ) {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].nextSteps[${nIdx}] extTopic target requires non-empty 'toStepNames' array`
+            );
+          }
+        } else if (item.targetType === 'lambdaSyncInv') {
+          const fnName = item.functionName || item.topicName || item.topic;
+          if (typeof fnName !== 'string' || fnName.trim() === '') {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].nextSteps[${nIdx}] lambdaSyncInv target requires non-empty 'functionName'`
+            );
+          }
+        }
+      }
+    }
+
+    if (Array.isArray(step.previousSteps) && step.previousSteps.length > 0) {
+      for (let pIdx = 0; pIdx < step.previousSteps.length; pIdx++) {
+        const item = step.previousSteps[pIdx];
+        if (!item || typeof item !== 'object') {
+          throw new Error(
+            `FlowSchema validation error: flowSteps[${idx}].previousSteps[${pIdx}] must be an object`
+          );
+        }
+        if (item.sourceType !== 'ownTopic' && item.sourceType !== 'extTopic') {
+          throw new Error(
+            `FlowSchema validation error: flowSteps[${idx}].previousSteps[${pIdx}] must have sourceType ('ownTopic' | 'extTopic')`
+          );
+        }
+        if (item.sourceType === 'ownTopic') {
+          if (
+            typeof item.stepName !== 'string' ||
+            item.stepName.trim() === ''
+          ) {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].previousSteps[${pIdx}] ownTopic source requires non-empty 'stepName'`
+            );
+          }
+        } else if (item.sourceType === 'extTopic') {
+          if (
+            typeof item.serviceTag !== 'string' ||
+            item.serviceTag.trim() === ''
+          ) {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].previousSteps[${pIdx}] extTopic source requires non-empty 'serviceTag'`
+            );
+          }
+          if (
+            typeof item.topicName !== 'string' ||
+            item.topicName.trim() === ''
+          ) {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].previousSteps[${pIdx}] extTopic source requires non-empty 'topicName'`
+            );
+          }
+          if (
+            !Array.isArray(item.fromStepNames) ||
+            item.fromStepNames.length === 0
+          ) {
+            throw new Error(
+              `FlowSchema validation error: flowSteps[${idx}].previousSteps[${pIdx}] extTopic source requires non-empty 'fromStepNames' array`
+            );
+          }
+        }
+      }
+    }
+  }
+
+  return true;
+}

package/src/compile/loadSchemas.js

@@ -7,6 +7,7 @@ import {
 } from '@izara_project/izara-core-library-service-schemas';
 import { s3 } from '@izara_project/izara-core-library-s3';
 import Logger from '@izara_project/izara-core-library-logger';
+import { validateFlowSchema } from './flowValidator.js';
 
 export async function loadLocalSchemaDirectory(project, directoryName) {
   const directoryPath = join(project.schemaRoot, directoryName);
@@ -42,6 +43,16 @@ export async function loadLocalSchemaDirectory(project, directoryName) {
       loadedSchemas = module.default;
     }
 
+    if (directoryName === 'FlowSchemas') {
+      for (const schema of loadedSchemas) {
+        if (Object.prototype.hasOwnProperty.call(schema?.generatedCodeConfig ?? {}, 'codeHookTag')) {
+          throw new Error(
+            `Unsupported FlowHook configuration in ${entry.name}: generatedCodeConfig.codeHookTag is no longer supported`
+          );
+        }
+      }
+    }
+
     if (process.env.NODE_ENV && process.env.NODE_ENV !== 'test') {
       for (const schema of loadedSchemas) {
         let status = true;
@@ -69,6 +80,9 @@ export async function loadLocalSchemaDirectory(project, directoryName) {
             { logger: Logger },
             schema
           );
+          if (status) {
+            validateFlowSchema(schema);
+          }
         }
 
         if (!status) {
@@ -159,10 +173,7 @@ export async function resolveExtendedObjectSchemas(
       }
     }
 
-    if (
-      currentSchema.hasOwnProperty('belongTo') &&
-      currentSchema.belongTo
-    ) {
+    if (currentSchema.hasOwnProperty('belongTo') && currentSchema.belongTo) {
       const belongToTarget = Array.isArray(currentSchema.belongTo)
         ? currentSchema.belongTo[0]
         : currentSchema.belongTo;
@@ -269,4 +280,3 @@ export async function resolveGraphServiceTags(
 
   return Array.from(resolvedTags);
 }
-

package/src/emit/coreFunction/emitCoreFunctionArtifacts.js

@@ -9,7 +9,44 @@ const SRC_ROOT = 'app/src/generatedCode/CoreFunctions';
 const INITIAL_SETUP_ROOT = 'app/initial_setup/generatedCode/source';
 const INITIAL_SETUP_DATA_ROOT = 'app/initial_setup/generatedCode/data';
 
-function _extractDynamoTableNames(objects = []) {
+function hasSelfRbacAddOn(object) {
+  return (
+    Array.isArray(object?.addOnDataStructure) &&
+    object.addOnDataStructure.some((addOn) => addOn?.type === 'rbac')
+  );
+}
+
+function hasRbacAddOn(object, objects = []) {
+  const selfHasRbac = hasSelfRbacAddOn(object);
+  const belongToTargets = object?.belongTo
+    ? Array.isArray(object.belongTo)
+      ? object.belongTo
+      : [object.belongTo]
+    : [];
+  const belongToHasRbac =
+    (Array.isArray(object?.belongToSchema?.addOnDataStructure) &&
+      object.belongToSchema.addOnDataStructure.some(
+        (addOn) => addOn?.type === 'rbac'
+      )) ||
+    belongToTargets.some((target) => {
+      if (target?.serviceTag === 'UserAccount') return true;
+      const matched = objects.find(
+        (candidate) =>
+          candidate?.serviceTag === target?.serviceTag &&
+          candidate?.objectType === target?.objectType
+      );
+      return hasSelfRbacAddOn(matched);
+    });
+  return selfHasRbac || belongToHasRbac;
+}
+
+function _extractDynamoTableNames({
+  objects = [],
+  relationships = [],
+  flows = [],
+  rbac = false,
+  s3Flows = []
+} = {}) {
   const dynamoTableNames = new Set();
   for (const obj of objects || []) {
     if (obj && obj.storageResources) {
@@ -26,18 +63,95 @@ function _extractDynamoTableNames(objects = []) {
       }
     }
   }
+  for (const rel of relationships || []) {
+    if (rel && rel.storageResources) {
+      for (const res of Object.values(rel.storageResources)) {
+        if (
+          res &&
+          res.tableName &&
+          (res.storageType === 'dynamo' ||
+            res.storageType === 'dynamoDB' ||
+            !res.storageType)
+        ) {
+          dynamoTableNames.add(res.tableName);
+        }
+      }
+    }
+  }
+  for (const flow of flows || []) {
+    if (flow && flow.storageResources) {
+      for (const res of Object.values(flow.storageResources)) {
+        if (
+          res &&
+          res.tableName &&
+          (res.storageType === 'dynamo' ||
+            res.storageType === 'dynamoDB' ||
+            !res.storageType)
+        ) {
+          dynamoTableNames.add(res.tableName);
+        }
+      }
+    }
+  }
+  if (rbac) {
+    dynamoTableNames.add('TargetRoles');
+    dynamoTableNames.add('RolePermissions');
+    dynamoTableNames.add('RoleUsers');
+    dynamoTableNames.add('UserRoles');
+    dynamoTableNames.add('RbacPermissionCaches');
+  }
+  if ((s3Flows || []).length > 0) {
+    dynamoTableNames.add('ReservedDataMain');
+  }
   return dynamoTableNames;
 }
 
 export function coreFunctionManagedPaths(
-  objects = [],
+  firstArg = [],
   objectGraphServiceTags = [],
-  relationshipGraphServiceTags = []
+  relationshipGraphServiceTags = [],
+  relationships = [],
+  flows = [],
+  rbac = false
 ) {
-  const dynamoTableNames = _extractDynamoTableNames(objects);
+  let objects = [];
+  let objTags = objectGraphServiceTags;
+  let relTags = relationshipGraphServiceTags;
+  let rels = relationships;
+  let fls = flows;
+  let isRbac = rbac;
+
+  if (firstArg && typeof firstArg === 'object' && !Array.isArray(firstArg)) {
+    objects = firstArg.objects || [];
+    objTags = firstArg.objectGraphServiceTags || [];
+    relTags = firstArg.relationshipGraphServiceTags || [];
+    rels = firstArg.relationships || [];
+    fls = firstArg.flows || [];
+    isRbac =
+      firstArg.project?.rbac === true ||
+      (objects || []).some((o) => o.rbac === true) ||
+      (fls || []).some((f) => f.type === 'rbac');
+  } else {
+    objects = firstArg || [];
+    isRbac =
+      (objects || []).some((o) => o.rbac === true) ||
+      (fls || []).some((f) => f.type === 'rbac');
+  }
+
+  const s3Flows = (fls || []).filter(
+    (flow) => Array.isArray(flow?.event) && flow.event.includes('s3')
+  );
+
+  const dynamoTableNames = _extractDynamoTableNames({
+    objects,
+    relationships: rels,
+    flows: fls,
+    rbac: isRbac,
+    s3Flows
+  });
   const graphTags = new Set([
-    ...(objectGraphServiceTags || []),
-    ...(relationshipGraphServiceTags || [])
+    ...(objTags || []),
+    ...(relTags || [])
   ]);
 
   const paths = [
@@ -91,6 +205,14 @@ export async function emitCoreFunctionArtifacts({ project, objects = [], relatio
       return { roleName };
     });
 
+  const rbac =
+    project?.rbac === true ||
+    (objects || []).some((o) => hasRbacAddOn(o, objects)) ||
+    (flows || []).some((f) => f.type === 'rbac');
+  const rbacValidatorServiceTags = Array.from(new Set(
+    (objects || []).filter(o => o.belongTo?.serviceTag && o.belongTo.serviceTag !== 'Rbac').map(o => o.belongTo.serviceTag)
+  )).sort();
+
   const state = { 
     project, 
     objects, 
@@ -101,6 +223,8 @@ export async function emitCoreFunctionArtifacts({ project, objects = [], relatio
     relationshipGraphServiceTags,
     crud,
     hasRelationships,
+    rbac,
+    rbacValidatorServiceTags,
     s3Flows,
     hasGenerateGraph: objects.length > 0 || relationships.length > 0
   };
@@ -250,7 +374,13 @@ export async function emitCoreFunctionArtifacts({ project, objects = [], relatio
     writeWhenFileExist: false
   });
 
-  const dynamoTableNames = _extractDynamoTableNames(objects);
+  const dynamoTableNames = _extractDynamoTableNames({
+    objects,
+    relationships,
+    flows,
+    rbac,
+    s3Flows
+  });
   for (const tableName of dynamoTableNames) {
     baseArtifacts.push({
       path: `${INITIAL_SETUP_DATA_ROOT}/dynamo/test/${tableName}.json`,

package/src/emit/coreFunction/templates/InitialSetupConfig.ejs

@@ -26,12 +26,12 @@ const _izContext = { logger: Logger };
 // ============================================================
 // External Service Config
 // ============================================================
-// <#InitialSetupConfig_ExternalServices#>
+//(<InitialSetupConfig_ExternalServices>)
 const externalServices = {
   serviceTagGraphHandler: 'GraphHandler',
   serviceTagRbac: 'Rbac'
 };
-// <#/InitialSetupConfig_ExternalServices#>
+//(</InitialSetupConfig_ExternalServices>)
 
 // ============================================================
 // Table Configs (generated + manual merge)
@@ -47,39 +47,68 @@ const externalServices = {
       });
     }
   });
+  (relationships || []).forEach(rel => {
+    if (rel && rel.storageResources) {
+      Object.values(rel.storageResources).forEach(res => {
+        if (res && res.tableName && (res.storageType === 'dynamo' || res.storageType === 'dynamoDB' || !res.storageType)) {
+          dynamoTableNames.add(res.tableName);
+        }
+      });
+    }
+  });
+  (flows || []).forEach(flow => {
+    if (flow && flow.storageResources) {
+      Object.values(flow.storageResources).forEach(res => {
+        if (res && res.tableName && (res.storageType === 'dynamo' || res.storageType === 'dynamoDB' || !res.storageType)) {
+          dynamoTableNames.add(res.tableName);
+        }
+      });
+    }
+  });
+  if (typeof rbac !== 'undefined' && rbac) {
+    dynamoTableNames.add('TargetRoles');
+    dynamoTableNames.add('RolePermissions');
+    dynamoTableNames.add('RoleUsers');
+    dynamoTableNames.add('UserRoles');
+  }
+  if (typeof s3Flows !== 'undefined' && (s3Flows || []).length > 0) {
+    dynamoTableNames.add('ReservedDataMain');
+  }
 -%>
 const tableConfigs = {
   prod: {
     Config: {
-      // <#InitialSetupConfig_Prod_Config_TableConfig#>
-      // <#/InitialSetupConfig_Prod_Config_TableConfig#>
+      //(<InitialSetupConfig_Prod_Config_TableConfig>)
+      //(</InitialSetupConfig_Prod_Config_TableConfig>)
     },
 <% dynamoTableNames.forEach(tableName => { -%>
     <%= tableName %>: {
-      // <#InitialSetupConfig_Prod_<%= tableName %>_TableConfig#>
-      // <#/InitialSetupConfig_Prod_<%= tableName %>_TableConfig#>
+      //(<InitialSetupConfig_Prod_<%= tableName %>_TableConfig>)
+      //(</InitialSetupConfig_Prod_<%= tableName %>_TableConfig>)
     },
 <% }); -%>
-    // <#InitialSetupConfig_ExtraProdTableConfigs#>
-    // <#/InitialSetupConfig_ExtraProdTableConfigs#>
+    //(<InitialSetupConfig_ExtraProdTableConfigs>)
+    //(</InitialSetupConfig_ExtraProdTableConfigs>)
   },
   test: {
     Config: {
-      // <#InitialSetupConfig_Test_Config_TableConfig#>
+      //(<InitialSetupConfig_Test_Config_TableConfig>)
       clearDataWhenRefresh: true,
       rawSource: false
-      // <#/InitialSetupConfig_Test_Config_TableConfig#>
+      //(</InitialSetupConfig_Test_Config_TableConfig>)
     },
 <% dynamoTableNames.forEach(tableName => { -%>
     <%= tableName %>: {
-      // <#InitialSetupConfig_Test_<%= tableName %>_TableConfig#>
+      //(<InitialSetupConfig_Test_<%= tableName %>_TableConfig>)
       clearDataWhenRefresh: true
-      // <#/InitialSetupConfig_Test_<%= tableName %>_TableConfig#>
+      //(</InitialSetupConfig_Test_<%= tableName %>_TableConfig>)
     },
 <% }); -%>
-    // <#InitialSetupConfig_ExtraTestTableConfigs#>
-    // <#/InitialSetupConfig_ExtraTestTableConfigs#>
-  }
+    //(<InitialSetupConfig_ExtraTestTableConfigs>)
+    //(</InitialSetupConfig_ExtraTestTableConfigs>)
+  },
+  //(<InitialSetupConfig_ExtraTableConfigs>)
+  //(</InitialSetupConfig_ExtraTableConfigs>)
 };
 
 // ============================================================
@@ -100,6 +129,37 @@ const tableConfigs = {
     nodeSubs.push({ serviceTag: tag, topicName: 'UpdateNode_Out', sqsEndpoint: 'UpdateCompleteHdrSqs' });
     nodeSubs.push({ serviceTag: tag, topicName: 'CreateNode_Out', sqsEndpoint: 'CreateCompleteHdrSqs' });
   });
+
+  const customSubs = [];
+  (flows || []).forEach(function(flow) {
+    if (flow && flow.outputTopic && !flow.generatedCodeConfig && typeof flow.flowTag === 'string' && flow.flowTag) {
+      const tag = flow.flowTag[0].toUpperCase() + flow.flowTag.slice(1);
+      const serviceTag = flow.objType?.serviceTag || (project && project.serviceTag) || '';
+      const topicName = typeof flow.outputTopic === 'string'
+        ? (flow.outputTopic.endsWith('_Out') ? flow.outputTopic : `${flow.outputTopic}_Out`)
+        : `${tag}_Out`;
+      customSubs.push({
+        serviceTag: serviceTag,
+        topicName: topicName,
+        sqsEndpoint: `${tag}CompleteHdrSqs`
+      });
+    }
+  });
+
+  const rbacSubs = [];
+  if (crud && typeof rbacValidatorServiceTags !== 'undefined' && rbacValidatorServiceTags && rbacValidatorServiceTags.length > 0) {
+    const allRbacTags = Array.from(new Set(['Rbac', ...rbacValidatorServiceTags]));
+    const hasGraph = typeof objectGraphServiceTags !== 'undefined' && objectGraphServiceTags && objectGraphServiceTags.length > 0;
+    const updateEndpoint = hasGraph ? 'UpdateRbacCallbackHdrSqs' : 'UpdateCompleteHdrSqs';
+    const deleteEndpoint = hasGraph ? 'DeleteRbacCallbackHdrSqs' : 'DeleteCompleteHdrSqs';
+    allRbacTags.forEach(function(tag) {
+      if (!hasGraph) {
+        rbacSubs.push({ serviceTag: tag, topicName: 'ValidatorRbac_Out', sqsEndpoint: 'CreateCompleteHdrSqs' });
+      }
+      rbacSubs.push({ serviceTag: tag, topicName: 'ValidatorRbac_Out', sqsEndpoint: updateEndpoint });
+      rbacSubs.push({ serviceTag: tag, topicName: 'ValidatorRbac_Out', sqsEndpoint: deleteEndpoint });
+    });
+  }
 -%>
 const snsTopicSubscriptions = [
 <% if (relSubs.length > 0) { -%>
@@ -126,6 +186,32 @@ const snsTopicSubscriptions = [
     sqsEndpoint: '<%= sub.sqsEndpoint %>'
   },
 <% }); -%>
+<% } -%>
+<% if (customSubs.length > 0) { -%>
+
+  // ------------------------------------------------------------
+  // Custom Flow Subscriptions
+  // ------------------------------------------------------------
+<% customSubs.forEach(function(sub, idx) { -%>
+  {
+    serviceTag: '<%= sub.serviceTag %>',
+    topicName: '<%= sub.topicName %>',
+    sqsEndpoint: '<%= sub.sqsEndpoint %>'
+  },
+<% }); -%>
+<% } -%>
+<% if (rbacSubs.length > 0) { -%>
+
+  // ------------------------------------------------------------
+  // RBAC Validator Subscriptions
+  // ------------------------------------------------------------
+<% rbacSubs.forEach(function(sub, idx) { -%>
+  {
+    serviceTag: '<%= sub.serviceTag %>',
+    topicName: '<%= sub.topicName %>',
+    sqsEndpoint: '<%= sub.sqsEndpoint %>'
+  },
+<% }); -%>
 <% } -%>
 
   //(<additionalSubscription>)
@@ -137,10 +223,11 @@ const snsTopicSubscriptions = [
 // ============================================================
 function roleConfigs() {
   const externalLambdaRole = [
-<% if (crud && objectGraphServiceTags && objectGraphServiceTags.length > 0) { -%>
+<% if (crud) { -%>
     {
       roleName: 'FlowObjects',
       statement: [
+<% if (objectGraphServiceTags && objectGraphServiceTags.length > 0) { -%>
 <% objectGraphServiceTags.forEach(function(tag, idx) { -%>
         {
           Sid: 'FlowObjectsInvokeGetNode<%= tag %>',
@@ -161,14 +248,46 @@ function roleConfigs() {
           ]
         },
 <% }); -%>
+<% } -%>
+<% if (rbac || (rbacValidatorServiceTags && rbacValidatorServiceTags.length > 0)) { -%>
+        {
+          Sid: 'FlowObjectsPublishValidatorRbacTopics',
+          Effect: 'Allow',
+          Action: ['sns:Publish'],
+          Resource: [
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
+          ]
+        },
+<% } -%>
         //(<createFlowObjectsRole>)
         //(</createFlowObjectsRole>)
       ]
     },
 
+    <% if (rbac) { -%>
+    {
+      roleName: 'FlowRbac',
+      statement: [
+        {
+          Sid: 'FlowRbacPublishValidatorRbacTopics',
+          Effect: 'Allow',
+          Action: ['sns:Publish'],
+          Resource: [
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
+          ]
+        }
+        //(<createFlowRbacRole>)
+        //(</createFlowRbacRole>)
+      ]
+    },
+    <% } -%>
+
     {
       roleName: 'ProcFindData',
       statement: [
+<% if (objectGraphServiceTags && objectGraphServiceTags.length > 0) { -%>
 <% objectGraphServiceTags.forEach(function(tag, idx) { -%>
         {
           Sid: 'ProcFindDataInvokeGetNode<%= tag %>',
@@ -179,6 +298,7 @@ function roleConfigs() {
           ]
         }
 <% }); -%>
+<% } -%>
         //(<createProcFindDataRole>)
         //(</createProcFindDataRole>)
       ]
@@ -303,7 +423,7 @@ function roleConfigs() {
           comma = ',';
         }
 -%>
-            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, '<%- item.topic %>'<%- tagArg %>)}`<%= comma %>
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, '<%- item.functionName || item.topicName || item.topic %>'<%- tagArg %>)}`<%= comma %>
 <%    } -%>
           ]
         }