@izara_project/izara-core-generate-service-code 1.0.82 → 1.0.84

package/src/emit/custom/emitCustomFlowApplicationArtifacts.js

@@ -16,7 +16,8 @@ import {
   generatedDsqFlows,
   generatedOwnTopicFlows,
   supportedCustomFlows,
-  upperFirst
+  upperFirst,
+  flowHasRbac
 } from './customFlows.js';
 
 const YAML_PATH = 'app/sls_yaml/generatedCode/source/flow-schema.yml';
@@ -67,10 +68,10 @@ export async function emitCustomFlowApplicationArtifacts(
   ];
 }
 
-export function customFlowApplicationManagedPaths(flows) {
+export function customFlowApplicationManagedPaths(flows, { objects = [] } = {}) {
   return [
-    ...supportedCustomFlows(flows).flatMap((flow) => flowPaths(flow)),
-    ...generatedOwnTopicFlows(flows).flatMap(ownTopicRootPaths),
+    ...supportedCustomFlows(flows).flatMap((flow) => flowPaths(flow, objects)),
+    ...generatedOwnTopicFlows(flows).flatMap((flow) => ownTopicRootPaths(flow, objects)),
     ...flowExtTopicSteps(flows).flatMap(({ flowTag, stepName }) => {
       const source = `app/src/generatedCode/FlowSchemas/${flowTag}/source`;
       return [
@@ -122,6 +123,45 @@ async function emitFlow(flow, objects) {
     : [];
   const functions = [];
 
+  const isRbac = flowHasRbac(flow, objects);
+  if (isRbac && !flow.event.includes('ownTopic')) {
+    const rbacStep = (flow.flowSteps || []).find(
+      (s) => typeof s?.stepName === 'string' && s.stepName.toLowerCase() === 'rbaccallback'
+    );
+    const rbacConfig = rbacStep ? stepConfig(flow, rbacStep) : null;
+    artifacts.push(
+      {
+        path: `${source}/${tag}RbacCallback_Main.js`,
+        content: await renderCustom('FlowEndpointRbacCallback_Main.ejs', {
+          flowTag: flow.flowTag,
+          upperCaseFlowTag: tag,
+          functionName: `${tag}RbacCallbackMain`
+        })
+      },
+      {
+        path: `${source}/${tag}RbacCallback_HdrSqs.js`,
+        content: await renderShared('FlowHandler_HdrSqs.ejs', {
+          flowTag: flow.flowTag,
+          flowStepName: 'RbacCallback',
+          mainFileName: `${tag}RbacCallback_Main`,
+          functionName: `${tag}RbacCallbackMain`,
+          queueName: `${tag}RbacCallbackHdrSqs`,
+          startConfig: rbacConfig
+        })
+      }
+    );
+    functions.push(
+      renderSqsFunctionYaml({
+        functionName: `${tag}RbacCallbackHdrSqs`,
+        handlerPath: `${handlerRoot}/${tag}RbacCallback_HdrSqs.main`,
+        roleName: customFlowRoleName(flow.flowTag),
+        queueName: `${tag}RbacCallbackHdrSqs`,
+        flowTag: flow.flowTag,
+        flowStepName: 'RbacCallback'
+      })
+    );
+  }
+
   if (flow.event.includes('extTopic') && !flow.event.includes('ownTopic')) {
     artifacts.push({
       path: `${source}/${process}_HdrSqs.js`,
@@ -219,7 +259,7 @@ async function emitFlow(flow, objects) {
   return { artifacts, functions };
 }
 
-function flowPaths(flow) {
+function flowPaths(flow, objects = []) {
   const tag = upperFirst(flow.flowTag);
   const process = tag;
   const source = `app/src/generatedCode/FlowSchemas/${tag}/source`;
@@ -227,6 +267,12 @@ function flowPaths(flow) {
   if (needsProcessMain(flow)) {
     paths.push(`${source}/${process}_Main.js`);
   }
+  if (flowHasRbac(flow, objects)) {
+    paths.push(
+      `${source}/${tag}RbacCallback_Main.js`,
+      `${source}/${tag}RbacCallback_HdrSqs.js`
+    );
+  }
   if (flow.event.includes('extTopic') && !flow.event.includes('ownTopic')) {
     paths.push(`${source}/${process}_HdrSqs.js`);
   }
@@ -418,68 +464,118 @@ async function emitOwnTopicRoot(flow, objects) {
     upperCaseFlowTag: tag,
     startConfig: _startConfig(flow)
   };
-  return {
-    artifacts: [
-      {
-        path: `${source}/${mainFileName}.js`,
-        content: await renderEndpointMain(flow, mainFileName, objects)
-      },
-      {
-        path: `${source}/${tag}_HdrSqs.js`,
-        content: await renderShared('FlowHandler_HdrSqs.ejs', {
-          ...shared,
-          functionName: mainFileName,
-          mainFileName,
-          queueName: `${tag}HdrSqs`
-        })
-      },
+  const isRbac = flowHasRbac(flow, objects);
+  const ownArtifacts = [
+    {
+      path: `${source}/${mainFileName}.js`,
+      content: await renderEndpointMain(flow, mainFileName, objects)
+    },
+    {
+      path: `${source}/${tag}_HdrSqs.js`,
+      content: await renderShared('FlowHandler_HdrSqs.ejs', {
+        ...shared,
+        functionName: mainFileName,
+        mainFileName,
+        queueName: `${tag}HdrSqs`
+      })
+    },
+    {
+      path: `${source}/${wbsMainFileName}.js`,
+      content: await renderCrudTemplate('FlowMain_Wbs.ejs', {
+        ...shared,
+        functionName: wbsMainFileName
+      })
+    },
+    {
+      path: `${source}/${tag}_HdrWbs.js`,
+      content: await renderCrudTemplate('FlowEndpoint_HdrWbs.ejs', {
+        ...shared,
+        functionName: tag,
+        mainFileName: wbsMainFileName,
+        route: tag
+      })
+    }
+  ];
+
+  const ownFunctions = [
+    renderWbsFunctionYaml({
+      functionName: `${tag}HdrWbs`,
+      handlerPath: `${handlerRoot}/${tag}_HdrWbs.main`,
+      roleName: customFlowRoleName(flow.flowTag),
+      routeName: tag,
+      flowTag: flow.flowTag,
+      flowStepName: ''
+    }),
+    renderSqsFunctionYaml({
+      functionName: `${tag}HdrSqs`,
+      handlerPath: `${handlerRoot}/${tag}_HdrSqs.main`,
+      roleName: customFlowRoleName(flow.flowTag),
+      queueName: `${tag}HdrSqs`,
+      flowTag: flow.flowTag,
+      flowStepName: ''
+    })
+  ];
+
+  if (isRbac) {
+    const rbacStep = (flow.flowSteps || []).find(
+      (s) => typeof s?.stepName === 'string' && s.stepName.toLowerCase() === 'rbaccallback'
+    );
+    const rbacConfig = rbacStep ? stepConfig(flow, rbacStep) : null;
+    ownArtifacts.push(
       {
-        path: `${source}/${wbsMainFileName}.js`,
-        content: await renderCrudTemplate('FlowMain_Wbs.ejs', {
-          ...shared,
-          functionName: wbsMainFileName
+        path: `${source}/${tag}RbacCallback_Main.js`,
+        content: await renderCustom('FlowEndpointRbacCallback_Main.ejs', {
+          flowTag: flow.flowTag,
+          upperCaseFlowTag: tag,
+          functionName: `${tag}RbacCallbackMain`
         })
       },
       {
-        path: `${source}/${tag}_HdrWbs.js`,
-        content: await renderCrudTemplate('FlowEndpoint_HdrWbs.ejs', {
-          ...shared,
-          functionName: tag,
-          mainFileName: wbsMainFileName,
-          route: tag
+        path: `${source}/${tag}RbacCallback_HdrSqs.js`,
+        content: await renderShared('FlowHandler_HdrSqs.ejs', {
+          flowTag: flow.flowTag,
+          flowStepName: 'RbacCallback',
+          mainFileName: `${tag}RbacCallback_Main`,
+          functionName: `${tag}RbacCallbackMain`,
+          queueName: `${tag}RbacCallbackHdrSqs`,
+          startConfig: rbacConfig
         })
       }
-    ],
-    functions: [
-      renderWbsFunctionYaml({
-        functionName: `${tag}HdrWbs`,
-        handlerPath: `${handlerRoot}/${tag}_HdrWbs.main`,
-        roleName: customFlowRoleName(flow.flowTag),
-        routeName: tag,
-        flowTag: flow.flowTag,
-        flowStepName: ''
-      }),
+    );
+    ownFunctions.push(
       renderSqsFunctionYaml({
-        functionName: `${tag}HdrSqs`,
-        handlerPath: `${handlerRoot}/${tag}_HdrSqs.main`,
+        functionName: `${tag}RbacCallbackHdrSqs`,
+        handlerPath: `${handlerRoot}/${tag}RbacCallback_HdrSqs.main`,
         roleName: customFlowRoleName(flow.flowTag),
-        queueName: `${tag}HdrSqs`,
+        queueName: `${tag}RbacCallbackHdrSqs`,
         flowTag: flow.flowTag,
-        flowStepName: ''
+        flowStepName: 'RbacCallback'
       })
-    ]
+    );
+  }
+
+  return {
+    artifacts: ownArtifacts,
+    functions: ownFunctions
   };
 }
 
-function ownTopicRootPaths(flow) {
+function ownTopicRootPaths(flow, objects = []) {
   const tag = upperFirst(flow.flowTag);
   const source = `app/src/generatedCode/FlowSchemas/${tag}/source`;
-  return [
+  const paths = [
     `${source}/${tag}_Main.js`,
     `${source}/${tag}_HdrSqs.js`,
     `${source}/${tag}_WbsMain.js`,
     `${source}/${tag}_HdrWbs.js`
   ];
+  if (flowHasRbac(flow, objects)) {
+    paths.push(
+      `${source}/${tag}RbacCallback_Main.js`,
+      `${source}/${tag}RbacCallback_HdrSqs.js`
+    );
+  }
+  return paths;
 }
 
 function needsProcessMain(flow) {
@@ -694,12 +790,35 @@ function isS3Only(flow) {
   return flow.event.length === 1 && flow.event[0] === 's3';
 }
 
-async function renderEndpointMain(flow, functionName, objects) {
+async function renderEndpointMain(flow, functionName, objects = []) {
+  const isRbac = flowHasRbac(flow, objects);
+  const matchedObject = objects.find(
+    (o) => o.objectType === flow.objType?.objectType
+  );
+  let rbacServiceTag = null;
+  if (matchedObject) {
+    const belongTo = matchedObject.belongTo;
+    if (belongTo) {
+      rbacServiceTag = Array.isArray(belongTo)
+        ? belongTo[0]?.serviceTag
+        : belongTo?.serviceTag;
+    }
+  }
+  if (!rbacServiceTag) {
+    rbacServiceTag = flow.objType?.serviceTag || flow.serviceTag || 'Rbac';
+  }
+
+  const enrichedFlow = {
+    ...flow,
+    isRbac
+  };
+
   return renderCustom('FlowEndpoint_Main.ejs', {
-    flow,
+    flow: enrichedFlow,
     flowTag: flow.flowTag,
     upperCaseFlowTag: upperFirst(flow.flowTag),
     functionName,
+    rbacServiceTag,
     tableName: storedCacheTableName(flow, objects),
     startConfig: _startConfig(flow)
   });

package/src/emit/custom/generateCustomFlowApplicationArtifacts.js

@@ -32,7 +32,7 @@ export async function generateCustomFlowApplicationArtifacts(
       managedPaths: [
         ...systemWebSocketManagedPaths(),
         ...customFlowApplicationManagedPaths(flows, {
-          includeYaml: hasSystemWebSocket(flows)
+          includeYaml: hasSystemWebSocket(flows), objects
         })
       ],
       managedScope: 'custom-flow-application'

package/src/emit/custom/templates/FlowEndpointRbacCallback_Main.ejs

@@ -0,0 +1,194 @@
+/*
+Copyright (C) 2021 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import asyncFlowSharedLib from '@izara_project/izara-core-library-asynchronous-flow';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+
+//(<optionalRequire>)
+//(</optionalRequire>)
+
+/**
+ * Handles callback after RbacCallback phase for custom flow — verifies awaitingStep then proceeds to next flow steps
+ * @param {Object} _izContext - Context object with logger
+ * @param {Object} requestParams - Request parameters
+ * @param {string} flowTag - Flow tag
+ * @param {Object} callingFlowConfig - Calling flow configuration
+ * @returns {Promise<Object>}
+ */
+export default async function <%- functionName %>(
+  _izContext,
+  requestParams,
+  flowTag,
+  callingFlowConfig = {}
+) {
+  try {
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- functionName %>] Started with params:`, {
+      requestParams,
+      flowTag,
+      callingFlowConfig
+    });
+
+    const parts = requestParams.parentFlowId.split('_');
+    const rbacType = parts.pop();
+    const rbacPendingStepId = '<%- flowTag %>RbacCallback_' + parts.join('_');
+    const currentAwaitingStepId = requestParams.parentFlowId;
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] Parsed RBAC pending details:`,
+      {
+        rbacType,
+        rbacPendingStepId,
+        currentAwaitingStepId,
+        parentFlowId: requestParams.parentFlowId
+      }
+    );
+
+    const rbacAwaitingStepsResult =
+      await asyncFlowSharedLib.checkAllAwaitingStepsFinishedWithReturnParams(
+        _izContext,
+        rbacPendingStepId,
+        currentAwaitingStepId,
+        requestParams.errorsFound,
+        {
+          returnValue: requestParams.returnValue,
+          rbacType
+        }
+      );
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] checkAllAwaitingStepsFinishedWithReturnParams result:`,
+      {
+        rbacAwaitingStepsResult
+      }
+    );
+
+    const {
+      isComplete,
+      collectedReturnValueByAwaitingStepId,
+      collectedErrors: errorsFound = [],
+      additionalAttributes
+    } = rbacAwaitingStepsResult;
+
+    if (isComplete === false) {
+      _izContext.logger.debug(
+        `[${process.env.iz_serviceTag}:<%- functionName %>] Awaiting steps still pending completion:`,
+        {
+          rbacPendingStepId,
+          isComplete
+        }
+      );
+
+      return 'all task not completed';
+    }
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] All awaiting steps completed — clearing awaiting steps:`,
+      {
+        rbacPendingStepId
+      }
+    );
+
+    await asyncFlowSharedLib.clearAllAwaitingSteps(
+      _izContext,
+      rbacPendingStepId
+    );
+
+    const originalRequestParams = additionalAttributes?.requestParams || {};
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] Retrieved originalRequestParams:`,
+      {
+        originalRequestParams
+      }
+    );
+
+    const rbacResults = Object.fromEntries(
+      Object.entries(collectedReturnValueByAwaitingStepId || {}).map(
+        ([stepId, attrs]) => {
+          const type = stepId.split('_').pop();
+          return [type, attrs];
+        }
+      )
+    );
+
+    const rbacCallbackResults = {};
+    const hasError = Object.entries(rbacResults).some(([type, result]) => {
+      if (result && result.error) {
+        errorsFound.push(result.error);
+        return true;
+      }
+      rbacCallbackResults[type] = result;
+      return false;
+    });
+
+    const isAllowed = Object.values(rbacCallbackResults).some(
+      item => item?.returnValue?.permission === true
+    );
+
+    if (!isAllowed) {
+      errorsFound.push('Permission denied');
+    }
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] Final rbacCallbackResults:`,
+      {
+        rbacCallbackResults,
+        isAllowed,
+        errorsFound
+      }
+    );
+
+    if (hasError || errorsFound.length > 0) {
+      const errorResult = {
+        errorsFound,
+        status: 'rejected',
+        requestParams: originalRequestParams
+      };
+
+      _izContext.logger.debug(
+        `[${process.env.iz_serviceTag}:<%- functionName %>] RBAC check failed, publishing rejected status:`,
+        errorResult
+      );
+
+      await sns.publishAsync(_izContext, {
+        TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+          _izContext,
+          '<%- upperCaseFlowTag %>_Out',
+          process.env.iz_serviceTag
+        ),
+        Message: JSON.stringify(errorResult)
+      });
+
+      return errorResult;
+    }
+
+    //(<rbacCallbackMain>)
+    //(</rbacCallbackMain>)
+
+    return {
+      status: 'complete',
+      requestParams: originalRequestParams,
+      rbacCallbackResults
+    };
+  } catch (err) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- functionName %>] Error caught:`, {
+      error: err
+    });
+    throw err;
+  }
+}

package/src/emit/custom/templates/FlowEndpoint_Main.ejs

@@ -66,10 +66,10 @@ export default async function <%- typeof functionName !== 'undefined' ? function
   //(</additionalParams>)
 ) {
   try {
-    _izContext.logger.debug('<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %> _izContext', _izContext);
-    _izContext.logger.debug('<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %> requestParams', requestParams);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %>] _izContext:`, _izContext);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %>] requestParams:`, requestParams);
     _izContext.logger.debug(
-      '<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %> callingFlowConfig',
+      `[${process.env.iz_serviceTag}:<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %>] callingFlowConfig:`,
       callingFlowConfig
     );
 
@@ -120,42 +120,34 @@ export default async function <%- typeof functionName !== 'undefined' ? function
 
     const resultPermissionCheck = await checkRbacPermission(
       _izContext,
-      { flowTag: '<%- flow.flowTag %>', serviceTag: '<%- flow.serviceTag || (flow.objType ? flow.objType.serviceTag : "") %>' },
+      { flowTag: '<%- flow.flowTag %>', serviceTag: process.env.iz_serviceTag || '<%- flow.serviceTag || (flow.objType ? flow.objType.serviceTag : "") %>' },
       parameterGroups,
       {
         rbacObjType: {
-          serviceTag: '<%- (flow.objType?.belongTo ? (Array.isArray(flow.objType.belongTo) ? flow.objType.belongTo[0]?.serviceTag : flow.objType.belongTo?.serviceTag) : null) || flow.serviceTag || (flow.objType ? flow.objType.serviceTag : "") %>'
+          serviceTag: '<%- (typeof rbacServiceTag !== "undefined" && rbacServiceTag) ? rbacServiceTag : ((flow.objType?.belongTo ? (Array.isArray(flow.objType.belongTo) ? flow.objType.belongTo[0]?.serviceTag : flow.objType.belongTo?.serviceTag) : null) || flow.serviceTag || (flow.objType ? flow.objType.serviceTag : "")) %>'
         },
         requestParams: typeof requestParams !== 'undefined' ? requestParams : {},
-        nextFlowStepName: '<%- flow.flowTag %>RbacCallback'
+        nextFlowStepName: '<%- upperCaseFlowTag %>RbacCallback'
       }
     );
 
     _izContext.logger.debug(
-      '[lib:auth:checkRbacPermission] resultPermissionCheck:',
+      `[${process.env.iz_serviceTag}:<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %>] checkRbacPermission result:`,
       resultPermissionCheck
     );
 
-    if (resultPermissionCheck.permission === false) {
-      //(<messageOutPutPermissionCheckFailed>)
-      const message = {};
-      //(</messageOutPutPermissionCheckFailed>)
-
-      return await sns.publishAsync(_izContext, {
-        Message: JSON.stringify(message),
-        TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
-          _izContext,
-          '<%- flow.flowTag %>_Out'
-        )
-      });
-    }
-<% } -%>
+    //(<rbacPublish_<%- flowTag %>)
+    //(</rbacPublish_<%- flowTag %>)
+
+    return resultPermissionCheck;
+<% } else { -%>
 
     //(<endpointHook>)
     //(</endpointHook>)
+<% } -%>
 
   } catch (err) {
-    _izContext.logger.error('error WebSocketInvoke: ', err);
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- typeof functionName !== undefined ? functionName : upperCaseFlowTag %>] error:`, err);
     throw err;
   }
 }

package/src/emit/custom/templates/FlowStep_Main.ejs

@@ -52,7 +52,7 @@ export default async function <%= functionName %>(
     //(<hookCode>)
     //(</hookCode>)
   } catch (err) {
-    _izContext.logger.error('error <%= functionName %>Main: ', err);
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%= functionName %>] error:`, err);
     throw err;
   }
 }

package/src/emit/function/templates/WbsFunction_Yaml.ejs

@@ -6,5 +6,3 @@
   events:
     - websocket:
         route: <%= routeName %>
-        # authorizer: \${self:custom.iz_authorizerAppLevel}
-        # identifierResource: 'route.request.header.Auth'

package/src/emit/rbac/emitDynamicRbacFlowSchemas.js

@@ -2,7 +2,7 @@ import ejsLib from 'ejs';
 import { readFile } from 'node:fs/promises';
 import { rbacFlowTag } from './rbacFlowTag.js';
 
-const RBAC_FLOW_DEFINITIONS = [
+const RBAC_CORE_FLOW_DEFINITIONS = [
   { flowTag: 'CreateTargetRole', event: ['ownTopic'] },
   { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
   { flowTag: 'DeleteTargetRole', event: ['ownTopic'] },
@@ -13,12 +13,33 @@ const RBAC_FLOW_DEFINITIONS = [
   { flowTag: 'ListUserInRoles', event: ['lambdaSyncApi'] },
   { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] }
 ];
+
+const LIMIT_FLOW_DEFINITIONS = [
+  { flowTag: 'CreateRoleLimit', event: ['ownTopic'] },
+  { flowTag: 'ListRoleLimits', event: ['lambdaSyncApi'] },
+  { flowTag: 'DeleteRoleLimit', event: ['ownTopic'] },
+  { flowTag: 'ReservedDynamicUsage', event: ['ownTopic'] },
+  { flowTag: 'ConfirmUsage', event: ['ownTopic'] },
+  { flowTag: 'CancelUsage', event: ['ownTopic'] }
+];
+
+const RBAC_FLOW_DEFINITIONS = [
+  ...RBAC_CORE_FLOW_DEFINITIONS,
+  ...LIMIT_FLOW_DEFINITIONS
+];
+
 const TEMPLATE_URL = new URL('./templates/', import.meta.url);
 
-export const dynamicRbacFlowSchemaPaths = RBAC_FLOW_DEFINITIONS.map(
-  ({ flowTag }) =>
-    `app/src/schemas/FlowSchemas/generateCode/FlowRbac/${flowTag}.js`
-);
+export const dynamicRbacFlowSchemaPaths = [
+  ...RBAC_CORE_FLOW_DEFINITIONS.map(
+    ({ flowTag }) =>
+      `app/src/schemas/FlowSchemas/generateCode/FlowRbac/${flowTag}.js`
+  ),
+  ...LIMIT_FLOW_DEFINITIONS.map(
+    ({ flowTag }) =>
+      `app/src/schemas/FlowSchemas/generateCode/FlowLimit/${flowTag}.js`
+  )
+];
 
 export function rbacFlowSchemaManagedPaths(objects = []) {
   if (!Array.isArray(objects)) {
@@ -78,8 +99,12 @@ function _hasRbacAddOn(object) {
 }
 
 async function _artifact(flowTag, flow) {
+  const isLimit = LIMIT_FLOW_DEFINITIONS.some(
+    (def) => def.flowTag === flowTag
+  );
+  const folder = isLimit ? 'FlowLimit' : 'FlowRbac';
   return {
-    path: `app/src/schemas/FlowSchemas/generateCode/FlowRbac/${flowTag}.js`,
+    path: `app/src/schemas/FlowSchemas/generateCode/${folder}/${flowTag}.js`,
     content: ejsLib.render(
       await readFile(
         new URL('DynamicRbacFlowSchema.ejs', TEMPLATE_URL),
@@ -93,7 +118,7 @@ async function _artifact(flowTag, flow) {
 function _createSharedRbacFlow(flowTag, event) {
   return {
     flowTag,
-    initiateBy: 'system',
+    initiateBy: 'systemNoUser',
     statusType: 'none',
     event,
     outputTopic: true,
@@ -119,7 +144,7 @@ function _createUserRbacFlow(flowTag, serviceTag, objectType) {
     flowTag,
     objType: { serviceTag, objectType },
     event: ['ownTopic'],
-    initiateBy: 'system',
+    initiateBy: 'systemNoUser',
     handleObj: 'one',
     statusType: 'none',
     outputTopic: true,