@izara_project/izara-core-generate-service-code 1.0.83 → 1.0.84

package/src/emit/crud/templates/DeleteEndpoint_Main.ejs

@@ -56,7 +56,7 @@ export default async function <%- flowTag %>(
   //(</additionalParams>)
 ) {
   try {
-    _izContext.logger.debug('[<%- flowTag %>]', {
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] deleteMain:`, {
       requestParams,
       callingFlowConfig
     });
@@ -72,18 +72,42 @@ export default async function <%- flowTag %>(
       _izContext,
       objType
     );
-    _izContext.logger.debug('objectSchema', objectSchema);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] objectSchema:`, objectSchema);
 
-    // ── Resolve userId / targetId ─────────────────────────────────────────────
+    // ── Resolve submittedByUserId / targetIdentifiers ─────────────────────────
+    let submittedByUserId, targetIdentifiers;
     if (
       objectSchema.generatedBy === 'user' ||
       objectSchema.generatedBy === 'systemWithUser'
     ) {
-      const userId = _izContext.correlationIds.get(coreConsts.BASE_USER_ID);
-      const targetId = _izContext.correlationIds.get(coreConsts.TARGET_ID);
-      if (!userId) errorsFound.push('Not have userId');
-      if (objectSchema.hasOwnProperty('belongTo') && !targetId)
-        errorsFound.push('not have targetId');
+      submittedByUserId =
+        requestParams.submittedByUserId ||
+        _izContext.correlationIds.get(coreConsts.SUBMITTED_BY_USER_ID);
+
+      targetIdentifiers = requestParams.targetIdentifiers;
+
+      if (!targetIdentifiers && objectSchema.belongTo?.objectType === 'user' && submittedByUserId) {
+        targetIdentifiers = { submittedByUserId };
+      }
+
+      if (!submittedByUserId) errorsFound.push('Not have submittedByUserId');
+      if (objectSchema.hasOwnProperty('belongTo') && !targetIdentifiers)
+        errorsFound.push('not have targetIdentifiers');
+
+      requestParams.submittedByUserId = submittedByUserId;
+      if (targetIdentifiers) {
+        if (!targetIdentifiers.submittedByUserId && submittedByUserId) {
+          targetIdentifiers.submittedByUserId = submittedByUserId;
+        }
+        requestParams.targetIdentifiers = targetIdentifiers;
+      }
+
+      _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Identity & Target Context Resolved:`,  {
+        submittedByUserId: requestParams.submittedByUserId,
+        targetIdentifiers: requestParams.targetIdentifiers,
+        belongTo: objectSchema.belongTo,
+        generatedBy: objectSchema.generatedBy
+      });
     }
 
     //(<beforeQuery>)
@@ -315,6 +339,7 @@ export default async function <%- flowTag %>(
       errorsFound
     );
   } catch (err) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- flowTag %>] error:`, err);
     throw err;
   }
 }

package/src/emit/crud/templates/DeleteLogicalLib.ejs

@@ -62,7 +62,7 @@ export async function <%- flowTag %>LogicalLib(
   phaseResults = {}
 ) {
   try {
-    _izContext.logger.debug('[<%- flowTag %>LogicalLib] started', {
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] started`,  {
       requestParams,
       callingFlowConfig,
       phaseResults
@@ -78,14 +78,14 @@ export async function <%- flowTag %>LogicalLib(
       _izContext,
       objType
     );
-    _izContext.logger.debug('objectSchema', objectSchema);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] objectSchema:`, objectSchema);
 
     // ── Build deleteDataDetails ───────────────────────────────────────────────
     const deleteDataDetails = await createDeleteDataDetail(
       _izContext,
       objectSchema
     );
-    _izContext.logger.debug('deleteDataDetails', deleteDataDetails);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] deleteDataDetails:`, deleteDataDetails);
 
     if (objectSchema.canDelete === false || objectSchema.canDelete == null) {
       errorsFound.push("this objectSchema can't delete");
@@ -119,6 +119,7 @@ export async function <%- flowTag %>LogicalLib(
       return {
         objType,
         identifiers: requestParams.identifiers,
+        targetIdentifiers: requestParams.targetIdentifiers,
         status: 'error',
         errorsFound
       };
@@ -201,10 +202,12 @@ export async function <%- flowTag %>LogicalLib(
     return {
       objType,
       identifiers: requestParams.identifiers,
+      targetIdentifiers: requestParams.targetIdentifiers,
       status: 'complete',
       errorsFound
     };
   } catch (err) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] error:`, err);
     throw err;
   }
 }

package/src/emit/crud/templates/FlowEndpointRbacCallback_Main.ejs

@@ -49,7 +49,7 @@ export default async function <%- flowTag %>RbacCallbackMain(
   callingFlowConfig = {}
 ) {
   try {
-    _izContext.logger.debug('[<%- flowTag %>RbacCallbackMain] Started with params:', {
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>RbacCallback] Started with params:`,  {
       requestParams,
       flowTag,
       callingFlowConfig
@@ -209,7 +209,7 @@ export default async function <%- flowTag %>RbacCallbackMain(
 
     return logicalResult;
   } catch (err) {
-    _izContext.logger.error('[<%- flowTag %>RbacCallbackMain] Error caught:', {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- flowTag %>RbacCallback] Error caught:`,  {
       error: err
     });
     throw err;

package/src/emit/crud/templates/FlowEndpoint_HdrWbs.ejs

@@ -100,6 +100,13 @@ export const main = middleware.wrap(async (event, context) => {
             );
           }
 
+          if (!eventParams.submittedByUserId) {
+            const contextUserId = event._izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
+            if (contextUserId) {
+              eventParams.submittedByUserId = contextUserId;
+            }
+          }
+
           let callingFlow = eventParams?.callingFlow
             ? eventParams.callingFlow
             : {};

package/src/emit/crud/templates/FlowMain_Wbs.ejs

@@ -120,7 +120,7 @@ export default async function <%- typeof functionName !== 'undefined' ? function
     _izContext.logger.debug('sendMessageToEndpoint', sendMessageToEndpoint);
     await sns.publishAsync(_izContext, sendMessageToEndpoint);
   } catch (err) {
-    _izContext.logger.error('error WebSocketInvoke: ', err);
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- typeof functionName !== undefined ? functionName : upperCaseFlowTag %>Wbs] error:`, err);
     throw err;
   }
 }

package/src/emit/crud/templates/GetEndpoint_Main.ejs

@@ -68,6 +68,19 @@ export default async function <%- flowTag %>(
       callingFlowConfig
     });
 
+    // ── Resolve submittedByUserId / targetIdentifiers ─────────────────────────
+    const submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds?.get(coreConsts.SUBMITTED_BY_USER_ID);
+    if (submittedByUserId) {
+      requestParams.submittedByUserId = submittedByUserId;
+    }
+
+    const targetIdentifiers = requestParams.targetIdentifiers;
+    if (targetIdentifiers) {
+      requestParams.targetIdentifiers = targetIdentifiers;
+    }
+
     // ── Settings ──────────────────────────────────────────────────────────────
     const settings = requestParams.additionalParams?.settings ?? {};
     const returnSystemFieldsName = settings.returnSystemFieldsName === true;

package/src/emit/crud/templates/UpdateComplete_Main.ejs

@@ -52,7 +52,7 @@ export default async function UpdateComplete(
   //(</additionalParams>)
 ) {
   try {
-    _izContext.logger.debug('[UpdateComplete] started', {
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:UpdateComplete] started`,  {
       requestParams
     });
     const {

package/src/emit/crud/templates/UpdateEndpoint_Main.ejs

@@ -78,9 +78,58 @@ export default async function <%- flowTag %>(
       callingFlowConfig
     });
 
+    const errorsFound = [];
+    const objType = createObjType(requestParams.objectType);
+
+    // ── Load schema ───────────────────────────────────────────────────────────
+    const objectSchema = await getObjectSchema.getObjSchemaS3WithHierarchy(
+      _izContext,
+      objType
+    );
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] objectSchema:`, objectSchema);
+
+    // ── Resolve submittedByUserId / targetIdentifiers ─────────────────────────
+    let submittedByUserId, targetIdentifiers;
+    if (
+      objectSchema.generatedBy === 'user' ||
+      objectSchema.generatedBy === 'systemWithUser'
+    ) {
+      submittedByUserId =
+        requestParams.submittedByUserId ||
+        _izContext.correlationIds?.get(coreConsts.SUBMITTED_BY_USER_ID);
+
+      targetIdentifiers = requestParams.targetIdentifiers;
+
+      if (!targetIdentifiers && objectSchema.belongTo?.objectType === 'user' && submittedByUserId) {
+        targetIdentifiers = { submittedByUserId };
+      }
+
+      if (!submittedByUserId) errorsFound.push('Not have submittedByUserId');
+      if (objectSchema.hasOwnProperty('belongTo') && !targetIdentifiers)
+        errorsFound.push('not have targetIdentifiers');
+
+      requestParams.submittedByUserId = submittedByUserId;
+      if (targetIdentifiers) {
+        if (!targetIdentifiers.submittedByUserId && submittedByUserId) {
+          targetIdentifiers.submittedByUserId = submittedByUserId;
+        }
+        requestParams.targetIdentifiers = targetIdentifiers;
+      }
+
+      _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Identity & Target Context Resolved:`,  {
+        submittedByUserId: requestParams.submittedByUserId,
+        targetIdentifiers: requestParams.targetIdentifiers,
+        belongTo: objectSchema.belongTo,
+        generatedBy: objectSchema.generatedBy
+      });
+    } else if (objectSchema.generatedBy === 'searchResultGenerated') {
+      throw new NoRetryError(
+        'error searchResultGenerated should not happen here'
+      );
+    }
+
     // ── Build identifiers used by asynchronous processing ────────────────────
     const identifiers = requestParams.objInstanceFull.identifiers;
-    const errorsFound = [];
 
     //(<validateBeforeUpdate>)
     //(</validateBeforeUpdate>)
@@ -142,7 +191,7 @@ export default async function <%- flowTag %>(
       );
 
       _izContext.logger.debug(
-        '[lib:auth:checkRbacPermission] resultPermissionCheck:',
+        `[${process.env.iz_serviceTag}:<%- flowTag %>] checkRbacPermission result:`, 
         resultPermissionCheck
       );
 
@@ -308,7 +357,7 @@ export default async function <%- flowTag %>(
       errorsFound
     );
   } catch (err) {
-    _izContext.logger.error('[<%- flowTag %>] error:', err);
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- flowTag %>] error:`, err);
     throw err;
   }
 }

package/src/emit/crud/templates/UpdateLogicalLib.ejs

@@ -72,7 +72,7 @@ export async function <%- flowTag %>LogicalLib(
   phaseResults = {}
 ) {
   try {
-    _izContext.logger.debug('[<%- flowTag %>LogicalLib] started', {
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] started`,  {
       requestParams,
       callingFlowConfig,
       phaseResults
@@ -96,7 +96,7 @@ export async function <%- flowTag %>LogicalLib(
       _izContext,
       objType
     );
-    _izContext.logger.debug('objectSchema', objectSchema);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] objectSchema:`, objectSchema);
 
     const objectSchemas =
       await uploadUseCase.generateObjectSchemaForCombineFieldNames(
@@ -110,7 +110,7 @@ export async function <%- flowTag %>LogicalLib(
       _izContext,
       objectSchemas
     );
-    _izContext.logger.debug('updateDataDetails', updateDataDetails);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] updateDataDetails:`, updateDataDetails);
 
     const originTimestamp = Date.now();
 
@@ -468,6 +468,7 @@ export async function <%- flowTag %>LogicalLib(
       errorsFound
     };
   } catch (err) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- flowTag %>LogicalLib] error:`, err);
     _izContext.logger.error('[<%- flowTag %>LogicalLib] error:', err);
     throw err;
   }

package/src/emit/custom/customFlows.js

@@ -49,6 +49,7 @@ export function flowExtTopicSteps(flows) {
         typeof step?.stepName !== 'string' ||
         step.stepName === '' ||
         step.stepName.toLowerCase() === 'start' ||
+        step.stepName.toLowerCase() === 'rbaccallback' ||
         !Array.isArray(step.event) ||
         !step.event.includes('extTopic')
       ) {
@@ -242,3 +243,49 @@ export function customFlowNextSteps(flows) {
   }
   return results;
 }
+
+export function flowHasRbac(flow, objects = []) {
+  if (!flow || !flow.objType || typeof flow.objType !== "object") return false;
+  const candidates = objects.filter(
+    (o) => o.objectType === flow.objType.objectType
+  );
+  const object = flow.objType.serviceTag
+    ? (candidates.find((o) => o.serviceTag === flow.objType.serviceTag) ??
+       candidates.find((o) => o.serviceTag === undefined) ??
+       candidates[0])
+    : candidates[0];
+  if (!object) return false;
+  return hasRbacObject(object, objects);
+}
+
+function hasRbacObject(object, objects = []) {
+  return (
+    hasSelfRbac(object) ||
+    (Array.isArray(object?.belongToSchema?.addOnDataStructure) &&
+      object.belongToSchema.addOnDataStructure.some(
+        (addOn) => addOn?.type === "rbac"
+      )) ||
+    normalizeBelongTo(object).some((target) => {
+      if (target?.serviceTag === "UserAccount") return true;
+      const matched = objects.find(
+        (candidate) =>
+          candidate?.serviceTag === target?.serviceTag &&
+          candidate?.objectType === target?.objectType
+      );
+      return hasSelfRbac(matched);
+    })
+  );
+}
+
+function hasSelfRbac(object) {
+  return (
+    Array.isArray(object?.addOnDataStructure) &&
+    object.addOnDataStructure.some((addOn) => addOn?.type === "rbac")
+  );
+}
+
+function normalizeBelongTo(object) {
+  const belongTo = object?.belongTo;
+  if (!belongTo) return [];
+  return Array.isArray(belongTo) ? belongTo : [belongTo];
+}

package/src/emit/custom/emitCustomFlowApplicationArtifacts.js

@@ -16,7 +16,8 @@ import {
   generatedDsqFlows,
   generatedOwnTopicFlows,
   supportedCustomFlows,
-  upperFirst
+  upperFirst,
+  flowHasRbac
 } from './customFlows.js';
 
 const YAML_PATH = 'app/sls_yaml/generatedCode/source/flow-schema.yml';
@@ -67,10 +68,10 @@ export async function emitCustomFlowApplicationArtifacts(
   ];
 }
 
-export function customFlowApplicationManagedPaths(flows) {
+export function customFlowApplicationManagedPaths(flows, { objects = [] } = {}) {
   return [
-    ...supportedCustomFlows(flows).flatMap((flow) => flowPaths(flow)),
-    ...generatedOwnTopicFlows(flows).flatMap(ownTopicRootPaths),
+    ...supportedCustomFlows(flows).flatMap((flow) => flowPaths(flow, objects)),
+    ...generatedOwnTopicFlows(flows).flatMap((flow) => ownTopicRootPaths(flow, objects)),
     ...flowExtTopicSteps(flows).flatMap(({ flowTag, stepName }) => {
       const source = `app/src/generatedCode/FlowSchemas/${flowTag}/source`;
       return [
@@ -122,6 +123,45 @@ async function emitFlow(flow, objects) {
     : [];
   const functions = [];
 
+  const isRbac = flowHasRbac(flow, objects);
+  if (isRbac && !flow.event.includes('ownTopic')) {
+    const rbacStep = (flow.flowSteps || []).find(
+      (s) => typeof s?.stepName === 'string' && s.stepName.toLowerCase() === 'rbaccallback'
+    );
+    const rbacConfig = rbacStep ? stepConfig(flow, rbacStep) : null;
+    artifacts.push(
+      {
+        path: `${source}/${tag}RbacCallback_Main.js`,
+        content: await renderCustom('FlowEndpointRbacCallback_Main.ejs', {
+          flowTag: flow.flowTag,
+          upperCaseFlowTag: tag,
+          functionName: `${tag}RbacCallbackMain`
+        })
+      },
+      {
+        path: `${source}/${tag}RbacCallback_HdrSqs.js`,
+        content: await renderShared('FlowHandler_HdrSqs.ejs', {
+          flowTag: flow.flowTag,
+          flowStepName: 'RbacCallback',
+          mainFileName: `${tag}RbacCallback_Main`,
+          functionName: `${tag}RbacCallbackMain`,
+          queueName: `${tag}RbacCallbackHdrSqs`,
+          startConfig: rbacConfig
+        })
+      }
+    );
+    functions.push(
+      renderSqsFunctionYaml({
+        functionName: `${tag}RbacCallbackHdrSqs`,
+        handlerPath: `${handlerRoot}/${tag}RbacCallback_HdrSqs.main`,
+        roleName: customFlowRoleName(flow.flowTag),
+        queueName: `${tag}RbacCallbackHdrSqs`,
+        flowTag: flow.flowTag,
+        flowStepName: 'RbacCallback'
+      })
+    );
+  }
+
   if (flow.event.includes('extTopic') && !flow.event.includes('ownTopic')) {
     artifacts.push({
       path: `${source}/${process}_HdrSqs.js`,
@@ -219,7 +259,7 @@ async function emitFlow(flow, objects) {
   return { artifacts, functions };
 }
 
-function flowPaths(flow) {
+function flowPaths(flow, objects = []) {
   const tag = upperFirst(flow.flowTag);
   const process = tag;
   const source = `app/src/generatedCode/FlowSchemas/${tag}/source`;
@@ -227,6 +267,12 @@ function flowPaths(flow) {
   if (needsProcessMain(flow)) {
     paths.push(`${source}/${process}_Main.js`);
   }
+  if (flowHasRbac(flow, objects)) {
+    paths.push(
+      `${source}/${tag}RbacCallback_Main.js`,
+      `${source}/${tag}RbacCallback_HdrSqs.js`
+    );
+  }
   if (flow.event.includes('extTopic') && !flow.event.includes('ownTopic')) {
     paths.push(`${source}/${process}_HdrSqs.js`);
   }
@@ -418,68 +464,118 @@ async function emitOwnTopicRoot(flow, objects) {
     upperCaseFlowTag: tag,
     startConfig: _startConfig(flow)
   };
-  return {
-    artifacts: [
-      {
-        path: `${source}/${mainFileName}.js`,
-        content: await renderEndpointMain(flow, mainFileName, objects)
-      },
-      {
-        path: `${source}/${tag}_HdrSqs.js`,
-        content: await renderShared('FlowHandler_HdrSqs.ejs', {
-          ...shared,
-          functionName: mainFileName,
-          mainFileName,
-          queueName: `${tag}HdrSqs`
-        })
-      },
+  const isRbac = flowHasRbac(flow, objects);
+  const ownArtifacts = [
+    {
+      path: `${source}/${mainFileName}.js`,
+      content: await renderEndpointMain(flow, mainFileName, objects)
+    },
+    {
+      path: `${source}/${tag}_HdrSqs.js`,
+      content: await renderShared('FlowHandler_HdrSqs.ejs', {
+        ...shared,
+        functionName: mainFileName,
+        mainFileName,
+        queueName: `${tag}HdrSqs`
+      })
+    },
+    {
+      path: `${source}/${wbsMainFileName}.js`,
+      content: await renderCrudTemplate('FlowMain_Wbs.ejs', {
+        ...shared,
+        functionName: wbsMainFileName
+      })
+    },
+    {
+      path: `${source}/${tag}_HdrWbs.js`,
+      content: await renderCrudTemplate('FlowEndpoint_HdrWbs.ejs', {
+        ...shared,
+        functionName: tag,
+        mainFileName: wbsMainFileName,
+        route: tag
+      })
+    }
+  ];
+
+  const ownFunctions = [
+    renderWbsFunctionYaml({
+      functionName: `${tag}HdrWbs`,
+      handlerPath: `${handlerRoot}/${tag}_HdrWbs.main`,
+      roleName: customFlowRoleName(flow.flowTag),
+      routeName: tag,
+      flowTag: flow.flowTag,
+      flowStepName: ''
+    }),
+    renderSqsFunctionYaml({
+      functionName: `${tag}HdrSqs`,
+      handlerPath: `${handlerRoot}/${tag}_HdrSqs.main`,
+      roleName: customFlowRoleName(flow.flowTag),
+      queueName: `${tag}HdrSqs`,
+      flowTag: flow.flowTag,
+      flowStepName: ''
+    })
+  ];
+
+  if (isRbac) {
+    const rbacStep = (flow.flowSteps || []).find(
+      (s) => typeof s?.stepName === 'string' && s.stepName.toLowerCase() === 'rbaccallback'
+    );
+    const rbacConfig = rbacStep ? stepConfig(flow, rbacStep) : null;
+    ownArtifacts.push(
       {
-        path: `${source}/${wbsMainFileName}.js`,
-        content: await renderCrudTemplate('FlowMain_Wbs.ejs', {
-          ...shared,
-          functionName: wbsMainFileName
+        path: `${source}/${tag}RbacCallback_Main.js`,
+        content: await renderCustom('FlowEndpointRbacCallback_Main.ejs', {
+          flowTag: flow.flowTag,
+          upperCaseFlowTag: tag,
+          functionName: `${tag}RbacCallbackMain`
         })
       },
       {
-        path: `${source}/${tag}_HdrWbs.js`,
-        content: await renderCrudTemplate('FlowEndpoint_HdrWbs.ejs', {
-          ...shared,
-          functionName: tag,
-          mainFileName: wbsMainFileName,
-          route: tag
+        path: `${source}/${tag}RbacCallback_HdrSqs.js`,
+        content: await renderShared('FlowHandler_HdrSqs.ejs', {
+          flowTag: flow.flowTag,
+          flowStepName: 'RbacCallback',
+          mainFileName: `${tag}RbacCallback_Main`,
+          functionName: `${tag}RbacCallbackMain`,
+          queueName: `${tag}RbacCallbackHdrSqs`,
+          startConfig: rbacConfig
         })
       }
-    ],
-    functions: [
-      renderWbsFunctionYaml({
-        functionName: `${tag}HdrWbs`,
-        handlerPath: `${handlerRoot}/${tag}_HdrWbs.main`,
-        roleName: customFlowRoleName(flow.flowTag),
-        routeName: tag,
-        flowTag: flow.flowTag,
-        flowStepName: ''
-      }),
+    );
+    ownFunctions.push(
       renderSqsFunctionYaml({
-        functionName: `${tag}HdrSqs`,
-        handlerPath: `${handlerRoot}/${tag}_HdrSqs.main`,
+        functionName: `${tag}RbacCallbackHdrSqs`,
+        handlerPath: `${handlerRoot}/${tag}RbacCallback_HdrSqs.main`,
         roleName: customFlowRoleName(flow.flowTag),
-        queueName: `${tag}HdrSqs`,
+        queueName: `${tag}RbacCallbackHdrSqs`,
         flowTag: flow.flowTag,
-        flowStepName: ''
+        flowStepName: 'RbacCallback'
       })
-    ]
+    );
+  }
+
+  return {
+    artifacts: ownArtifacts,
+    functions: ownFunctions
   };
 }
 
-function ownTopicRootPaths(flow) {
+function ownTopicRootPaths(flow, objects = []) {
   const tag = upperFirst(flow.flowTag);
   const source = `app/src/generatedCode/FlowSchemas/${tag}/source`;
-  return [
+  const paths = [
     `${source}/${tag}_Main.js`,
     `${source}/${tag}_HdrSqs.js`,
     `${source}/${tag}_WbsMain.js`,
     `${source}/${tag}_HdrWbs.js`
   ];
+  if (flowHasRbac(flow, objects)) {
+    paths.push(
+      `${source}/${tag}RbacCallback_Main.js`,
+      `${source}/${tag}RbacCallback_HdrSqs.js`
+    );
+  }
+  return paths;
 }
 
 function needsProcessMain(flow) {
@@ -694,12 +790,35 @@ function isS3Only(flow) {
   return flow.event.length === 1 && flow.event[0] === 's3';
 }
 
-async function renderEndpointMain(flow, functionName, objects) {
+async function renderEndpointMain(flow, functionName, objects = []) {
+  const isRbac = flowHasRbac(flow, objects);
+  const matchedObject = objects.find(
+    (o) => o.objectType === flow.objType?.objectType
+  );
+  let rbacServiceTag = null;
+  if (matchedObject) {
+    const belongTo = matchedObject.belongTo;
+    if (belongTo) {
+      rbacServiceTag = Array.isArray(belongTo)
+        ? belongTo[0]?.serviceTag
+        : belongTo?.serviceTag;
+    }
+  }
+  if (!rbacServiceTag) {
+    rbacServiceTag = flow.objType?.serviceTag || flow.serviceTag || 'Rbac';
+  }
+
+  const enrichedFlow = {
+    ...flow,
+    isRbac
+  };
+
   return renderCustom('FlowEndpoint_Main.ejs', {
-    flow,
+    flow: enrichedFlow,
     flowTag: flow.flowTag,
     upperCaseFlowTag: upperFirst(flow.flowTag),
     functionName,
+    rbacServiceTag,
     tableName: storedCacheTableName(flow, objects),
     startConfig: _startConfig(flow)
   });

package/src/emit/custom/generateCustomFlowApplicationArtifacts.js

@@ -32,7 +32,7 @@ export async function generateCustomFlowApplicationArtifacts(
       managedPaths: [
         ...systemWebSocketManagedPaths(),
         ...customFlowApplicationManagedPaths(flows, {
-          includeYaml: hasSystemWebSocket(flows)
+          includeYaml: hasSystemWebSocket(flows), objects
         })
       ],
       managedScope: 'custom-flow-application'