@izara_project/izara-core-generate-service-code 1.0.83 → 1.0.84

package/src/emit/custom/templates/FlowEndpointRbacCallback_Main.ejs

@@ -0,0 +1,194 @@
+/*
+Copyright (C) 2021 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import asyncFlowSharedLib from '@izara_project/izara-core-library-asynchronous-flow';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+
+//(<optionalRequire>)
+//(</optionalRequire>)
+
+/**
+ * Handles callback after RbacCallback phase for custom flow — verifies awaitingStep then proceeds to next flow steps
+ * @param {Object} _izContext - Context object with logger
+ * @param {Object} requestParams - Request parameters
+ * @param {string} flowTag - Flow tag
+ * @param {Object} callingFlowConfig - Calling flow configuration
+ * @returns {Promise<Object>}
+ */
+export default async function <%- functionName %>(
+  _izContext,
+  requestParams,
+  flowTag,
+  callingFlowConfig = {}
+) {
+  try {
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- functionName %>] Started with params:`, {
+      requestParams,
+      flowTag,
+      callingFlowConfig
+    });
+
+    const parts = requestParams.parentFlowId.split('_');
+    const rbacType = parts.pop();
+    const rbacPendingStepId = '<%- flowTag %>RbacCallback_' + parts.join('_');
+    const currentAwaitingStepId = requestParams.parentFlowId;
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] Parsed RBAC pending details:`,
+      {
+        rbacType,
+        rbacPendingStepId,
+        currentAwaitingStepId,
+        parentFlowId: requestParams.parentFlowId
+      }
+    );
+
+    const rbacAwaitingStepsResult =
+      await asyncFlowSharedLib.checkAllAwaitingStepsFinishedWithReturnParams(
+        _izContext,
+        rbacPendingStepId,
+        currentAwaitingStepId,
+        requestParams.errorsFound,
+        {
+          returnValue: requestParams.returnValue,
+          rbacType
+        }
+      );
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] checkAllAwaitingStepsFinishedWithReturnParams result:`,
+      {
+        rbacAwaitingStepsResult
+      }
+    );
+
+    const {
+      isComplete,
+      collectedReturnValueByAwaitingStepId,
+      collectedErrors: errorsFound = [],
+      additionalAttributes
+    } = rbacAwaitingStepsResult;
+
+    if (isComplete === false) {
+      _izContext.logger.debug(
+        `[${process.env.iz_serviceTag}:<%- functionName %>] Awaiting steps still pending completion:`,
+        {
+          rbacPendingStepId,
+          isComplete
+        }
+      );
+
+      return 'all task not completed';
+    }
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] All awaiting steps completed — clearing awaiting steps:`,
+      {
+        rbacPendingStepId
+      }
+    );
+
+    await asyncFlowSharedLib.clearAllAwaitingSteps(
+      _izContext,
+      rbacPendingStepId
+    );
+
+    const originalRequestParams = additionalAttributes?.requestParams || {};
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] Retrieved originalRequestParams:`,
+      {
+        originalRequestParams
+      }
+    );
+
+    const rbacResults = Object.fromEntries(
+      Object.entries(collectedReturnValueByAwaitingStepId || {}).map(
+        ([stepId, attrs]) => {
+          const type = stepId.split('_').pop();
+          return [type, attrs];
+        }
+      )
+    );
+
+    const rbacCallbackResults = {};
+    const hasError = Object.entries(rbacResults).some(([type, result]) => {
+      if (result && result.error) {
+        errorsFound.push(result.error);
+        return true;
+      }
+      rbacCallbackResults[type] = result;
+      return false;
+    });
+
+    const isAllowed = Object.values(rbacCallbackResults).some(
+      item => item?.returnValue?.permission === true
+    );
+
+    if (!isAllowed) {
+      errorsFound.push('Permission denied');
+    }
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- functionName %>] Final rbacCallbackResults:`,
+      {
+        rbacCallbackResults,
+        isAllowed,
+        errorsFound
+      }
+    );
+
+    if (hasError || errorsFound.length > 0) {
+      const errorResult = {
+        errorsFound,
+        status: 'rejected',
+        requestParams: originalRequestParams
+      };
+
+      _izContext.logger.debug(
+        `[${process.env.iz_serviceTag}:<%- functionName %>] RBAC check failed, publishing rejected status:`,
+        errorResult
+      );
+
+      await sns.publishAsync(_izContext, {
+        TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+          _izContext,
+          '<%- upperCaseFlowTag %>_Out',
+          process.env.iz_serviceTag
+        ),
+        Message: JSON.stringify(errorResult)
+      });
+
+      return errorResult;
+    }
+
+    //(<rbacCallbackMain>)
+    //(</rbacCallbackMain>)
+
+    return {
+      status: 'complete',
+      requestParams: originalRequestParams,
+      rbacCallbackResults
+    };
+  } catch (err) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- functionName %>] Error caught:`, {
+      error: err
+    });
+    throw err;
+  }
+}

package/src/emit/custom/templates/FlowEndpoint_Main.ejs

@@ -66,10 +66,10 @@ export default async function <%- typeof functionName !== 'undefined' ? function
   //(</additionalParams>)
 ) {
   try {
-    _izContext.logger.debug('<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %> _izContext', _izContext);
-    _izContext.logger.debug('<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %> requestParams', requestParams);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %>] _izContext:`, _izContext);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %>] requestParams:`, requestParams);
     _izContext.logger.debug(
-      '<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %> callingFlowConfig',
+      `[${process.env.iz_serviceTag}:<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %>] callingFlowConfig:`,
       callingFlowConfig
     );
 
@@ -120,42 +120,34 @@ export default async function <%- typeof functionName !== 'undefined' ? function
 
     const resultPermissionCheck = await checkRbacPermission(
       _izContext,
-      { flowTag: '<%- flow.flowTag %>', serviceTag: '<%- flow.serviceTag || (flow.objType ? flow.objType.serviceTag : "") %>' },
+      { flowTag: '<%- flow.flowTag %>', serviceTag: process.env.iz_serviceTag || '<%- flow.serviceTag || (flow.objType ? flow.objType.serviceTag : "") %>' },
       parameterGroups,
       {
         rbacObjType: {
-          serviceTag: '<%- (flow.objType?.belongTo ? (Array.isArray(flow.objType.belongTo) ? flow.objType.belongTo[0]?.serviceTag : flow.objType.belongTo?.serviceTag) : null) || flow.serviceTag || (flow.objType ? flow.objType.serviceTag : "") %>'
+          serviceTag: '<%- (typeof rbacServiceTag !== "undefined" && rbacServiceTag) ? rbacServiceTag : ((flow.objType?.belongTo ? (Array.isArray(flow.objType.belongTo) ? flow.objType.belongTo[0]?.serviceTag : flow.objType.belongTo?.serviceTag) : null) || flow.serviceTag || (flow.objType ? flow.objType.serviceTag : "")) %>'
         },
         requestParams: typeof requestParams !== 'undefined' ? requestParams : {},
-        nextFlowStepName: '<%- flow.flowTag %>RbacCallback'
+        nextFlowStepName: '<%- upperCaseFlowTag %>RbacCallback'
       }
     );
 
     _izContext.logger.debug(
-      '[lib:auth:checkRbacPermission] resultPermissionCheck:',
+      `[${process.env.iz_serviceTag}:<%- typeof functionName !== 'undefined' ? functionName : upperCaseFlowTag %>] checkRbacPermission result:`,
       resultPermissionCheck
     );
 
-    if (resultPermissionCheck.permission === false) {
-      //(<messageOutPutPermissionCheckFailed>)
-      const message = {};
-      //(</messageOutPutPermissionCheckFailed>)
-
-      return await sns.publishAsync(_izContext, {
-        Message: JSON.stringify(message),
-        TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
-          _izContext,
-          '<%- flow.flowTag %>_Out'
-        )
-      });
-    }
-<% } -%>
+    //(<rbacPublish_<%- flowTag %>)
+    //(</rbacPublish_<%- flowTag %>)
+
+    return resultPermissionCheck;
+<% } else { -%>
 
     //(<endpointHook>)
     //(</endpointHook>)
+<% } -%>
 
   } catch (err) {
-    _izContext.logger.error('error WebSocketInvoke: ', err);
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- typeof functionName !== undefined ? functionName : upperCaseFlowTag %>] error:`, err);
     throw err;
   }
 }

package/src/emit/custom/templates/FlowStep_Main.ejs

@@ -52,7 +52,7 @@ export default async function <%= functionName %>(
     //(<hookCode>)
     //(</hookCode>)
   } catch (err) {
-    _izContext.logger.error('error <%= functionName %>Main: ', err);
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%= functionName %>] error:`, err);
     throw err;
   }
 }

package/src/emit/function/templates/WbsFunction_Yaml.ejs

@@ -6,5 +6,3 @@
   events:
     - websocket:
         route: <%= routeName %>
-        # authorizer: \${self:custom.iz_authorizerAppLevel}
-        # identifierResource: 'route.request.header.Auth'

package/src/emit/rbac/emitDynamicRbacFlowSchemas.js

@@ -2,7 +2,7 @@ import ejsLib from 'ejs';
 import { readFile } from 'node:fs/promises';
 import { rbacFlowTag } from './rbacFlowTag.js';
 
-const RBAC_FLOW_DEFINITIONS = [
+const RBAC_CORE_FLOW_DEFINITIONS = [
   { flowTag: 'CreateTargetRole', event: ['ownTopic'] },
   { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
   { flowTag: 'DeleteTargetRole', event: ['ownTopic'] },
@@ -13,12 +13,33 @@ const RBAC_FLOW_DEFINITIONS = [
   { flowTag: 'ListUserInRoles', event: ['lambdaSyncApi'] },
   { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] }
 ];
+
+const LIMIT_FLOW_DEFINITIONS = [
+  { flowTag: 'CreateRoleLimit', event: ['ownTopic'] },
+  { flowTag: 'ListRoleLimits', event: ['lambdaSyncApi'] },
+  { flowTag: 'DeleteRoleLimit', event: ['ownTopic'] },
+  { flowTag: 'ReservedDynamicUsage', event: ['ownTopic'] },
+  { flowTag: 'ConfirmUsage', event: ['ownTopic'] },
+  { flowTag: 'CancelUsage', event: ['ownTopic'] }
+];
+
+const RBAC_FLOW_DEFINITIONS = [
+  ...RBAC_CORE_FLOW_DEFINITIONS,
+  ...LIMIT_FLOW_DEFINITIONS
+];
+
 const TEMPLATE_URL = new URL('./templates/', import.meta.url);
 
-export const dynamicRbacFlowSchemaPaths = RBAC_FLOW_DEFINITIONS.map(
-  ({ flowTag }) =>
-    `app/src/schemas/FlowSchemas/generateCode/FlowRbac/${flowTag}.js`
-);
+export const dynamicRbacFlowSchemaPaths = [
+  ...RBAC_CORE_FLOW_DEFINITIONS.map(
+    ({ flowTag }) =>
+      `app/src/schemas/FlowSchemas/generateCode/FlowRbac/${flowTag}.js`
+  ),
+  ...LIMIT_FLOW_DEFINITIONS.map(
+    ({ flowTag }) =>
+      `app/src/schemas/FlowSchemas/generateCode/FlowLimit/${flowTag}.js`
+  )
+];
 
 export function rbacFlowSchemaManagedPaths(objects = []) {
   if (!Array.isArray(objects)) {
@@ -78,8 +99,12 @@ function _hasRbacAddOn(object) {
 }
 
 async function _artifact(flowTag, flow) {
+  const isLimit = LIMIT_FLOW_DEFINITIONS.some(
+    (def) => def.flowTag === flowTag
+  );
+  const folder = isLimit ? 'FlowLimit' : 'FlowRbac';
   return {
-    path: `app/src/schemas/FlowSchemas/generateCode/FlowRbac/${flowTag}.js`,
+    path: `app/src/schemas/FlowSchemas/generateCode/${folder}/${flowTag}.js`,
     content: ejsLib.render(
       await readFile(
         new URL('DynamicRbacFlowSchema.ejs', TEMPLATE_URL),
@@ -93,7 +118,7 @@ async function _artifact(flowTag, flow) {
 function _createSharedRbacFlow(flowTag, event) {
   return {
     flowTag,
-    initiateBy: 'systemWithNoUser',
+    initiateBy: 'systemNoUser',
     statusType: 'none',
     event,
     outputTopic: true,
@@ -119,7 +144,7 @@ function _createUserRbacFlow(flowTag, serviceTag, objectType) {
     flowTag,
     objType: { serviceTag, objectType },
     event: ['ownTopic'],
-    initiateBy: 'systemWithNoUser',
+    initiateBy: 'systemNoUser',
     handleObj: 'one',
     statusType: 'none',
     outputTopic: true,

package/src/emit/rbac/emitRbacApplicationArtifacts.js

@@ -10,6 +10,7 @@ import {
 import { rbacFlowTag } from './rbacFlowTag.js';
 
 const FLOW_RBAC_YAML_PATH = 'app/sls_yaml/generatedCode/source/flow-rbac.yml';
+const FLOW_LIMITS_YAML_PATH = 'app/sls_yaml/generatedCode/source/flow-limits.yml';
 const CRUD_TEMPLATE_URL = new URL('../crud/templates/', import.meta.url);
 const RBAC_TEMPLATE_URL = new URL('./templates/', import.meta.url);
 
@@ -23,7 +24,8 @@ export async function emitRbacApplicationArtifacts(objects) {
   }
   const hasSelfRbac = objects.some(hasSelfRbacAddOn);
   const flowTags = [...new Set(rbacObjects.map(rbacFlowTag))];
-  const handlers = await Promise.all([
+
+  const rbacHandlers = await Promise.all([
     ...(hasSelfRbac
       ? [
           createTargetRoleHandler(),
@@ -34,23 +36,47 @@ export async function emitRbacApplicationArtifacts(objects) {
       : []),
     ...flowTags.map(createUserRbacFlowHandler)
   ]);
-  return [
-    ...handlers.flatMap((handler) => handler.artifacts),
+
+  const limitHandlers = await Promise.all(
+    hasSelfRbac
+      ? [
+          ...LIMIT_LIST_DEFINITIONS.map(createLimitListHandler),
+          ...LIMIT_MUTATION_DEFINITIONS.map(createLimitMutationHandler),
+          ...ACCOUNT_LIMIT_HANDLERS.map(createAccountLimitHandler)
+        ]
+      : []
+  );
+
+  const artifacts = [
+    ...rbacHandlers.flatMap((handler) => handler.artifacts),
+    ...limitHandlers.flatMap((handler) => handler.artifacts),
     {
       path: FLOW_RBAC_YAML_PATH,
-      content: handlers
+      content: rbacHandlers
         .flatMap((handler) => handler.functions)
         .map(renderFunctionYaml)
         .join('\n')
     }
   ];
+
+  if (hasSelfRbac) {
+    artifacts.push({
+      path: FLOW_LIMITS_YAML_PATH,
+      content: limitHandlers
+        .flatMap((handler) => handler.functions)
+        .map(renderFunctionYaml)
+        .join('\n')
+    });
+  }
+
+  return artifacts;
 }
 
 const LIST_DEFINITIONS = [
   {
     flowTag: 'ListTargetRole',
     tableName: 'TargetRoles',
-    requestProperty: 'userId',
+    requestProperty: 'identifiersConcat',
     useContextUserId: true
   },
   {
@@ -64,6 +90,15 @@ const LIST_DEFINITIONS = [
     requestProperty: 'roleIdKey'
   }
 ];
+
+const LIMIT_LIST_DEFINITIONS = [
+  {
+    flowTag: 'ListRoleLimits',
+    tableName: 'RoleLimit',
+    requestProperty: 'roleLimitId'
+  }
+];
+
 const MUTATION_DEFINITIONS = [
   {
     flowTag: 'CreateRolePermissions',
@@ -81,14 +116,36 @@ const MUTATION_DEFINITIONS = [
     flowTag: 'DeleteTargetRole',
     tableName: 'TargetRoles',
     method: 'deleteItem',
-    fields: ['targetId', 'roleIdKey']
+    fields: ['identifiersConcat', 'roleIdKey']
   }
 ];
+
+const LIMIT_MUTATION_DEFINITIONS = [
+  {
+    flowTag: 'CreateRoleLimit',
+    tableName: 'RoleLimit',
+    method: 'putItem',
+    fields: ['roleLimitId', 'limitType', 'limitValue', 'actionType']
+  },
+  {
+    flowTag: 'DeleteRoleLimit',
+    tableName: 'RoleLimit',
+    method: 'deleteItem',
+    fields: ['roleLimitId', 'limitType']
+  }
+];
+
 const USER_ROLE_MUTATIONS = [
   { flowTag: 'CreateUserRole', operation: 'Put' },
   { flowTag: 'DeleteUserFromRole', operation: 'Delete' }
 ];
 
+const ACCOUNT_LIMIT_HANDLERS = [
+  'ReservedDynamicUsage',
+  'ConfirmUsage',
+  'CancelUsage'
+];
+
 const STATIC_RBAC_APPLICATION_PATHS = [
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_Main.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrSqs.js',
@@ -118,6 +175,27 @@ const STATIC_RBAC_APPLICATION_PATHS = [
   FLOW_RBAC_YAML_PATH
 ];
 
+const STATIC_LIMIT_APPLICATION_PATHS = [
+  ...LIMIT_LIST_DEFINITIONS.flatMap(({ flowTag }) => [
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrApi.js`
+  ]),
+  ...LIMIT_MUTATION_DEFINITIONS.flatMap(({ flowTag }) => [
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_WbsMain.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrWbs.js`
+  ]),
+  ...ACCOUNT_LIMIT_HANDLERS.flatMap((flowTag) => [
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_WbsMain.js`,
+    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrWbs.js`
+  ]),
+  FLOW_LIMITS_YAML_PATH
+];
+
 export function rbacApplicationManagedPaths(objects = []) {
   if (!Array.isArray(objects)) {
     throw new TypeError('objects must be an array');
@@ -131,7 +209,126 @@ export function rbacApplicationManagedPaths(objects = []) {
       `${sourcePath}/${flowTag}_HdrSqs.js`
     ];
   });
-  return [...new Set([...STATIC_RBAC_APPLICATION_PATHS, ...sourcePaths])];
+  return [
+    ...new Set([
+      ...STATIC_RBAC_APPLICATION_PATHS,
+      ...STATIC_LIMIT_APPLICATION_PATHS,
+      ...sourcePaths
+    ])
+  ];
+}
+
+async function createAccountLimitHandler(flowTag) {
+  const sourcePath = `app/src/generatedCode/FlowLimit/${flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowLimit/${flowTag}/source`;
+  const webSocket = await createWebSocketEntry(
+    flowTag,
+    sourcePath,
+    handlerPath
+  );
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/${flowTag}_Main.js`,
+        content: await renderRbacTemplate(`${flowTag}_Main.ejs`, { flowTag })
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
+      },
+      ...webSocket.artifacts
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `${flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `${flowTag}HdrSqs`,
+        flowTag: flowTag,
+        flowStepName: ''
+      },
+      ...webSocket.functions
+    ]
+  };
+}
+
+async function createLimitListHandler(definition) {
+  const sourcePath = `app/src/generatedCode/FlowLimit/${definition.flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowLimit/${definition.flowTag}/source`;
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/${definition.flowTag}_Main.js`,
+        content: await renderRbacTemplate('ListRbac_Main.ejs', {
+          ...definition,
+          useContextUserId: definition.useContextUserId ?? false
+        })
+      },
+      {
+        path: `${sourcePath}/${definition.flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', definition)
+      },
+      {
+        path: `${sourcePath}/${definition.flowTag}_HdrApi.js`,
+        content: await renderRbacTemplate('ListRbac_HdrApi.ejs', definition)
+      }
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `${definition.flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${definition.flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `${definition.flowTag}HdrSqs`,
+        flowTag: definition.flowTag,
+        flowStepName: ''
+      },
+      {
+        type: 'api',
+        functionName: `${definition.flowTag}HdrApi`,
+        handlerPath: `${handlerPath}/${definition.flowTag}_HdrApi.main`,
+        roleName: 'FlowRbacRole',
+        flowTag: definition.flowTag,
+        flowStepName: ''
+      }
+    ]
+  };
+}
+
+async function createLimitMutationHandler(definition) {
+  const sourcePath = `app/src/generatedCode/FlowLimit/${definition.flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowLimit/${definition.flowTag}/source`;
+  const webSocket = await createWebSocketEntry(
+    definition.flowTag,
+    sourcePath,
+    handlerPath
+  );
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/${definition.flowTag}_Main.js`,
+        content: await renderRbacTemplate('RbacMutation_Main.ejs', definition)
+      },
+      {
+        path: `${sourcePath}/${definition.flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', definition)
+      },
+      ...webSocket.artifacts
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `${definition.flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${definition.flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `${definition.flowTag}HdrSqs`,
+        flowTag: definition.flowTag,
+        flowStepName: ''
+      },
+      ...webSocket.functions
+    ]
+  };
 }
 
 async function createTargetRoleHandler() {