@izara_project/izara-core-generate-service-code 1.0.83 → 1.0.85

package/src/emit/resource/emitResourceArtifacts.js

@@ -7,7 +7,8 @@ import {
   flowExtTopicSteps,
   generatedDsqFlows,
   generatedOwnTopicFlows,
-  supportedCustomFlows
+  supportedCustomFlows,
+  flowHasRbac
 } from '../custom/customFlows.js';
 import { hasSystemWebSocket } from '../system/emitSystemWebSocketArtifacts.js';
 import { rbacFlowTag } from '../rbac/rbacFlowTag.js';
@@ -38,7 +39,13 @@ const RBAC_ACTIONS = [
   'CreateUserRole',
   'ListUserInRoles',
   'DeleteUserFromRole',
-  'ValidatorRbac'
+  'ValidatorRbac',
+  'CreateRoleLimit',
+  'ListRoleLimits',
+  'DeleteRoleLimit',
+  'ReservedDynamicUsage',
+  'ConfirmUsage',
+  'CancelUsage'
 ];
 const SYSTEM_TABLES = [
   'WebSocketTask',
@@ -57,6 +64,9 @@ const RBAC_TABLES = [
   'RoleUsers',
   'UserRoles',
   'RbacPermissionCaches',
+  'RoleLimit',
+  'RunningTotalUsage',
+  'RunningTotalReservedUsage',
   'WebSocketTask'
 ];
 const LEGACY_PROCESS_QUEUES = [
@@ -93,8 +103,23 @@ export async function emitResourceArtifacts({
     throw new TypeError('objects, relationships, and flows must be arrays');
   }
   const state = createResourceState({ objects, relationships, flows });
-  const [inSqs, out, dynamo, iam, lambdaRoleConfig, s3] = await Promise.all([
-    renderInSqs(state),
+  const [
+    crudInSqs,
+    relationshipInSqs,
+    rbacInSqs,
+    customFlowInSqs,
+    systemInSqs,
+    out,
+    dynamo,
+    iam,
+    lambdaRoleConfig,
+    s3
+  ] = await Promise.all([
+    renderCrudInSqs(state),
+    renderRelationshipInSqs(state),
+    renderRbacInSqs(state),
+    renderCustomFlowInSqs(state),
+    renderSystemInSqs(state),
     renderOut(state),
     renderDynamo(state),
     renderIam(state),
@@ -102,10 +127,6 @@ export async function emitResourceArtifacts({
     renderS3(state)
   ]);
   const artifacts = [
-    {
-      path: `${RESOURCE_ROOT}/generated-sns-in-sqs.yml`,
-      content: normalizeYaml(inSqs)
-    },
     {
       path: `${RESOURCE_ROOT}/generated-sns-out.yml`,
       content: normalizeYaml(out)
@@ -123,6 +144,36 @@ export async function emitResourceArtifacts({
       content: normalizeYaml(iam.roleNameConfigContent)
     }
   ];
+  if (crudInSqs) {
+    artifacts.push({
+      path: `${RESOURCE_ROOT}/generated-sns-sqs-crud.yml`,
+      content: normalizeYaml(crudInSqs)
+    });
+  }
+  if (relationshipInSqs) {
+    artifacts.push({
+      path: `${RESOURCE_ROOT}/generated-sns-sqs-relationship.yml`,
+      content: normalizeYaml(relationshipInSqs)
+    });
+  }
+  if (rbacInSqs) {
+    artifacts.push({
+      path: `${RESOURCE_ROOT}/generated-sns-sqs-rbac.yml`,
+      content: normalizeYaml(rbacInSqs)
+    });
+  }
+  if (customFlowInSqs) {
+    artifacts.push({
+      path: `${RESOURCE_ROOT}/generated-sns-sqs-custom-flows.yml`,
+      content: normalizeYaml(customFlowInSqs)
+    });
+  }
+  if (systemInSqs) {
+    artifacts.push({
+      path: `${RESOURCE_ROOT}/generated-sns-sqs-system.yml`,
+      content: normalizeYaml(systemInSqs)
+    });
+  }
   if (state.s3Buckets.length > 0) {
     artifacts.push({
       path: `${RESOURCE_ROOT}/generated-s3.yml`,
@@ -140,6 +191,11 @@ export async function emitResourceArtifacts({
 
 export const resourceArtifactPaths = [
   `${RESOURCE_ROOT}/generated-sns-in-sqs.yml`,
+  `${RESOURCE_ROOT}/generated-sns-sqs-crud.yml`,
+  `${RESOURCE_ROOT}/generated-sns-sqs-relationship.yml`,
+  `${RESOURCE_ROOT}/generated-sns-sqs-rbac.yml`,
+  `${RESOURCE_ROOT}/generated-sns-sqs-custom-flows.yml`,
+  `${RESOURCE_ROOT}/generated-sns-sqs-system.yml`,
   `${RESOURCE_ROOT}/generated-sns-out.yml`,
   `${RESOURCE_ROOT}/generated-dynamoDB-table.yml`,
   `${RESOURCE_ROOT}/generated-s3.yml`,
@@ -153,65 +209,37 @@ function createResourceState({ objects, relationships, flows }) {
   const selfRbac = objects.some(hasSelfRbacAddOn);
   const rbac = objects.some(hasSelfRbacAddOn);
   const crudActionPlans = createCrudActionPlans(objects);
-  const ownTopics = new Set([
-    'ProcessLogical',
-    'FindData',
-    ...flows
-      .filter((flow) => includesEvent(flow, 'ownTopic'))
-      .map((flow) => upperFirst(flow.flowTag))
-  ]);
-  const sqsQueues = new Set([
-    'PaginateProcessLogicalHdrDsq',
-    'PaginateProcessLogicalHdrSqs',
-    ...flows
-      .filter((flow) => includesEvent(flow, 'extTopic'))
-      .map((flow) => `Process${upperFirst(flow.flowTag)}HdrSqs`),
-    ...flows
-      .filter((flow) => flow?.outputTopic && !flow?.generatedCodeConfig && upperFirst(flow.flowTag))
-      .map((flow) => `${upperFirst(flow.flowTag)}CompleteHdrSqs`)
-  ]);
-  for (const { flowTag, stepName } of flowExtTopicSteps(flows)) {
-    sqsQueues.add(`${flowTag}${stepName}HdrSqs`);
-  }
-  for (const flow of flows.filter((flow) => includesEvent(flow, 's3'))) {
-    const tag = upperFirst(flow.flowTag);
-    sqsQueues.add(`${tag}CreatePreSignUrlHdrSqs`);
-    sqsQueues.add(`${tag}ReservedLimitHdrSqs`);
-    sqsQueues.add(`${tag}ConfirmAfterUploadHdrSqs`);
-  }
-  const dsqQueues = new Set(
-    flows
-      .filter((flow) => includesEvent(flow, 'dsq'))
-      .map((flow) => `${upperFirst(flow.flowTag)}HdrDsq`)
-  );
-  for (const { flowTag, stepName } of flowDsqSteps(flows)) {
-    dsqQueues.add(`${flowTag}${stepName}HdrDsq`);
-  }
+
+  const crudOwnTopics = crud ? [...CRUD_ACTIONS] : [];
+  const crudSqsQueues = [];
   if (crud) {
-    for (const action of CRUD_ACTIONS) {
-      ownTopics.add(action);
-    }
     for (const action of ['Create', 'Update', 'Delete']) {
       const plan = crudActionPlans[action];
-      if (plan.hasComplete) {
-        sqsQueues.add(`${action}CompleteHdrSqs`);
+      if (plan.hasCreateNodeCallback) {
+        crudSqsQueues.push(`${action}NodeCallbackHdrSqs`);
       }
-      if (plan.hasRbacCallback) {
-        sqsQueues.add(`${action}RbacCallbackHdrSqs`);
+      if (plan.hasComplete) {
+        crudSqsQueues.push(`${action}CompleteHdrSqs`);
       }
     }
   }
-  if (relationships.length > 0) {
-    for (const action of RELATIONSHIP_ACTIONS) {
-      ownTopics.add(action);
-      sqsQueues.add(`${action}CompleteHdrSqs`);
-    }
-    dsqQueues.add('GetRelationshipHdrDsq');
-  }
+
+  const relationshipOwnTopics = relationships.length > 0
+    ? [...RELATIONSHIP_ACTIONS]
+    : [];
+  const relationshipSqsQueues = relationships.length > 0
+    ? RELATIONSHIP_ACTIONS.map((action) => `${action}CompleteHdrSqs`)
+    : [];
+  const relationshipDsqQueues = relationships.length > 0
+    ? ['GetRelationshipHdrDsq']
+    : [];
+
+  const rbacOwnTopics = [];
+  const rbacSqsQueues = [];
   if (selfRbac) {
     for (const action of RBAC_ACTIONS) {
-      ownTopics.add(action);
-      sqsQueues.add(`Process${action}HdrSqs`);
+      rbacOwnTopics.push(action);
+      rbacSqsQueues.push(`Process${action}HdrSqs`);
     }
   }
   if (rbac) {
@@ -219,9 +247,93 @@ function createResourceState({ objects, relationships, flows }) {
       ...new Set(objects.filter(hasRbacAddOn).map(rbacFlowTag))
     ];
     for (const flowTag of flowTags) {
-      ownTopics.add(flowTag);
+      rbacOwnTopics.push(flowTag);
+    }
+  }
+  if (crud) {
+    for (const action of ['Create', 'Update', 'Delete']) {
+      const plan = crudActionPlans[action];
+      if (plan.hasRbacCallback) {
+        rbacSqsQueues.push(`${action}RbacCallbackHdrSqs`);
+      }
+    }
+  }
+
+  const customOwnTopics = flows
+    .filter((flow) => includesEvent(flow, 'ownTopic'))
+    .map((flow) => upperFirst(flow.flowTag));
+
+  const customSqsQueues = [
+    ...flows
+      .filter((flow) => includesEvent(flow, 'extTopic'))
+      .map((flow) => `Process${upperFirst(flow.flowTag)}HdrSqs`),
+    ...flows
+      .filter(
+        (flow) =>
+          flow?.outputTopic &&
+          !flow?.generatedCodeConfig &&
+          upperFirst(flow.flowTag)
+      )
+      .map((flow) => `${upperFirst(flow.flowTag)}CompleteHdrSqs`)
+  ];
+  for (const { flowTag, stepName } of flowExtTopicSteps(flows)) {
+    customSqsQueues.push(`${flowTag}${stepName}HdrSqs`);
+  }
+  for (const flow of flows) {
+    if (flowHasRbac(flow, objects)) {
+      const tag = upperFirst(flow.flowTag);
+      customSqsQueues.push(`${tag}RbacCallbackHdrSqs`);
     }
   }
+  for (const flow of flows.filter((flow) => includesEvent(flow, 's3'))) {
+    const tag = upperFirst(flow.flowTag);
+    customSqsQueues.push(`${tag}CreatePreSignUrlHdrSqs`);
+    customSqsQueues.push(`${tag}ReservedLimitHdrSqs`);
+    customSqsQueues.push(`${tag}ConfirmAfterUploadHdrSqs`);
+  }
+
+  const customDsqQueues = flows
+    .filter((flow) => includesEvent(flow, 'dsq'))
+    .map((flow) => `${upperFirst(flow.flowTag)}HdrDsq`);
+  for (const { flowTag, stepName } of flowDsqSteps(flows)) {
+    customDsqQueues.push(`${flowTag}${stepName}HdrDsq`);
+  }
+
+  const websocket = hasSystemWebSocket(flows, {
+    includeRelationshipOwnTopic: true,
+    objects,
+    relationships
+  });
+
+  const systemOwnTopics = ['ProcessLogical', 'FindData'];
+  const systemSqsQueues = [
+    'PaginateProcessLogicalHdrSqs',
+    ...(websocket
+      ? ['WebSocketCompleteHdrSqs', 'RegisterCompleteHdrSqs']
+      : [])
+  ];
+  const systemDsqQueues = ['PaginateProcessLogicalHdrDsq'];
+
+  const ownTopics = new Set([
+    ...systemOwnTopics,
+    ...crudOwnTopics,
+    ...relationshipOwnTopics,
+    ...rbacOwnTopics,
+    ...customOwnTopics
+  ]);
+  const sqsQueues = new Set([
+    ...systemSqsQueues,
+    ...crudSqsQueues,
+    ...relationshipSqsQueues,
+    ...rbacSqsQueues,
+    ...customSqsQueues
+  ]);
+  const dsqQueues = new Set([
+    ...systemDsqQueues,
+    ...relationshipDsqQueues,
+    ...customDsqQueues
+  ]);
+
   const customRoles = [
     ...new Set([
       ...supportedCustomFlows(flows).map((flow) =>
@@ -236,12 +348,11 @@ function createResourceState({ objects, relationships, flows }) {
       ...flowExtTopicSteps(flows).map(({ flow }) =>
         customFlowRoleName(flow.flowTag)
       ),
-      ...flowDsqSteps(flows).map(({ flow }) => customFlowRoleName(flow.flowTag))
+      ...flowDsqSteps(flows).map(({ flow }) =>
+        customFlowRoleName(flow.flowTag)
+      )
     ])
   ];
-  const websocket = hasSystemWebSocket(flows, {
-    includeRelationshipOwnTopic: true
-  });
   const webSocketRoles = new Set();
   if (websocket) {
     webSocketRoles.add('WebSocketMainRole');
@@ -286,7 +397,8 @@ function createResourceState({ objects, relationships, flows }) {
     .filter((flow) => includesEvent(flow, 's3'))
     .map((flow) => {
       const tag = upperFirst(flow.flowTag);
-      const outputTopicStr = typeof flow.outputTopic === 'string' ? flow.outputTopic : null;
+      const outputTopicStr =
+        typeof flow.outputTopic === 'string' ? flow.outputTopic : null;
       const topicName = outputTopicStr
         ? (outputTopicStr.startsWith('Out')
           ? outputTopicStr
@@ -301,7 +413,16 @@ function createResourceState({ objects, relationships, flows }) {
     });
   const systemTables = [...SYSTEM_TABLES];
   if (rbac) {
-    systemTables.push('TargetRoles', 'RolePermissions', 'RoleUsers', 'UserRoles', 'RbacPermissionCaches');
+    systemTables.push(
+      'TargetRoles',
+      'RolePermissions',
+      'RoleUsers',
+      'UserRoles',
+      'RbacPermissionCaches',
+      'RoleLimit',
+      'RunningTotalUsage',
+      'RunningTotalReservedUsage'
+    );
   }
   if (s3FlowTags.length > 0) {
     systemTables.push('ReservedDataMain');
@@ -315,6 +436,25 @@ function createResourceState({ objects, relationships, flows }) {
     crud,
     rbac,
     crudActionPlans,
+    crudOwnTopics: [...new Set(crudOwnTopics)].filter(Boolean).sort(),
+    crudSqsQueues: [...new Set(crudSqsQueues)].filter(Boolean).sort(),
+    relationshipOwnTopics: [...new Set(relationshipOwnTopics)]
+      .filter(Boolean)
+      .sort(),
+    relationshipSqsQueues: [...new Set(relationshipSqsQueues)]
+      .filter(Boolean)
+      .sort(),
+    relationshipDsqQueues: [...new Set(relationshipDsqQueues)]
+      .filter(Boolean)
+      .sort(),
+    rbacOwnTopics: [...new Set(rbacOwnTopics)].filter(Boolean).sort(),
+    rbacSqsQueues: [...new Set(rbacSqsQueues)].filter(Boolean).sort(),
+    customOwnTopics: [...new Set(customOwnTopics)].filter(Boolean).sort(),
+    customSqsQueues: [...new Set(customSqsQueues)].filter(Boolean).sort(),
+    customDsqQueues: [...new Set(customDsqQueues)].filter(Boolean).sort(),
+    systemOwnTopics: [...new Set(systemOwnTopics)].filter(Boolean).sort(),
+    systemSqsQueues: [...new Set(systemSqsQueues)].filter(Boolean).sort(),
+    systemDsqQueues: [...new Set(systemDsqQueues)].filter(Boolean).sort(),
     s3Subscriptions,
     s3FlowTags,
     hasHttpApi,
@@ -337,6 +477,9 @@ function createResourceState({ objects, relationships, flows }) {
                         flow.initiateBy === 'systemWithUser'))) &&
                   upperFirst(flow.flowTag) === topic
               ) ||
+              (objects.length > 0 &&
+                topic !== 'Get' &&
+                CRUD_ACTIONS.includes(topic)) ||
               (relationships.length > 0 &&
                 topic !== 'GetRelationship' &&
                 RELATIONSHIP_ACTIONS.includes(topic))
@@ -396,35 +539,39 @@ async function renderS3(state) {
   return `Resources:\n${indentYaml(chunks.join('\n'), 2)}`;
 }
 
-async function renderInSqs(state) {
+async function renderResourceGroup({
+  ownTopics = [],
+  sqsQueues = [],
+  dsqQueues = [],
+  webSocketSubscriptions = [],
+  s3Subscriptions = []
+}) {
+  const hasResources =
+    ownTopics.length > 0 ||
+    sqsQueues.length > 0 ||
+    dsqQueues.length > 0 ||
+    webSocketSubscriptions.length > 0 ||
+    s3Subscriptions.length > 0;
+  if (!hasResources) return '';
+
   const chunks = await Promise.all([
-    ...state.ownTopics.map((queueName) =>
+    ...ownTopics.map((queueName) =>
       render('ResourceYaml.ejs', { queueName })
     ),
-    ...state.sqsQueues.map((queueName) =>
+    ...sqsQueues.map((queueName) =>
       render('ResourceSqsYaml.ejs', { queueName })
     ),
-    ...state.dsqQueues.map((queueName) =>
+    ...dsqQueues.map((queueName) =>
       render('ResourceSqsYaml.ejs', { queueName })
-    ),
-    ...(state.websocket
-      ? [
-          render('ResourceSqsYaml.ejs', {
-            queueName: 'WebSocketCompleteHdrSqs'
-          }),
-          render('ResourceSqsYaml.ejs', {
-            queueName: 'RegisterCompleteHdrSqs'
-          })
-        ]
-      : [])
+    )
   ]);
-  const webSocketSubscriptions = await Promise.all(
-    state.webSocketSubscriptions.map((topicName) =>
+  const wsSubs = await Promise.all(
+    webSocketSubscriptions.map((topicName) =>
       renderWebSocketSubscription(topicName)
     )
   );
-  const s3Subscriptions = await Promise.all(
-    (state.s3Subscriptions ?? []).map(
+  const s3Subs = await Promise.all(
+    s3Subscriptions.map(
       ({ subscriptionName, topicName, queueName }) =>
         render('S3Subscription_Yaml.ejs', {
           subscriptionName,
@@ -434,16 +581,53 @@ async function renderInSqs(state) {
     )
   );
   const parts = [chunks.join('\n')];
-  if (webSocketSubscriptions.length > 0) {
-    parts.push(webSocketSubscriptions.join('\n'));
-  }
-  if (s3Subscriptions.length > 0) {
-    parts.push(s3Subscriptions.join('\n'));
-  }
-  const body = parts.join('\n');
+  if (wsSubs.length > 0) parts.push(wsSubs.join('\n'));
+  if (s3Subs.length > 0) parts.push(s3Subs.join('\n'));
+  const body = parts.filter(Boolean).join('\n');
+  if (!body.trim()) return '';
   return `Resources:\n${indentYaml(body, 2)}`;
 }
 
+async function renderCrudInSqs(state) {
+  return renderResourceGroup({
+    ownTopics: state.crudOwnTopics,
+    sqsQueues: state.crudSqsQueues
+  });
+}
+
+async function renderRelationshipInSqs(state) {
+  return renderResourceGroup({
+    ownTopics: state.relationshipOwnTopics,
+    sqsQueues: state.relationshipSqsQueues,
+    dsqQueues: state.relationshipDsqQueues
+  });
+}
+
+async function renderRbacInSqs(state) {
+  return renderResourceGroup({
+    ownTopics: state.rbacOwnTopics,
+    sqsQueues: state.rbacSqsQueues
+  });
+}
+
+async function renderCustomFlowInSqs(state) {
+  return renderResourceGroup({
+    ownTopics: state.customOwnTopics,
+    sqsQueues: state.customSqsQueues,
+    dsqQueues: state.customDsqQueues,
+    s3Subscriptions: state.s3Subscriptions
+  });
+}
+
+async function renderSystemInSqs(state) {
+  return renderResourceGroup({
+    ownTopics: state.systemOwnTopics,
+    sqsQueues: state.systemSqsQueues,
+    dsqQueues: state.systemDsqQueues,
+    webSocketSubscriptions: state.webSocketSubscriptions
+  });
+}
+
 async function renderOut(state) {
   const body = (
     await Promise.all(
@@ -517,7 +701,13 @@ function roleStatements(state, roleName) {
     statements.push({
       action: ['s3:GetObject'],
       resource: [
-        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/perServiceSchemas/*'
+        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/*'
+      ]
+    });
+    statements.push({
+      action: ['s3:ListBucket'],
+      resource: [
+        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}'
       ]
     });
   }
@@ -572,7 +762,17 @@ function roleTableNames(state, roleName) {
       ...state.objectTableNames,
       'AwaitingMultipleSteps',
       'AwaitingMultipleStepByPending',
-      'WebSocketTask'
+      'WebSocketTask',
+      ...(state.rbac
+        ? [
+            'TargetRoles',
+            'RoleUsers',
+            'UserRoles',
+            'RoleLimit',
+            'RunningTotalUsage',
+            'RunningTotalReservedUsage'
+          ]
+        : [])
     ];
   if (roleName === 'FlowRelationshipRole')
     return [
@@ -611,7 +811,7 @@ function dynamoActionsForRole(roleName) {
     return ['dynamodb:GetItem', 'dynamodb:Query', 'dynamodb:UpdateItem'];
   if (roleName === 'WebSocketMainRole')
     return ['dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:Query'];
-  if (roleName === 'FlowRbacRole')
+  if (roleName === 'FlowRbacRole' || roleName === 'FlowObjectsRole')
     return [...DYNAMO_ACTIONS, 'dynamodb:TransactWriteItems'];
   return DYNAMO_ACTIONS;
 }
@@ -638,6 +838,9 @@ function roleQueueNames(state, roleName) {
       if (!plan.outputTopic) return [];
       return [
         `${action}HdrSqs`,
+        ...(plan.hasCreateNodeCallback
+          ? [`${action}NodeCallbackHdrSqs`]
+          : []),
         ...(plan.hasRbacCallback
           ? [`${action}RbacCallbackHdrSqs`]
           : []),
@@ -677,6 +880,9 @@ function roleQueueNames(state, roleName) {
   if (includesEvent(flow, 'dsq')) {
     queueList.push(`${tag}HdrDsq`);
   }
+  if (flowHasRbac(flow, state.objects)) {
+    queueList.push(`${tag}RbacCallbackHdrSqs`);
+  }
   queueList.push(
     ...flowExtTopicSteps([flow]).map(
       ({ flowTag, stepName }) => `${flowTag}${stepName}HdrSqs`
@@ -708,21 +914,58 @@ function roleDlqQueueNames(state, roleName) {
 
 function roleTopicNames(state, roleName) {
   if (roleName === 'ProcFindDataRole')
-    return state.outTopics.filter((topic) => topic === 'FindData');
-  if (roleName === 'FlowObjectsRole')
-    return state.outTopics.filter((topic) => CRUD_ACTIONS.includes(topic));
-  if (roleName === 'FlowRelationshipRole')
-    return state.outTopics.filter((topic) =>
-      RELATIONSHIP_ACTIONS.includes(topic)
-    );
-  if (roleName === 'FlowRbacRole')
-    return state.outTopics.filter((topic) => RBAC_ACTIONS.includes(topic));
+    return state.outTopics.filter((topic) => topic === 'FindData').map((t) => `${t}_Out`);
+  if (roleName === 'FlowObjectsRole') {
+    const actions = state.outTopics.filter((topic) => CRUD_ACTIONS.includes(topic));
+    const topics = [];
+    for (const action of actions) {
+      if (action === 'Get') {
+        topics.push(`${action}_Out`);
+      } else {
+        topics.push(`${action}_In`, `${action}_Out`);
+      }
+    }
+    return topics;
+  }
+  if (roleName === 'FlowRelationshipRole') {
+    const actions = state.outTopics.filter((topic) => RELATIONSHIP_ACTIONS.includes(topic));
+    const topics = [];
+    for (const action of actions) {
+      if (action === 'GetRelationship') {
+        topics.push(`${action}_Out`);
+      } else {
+        topics.push(`${action}_In`, `${action}_Out`);
+      }
+    }
+    return topics;
+  }
+  if (roleName === 'FlowRbacRole') {
+    const actions = state.outTopics.filter((topic) => RBAC_ACTIONS.includes(topic));
+    const topics = [];
+    for (const action of actions) {
+      if (action.startsWith('List')) {
+        topics.push(`${action}_Out`);
+      } else {
+        topics.push(`${action}_In`, `${action}_Out`);
+      }
+    }
+    return topics;
+  }
   const flow = state.flows.find(
     (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
   );
-  return flow
-    ? state.outTopics.filter((topic) => topic === upperFirst(flow.flowTag))
-    : [];
+  if (flow && flow.flowTag) {
+    const name = upperFirst(flow.flowTag);
+    const topics = [];
+    if (state.outTopics.includes(name)) {
+      topics.push(`${name}_Out`);
+    }
+    if (includesEvent(flow, 'ownTopic')) {
+      topics.push(`${name}_In`);
+    }
+    return topics;
+  }
+  return [];
 }
 
 function dynamoArns(tableNames) {
@@ -794,7 +1037,7 @@ function topicArns(topicNames) {
     .sort()
     .map(
       (topic) =>
-        `arn:aws:sns:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_serviceTag}'}_${'${self:custom.iz_stage}'}_${topic}_Out`
+        `arn:aws:sns:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_serviceTag}'}_${'${self:custom.iz_stage}'}_${topic}`
     );
 }
 
@@ -903,7 +1146,7 @@ function keyName(identifier) {
 const VALID_CRUD_GENERATED_BY = new Set([
   'user',
   'systemWithUser',
-  'systemWithNoUser'
+  'systemNoUser'
 ]);
 
 function isCrudObject(object) {

package/src/emit/resource/templates/GeneratedLambdaRoleServiceConfig.ejs

@@ -56,7 +56,9 @@ export function generatedLambdaRole() {
           Effect: 'Allow',
           Action: ['sns:Publish'],
           Resource: [
-            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ConfirmUsage_In', 'Rbac')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CancelUsage_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
           ]
         }<% } %>