@izara_project/izara-core-generate-service-code 1.0.83 → 1.0.85

package/src/emit/rbac/templates/UserRbacFlow_Main.ejs

@@ -48,11 +48,11 @@ function _setL1Cache(key, value) {
 // ── L2 Cache (Shared DynamoDB TTL Cache) ──────────────────────────────────────
 const L2_TTL_SECONDS = 5 * 60; // 5 minutes
 
-async function _getL2Cache(_izContext, userId, cacheSubKey) {
+async function _getL2Cache(_izContext, submittedByUserId, cacheSubKey) {
   try {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
     const result = await dynamodbSharedLib.getItem(_izContext, tableName, {
-      userId,
+      submittedByUserId,
       cacheKey: cacheSubKey
     });
     if (result && result.ttlTimestamp && result.ttlTimestamp > Math.floor(Date.now() / 1000)) {
@@ -72,12 +72,12 @@ async function _getL2Cache(_izContext, userId, cacheSubKey) {
   return null;
 }
 
-async function _setL2Cache(_izContext, userId, cacheSubKey, value) {
+async function _setL2Cache(_izContext, submittedByUserId, cacheSubKey, value) {
   try {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
     const ttlTimestamp = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
     await dynamodbSharedLib.putItem(_izContext, tableName, {
-      userId,
+      submittedByUserId,
       cacheKey: cacheSubKey,
       permission: value.returnValue ? value.returnValue.permission : value.permission,
       roleIdKey: value.returnValue ? value.returnValue.roleIdKey : value.roleIdKey,
@@ -90,10 +90,42 @@ async function _setL2Cache(_izContext, userId, cacheSubKey, value) {
 }
 
 export default async function <%- flowTag %>(_izContext, requestParams = {}) {
-  const userId = _izContext.correlationIds.get(consts.BASE_USER_ID);
-  const targetId = _izContext.correlationIds.get(consts.TARGET_ID);
-  if (!userId || !targetId) {
-    throw new Error('Missing required request parameters: userId or targetId');
+  const submittedByUserId =
+    requestParams.submittedByUserId ||
+    requestParams.targetIdentifiers?.submittedByUserId ||
+    _izContext.correlationIds.get(consts.SUBMITTED_BY_USER_ID);
+
+  const targetIdentifiers = requestParams.targetIdentifiers;
+  let targetId = '';
+  if (targetIdentifiers) {
+    if (typeof targetIdentifiers === 'string') {
+      targetId = targetIdentifiers;
+    } else if (typeof targetIdentifiers === 'object') {
+      if (targetIdentifiers.identifierConcat) {
+        targetId = targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (
+            key !== 'submittedByUserId' &&
+            key !== 'identifierConcat' &&
+            value !== undefined &&
+            value !== null
+          ) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          targetId = parts.join('|');
+        }
+      }
+    }
+  }
+
+  if (!submittedByUserId || !targetIdentifiers) {
+    throw new Error('Missing required request parameters: submittedByUserId or targetIdentifiers');
   }
 
   const { flowTypeConcat, inputParameterGroups, parentFlowId } = requestParams;
@@ -101,40 +133,69 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     throw new Error('Missing flowTypeConcat in requestParams');
   }
 
-  _izContext.logger.debug('[<%- flowTag %>] requestParams:', {
-    userId,
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] requestParams:', {
+    submittedByUserId,
     targetId,
     flowTypeConcat,
     inputParameterGroups
   });
 
   const cacheSubKey = `${targetId}#${flowTypeConcat}#${JSON.stringify(inputParameterGroups || {})}`;
-  const fullCacheKey = `${userId}:${cacheSubKey}`;
+  const fullCacheKey = `${submittedByUserId}:${cacheSubKey}`;
+
+  // ── Fast-path for User Self-Action (submittedByUserId === targetId) ───────────────────
+  const isSelfUser = Boolean(
+    submittedByUserId &&
+      targetId &&
+      (submittedByUserId === targetId ||
+        targetId === `user#${submittedByUserId}` ||
+        targetId === `submittedByUserId#${submittedByUserId}`)
+  );
+
+  if (isSelfUser) {
+    _izContext.logger.debug(
+      '[<%- flowTag %>] Fast-path triggered: user self-action',
+      { submittedByUserId, targetId }
+    );
+    const result = {
+      returnValue: {
+        permission: true,
+        roleIdKey: 'self_user',
+        rbacType: 'self_user'
+      },
+      errorsFound: [],
+      status: 'Completed'
+    };
+    _setL1Cache(fullCacheKey, result);
+    await _setL2Cache(_izContext, submittedByUserId, cacheSubKey, result);
+    await _publicMessageOut(_izContext, { ...result, parentFlowId });
+    return 'Completed';
+  }
 
   // 1. Check L1 In-Memory Cache
   const l1Hit = _getL1Cache(fullCacheKey);
   if (l1Hit) {
-    _izContext.logger.debug('[<%- flowTag %>] L1 Cache hit:', l1Hit);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:', l1Hit);
     await _publicMessageOut(_izContext, { ...l1Hit, parentFlowId });
     return;
   }
 
   // 2. Check L2 Shared DynamoDB Cache
-  const l2Hit = await _getL2Cache(_izContext, userId, cacheSubKey);
+  const l2Hit = await _getL2Cache(_izContext, submittedByUserId, cacheSubKey);
   if (l2Hit) {
-    _izContext.logger.debug('[<%- flowTag %>] L2 Cache hit:', l2Hit);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:', l2Hit);
     _setL1Cache(fullCacheKey, l2Hit);
     await _publicMessageOut(_izContext, { ...l2Hit, parentFlowId });
     return;
   }
 
-  _izContext.logger.debug('[<%- flowTag %>] Cache miss — querying DynamoDB');
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB');
 
   // 3. Fallback to DB Query
   const userRolesResult = await dynamodbSharedLib.query(
     _izContext,
     dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-    { userId }
+    { submittedByUserId }
   );
 
   let userRoles = [];
@@ -144,7 +205,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     userRoles = userRolesResult.Items;
   }
 
-  _izContext.logger.debug('[<%- flowTag %>] userRoles fetched:', { userRoles });
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] userRoles fetched:', { userRoles });
 
   const targetIdPrefix = `${targetId}_`;
   const targetRoles = [];
@@ -154,13 +215,13 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     }
   }
 
-  _izContext.logger.debug('[<%- flowTag %>] targetRoles filtered:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] targetRoles filtered:', {
     targetIdPrefix,
     targetRoles
   });
 
   if (targetRoles.length === 0) {
-    _izContext.logger.debug('[<%- flowTag %>] no targetRoles found, permission denied');
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] no targetRoles found, permission denied');
     const result = {
       returnValue: {
         permission: false,
@@ -171,7 +232,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
       status: 'Completed'
     };
     _setL1Cache(fullCacheKey, result);
-    await _setL2Cache(_izContext, userId, cacheSubKey, result);
+    await _setL2Cache(_izContext, submittedByUserId, cacheSubKey, result);
     await _publicMessageOut(_izContext, { ...result, parentFlowId });
     return;
   }
@@ -189,7 +250,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     })
   );
 
-  _izContext.logger.debug('[<%- flowTag %>] rolePermissions fetched:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] rolePermissions fetched:', {
     rolePermissions
   });
 
@@ -217,11 +278,11 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     status: 'Completed'
   };
 
-  _izContext.logger.debug('[<%- flowTag %>] validation result:', cacheResult);
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] validation result:', cacheResult);
 
   // Store in L1 & L2 Cache
   _setL1Cache(fullCacheKey, cacheResult);
-  await _setL2Cache(_izContext, userId, cacheSubKey, cacheResult);
+  await _setL2Cache(_izContext, submittedByUserId, cacheSubKey, cacheResult);
 
   await _publicMessageOut(_izContext, { ...cacheResult, parentFlowId });
 

package/src/emit/rbac/templates/UserRoleMutation_Main.ejs

@@ -16,7 +16,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 <%
-const itemType = operation === 'Put' ? 'Item' : 'Key';
+const action = operation === 'Put' ? 'put' : 'delete';
+const propName = operation === 'Put' ? 'attributes' : 'keyValues';
 const roleUsersKey = operation === 'Put' ? 'userId, roleIdKey' : 'roleIdKey, userId';
 -%> import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
 import snsSharedLib from '@izara_project/izara-core-library-sns';
@@ -27,15 +28,17 @@ export default async function <%- flowTag %>(_izContext, requestParams) {
     const { roleIdKey, userId } = requestParams;
     await dynamodbSharedLib.transactWriteItems(_izContext, [
       {
-        <%- operation %>: {
-          TableName: dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
-          <%- itemType %>: { <%- roleUsersKey %> }
+        action: '<%- action %>',
+        params: {
+          tableName: dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
+          <%- propName %>: { <%- roleUsersKey %> }
         }
       },
       {
-        <%- operation %>: {
-          TableName: dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-          <%- itemType %>: { userId, roleIdKey }
+        action: '<%- action %>',
+        params: {
+          tableName: dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
+          <%- propName %>: { userId, roleIdKey }
         }
       }
     ]);
@@ -47,7 +50,7 @@ export default async function <%- flowTag %>(_izContext, requestParams) {
       )
     });
   } catch (error) {
-    _izContext.logger.error('[Rbac:<%- flowTag %>] error:', error);
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:<%- flowTag %>] error:`, error);
     throw error;
   }
 }

package/src/emit/relationship/emitDynamicRelationshipFlowSchemas.js

@@ -96,7 +96,7 @@ function createDynamicRelationshipFlow(action) {
 
   return {
     flowTag: action,
-    initiateBy: 'systemWithNoUser',
+    initiateBy: 'systemNoUser',
     handleObj: 'one',
     statusType: 'none',
     event: outputTopic

package/src/emit/relationship/templates/ChangeRelationship_Main.ejs

@@ -78,7 +78,7 @@ export default async function <%- functionName %>(
 
     let originTimestamp = Date.now();
     let changedByUserId = _izContext.correlationIds.get(
-      coreConsts.BASE_USER_ID
+      coreConsts.SUBMITTED_BY_USER_ID
     );
     const {
       firstObject,
@@ -191,14 +191,14 @@ export default async function <%- functionName %>(
             */
             // ? [Fix]: The legacy logic incorrectly blocked "user" from regular execution and allowed non-user values.
             // ? It has been corrected to require changeBy === "user" for normal execution.
-            const isUserProcess = Boolean(_izContext.correlationIds?.get(consts.BASE_USER_ID));
+            const isUserProcess = Boolean(_izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID));
             if (isUserProcess) {
               if (canChangeToRelType.changeBy !== 'user' && canChangeToRelType.changeBy !== 'systemWithUser') {
                 errorsFound.push(`CanChangeToRelType changeBy is not user or systemWithUser`);
               }
             } else {
-              if (canChangeToRelType.changeBy !== 'systemWithNoUser' && canChangeToRelType.changeBy !== 'system') {
-                errorsFound.push(`CanChangeToRelType changeBy is not systemWithNoUser`);
+              if (canChangeToRelType.changeBy !== 'systemNoUser') {
+                errorsFound.push(`CanChangeToRelType changeBy is not systemNoUser`);
               }
             }
           }