@izara_project/izara-core-generate-service-code 1.0.84 → 1.0.86

package/src/emit/rbac/emitDynamicRbacFlowSchemas.js

@@ -4,14 +4,17 @@ import { rbacFlowTag } from './rbacFlowTag.js';
 
 const RBAC_CORE_FLOW_DEFINITIONS = [
   { flowTag: 'CreateTargetRole', event: ['ownTopic'] },
-  { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
+  { flowTag: 'UpdateTargetRole', event: ['ownTopic'] },
   { flowTag: 'DeleteTargetRole', event: ['ownTopic'] },
+  { flowTag: 'GetTargetRole', event: ['lambdaSyncApi'] },
+  { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
   { flowTag: 'CreateRolePermissions', event: ['ownTopic'] },
   { flowTag: 'ListRolePermissions', event: ['lambdaSyncApi'] },
   { flowTag: 'DeleteRolePermissions', event: ['ownTopic'] },
   { flowTag: 'CreateUserRole', event: ['ownTopic'] },
   { flowTag: 'ListUserInRoles', event: ['lambdaSyncApi'] },
-  { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] }
+  { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] },
+  { flowTag: 'GetMyPermissions', event: ['lambdaSyncApi'] }
 ];
 
 const LIMIT_FLOW_DEFINITIONS = [

package/src/emit/rbac/emitRbacApplicationArtifacts.js

@@ -29,6 +29,19 @@ export async function emitRbacApplicationArtifacts(objects) {
     ...(hasSelfRbac
       ? [
           createTargetRoleHandler(),
+          createCustomRbacOwnTopicHandler(
+            'UpdateTargetRole',
+            'UpdateTargetRole_Main.ejs'
+          ),
+          createCustomRbacOwnTopicHandler(
+            'DeleteTargetRole',
+            'DeleteTargetRole_Main.ejs'
+          ),
+          createCustomRbacApiHandler('GetTargetRole', 'GetTargetRole_Main.ejs'),
+          createCustomRbacApiHandler(
+            'GetMyPermissions',
+            'GetMyPermissions_Main.ejs'
+          ),
           ...LIST_DEFINITIONS.map(createListHandler),
           ...MUTATION_DEFINITIONS.map(createMutationHandler),
           ...USER_ROLE_MUTATIONS.map(createUserRoleMutationHandler)
@@ -111,12 +124,6 @@ const MUTATION_DEFINITIONS = [
     tableName: 'RolePermissions',
     method: 'deleteItem',
     fields: ['roleIdKey', 'flowTypeConcat']
-  },
-  {
-    flowTag: 'DeleteTargetRole',
-    tableName: 'TargetRoles',
-    method: 'deleteItem',
-    fields: ['identifiersConcat', 'roleIdKey']
   }
 ];
 
@@ -151,6 +158,20 @@ const STATIC_RBAC_APPLICATION_PATHS = [
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrSqs.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_WbsMain.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_WbsMain.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_WbsMain.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_HdrApi.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_Main.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_HdrApi.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_HdrSqs.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_WbsMain.js',
@@ -331,6 +352,81 @@ async function createLimitMutationHandler(definition) {
   };
 }
 
+async function createCustomRbacOwnTopicHandler(flowTag, mainTemplateName) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${flowTag}/source`;
+  const webSocket = await createWebSocketEntry(
+    flowTag,
+    sourcePath,
+    handlerPath
+  );
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/${flowTag}_Main.js`,
+        content: await renderRbacTemplate(mainTemplateName, { flowTag })
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
+      },
+      ...webSocket.artifacts
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `${flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `${flowTag}HdrSqs`,
+        flowTag: flowTag,
+        flowStepName: ''
+      },
+      ...webSocket.functions
+    ]
+  };
+}
+
+async function createCustomRbacApiHandler(flowTag, mainTemplateName) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${flowTag}/source`;
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/${flowTag}_Main.js`,
+        content: await renderRbacTemplate(mainTemplateName, { flowTag })
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrApi.js`,
+        content: await renderRbacTemplate('ListRbac_HdrApi.ejs', { flowTag })
+      }
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `${flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `${flowTag}HdrSqs`,
+        flowTag: flowTag,
+        flowStepName: ''
+      },
+      {
+        type: 'api',
+        functionName: `${flowTag}HdrApi`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrApi.main`,
+        roleName: 'FlowRbacRole',
+        flowTag: flowTag,
+        flowStepName: ''
+      }
+    ]
+  };
+}
+
 async function createTargetRoleHandler() {
   const sourcePath = 'app/src/generatedCode/FlowRbac/CreateTargetRole/source';
   const webSocket = await createWebSocketEntry(

package/src/emit/rbac/templates/CancelUsage_Main.ejs

@@ -22,35 +22,68 @@ import { consts, NoRetryError } from '@izara_project/izara-core-library-core';
 
 export default async function CancelUsage(_izContext, requestParams) {
   try {
+    let runningTotalReservedId =
+      requestParams?.runningTotalReservedId ||
+      requestParams?.reservedId ||
+      requestParams?.runningTotalReservedUsageId;
+
+    const usedTimestampId =
+      requestParams?.usedTimestampId ||
+      requestParams?.uniqueIdentify;
+
     const submittedByUserId =
-      requestParams.submittedByUserId ||
+      requestParams?.submittedByUserId ||
       _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
-    const { limitTag, uniqueIdentify } = requestParams;
+    const flowTypeConcat =
+      requestParams?.flowTypeConcat ||
+      requestParams?.limitTag;
 
-    const targetIdentifiers = requestParams.targetIdentifiers;
-    let identifiersConcat = requestParams.identifiersConcat;
+    const targetIdentifiers = requestParams?.targetIdentifiers;
+    let identifiersConcat = requestParams?.identifiersConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      identifiersConcat = Object.entries(targetIdentifiers)
-        .map(([k, v]) => `${k}#${v}`)
-        .join('_');
+      if (targetIdentifiers.identifierConcat) {
+        identifiersConcat = targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (
+            key !== 'submittedByUserId' &&
+            key !== 'identifierConcat' &&
+            value !== undefined &&
+            value !== null
+          ) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          identifiersConcat = parts.join('|');
+        }
+      }
     }
     if (!identifiersConcat) {
       identifiersConcat = submittedByUserId;
     }
 
-    if (!identifiersConcat || !limitTag || !uniqueIdentify) {
+    if (!runningTotalReservedId) {
+      if (identifiersConcat && flowTypeConcat) {
+        runningTotalReservedId = `${identifiersConcat}_${flowTypeConcat}`;
+      }
+    }
+
+    if (!runningTotalReservedId || !usedTimestampId) {
       throw new NoRetryError(
-        'identifiersConcat, limitTag, and uniqueIdentify are required.'
+        'runningTotalReservedId (or identifiersConcat + flowTypeConcat) and usedTimestampId (or uniqueIdentify) are required.'
       );
     }
 
-    const runningTotalReservedId = `${identifiersConcat}_${limitTag}`;
     const reservedRecord = await dynamodbSharedLib.getItem(
       _izContext,
       dynamodbSharedLib.tableName(_izContext, 'RunningTotalReservedUsage'),
       {
         runningTotalReservedId,
-        usedTimestampId: uniqueIdentify
+        usedTimestampId
       }
     );
 
@@ -61,36 +94,63 @@ export default async function CancelUsage(_izContext, requestParams) {
       dynamodbSharedLib.tableName(_izContext, 'RunningTotalReservedUsage'),
       {
         runningTotalReservedId,
-        usedTimestampId: uniqueIdentify
+        usedTimestampId
       },
       {
         runningTotalUsageStatus: 'cancelled'
       }
     );
 
-    if (usageCount > 0) {
+    if (usageCount > 0 && identifiersConcat && flowTypeConcat) {
       const usageRecord = await dynamodbSharedLib.getItem(
         _izContext,
         dynamodbSharedLib.tableName(_izContext, 'RunningTotalUsage'),
-        { identifiersConcat, limitTag }
+        { identifiersConcat, flowTypeConcat }
       );
       if (usageRecord) {
-        const newTotal = Math.max(0, (usageRecord.totalCount || 0) - usageCount);
-        await dynamodbSharedLib.putItem(
+        const currentTotal = usageRecord.totalCount || 0;
+        const newTotal = Math.max(0, currentTotal - usageCount);
+        const queryElementsWhenUpdate = {
+          additionalAttributes: { currentUuid: usageRecord.updateUuid },
+          logicalElements: [
+            {
+              type: 'logical',
+              comparison: 'equals',
+              lhsAttribute: 'updateUuid',
+              rhsReference: 'currentUuid'
+            }
+          ],
+          returnValues: 'ALL_NEW'
+        };
+
+        const updateAttributes = [
+          { attributeName: 'totalCount', action: 'set', value: newTotal },
+          { attributeName: 'updateUuid', action: 'set', value: _izContext.uniqueRequestId || `${Date.now()}` }
+        ];
+
+        await dynamodbSharedLib.updateItem(
           _izContext,
           dynamodbSharedLib.tableName(_izContext, 'RunningTotalUsage'),
+          { identifiersConcat, flowTypeConcat },
+          updateAttributes,
+          queryElementsWhenUpdate,
           {
-            identifiersConcat,
-            limitTag,
-            totalCount: newTotal,
-            updateUuid: _izContext.uniqueRequestId || `${Date.now()}`
+            complexAttributes: true,
+            errorOnConditionalExpNotPass: false
           }
-        );
+        ).catch(() => null);
       }
     }
 
     await sns.publishMessage(_izContext, {
-      message: { returnResult: { status: true, uniqueIdentify } },
+      message: {
+        returnResult: {
+          status: true,
+          uniqueIdentify: usedTimestampId,
+          usedTimestampId,
+          runningTotalReservedId
+        }
+      },
       TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
         _izContext,
         'CancelUsage_Out'

package/src/emit/rbac/templates/ConfirmUsage_Main.ejs

@@ -22,43 +22,159 @@ import { consts, NoRetryError } from '@izara_project/izara-core-library-core';
 
 export default async function ConfirmUsage(_izContext, requestParams) {
   try {
+    let runningTotalReservedId =
+      requestParams?.runningTotalReservedId ||
+      requestParams?.reservedId ||
+      requestParams?.runningTotalReservedUsageId;
+
+    const usedTimestampId =
+      requestParams?.usedTimestampId ||
+      requestParams?.uniqueIdentify;
+
     const submittedByUserId =
-      requestParams.submittedByUserId ||
+      requestParams?.submittedByUserId ||
       _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
-    const { limitTag, uniqueIdentify } = requestParams;
+    const flowTypeConcat =
+      requestParams?.flowTypeConcat ||
+      requestParams?.limitTag;
 
-    const targetIdentifiers = requestParams.targetIdentifiers;
-    let identifiersConcat = requestParams.identifiersConcat;
+    const targetIdentifiers = requestParams?.targetIdentifiers;
+    let identifiersConcat = requestParams?.identifiersConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      identifiersConcat = Object.entries(targetIdentifiers)
-        .map(([k, v]) => `${k}#${v}`)
-        .join('_');
+      if (targetIdentifiers.identifierConcat) {
+        identifiersConcat = targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (
+            key !== 'submittedByUserId' &&
+            key !== 'identifierConcat' &&
+            value !== undefined &&
+            value !== null
+          ) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          identifiersConcat = parts.join('|');
+        }
+      }
     }
     if (!identifiersConcat) {
       identifiersConcat = submittedByUserId;
     }
 
-    if (!identifiersConcat || !limitTag || !uniqueIdentify) {
+    if (!runningTotalReservedId) {
+      if (identifiersConcat && flowTypeConcat) {
+        runningTotalReservedId = `${identifiersConcat}_${flowTypeConcat}`;
+      }
+    }
+
+    if (!runningTotalReservedId || !usedTimestampId) {
       throw new NoRetryError(
-        'identifiersConcat, limitTag, and uniqueIdentify are required.'
+        'runningTotalReservedId (or identifiersConcat + flowTypeConcat) and usedTimestampId (or uniqueIdentify) are required.'
       );
     }
 
-    const runningTotalReservedId = `${identifiersConcat}_${limitTag}`;
+    const reservedTable = dynamodbSharedLib.tableName(
+      _izContext,
+      'RunningTotalReservedUsage'
+    );
+
+    const reservedRecord = await dynamodbSharedLib
+      .getItem(_izContext, reservedTable, {
+        runningTotalReservedId,
+        usedTimestampId
+      })
+      .catch(() => null);
+
+    let usageCount = 1;
+    if (reservedRecord && typeof reservedRecord.usageCount === 'number') {
+      usageCount = reservedRecord.usageCount;
+    }
+
     await dynamodbSharedLib.updateItem(
       _izContext,
-      dynamodbSharedLib.tableName(_izContext, 'RunningTotalReservedUsage'),
+      reservedTable,
       {
         runningTotalReservedId,
-        usedTimestampId: uniqueIdentify
+        usedTimestampId
       },
       {
-        runningTotalUsageStatus: 'confirmed'
+        runningTotalUsageStatus: 'confirmed',
+        confirmedAt: new Date().toISOString()
       }
     );
 
+    if (identifiersConcat && flowTypeConcat) {
+      const usageTable = dynamodbSharedLib.tableName(
+        _izContext,
+        'RunningTotalUsage'
+      );
+
+      const usageRecord = await dynamodbSharedLib
+        .getItem(_izContext, usageTable, {
+          identifiersConcat,
+          flowTypeConcat
+        })
+        .catch(() => null);
+
+      let currentTotal = 0;
+      let queryElementsWhenUpdate = {};
+
+      if (usageRecord && typeof usageRecord.totalCount === 'number') {
+        currentTotal = usageRecord.totalCount;
+        queryElementsWhenUpdate = {
+          additionalAttributes: { currentUuid: usageRecord.updateUuid },
+          logicalElements: [
+            {
+              type: 'logical',
+              comparison: 'equals',
+              lhsAttribute: 'updateUuid',
+              rhsReference: 'currentUuid'
+            }
+          ],
+          returnValues: 'ALL_NEW'
+        };
+      } else {
+        queryElementsWhenUpdate = {
+          logicalElements: dynamodbSharedLib.generateNotExistLogicalElements({
+            identifiersConcat,
+            flowTypeConcat
+          }),
+          returnValues: 'ALL_NEW'
+        };
+      }
+
+      const updateAttributes = [
+        { attributeName: 'totalCount', action: 'set', value: currentTotal + usageCount },
+        { attributeName: 'updateUuid', action: 'set', value: _izContext.uniqueRequestId || `${Date.now()}` }
+      ];
+
+      await dynamodbSharedLib.updateItem(
+        _izContext,
+        usageTable,
+        { identifiersConcat, flowTypeConcat },
+        updateAttributes,
+        queryElementsWhenUpdate,
+        {
+          complexAttributes: true,
+          errorOnConditionalExpNotPass: false
+        }
+      ).catch(() => null);
+    }
+
     await sns.publishMessage(_izContext, {
-      message: { returnResult: { status: true, uniqueIdentify } },
+      message: {
+        returnResult: {
+          status: true,
+          uniqueIdentify: usedTimestampId,
+          usedTimestampId,
+          runningTotalReservedId
+        }
+      },
       TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
         _izContext,
         'ConfirmUsage_Out'

package/src/emit/rbac/templates/CreateTargetRole_Main.ejs

@@ -30,15 +30,37 @@ export default async function CreateTargetRole(_izContext, requestParams) {
     const targetIdentifiers = requestParams.targetIdentifiers;
     let identifiersConcat = requestParams.identifiersConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      identifiersConcat = Object.entries(targetIdentifiers)
-        .map(([k, v]) => `${k}#${v}`)
-        .join('_');
+      if (targetIdentifiers.identifierConcat) {
+        identifiersConcat = targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (
+            key !== 'submittedByUserId' &&
+            key !== 'identifierConcat' &&
+            value !== undefined &&
+            value !== null
+          ) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          identifiersConcat = parts.join('|');
+        }
+      }
     }
     if (!identifiersConcat) {
       identifiersConcat = submittedByUserId;
     }
 
-    const { roleName = 'owner', roleId: inputRoleId } = requestParams;
+    const {
+      roleName = 'owner',
+      roleId: inputRoleId,
+      permissions = [],
+      assignUserIds = []
+    } = requestParams;
     const roleId = inputRoleId || roleName || identifierUuid();
     const roleIdKey = `${identifiersConcat}_${roleId}`;
 
@@ -53,24 +75,51 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       }
     );
 
-    if (submittedByUserId) {
+    if (Array.isArray(permissions) && permissions.length > 0) {
+      const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+      for (const perm of permissions) {
+        const flowTypeConcat = typeof perm === 'string' ? perm : perm.flowTypeConcat;
+        if (flowTypeConcat) {
+          const permission =
+            typeof perm === 'object' && perm.permission !== undefined
+              ? perm.permission
+              : true;
+          const parameterGroups = (typeof perm === 'object' && perm.parameterGroups) || {};
+          await dynamodbSharedLib.putItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat,
+            permission,
+            parameterGroups
+          });
+        }
+      }
+    }
+
+    const usersToAssign =
+      Array.isArray(assignUserIds) && assignUserIds.length > 0
+        ? assignUserIds
+        : (roleName === 'owner' && submittedByUserId ? [submittedByUserId] : []);
+
+    for (const userId of usersToAssign) {
       try {
         await dynamodbSharedLib.transactWriteItems(_izContext, [
           {
-            Put: {
-              TableName: dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
-              Item: { roleIdKey, submittedByUserId }
+            action: 'put',
+            params: {
+              tableName: dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
+              attributes: { roleIdKey, userId, submittedByUserId }
             }
           },
           {
-            Put: {
-              TableName: dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-              Item: { submittedByUserId, roleIdKey }
+            action: 'put',
+            params: {
+              tableName: dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
+              attributes: { userId, roleIdKey, submittedByUserId }
             }
           }
         ]);
       } catch (assignError) {
-        _izContext.logger.debug(`[${process.env.iz_serviceTag}:CreateTargetRole] UserRoles transactWrite ignored:', assignError);
+        _izContext.logger.debug(`[${process.env.iz_serviceTag}:CreateTargetRole] UserRoles transactWrite ignored:`, assignError);
       }
     }
 

package/src/emit/rbac/templates/DeleteTargetRole_Main.ejs

@@ -0,0 +1,96 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function DeleteTargetRole(_izContext, requestParams) {
+  try {
+    const { identifiersConcat, roleIdKey } = requestParams;
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    if (roleIdKey.endsWith('_owner')) {
+      throw new NoRetryError('Cannot delete system owner role');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+    const roleUsersTable = dynamodbSharedLib.tableName(_izContext, 'RoleUsers');
+    const userRolesTable = dynamodbSharedLib.tableName(_izContext, 'UserRoles');
+
+    // 1. Delete from TargetRoles
+    await dynamodbSharedLib.deleteItem(
+      _izContext,
+      targetRolesTable,
+      { identifiersConcat, roleIdKey }
+    );
+
+    // 2. Cascade delete all permissions for this roleIdKey
+    const permsResult = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+      roleIdKey
+    });
+    for (const perm of (permsResult?.Items || [])) {
+      await dynamodbSharedLib.deleteItem(_izContext, rolePermissionsTable, {
+        roleIdKey,
+        flowTypeConcat: perm.flowTypeConcat
+      });
+    }
+
+    // 3. Cascade delete user assignments in RoleUsers and UserRoles
+    const usersResult = await dynamodbSharedLib.query(_izContext, roleUsersTable, {
+      roleIdKey
+    });
+    for (const userItem of (usersResult?.Items || [])) {
+      const userId = userItem.userId;
+      try {
+        await dynamodbSharedLib.transactWriteItems(_izContext, [
+          {
+            action: 'delete',
+            params: {
+              tableName: roleUsersTable,
+              keyValues: { roleIdKey, userId }
+            }
+          },
+          {
+            action: 'delete',
+            params: {
+              tableName: userRolesTable,
+              keyValues: { userId, roleIdKey }
+            }
+          }
+        ]);
+      } catch (err) {
+        _izContext.logger.debug(`[${process.env.iz_serviceTag}:DeleteTargetRole] Cascade user cleanup ignored:`, err);
+      }
+    }
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: { identifiersConcat, roleIdKey, status: 'deleted' } },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'DeleteTargetRole_Out'
+      )
+    });
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:DeleteTargetRole] error:`, error);
+    throw error;
+  }
+}