@izara_project/izara-core-generate-service-code 1.0.84 → 1.0.86

package/src/emit/rbac/templates/GetMyPermissions_Main.ejs

@@ -0,0 +1,106 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { consts, NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function GetMyPermissions(_izContext, requestParams) {
+  try {
+    const submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
+
+    if (!submittedByUserId) {
+      throw new NoRetryError('User identity not found in context.');
+    }
+
+    const targetIdentifiers = requestParams.targetIdentifiers;
+    let identifiersConcat = requestParams.identifiersConcat;
+    if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
+      if (targetIdentifiers.identifierConcat) {
+        identifiersConcat = targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (
+            key !== 'submittedByUserId' &&
+            key !== 'identifierConcat' &&
+            value !== undefined &&
+            value !== null
+          ) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          identifiersConcat = parts.join('|');
+        }
+      }
+    }
+
+    const userRolesTable = dynamodbSharedLib.tableName(_izContext, 'UserRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+
+    const userRolesResult = await dynamodbSharedLib.query(_izContext, userRolesTable, {
+      userId: submittedByUserId
+    });
+    const userRoleItems = userRolesResult?.Items || [];
+
+    const matchingRoles = identifiersConcat
+      ? userRoleItems.filter((item) => item.roleIdKey?.startsWith(identifiersConcat))
+      : userRoleItems;
+
+    const permissionsMap = {};
+    const rolesList = [];
+
+    for (const roleItem of matchingRoles) {
+      rolesList.push(roleItem.roleIdKey);
+      const permsResult = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+        roleIdKey: roleItem.roleIdKey
+      });
+      for (const p of (permsResult?.Items || [])) {
+        if (p.permission === true) {
+          permissionsMap[p.flowTypeConcat] = true;
+        } else if (permissionsMap[p.flowTypeConcat] === undefined) {
+          permissionsMap[p.flowTypeConcat] = false;
+        }
+      }
+    }
+
+    const result = {
+      userId: submittedByUserId,
+      identifiersConcat: identifiersConcat || null,
+      roles: rolesList,
+      permissions: permissionsMap
+    };
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: result },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'GetMyPermissions_Out'
+      )
+    });
+    return result;
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:GetMyPermissions] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/GetTargetRole_Main.ejs

@@ -0,0 +1,62 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function GetTargetRole(_izContext, requestParams) {
+  try {
+    const { identifiersConcat, roleIdKey } = requestParams;
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+    const roleUsersTable = dynamodbSharedLib.tableName(_izContext, 'RoleUsers');
+
+    const role = identifiersConcat
+      ? await dynamodbSharedLib.getItem(_izContext, targetRolesTable, { identifiersConcat, roleIdKey })
+      : null;
+
+    const [permsResult, usersResult] = await Promise.all([
+      dynamodbSharedLib.query(_izContext, rolePermissionsTable, { roleIdKey }),
+      dynamodbSharedLib.query(_izContext, roleUsersTable, { roleIdKey })
+    ]);
+
+    const result = {
+      role,
+      roleIdKey,
+      permissions: permsResult?.Items || [],
+      users: usersResult?.Items || []
+    };
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: result },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'GetTargetRole_Out'
+      )
+    });
+    return result;
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:GetTargetRole] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/ReservedDynamicUsage_Main.ejs

@@ -25,8 +25,10 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     const submittedByUserId =
       requestParams.submittedByUserId ||
       _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
+    const flowTypeConcat =
+      requestParams.flowTypeConcat ||
+      requestParams.limitTag;
     const {
-      limitTag,
       value = 1,
       usedTimestamp = new Date().toISOString(),
       roleLimitId
@@ -35,9 +37,26 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     const targetIdentifiers = requestParams.targetIdentifiers;
     let identifiersConcat = requestParams.identifiersConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      identifiersConcat = Object.entries(targetIdentifiers)
-        .map(([k, v]) => `${k}#${v}`)
-        .join('_');
+      if (targetIdentifiers.identifierConcat) {
+        identifiersConcat = targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (
+            key !== 'submittedByUserId' &&
+            key !== 'identifierConcat' &&
+            value !== undefined &&
+            value !== null
+          ) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          identifiersConcat = parts.join('|');
+        }
+      }
     }
     if (!identifiersConcat) {
       identifiersConcat = submittedByUserId;
@@ -46,14 +65,14 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     if (!identifiersConcat) {
       throw new NoRetryError('Identifier not found.');
     }
-    if (!limitTag) {
-      throw new NoRetryError('limitTag is required.');
+    if (!flowTypeConcat) {
+      throw new NoRetryError('flowTypeConcat (or limitTag) is required.');
     }
 
     const uniqueIdentify = `${usedTimestamp}_${_izContext.uniqueRequestId || Date.now()}`;
     const roleLimitKeys = Array.isArray(requestParams.roleLimitIds)
       ? requestParams.roleLimitIds
-      : [roleLimitId || `${identifiersConcat}_${limitTag}`];
+      : [roleLimitId || `${identifiersConcat}_${flowTypeConcat}`];
 
     let maxLimit = Infinity;
     const limitRecords = [];
@@ -93,7 +112,7 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     const usageRecord = await dynamodbSharedLib.getItem(
       _izContext,
       dynamodbSharedLib.tableName(_izContext, 'RunningTotalUsage'),
-      { identifiersConcat, limitTag }
+      { identifiersConcat, flowTypeConcat }
     );
     const currentTotal = usageRecord?.totalCount || 0;
 
@@ -106,7 +125,7 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
         _izContext,
         dynamodbSharedLib.tableName(_izContext, 'RunningTotalReservedUsage'),
         {
-          runningTotalReservedId: `${identifiersConcat}_${limitTag}`,
+          runningTotalReservedId: `${identifiersConcat}_${flowTypeConcat}`,
           usedTimestampId: uniqueIdentify,
           usageCount: value,
           runningTotalUsageStatus: 'reserved',
@@ -119,7 +138,7 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
         dynamodbSharedLib.tableName(_izContext, 'RunningTotalUsage'),
         {
           identifiersConcat,
-          limitTag,
+          flowTypeConcat,
           totalCount: currentTotal + value,
           updateUuid: _izContext.uniqueRequestId || `${Date.now()}`
         }
@@ -129,7 +148,7 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     const returnResult = {
       passStatus,
       uniqueIdentify,
-      limitTag,
+      flowTypeConcat,
       identifiersConcat
     };
 

package/src/emit/rbac/templates/UpdateTargetRole_Main.ejs

@@ -0,0 +1,107 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { consts, NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function UpdateTargetRole(_izContext, requestParams) {
+  try {
+    const submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
+
+    const {
+      identifiersConcat,
+      roleIdKey,
+      roleName,
+      permissions
+    } = requestParams;
+
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    if (roleIdKey.endsWith('_owner')) {
+      throw new NoRetryError('Cannot modify system owner role');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+
+    if (roleName && identifiersConcat) {
+      const existingRole = await dynamodbSharedLib.getItem(_izContext, targetRolesTable, {
+        identifiersConcat,
+        roleIdKey
+      });
+      if (existingRole) {
+        await dynamodbSharedLib.putItem(_izContext, targetRolesTable, {
+          ...existingRole,
+          roleName
+        });
+      }
+    }
+
+    if (Array.isArray(permissions)) {
+      const currentPermsQuery = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+        roleIdKey
+      });
+      const currentPerms = currentPermsQuery?.Items || [];
+      const currentFlowMap = new Map(currentPerms.map((p) => [p.flowTypeConcat, p]));
+
+      const newFlowSet = new Set();
+      for (const perm of permissions) {
+        const flowTypeConcat = typeof perm === 'string' ? perm : perm.flowTypeConcat;
+        if (flowTypeConcat) {
+          newFlowSet.add(flowTypeConcat);
+          const permission =
+            typeof perm === 'object' && perm.permission !== undefined
+              ? perm.permission
+              : true;
+          const parameterGroups = (typeof perm === 'object' && perm.parameterGroups) || {};
+          await dynamodbSharedLib.putItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat,
+            permission,
+            parameterGroups
+          });
+        }
+      }
+
+      for (const [oldFlow] of currentFlowMap.entries()) {
+        if (!newFlowSet.has(oldFlow)) {
+          await dynamodbSharedLib.deleteItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat: oldFlow
+          });
+        }
+      }
+    }
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: { roleIdKey, status: 'updated' } },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'UpdateTargetRole_Out'
+      )
+    });
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:UpdateTargetRole] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/UserRbacFlow_Main.ejs

@@ -52,7 +52,7 @@ async function _getL2Cache(_izContext, submittedByUserId, cacheSubKey) {
   try {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
     const result = await dynamodbSharedLib.getItem(_izContext, tableName, {
-      submittedByUserId,
+      userId: submittedByUserId,
       cacheKey: cacheSubKey
     });
     if (result && result.ttlTimestamp && result.ttlTimestamp > Math.floor(Date.now() / 1000)) {
@@ -77,7 +77,7 @@ async function _setL2Cache(_izContext, submittedByUserId, cacheSubKey, value) {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
     const ttlTimestamp = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
     await dynamodbSharedLib.putItem(_izContext, tableName, {
-      submittedByUserId,
+      userId: submittedByUserId,
       cacheKey: cacheSubKey,
       permission: value.returnValue ? value.returnValue.permission : value.permission,
       roleIdKey: value.returnValue ? value.returnValue.roleIdKey : value.roleIdKey,
@@ -92,12 +92,37 @@ async function _setL2Cache(_izContext, submittedByUserId, cacheSubKey, value) {
 export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   const submittedByUserId =
     requestParams.submittedByUserId ||
+    requestParams.targetIdentifiers?.submittedByUserId ||
     _izContext.correlationIds.get(consts.SUBMITTED_BY_USER_ID);
 
   const targetIdentifiers = requestParams.targetIdentifiers;
-  let targetId = targetIdentifiers && typeof targetIdentifiers === 'object'
-    ? Object.entries(targetIdentifiers).map(([k, v]) => `${k}#${v}`).join('_')
-    : undefined;
+  let targetId = '';
+  if (targetIdentifiers) {
+    if (typeof targetIdentifiers === 'string') {
+      targetId = targetIdentifiers;
+    } else if (typeof targetIdentifiers === 'object') {
+      if (targetIdentifiers.identifierConcat) {
+        targetId = targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (
+            key !== 'submittedByUserId' &&
+            key !== 'identifierConcat' &&
+            value !== undefined &&
+            value !== null
+          ) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          targetId = parts.join('|');
+        }
+      }
+    }
+  }
 
   if (!submittedByUserId || !targetIdentifiers) {
     throw new Error('Missing required request parameters: submittedByUserId or targetIdentifiers');
@@ -108,7 +133,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     throw new Error('Missing flowTypeConcat in requestParams');
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] requestParams:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] requestParams:`, {
     submittedByUserId,
     targetId,
     flowTypeConcat,
@@ -150,7 +175,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   // 1. Check L1 In-Memory Cache
   const l1Hit = _getL1Cache(fullCacheKey);
   if (l1Hit) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:', l1Hit);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:`, l1Hit);
     await _publicMessageOut(_izContext, { ...l1Hit, parentFlowId });
     return;
   }
@@ -158,19 +183,19 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   // 2. Check L2 Shared DynamoDB Cache
   const l2Hit = await _getL2Cache(_izContext, submittedByUserId, cacheSubKey);
   if (l2Hit) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:', l2Hit);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:`, l2Hit);
     _setL1Cache(fullCacheKey, l2Hit);
     await _publicMessageOut(_izContext, { ...l2Hit, parentFlowId });
     return;
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB');
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB`);
 
   // 3. Fallback to DB Query
   const userRolesResult = await dynamodbSharedLib.query(
     _izContext,
     dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-    { submittedByUserId }
+    { userId: submittedByUserId }
   );
 
   let userRoles = [];
@@ -180,7 +205,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     userRoles = userRolesResult.Items;
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] userRoles fetched:', { userRoles });
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] userRoles fetched:`, { userRoles });
 
   const targetIdPrefix = `${targetId}_`;
   const targetRoles = [];
@@ -190,13 +215,13 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     }
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] targetRoles filtered:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] targetRoles filtered:`, {
     targetIdPrefix,
     targetRoles
   });
 
   if (targetRoles.length === 0) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] no targetRoles found, permission denied');
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] no targetRoles found, permission denied`);
     const result = {
       returnValue: {
         permission: false,
@@ -225,7 +250,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     })
   );
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] rolePermissions fetched:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] rolePermissions fetched:`, {
     rolePermissions
   });
 
@@ -253,7 +278,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     status: 'Completed'
   };
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] validation result:', cacheResult);
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] validation result:`, cacheResult);
 
   // Store in L1 & L2 Cache
   _setL1Cache(fullCacheKey, cacheResult);

package/src/emit/rbac/templates/UserRoleMutation_Main.ejs

@@ -16,7 +16,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 <%
-const itemType = operation === 'Put' ? 'Item' : 'Key';
+const action = operation === 'Put' ? 'put' : 'delete';
+const propName = operation === 'Put' ? 'attributes' : 'keyValues';
 const roleUsersKey = operation === 'Put' ? 'userId, roleIdKey' : 'roleIdKey, userId';
 -%> import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
 import snsSharedLib from '@izara_project/izara-core-library-sns';
@@ -25,17 +26,31 @@ import { sns } from '@izara_project/izara-core-library-external-request';
 export default async function <%- flowTag %>(_izContext, requestParams) {
   try {
     const { roleIdKey, userId } = requestParams;
+<% if (operation === 'Delete') { -%>
+    if (roleIdKey && roleIdKey.endsWith('_owner')) {
+      const remainingUsers = await dynamodbSharedLib.query(
+        _izContext,
+        dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
+        { roleIdKey }
+      );
+      if (remainingUsers?.Items?.length <= 1) {
+        throw new Error('Cannot remove the last remaining owner');
+      }
+    }
+<% } -%>
     await dynamodbSharedLib.transactWriteItems(_izContext, [
       {
-        <%- operation %>: {
-          TableName: dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
-          <%- itemType %>: { <%- roleUsersKey %> }
+        action: '<%- action %>',
+        params: {
+          tableName: dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
+          <%- propName %>: { <%- roleUsersKey %> }
         }
       },
       {
-        <%- operation %>: {
-          TableName: dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-          <%- itemType %>: { userId, roleIdKey }
+        action: '<%- action %>',
+        params: {
+          tableName: dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
+          <%- propName %>: { userId, roleIdKey }
         }
       }
     ]);

package/src/emit/resource/emitResourceArtifacts.js

@@ -31,14 +31,17 @@ const RELATIONSHIP_ACTIONS = [
 ];
 const RBAC_ACTIONS = [
   'CreateTargetRole',
-  'ListTargetRole',
+  'UpdateTargetRole',
   'DeleteTargetRole',
+  'GetTargetRole',
+  'ListTargetRole',
   'CreateRolePermissions',
   'ListRolePermissions',
   'DeleteRolePermissions',
   'CreateUserRole',
   'ListUserInRoles',
   'DeleteUserFromRole',
+  'GetMyPermissions',
   'ValidatorRbac',
   'CreateRoleLimit',
   'ListRoleLimits',
@@ -215,6 +218,9 @@ function createResourceState({ objects, relationships, flows }) {
   if (crud) {
     for (const action of ['Create', 'Update', 'Delete']) {
       const plan = crudActionPlans[action];
+      if (plan.hasCreateNodeCallback) {
+        crudSqsQueues.push(`${action}NodeCallbackHdrSqs`);
+      }
       if (plan.hasComplete) {
         crudSqsQueues.push(`${action}CompleteHdrSqs`);
       }
@@ -474,6 +480,9 @@ function createResourceState({ objects, relationships, flows }) {
                         flow.initiateBy === 'systemWithUser'))) &&
                   upperFirst(flow.flowTag) === topic
               ) ||
+              (objects.length > 0 &&
+                topic !== 'Get' &&
+                CRUD_ACTIONS.includes(topic)) ||
               (relationships.length > 0 &&
                 topic !== 'GetRelationship' &&
                 RELATIONSHIP_ACTIONS.includes(topic))
@@ -722,7 +731,10 @@ function roleStatements(state, roleName) {
   addStatement(
     statements,
     ['sns:Publish'],
-    topicArns(roleTopicNames(state, roleName))
+    [
+      ...topicArns(roleTopicNames(state, roleName)),
+      ...roleExternalTopicArns(state, roleName)
+    ]
   );
   if (state.webSocketRoles.has(roleName)) {
     statements.push({
@@ -760,6 +772,7 @@ function roleTableNames(state, roleName) {
       ...(state.rbac
         ? [
             'TargetRoles',
+            'RolePermissions',
             'RoleUsers',
             'UserRoles',
             'RoleLimit',
@@ -832,6 +845,9 @@ function roleQueueNames(state, roleName) {
       if (!plan.outputTopic) return [];
       return [
         `${action}HdrSqs`,
+        ...(plan.hasCreateNodeCallback
+          ? [`${action}NodeCallbackHdrSqs`]
+          : []),
         ...(plan.hasRbacCallback
           ? [`${action}RbacCallbackHdrSqs`]
           : []),
@@ -916,6 +932,9 @@ function roleTopicNames(state, roleName) {
         topics.push(`${action}_In`, `${action}_Out`);
       }
     }
+    if (state.rbac) {
+      topics.push('ValidatorRbac_In');
+    }
     return topics;
   }
   if (roleName === 'FlowRelationshipRole') {
@@ -928,6 +947,9 @@ function roleTopicNames(state, roleName) {
         topics.push(`${action}_In`, `${action}_Out`);
       }
     }
+    if (state.rbac) {
+      topics.push('ValidatorRbac_In');
+    }
     return topics;
   }
   if (roleName === 'FlowRbacRole') {
@@ -1014,6 +1036,34 @@ function roleExternalDynamoTables(state, roleName) {
   return [];
 }
 
+function roleExternalTopicArns(state, roleName) {
+  if (!state.rbac) {
+    return [];
+  }
+  const extraTags = getRbacValidatorServiceTags(state).filter(
+    (tag) => tag && tag !== 'Rbac'
+  );
+  const extraTopics = extraTags.map(
+    (tag) =>
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_ValidatorRbac_In`
+  );
+  if (roleName === 'FlowObjectsRole') {
+    return [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ConfirmUsage_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_CancelUsage_In`,
+      ...extraTopics
+    ];
+  }
+  if (roleName === 'FlowRbacRole' || roleName === 'FlowRelationshipRole') {
+    return [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      ...extraTopics
+    ];
+  }
+  return [];
+}
+
 function queueArns(queueNames) {
   return [...new Set(queueNames)]
     .sort()