@izara_project/izara-core-generate-service-code 1.0.85 → 1.0.86

package/src/emit/rbac/emitDynamicRbacFlowSchemas.js

@@ -4,14 +4,17 @@ import { rbacFlowTag } from './rbacFlowTag.js';
 
 const RBAC_CORE_FLOW_DEFINITIONS = [
   { flowTag: 'CreateTargetRole', event: ['ownTopic'] },
-  { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
+  { flowTag: 'UpdateTargetRole', event: ['ownTopic'] },
   { flowTag: 'DeleteTargetRole', event: ['ownTopic'] },
+  { flowTag: 'GetTargetRole', event: ['lambdaSyncApi'] },
+  { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
   { flowTag: 'CreateRolePermissions', event: ['ownTopic'] },
   { flowTag: 'ListRolePermissions', event: ['lambdaSyncApi'] },
   { flowTag: 'DeleteRolePermissions', event: ['ownTopic'] },
   { flowTag: 'CreateUserRole', event: ['ownTopic'] },
   { flowTag: 'ListUserInRoles', event: ['lambdaSyncApi'] },
-  { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] }
+  { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] },
+  { flowTag: 'GetMyPermissions', event: ['lambdaSyncApi'] }
 ];
 
 const LIMIT_FLOW_DEFINITIONS = [

package/src/emit/rbac/emitRbacApplicationArtifacts.js

@@ -29,6 +29,19 @@ export async function emitRbacApplicationArtifacts(objects) {
     ...(hasSelfRbac
       ? [
           createTargetRoleHandler(),
+          createCustomRbacOwnTopicHandler(
+            'UpdateTargetRole',
+            'UpdateTargetRole_Main.ejs'
+          ),
+          createCustomRbacOwnTopicHandler(
+            'DeleteTargetRole',
+            'DeleteTargetRole_Main.ejs'
+          ),
+          createCustomRbacApiHandler('GetTargetRole', 'GetTargetRole_Main.ejs'),
+          createCustomRbacApiHandler(
+            'GetMyPermissions',
+            'GetMyPermissions_Main.ejs'
+          ),
           ...LIST_DEFINITIONS.map(createListHandler),
           ...MUTATION_DEFINITIONS.map(createMutationHandler),
           ...USER_ROLE_MUTATIONS.map(createUserRoleMutationHandler)
@@ -111,12 +124,6 @@ const MUTATION_DEFINITIONS = [
     tableName: 'RolePermissions',
     method: 'deleteItem',
     fields: ['roleIdKey', 'flowTypeConcat']
-  },
-  {
-    flowTag: 'DeleteTargetRole',
-    tableName: 'TargetRoles',
-    method: 'deleteItem',
-    fields: ['identifiersConcat', 'roleIdKey']
   }
 ];
 
@@ -151,6 +158,20 @@ const STATIC_RBAC_APPLICATION_PATHS = [
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrSqs.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_WbsMain.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_WbsMain.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_WbsMain.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_HdrApi.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_Main.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_HdrApi.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_HdrSqs.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_WbsMain.js',
@@ -331,6 +352,81 @@ async function createLimitMutationHandler(definition) {
   };
 }
 
+async function createCustomRbacOwnTopicHandler(flowTag, mainTemplateName) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${flowTag}/source`;
+  const webSocket = await createWebSocketEntry(
+    flowTag,
+    sourcePath,
+    handlerPath
+  );
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/${flowTag}_Main.js`,
+        content: await renderRbacTemplate(mainTemplateName, { flowTag })
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
+      },
+      ...webSocket.artifacts
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `${flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `${flowTag}HdrSqs`,
+        flowTag: flowTag,
+        flowStepName: ''
+      },
+      ...webSocket.functions
+    ]
+  };
+}
+
+async function createCustomRbacApiHandler(flowTag, mainTemplateName) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${flowTag}/source`;
+  return {
+    artifacts: [
+      {
+        path: `${sourcePath}/${flowTag}_Main.js`,
+        content: await renderRbacTemplate(mainTemplateName, { flowTag })
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
+      },
+      {
+        path: `${sourcePath}/${flowTag}_HdrApi.js`,
+        content: await renderRbacTemplate('ListRbac_HdrApi.ejs', { flowTag })
+      }
+    ],
+    functions: [
+      {
+        type: 'sqs',
+        functionName: `${flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
+        roleName: 'FlowRbacRole',
+        queueName: `${flowTag}HdrSqs`,
+        flowTag: flowTag,
+        flowStepName: ''
+      },
+      {
+        type: 'api',
+        functionName: `${flowTag}HdrApi`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrApi.main`,
+        roleName: 'FlowRbacRole',
+        flowTag: flowTag,
+        flowStepName: ''
+      }
+    ]
+  };
+}
+
 async function createTargetRoleHandler() {
   const sourcePath = 'app/src/generatedCode/FlowRbac/CreateTargetRole/source';
   const webSocket = await createWebSocketEntry(

package/src/emit/rbac/templates/CreateTargetRole_Main.ejs

@@ -55,7 +55,12 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       identifiersConcat = submittedByUserId;
     }
 
-    const { roleName = 'owner', roleId: inputRoleId } = requestParams;
+    const {
+      roleName = 'owner',
+      roleId: inputRoleId,
+      permissions = [],
+      assignUserIds = []
+    } = requestParams;
     const roleId = inputRoleId || roleName || identifierUuid();
     const roleIdKey = `${identifiersConcat}_${roleId}`;
 
@@ -70,21 +75,46 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       }
     );
 
-    if (submittedByUserId) {
+    if (Array.isArray(permissions) && permissions.length > 0) {
+      const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+      for (const perm of permissions) {
+        const flowTypeConcat = typeof perm === 'string' ? perm : perm.flowTypeConcat;
+        if (flowTypeConcat) {
+          const permission =
+            typeof perm === 'object' && perm.permission !== undefined
+              ? perm.permission
+              : true;
+          const parameterGroups = (typeof perm === 'object' && perm.parameterGroups) || {};
+          await dynamodbSharedLib.putItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat,
+            permission,
+            parameterGroups
+          });
+        }
+      }
+    }
+
+    const usersToAssign =
+      Array.isArray(assignUserIds) && assignUserIds.length > 0
+        ? assignUserIds
+        : (roleName === 'owner' && submittedByUserId ? [submittedByUserId] : []);
+
+    for (const userId of usersToAssign) {
       try {
         await dynamodbSharedLib.transactWriteItems(_izContext, [
           {
             action: 'put',
             params: {
               tableName: dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
-              attributes: { roleIdKey, submittedByUserId }
+              attributes: { roleIdKey, userId, submittedByUserId }
             }
           },
           {
             action: 'put',
             params: {
               tableName: dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-              attributes: { submittedByUserId, roleIdKey }
+              attributes: { userId, roleIdKey, submittedByUserId }
             }
           }
         ]);

package/src/emit/rbac/templates/DeleteTargetRole_Main.ejs

@@ -0,0 +1,96 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function DeleteTargetRole(_izContext, requestParams) {
+  try {
+    const { identifiersConcat, roleIdKey } = requestParams;
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    if (roleIdKey.endsWith('_owner')) {
+      throw new NoRetryError('Cannot delete system owner role');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+    const roleUsersTable = dynamodbSharedLib.tableName(_izContext, 'RoleUsers');
+    const userRolesTable = dynamodbSharedLib.tableName(_izContext, 'UserRoles');
+
+    // 1. Delete from TargetRoles
+    await dynamodbSharedLib.deleteItem(
+      _izContext,
+      targetRolesTable,
+      { identifiersConcat, roleIdKey }
+    );
+
+    // 2. Cascade delete all permissions for this roleIdKey
+    const permsResult = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+      roleIdKey
+    });
+    for (const perm of (permsResult?.Items || [])) {
+      await dynamodbSharedLib.deleteItem(_izContext, rolePermissionsTable, {
+        roleIdKey,
+        flowTypeConcat: perm.flowTypeConcat
+      });
+    }
+
+    // 3. Cascade delete user assignments in RoleUsers and UserRoles
+    const usersResult = await dynamodbSharedLib.query(_izContext, roleUsersTable, {
+      roleIdKey
+    });
+    for (const userItem of (usersResult?.Items || [])) {
+      const userId = userItem.userId;
+      try {
+        await dynamodbSharedLib.transactWriteItems(_izContext, [
+          {
+            action: 'delete',
+            params: {
+              tableName: roleUsersTable,
+              keyValues: { roleIdKey, userId }
+            }
+          },
+          {
+            action: 'delete',
+            params: {
+              tableName: userRolesTable,
+              keyValues: { userId, roleIdKey }
+            }
+          }
+        ]);
+      } catch (err) {
+        _izContext.logger.debug(`[${process.env.iz_serviceTag}:DeleteTargetRole] Cascade user cleanup ignored:`, err);
+      }
+    }
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: { identifiersConcat, roleIdKey, status: 'deleted' } },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'DeleteTargetRole_Out'
+      )
+    });
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:DeleteTargetRole] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/GetMyPermissions_Main.ejs

@@ -0,0 +1,106 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { consts, NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function GetMyPermissions(_izContext, requestParams) {
+  try {
+    const submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
+
+    if (!submittedByUserId) {
+      throw new NoRetryError('User identity not found in context.');
+    }
+
+    const targetIdentifiers = requestParams.targetIdentifiers;
+    let identifiersConcat = requestParams.identifiersConcat;
+    if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
+      if (targetIdentifiers.identifierConcat) {
+        identifiersConcat = targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (
+            key !== 'submittedByUserId' &&
+            key !== 'identifierConcat' &&
+            value !== undefined &&
+            value !== null
+          ) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          identifiersConcat = parts.join('|');
+        }
+      }
+    }
+
+    const userRolesTable = dynamodbSharedLib.tableName(_izContext, 'UserRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+
+    const userRolesResult = await dynamodbSharedLib.query(_izContext, userRolesTable, {
+      userId: submittedByUserId
+    });
+    const userRoleItems = userRolesResult?.Items || [];
+
+    const matchingRoles = identifiersConcat
+      ? userRoleItems.filter((item) => item.roleIdKey?.startsWith(identifiersConcat))
+      : userRoleItems;
+
+    const permissionsMap = {};
+    const rolesList = [];
+
+    for (const roleItem of matchingRoles) {
+      rolesList.push(roleItem.roleIdKey);
+      const permsResult = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+        roleIdKey: roleItem.roleIdKey
+      });
+      for (const p of (permsResult?.Items || [])) {
+        if (p.permission === true) {
+          permissionsMap[p.flowTypeConcat] = true;
+        } else if (permissionsMap[p.flowTypeConcat] === undefined) {
+          permissionsMap[p.flowTypeConcat] = false;
+        }
+      }
+    }
+
+    const result = {
+      userId: submittedByUserId,
+      identifiersConcat: identifiersConcat || null,
+      roles: rolesList,
+      permissions: permissionsMap
+    };
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: result },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'GetMyPermissions_Out'
+      )
+    });
+    return result;
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:GetMyPermissions] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/GetTargetRole_Main.ejs

@@ -0,0 +1,62 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function GetTargetRole(_izContext, requestParams) {
+  try {
+    const { identifiersConcat, roleIdKey } = requestParams;
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+    const roleUsersTable = dynamodbSharedLib.tableName(_izContext, 'RoleUsers');
+
+    const role = identifiersConcat
+      ? await dynamodbSharedLib.getItem(_izContext, targetRolesTable, { identifiersConcat, roleIdKey })
+      : null;
+
+    const [permsResult, usersResult] = await Promise.all([
+      dynamodbSharedLib.query(_izContext, rolePermissionsTable, { roleIdKey }),
+      dynamodbSharedLib.query(_izContext, roleUsersTable, { roleIdKey })
+    ]);
+
+    const result = {
+      role,
+      roleIdKey,
+      permissions: permsResult?.Items || [],
+      users: usersResult?.Items || []
+    };
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: result },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'GetTargetRole_Out'
+      )
+    });
+    return result;
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:GetTargetRole] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/UpdateTargetRole_Main.ejs

@@ -0,0 +1,107 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { consts, NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function UpdateTargetRole(_izContext, requestParams) {
+  try {
+    const submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
+
+    const {
+      identifiersConcat,
+      roleIdKey,
+      roleName,
+      permissions
+    } = requestParams;
+
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    if (roleIdKey.endsWith('_owner')) {
+      throw new NoRetryError('Cannot modify system owner role');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+
+    if (roleName && identifiersConcat) {
+      const existingRole = await dynamodbSharedLib.getItem(_izContext, targetRolesTable, {
+        identifiersConcat,
+        roleIdKey
+      });
+      if (existingRole) {
+        await dynamodbSharedLib.putItem(_izContext, targetRolesTable, {
+          ...existingRole,
+          roleName
+        });
+      }
+    }
+
+    if (Array.isArray(permissions)) {
+      const currentPermsQuery = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+        roleIdKey
+      });
+      const currentPerms = currentPermsQuery?.Items || [];
+      const currentFlowMap = new Map(currentPerms.map((p) => [p.flowTypeConcat, p]));
+
+      const newFlowSet = new Set();
+      for (const perm of permissions) {
+        const flowTypeConcat = typeof perm === 'string' ? perm : perm.flowTypeConcat;
+        if (flowTypeConcat) {
+          newFlowSet.add(flowTypeConcat);
+          const permission =
+            typeof perm === 'object' && perm.permission !== undefined
+              ? perm.permission
+              : true;
+          const parameterGroups = (typeof perm === 'object' && perm.parameterGroups) || {};
+          await dynamodbSharedLib.putItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat,
+            permission,
+            parameterGroups
+          });
+        }
+      }
+
+      for (const [oldFlow] of currentFlowMap.entries()) {
+        if (!newFlowSet.has(oldFlow)) {
+          await dynamodbSharedLib.deleteItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat: oldFlow
+          });
+        }
+      }
+    }
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: { roleIdKey, status: 'updated' } },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'UpdateTargetRole_Out'
+      )
+    });
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:UpdateTargetRole] error:`, error);
+    throw error;
+  }
+}