@izara_project/izara-core-generate-service-code 1.0.85 → 1.0.86

package/src/emit/rbac/templates/UserRbacFlow_Main.ejs

@@ -52,7 +52,7 @@ async function _getL2Cache(_izContext, submittedByUserId, cacheSubKey) {
   try {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
     const result = await dynamodbSharedLib.getItem(_izContext, tableName, {
-      submittedByUserId,
+      userId: submittedByUserId,
       cacheKey: cacheSubKey
     });
     if (result && result.ttlTimestamp && result.ttlTimestamp > Math.floor(Date.now() / 1000)) {
@@ -77,7 +77,7 @@ async function _setL2Cache(_izContext, submittedByUserId, cacheSubKey, value) {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
     const ttlTimestamp = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
     await dynamodbSharedLib.putItem(_izContext, tableName, {
-      submittedByUserId,
+      userId: submittedByUserId,
       cacheKey: cacheSubKey,
       permission: value.returnValue ? value.returnValue.permission : value.permission,
       roleIdKey: value.returnValue ? value.returnValue.roleIdKey : value.roleIdKey,
@@ -133,7 +133,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     throw new Error('Missing flowTypeConcat in requestParams');
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] requestParams:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] requestParams:`, {
     submittedByUserId,
     targetId,
     flowTypeConcat,
@@ -175,7 +175,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   // 1. Check L1 In-Memory Cache
   const l1Hit = _getL1Cache(fullCacheKey);
   if (l1Hit) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:', l1Hit);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:`, l1Hit);
     await _publicMessageOut(_izContext, { ...l1Hit, parentFlowId });
     return;
   }
@@ -183,19 +183,19 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   // 2. Check L2 Shared DynamoDB Cache
   const l2Hit = await _getL2Cache(_izContext, submittedByUserId, cacheSubKey);
   if (l2Hit) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:', l2Hit);
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:`, l2Hit);
     _setL1Cache(fullCacheKey, l2Hit);
     await _publicMessageOut(_izContext, { ...l2Hit, parentFlowId });
     return;
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB');
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB`);
 
   // 3. Fallback to DB Query
   const userRolesResult = await dynamodbSharedLib.query(
     _izContext,
     dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-    { submittedByUserId }
+    { userId: submittedByUserId }
   );
 
   let userRoles = [];
@@ -205,7 +205,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     userRoles = userRolesResult.Items;
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] userRoles fetched:', { userRoles });
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] userRoles fetched:`, { userRoles });
 
   const targetIdPrefix = `${targetId}_`;
   const targetRoles = [];
@@ -215,13 +215,13 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     }
   }
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] targetRoles filtered:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] targetRoles filtered:`, {
     targetIdPrefix,
     targetRoles
   });
 
   if (targetRoles.length === 0) {
-    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] no targetRoles found, permission denied');
+    _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] no targetRoles found, permission denied`);
     const result = {
       returnValue: {
         permission: false,
@@ -250,7 +250,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     })
   );
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] rolePermissions fetched:', {
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] rolePermissions fetched:`, {
     rolePermissions
   });
 
@@ -278,7 +278,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     status: 'Completed'
   };
 
-  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] validation result:', cacheResult);
+  _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] validation result:`, cacheResult);
 
   // Store in L1 & L2 Cache
   _setL1Cache(fullCacheKey, cacheResult);

package/src/emit/rbac/templates/UserRoleMutation_Main.ejs

@@ -26,6 +26,18 @@ import { sns } from '@izara_project/izara-core-library-external-request';
 export default async function <%- flowTag %>(_izContext, requestParams) {
   try {
     const { roleIdKey, userId } = requestParams;
+<% if (operation === 'Delete') { -%>
+    if (roleIdKey && roleIdKey.endsWith('_owner')) {
+      const remainingUsers = await dynamodbSharedLib.query(
+        _izContext,
+        dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
+        { roleIdKey }
+      );
+      if (remainingUsers?.Items?.length <= 1) {
+        throw new Error('Cannot remove the last remaining owner');
+      }
+    }
+<% } -%>
     await dynamodbSharedLib.transactWriteItems(_izContext, [
       {
         action: '<%- action %>',

package/src/emit/resource/emitResourceArtifacts.js

@@ -31,14 +31,17 @@ const RELATIONSHIP_ACTIONS = [
 ];
 const RBAC_ACTIONS = [
   'CreateTargetRole',
-  'ListTargetRole',
+  'UpdateTargetRole',
   'DeleteTargetRole',
+  'GetTargetRole',
+  'ListTargetRole',
   'CreateRolePermissions',
   'ListRolePermissions',
   'DeleteRolePermissions',
   'CreateUserRole',
   'ListUserInRoles',
   'DeleteUserFromRole',
+  'GetMyPermissions',
   'ValidatorRbac',
   'CreateRoleLimit',
   'ListRoleLimits',
@@ -728,7 +731,10 @@ function roleStatements(state, roleName) {
   addStatement(
     statements,
     ['sns:Publish'],
-    topicArns(roleTopicNames(state, roleName))
+    [
+      ...topicArns(roleTopicNames(state, roleName)),
+      ...roleExternalTopicArns(state, roleName)
+    ]
   );
   if (state.webSocketRoles.has(roleName)) {
     statements.push({
@@ -766,6 +772,7 @@ function roleTableNames(state, roleName) {
       ...(state.rbac
         ? [
             'TargetRoles',
+            'RolePermissions',
             'RoleUsers',
             'UserRoles',
             'RoleLimit',
@@ -925,6 +932,9 @@ function roleTopicNames(state, roleName) {
         topics.push(`${action}_In`, `${action}_Out`);
       }
     }
+    if (state.rbac) {
+      topics.push('ValidatorRbac_In');
+    }
     return topics;
   }
   if (roleName === 'FlowRelationshipRole') {
@@ -937,6 +947,9 @@ function roleTopicNames(state, roleName) {
         topics.push(`${action}_In`, `${action}_Out`);
       }
     }
+    if (state.rbac) {
+      topics.push('ValidatorRbac_In');
+    }
     return topics;
   }
   if (roleName === 'FlowRbacRole') {
@@ -1023,6 +1036,34 @@ function roleExternalDynamoTables(state, roleName) {
   return [];
 }
 
+function roleExternalTopicArns(state, roleName) {
+  if (!state.rbac) {
+    return [];
+  }
+  const extraTags = getRbacValidatorServiceTags(state).filter(
+    (tag) => tag && tag !== 'Rbac'
+  );
+  const extraTopics = extraTags.map(
+    (tag) =>
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_ValidatorRbac_In`
+  );
+  if (roleName === 'FlowObjectsRole') {
+    return [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ConfirmUsage_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_CancelUsage_In`,
+      ...extraTopics
+    ];
+  }
+  if (roleName === 'FlowRbacRole' || roleName === 'FlowRelationshipRole') {
+    return [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      ...extraTopics
+    ];
+  }
+  return [];
+}
+
 function queueArns(queueNames) {
   return [...new Set(queueNames)]
     .sort()

package/src/emit/resource/templates/GeneratedLambdaRoleServiceConfig.ejs

@@ -58,7 +58,8 @@ export function generatedLambdaRole() {
           Resource: [
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ConfirmUsage_In', 'Rbac')}`,
-            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CancelUsage_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CancelUsage_In', 'Rbac')}`<% if (rbac) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In')}`<% } %><% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
           ]
         }<% } %>
@@ -77,7 +78,8 @@ export function generatedLambdaRole() {
           Effect: 'Allow',
           Action: ['sns:Publish'],
           Resource: [
-            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
           ]
         }

package/src/emit/systemText/emitSystemTextSchemas.js

@@ -17,14 +17,17 @@ const RELATIONSHIP_ACTIONS = [
 ];
 const RBAC_SHARED_FLOW_TAGS = [
   'CreateTargetRole',
-  'ListTargetRole',
+  'UpdateTargetRole',
   'DeleteTargetRole',
+  'GetTargetRole',
+  'ListTargetRole',
   'CreateRolePermissions',
   'ListRolePermissions',
   'DeleteRolePermissions',
   'CreateUserRole',
   'ListUserInRoles',
-  'DeleteUserFromRole'
+  'DeleteUserFromRole',
+  'GetMyPermissions'
 ];
 
 export function systemTextSchemaManagedPaths() {

package/src/generate.js

@@ -64,12 +64,10 @@ import {
 
 export async function generate(rootPath, options = {}) {
   const startedAt = Date.now();
-  const logger = options.logger;
-  logger?.info?.(`[INFO] [Generate] STATUS=STARTED | rootPath=${rootPath}`);
+  console.log(`[INFO] [Generate] STATUS=STARTED | rootPath=${rootPath}`);
   try {
     const project = compileProject({ ...options, rootPath });
     const schemaLoadOptions = {
-      logger,
       skipValidation: options.skipValidation
     };
     const [rawObjects, relationships, flows, notifications] = await Promise.all([
@@ -92,8 +90,10 @@ export async function generate(rootPath, options = {}) {
       relationships,
       schemaBucketName
     );
-    logger?.debug?.(
-      `[DEBUG] [Generate] STATUS=SCHEMAS_LOADED | objects=${objects.length} relationships=${relationships.length} flows=${flows.length}`
+    console.log(
+      `[DEBUG] [Generate] STATUS=SCHEMAS_LOADED | ` +
+      `objects=${objects.length} ` +
+      `relationships=${relationships.length} flows=${flows.length}`
     );
     const groups = await _emitGroups({
       project,
@@ -103,10 +103,14 @@ export async function generate(rootPath, options = {}) {
       notifications,
       objectGraphServiceTags,
       relationshipGraphServiceTags,
-      logger
+      logger: options.logger
+    });
+    const scopeCounts = groups.map((group) => {
+      return `${group.scope}=${group.artifacts.length}`;
     });
-    logger?.debug?.(
-      `[DEBUG] [Generate] STATUS=ARTIFACTS_EMITTED | ${groups.map((group) => `${group.scope}=${group.artifacts.length}`).join(' ')}`
+    const emittedScopeSummary = scopeCounts.join(' ');
+    console.log(
+      `[DEBUG] [Generate] STATUS=ARTIFACTS_EMITTED | ${emittedScopeSummary}`
     );
     let files = [];
     if (groups.length > 0) {
@@ -123,14 +127,16 @@ export async function generate(rootPath, options = {}) {
       );
     }
     const durationMs = Date.now() - startedAt;
-    logger?.info?.(
-      `[INFO] [Generate] STATUS=FINISHED | files=${files.length} durationMs=${durationMs}`
+    console.log(
+      `[INFO] [Generate] STATUS=FINISHED | ` +
+      `files=${files.length} durationMs=${durationMs}`
     );
 
     return { project, durationMs, files };
   } catch (error) {
-    logger?.error?.(
-      `[ERROR] [Generate] STATUS=FAILED | durationMs=${Date.now() - startedAt}`,
+    console.log(
+      `[ERROR] [Generate] STATUS=FAILED | ` +
+      `durationMs=${Date.now() - startedAt}`,
       error
     );
     throw error;

package/src/generateResources/IntTest/generateResources/generateResources.js

@@ -103,7 +103,7 @@ async function generateCodeWithTemplate(_izContext, savePath, settings) {
 
     return allCreateSource;
   } catch (error) {
-    _izContext.logger.error(
+    console.log(
       'Error generating code with template propertyNode schema:',
       error
     );

package/src/generateResources/IntTest/generateTests/generateTemplate.js

@@ -71,7 +71,7 @@ async function generateCodeWithTemplate(_izContext, savePath, settings) {
 
     return allCreateSource;
   } catch (error) {
-    _izContext.logger.error(
+    console.log(
       'Error generating code with template propertyNode schema:',
       error
     );

package/src/generateResources/IntTest/upload/uploadIntTest.js

@@ -17,10 +17,16 @@ import fs from 'fs';
 import path from 'path';
 
 import { s3 } from '@izara_project/izara-core-library-s3';
-import Logger from '@izara_project/izara-core-library-logger';
+
+const consoleLogger = {
+  debug: console.log,
+  info: console.log,
+  warn: console.log,
+  error: console.error
+};
 
 const DEFAULT_BUCKET = 'integrationtest-config-us-east-2';
-const _izContext = { Logger };
+const _izContext = { logger: consoleLogger, Logger: consoleLogger };
 
 function _getAllFiles(dirPath, filePaths = []) {
   if (!fs.existsSync(dirPath)) {

package/test/createTargetRoleHandler.test.js

@@ -9,6 +9,7 @@ import { generateCreateTargetRoleHandler } from '../src/emit/rbac/generateCreate
 const roots = new Set();
 const OWN_TOPIC_FLOWS = [
   'CreateTargetRole',
+  'UpdateTargetRole',
   'CreateRolePermissions',
   'DeleteRolePermissions',
   'DeleteTargetRole',
@@ -39,7 +40,7 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
   const rootPath = await createProject(true);
   const result = await generateCreateTargetRoleHandler(rootPath);
 
-  assert.equal(result.files.length, 60);
+  assert.equal(result.files.length, 70);
   assert.match(
     await readFile(join(rootPath, result.files[0].path), 'utf8'),
     /CreateTargetRole/
@@ -48,6 +49,46 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     await readFile(join(rootPath, result.files[0].path), 'utf8'),
     /roleName = 'owner'/
   );
+  assert.match(
+    await readFile(
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_Main.js'
+      ),
+      'utf8'
+    ),
+    /Cannot modify system owner role/
+  );
+  assert.match(
+    await readFile(
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_Main.js'
+      ),
+      'utf8'
+    ),
+    /Cannot delete system owner role/
+  );
+  assert.match(
+    await readFile(
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_Main.js'
+      ),
+      'utf8'
+    ),
+    /GetTargetRole/
+  );
+  assert.match(
+    await readFile(
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_Main.js'
+      ),
+      'utf8'
+    ),
+    /GetMyPermissions/
+  );
   assert.match(
     await readFile(join(rootPath, result.files[1].path), 'utf8'),
     /CreateTargetRoleHdrSqs/

package/test/crudApplicationArtifacts.test.js

@@ -357,6 +357,59 @@ test('logs warning when ObjectSchema has invalid or non-CRUD generatedBy in crud
   );
 });
 
+test('emits targetIdentifiers consistency check and fallback in Update_Main.js and Delete_Main.js', async () => {
+  const rootPath = await createProject(true);
+  await generateCrudApplicationArtifacts(rootPath, {
+    serviceTag: 'orders'
+  });
+
+  const updateMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Update/source/Update_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(updateMain, /targetIdentifiers\.\$\{key\} must match objInstanceFull\.identifiers\.\$\{key\}/);
+  assert.match(updateMain, /if \(!objectSchema\.hasOwnProperty\('belongTo'\)\)/);
+  assert.doesNotMatch(updateMain, /requestParams\.targetIdentifiers\s*=/);
+
+  const deleteMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Delete/source/Delete_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(deleteMain, /targetIdentifiers\.\$\{key\} must match identifiers\.\$\{key\}/);
+  assert.match(deleteMain, /if \(!objectSchema\.hasOwnProperty\('belongTo'\)\)/);
+  assert.doesNotMatch(deleteMain, /requestParams\.targetIdentifiers\s*=/);
+});
+
+test('emits targetIdentifiers passed directly to checkRbacPermission options in RBAC project', async () => {
+  const rootPath = await createRbacProject();
+  await generateCrudApplicationArtifacts(rootPath, {
+    serviceTag: 'orders'
+  });
+
+  const updateMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Update/source/Update_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(updateMain, /checkRbacPermission\([\s\S]*targetIdentifiers,[\s\S]*rbacObjType/);
+
+  const deleteMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Delete/source/Delete_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(deleteMain, /checkRbacPermission\([\s\S]*targetIdentifiers,[\s\S]*rbacObjType/);
+});
 
 async function createProject(withCrudObject) {
   const rootPath = await mkdtemp(

package/test/dynamicRbacFlowSchemas.test.js

@@ -10,14 +10,17 @@ import { generateDynamicRbacFlowSchemas } from '../src/emit/rbac/generateDynamic
 const projectRoots = new Set();
 const STATIC_RBAC_ACTIONS = [
   'CreateTargetRole',
-  'ListTargetRole',
+  'UpdateTargetRole',
   'DeleteTargetRole',
+  'GetTargetRole',
+  'ListTargetRole',
   'CreateRolePermissions',
   'ListRolePermissions',
   'DeleteRolePermissions',
   'CreateUserRole',
   'ListUserInRoles',
-  'DeleteUserFromRole'
+  'DeleteUserFromRole',
+  'GetMyPermissions'
 ];
 
 const STATIC_LIMIT_ACTIONS = [

package/test/publicApi.test.js

@@ -57,24 +57,28 @@ test('generate commits schemas, application artifacts, and resources in one publ
   );
 });
 
-test('generate logs its lifecycle through the supplied logger', async () => {
+test('generate logs its lifecycle through console.log', async () => {
   const rootPath = await createCrudProject();
   const messages = [];
-  const logger = Object.fromEntries(
-    ['info', 'debug', 'error'].map((level) => [
-      level,
-      (message) => messages.push(message)
-    ])
-  );
+  const originalLog = console.log;
+  console.log = (...args) => {
+    messages.push(args.join(' '));
+  };
 
-  await generate(rootPath, { logger });
+  try {
+    await generate(rootPath);
 
-  assert.match(messages[0], /STATUS=STARTED/);
-  assert.ok(messages.some((message) => /STATUS=SCHEMAS_LOADED/.test(message)));
-  assert.ok(
-    messages.some((message) => /STATUS=ARTIFACTS_EMITTED/.test(message))
-  );
-  assert.match(messages.at(-1), /STATUS=FINISHED/);
+    assert.match(messages[0], /STATUS=STARTED/);
+    assert.ok(messages.some((message) => {
+      return /STATUS=SCHEMAS_LOADED/.test(message);
+    }));
+    assert.ok(messages.some((message) => {
+      return /STATUS=ARTIFACTS_EMITTED/.test(message);
+    }));
+    assert.match(messages.at(-1), /STATUS=FINISHED/);
+  } finally {
+    console.log = originalLog;
+  }
 });
 
 test('generate commits RBAC WebSocket entries for own-topic mutation flows', async () => {

package/test/resourceArtifacts.test.js

@@ -365,6 +365,9 @@ test('emits CreateNodeCallbackHdrSqs in FlowObjectsRole when object has graph an
   const role = roleBlock(iam, 'FlowObjectsRole');
   assert.match(role, /CreateNodeCallbackHdrSqs/);
   assert.match(role, /CreateNodeCallbackHdrSqsDLQ/);
+  assert.match(role, /RolePermissions/);
+  assert.match(role, /ValidatorRbac_In/);
+  assert.match(role, /Rbac_\$\{self:custom\.iz_stage\}_ValidatorRbac_In/);
 });
 
 function roleBlock(iam, roleName) {