@izara_project/izara-core-generate-service-code 1.0.85 → 1.0.87

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@izara_project/izara-core-generate-service-code",
-  "version": "1.0.85",
+  "version": "1.0.87",
   "description": "Code for locally generating per service files",
   "homepage": "https://bitbucket.org/izara-core-support-services/izara-core-support-services-generate-service-code#readme",
   "repository": {

package/src/compile/compileProject.js

@@ -1,4 +1,3 @@
-import Logger from '@izara_project/izara-core-library-logger';
 import { join, resolve } from 'node:path';
 import { readFileSync, existsSync } from 'node:fs';
 import { parse as parseYaml } from 'yaml';
@@ -33,7 +32,7 @@ export function compileProject(request = {}) {
         }
       }
     } catch (err) {
-      Logger?.debug?.('Could not read serverless.config.yml', err);
+      console.log('Could not read serverless.config.yml', err);
     }
   }
 

package/src/compile/loadSchemas.js

@@ -7,9 +7,15 @@ import {
 } from '@izara_project/izara-core-library-service-schemas';
 import { basicValidatorSchema } from '@izara_project/izara-shared-service-schemas';
 import { s3 } from '@izara_project/izara-core-library-s3';
-import Logger from '@izara_project/izara-core-library-logger';
 import { validateFlowSchema } from './flowValidator.js';
 
+const consoleLogger = {
+  debug: console.log,
+  info: console.log,
+  warn: console.log,
+  error: console.error
+};
+
 const VALID_INITIATE_BY_ENUM = [
   'user',
   'systemWithUser',
@@ -66,7 +72,7 @@ export async function loadLocalSchemaDirectory(
   options = {}
 ) {
   const directoryPath = join(project.schemaRoot, directoryName);
-  const logger = options.logger || Logger;
+  const logger = options.logger || consoleLogger;
   let entries;
   try {
     entries = await readdir(directoryPath, { withFileTypes: true });
@@ -229,8 +235,9 @@ export async function resolveExtendedObjectSchemas(
     let currentSchema = schema;
     if (currentSchema.hasOwnProperty('extendObjType')) {
       try {
-        Logger.debug(
-          `[DEBUG] [resolveExtendedObjectSchemas] Merging extendObjType for objectType=${currentSchema.objectType}`,
+        console.log(
+          `[DEBUG] [resolveExtendedObjectSchemas] Merging extendObjType ` +
+          `for objectType=${currentSchema.objectType}`,
           { extendObjType: currentSchema.extendObjType }
         );
         const initialResources = currentSchema.storageResources || {};
@@ -238,7 +245,7 @@ export async function resolveExtendedObjectSchemas(
         const parentServiceTag = currentSchema.extendObjType.serviceTag;
 
         const mergedSchema = await getObjectSchema.mergeExtendObjSchema(
-          { logger: Logger },
+          { logger: consoleLogger },
           currentSchema,
           bucketName
         );
@@ -270,8 +277,9 @@ export async function resolveExtendedObjectSchemas(
 
         currentSchema = mergedSchema;
       } catch (error) {
-        Logger.error(
-          `[ERROR] [resolveExtendedObjectSchemas] Failed to merge extendObjType for objectType=${currentSchema.objectType}`,
+        console.log(
+          `[ERROR] [resolveExtendedObjectSchemas] Failed to merge ` +
+          `extendObjType for objectType=${currentSchema.objectType}`,
           { error }
         );
         throw error;
@@ -289,8 +297,9 @@ export async function resolveExtendedObjectSchemas(
         belongToTarget.objectType
       ) {
         try {
-          Logger.debug(
-            `[DEBUG] [resolveExtendedObjectSchemas] Fetching belongTo schema for objectType=${currentSchema.objectType}`,
+          console.log(
+            `[DEBUG] [resolveExtendedObjectSchemas] Fetching belongTo ` +
+            `schema for objectType=${currentSchema.objectType}`,
             { belongTo: belongToTarget }
           );
           const belongToObjType = {
@@ -298,19 +307,21 @@ export async function resolveExtendedObjectSchemas(
             objectType: belongToTarget.objectType
           };
           const belongToSchema = await getObjectSchema.getObjSchemaS3(
-            { logger: Logger },
+            { logger: consoleLogger },
             belongToObjType,
             false,
             bucketName
           );
           currentSchema.belongToSchema = belongToSchema;
-          Logger.debug(
-            `[DEBUG] [resolveExtendedObjectSchemas] Successfully fetched belongTo schema for objectType=${currentSchema.objectType}`,
+          console.log(
+            `[DEBUG] [resolveExtendedObjectSchemas] Successfully fetched ` +
+            `belongTo schema for objectType=${currentSchema.objectType}`,
             { belongToObjectType: belongToSchema?.objectType }
           );
         } catch (error) {
-          Logger.warn(
-            `[WARN] [resolveExtendedObjectSchemas] Failed to fetch belongTo schema for objectType=${currentSchema.objectType}`,
+          console.log(
+            `[WARN] [resolveExtendedObjectSchemas] Failed to fetch ` +
+            `belongTo schema for objectType=${currentSchema.objectType}`,
             { error }
           );
         }
@@ -361,7 +372,7 @@ export async function resolveGraphServiceTags(
   let graphServerTagsMap = {};
   if (bucketName) {
     try {
-      const _izContext = { logger: Logger };
+      const _izContext = { logger: consoleLogger };
       const s3Data = await s3.getObjectS3(_izContext, {
         Bucket: bucketName,
         Key: 'serviceConfig/GraphServerTags.json'
@@ -370,8 +381,9 @@ export async function resolveGraphServiceTags(
         graphServerTagsMap = s3Data;
       }
     } catch (error) {
-      Logger.debug?.(
-        `[DEBUG] [resolveGraphServiceTags] Could not fetch GraphServerTags.json from bucket=${bucketName}`,
+      console.log(
+        `[DEBUG] [resolveGraphServiceTags] Could not fetch ` +
+        `GraphServerTags.json from bucket=${bucketName}`,
         error
       );
     }

package/src/emit/coreFunction/emitCoreFunctionArtifacts.js

@@ -95,12 +95,12 @@ function _extractDynamoTableNames({
     }
   }
   if (rbac) {
+    dynamoTableNames.add('Roles');
     dynamoTableNames.add('TargetRoles');
     dynamoTableNames.add('RolePermissions');
     dynamoTableNames.add('RoleUsers');
     dynamoTableNames.add('UserRoles');
     dynamoTableNames.add('RbacPermissionCaches');
-    dynamoTableNames.add('RoleLimit');
     dynamoTableNames.add('RunningTotalUsage');
     dynamoTableNames.add('RunningTotalReservedUsage');
   }
@@ -244,6 +244,7 @@ export async function emitCoreFunctionArtifacts({ project, objects = [], relatio
   const hasQuotaReservation = crudPlans?.Create?.hasQuotaReservation ?? false;
 
   const state = { 
+    serviceTag: project?.serviceTag || '',
     project, 
     objects, 
     relationships,

package/src/emit/coreFunction/templates/InitialSetupConfig.ejs

@@ -66,12 +66,12 @@ const externalServices = {
     }
   });
   if (typeof rbac !== 'undefined' && rbac) {
+    dynamoTableNames.add('Roles');
     dynamoTableNames.add('TargetRoles');
     dynamoTableNames.add('RolePermissions');
     dynamoTableNames.add('RoleUsers');
     dynamoTableNames.add('UserRoles');
     dynamoTableNames.add('RbacPermissionCaches');
-    dynamoTableNames.add('RoleLimit');
     dynamoTableNames.add('RunningTotalUsage');
     dynamoTableNames.add('RunningTotalReservedUsage');
   }
@@ -179,18 +179,9 @@ const tableConfigs = {
     });
   });
 
+  const currentServiceTag = (typeof serviceTag !== 'undefined' && serviceTag) ? serviceTag : ((typeof project !== 'undefined' && project?.serviceTag) ? project.serviceTag : '');
   const rbacSubs = [];
   if (crud && rbac) {
-    const allRbacTags = Array.from(new Set(['Rbac', ...(typeof rbacValidatorServiceTags !== 'undefined' && rbacValidatorServiceTags ? rbacValidatorServiceTags : [])]));
-    const hasGraph = typeof objectGraphServiceTags !== 'undefined' && objectGraphServiceTags && objectGraphServiceTags.length > 0;
-    const createEndpoint = hasGraph ? 'CreateRbacCallbackHdrSqs' : 'CreateCompleteHdrSqs';
-    const updateEndpoint = hasGraph ? 'UpdateRbacCallbackHdrSqs' : 'UpdateCompleteHdrSqs';
-    const deleteEndpoint = hasGraph ? 'DeleteRbacCallbackHdrSqs' : 'DeleteCompleteHdrSqs';
-    allRbacTags.forEach(function(tag) {
-      rbacSubs.push({ serviceTag: tag, topicName: 'ValidatorRbac_Out', sqsEndpoint: createEndpoint });
-      rbacSubs.push({ serviceTag: tag, topicName: 'ValidatorRbac_Out', sqsEndpoint: updateEndpoint });
-      rbacSubs.push({ serviceTag: tag, topicName: 'ValidatorRbac_Out', sqsEndpoint: deleteEndpoint });
-    });
     if (typeof hasQuotaReservation !== 'undefined' && hasQuotaReservation) {
       rbacSubs.push({ serviceTag: 'Rbac', topicName: 'ConfirmUsage_Out', sqsEndpoint: 'CreateCompleteHdrSqs' });
       rbacSubs.push({ serviceTag: 'Rbac', topicName: 'CancelUsage_Out', sqsEndpoint: 'CreateCompleteHdrSqs' });
@@ -198,7 +189,11 @@ const tableConfigs = {
   }
 
   if (typeof customRbacFlowTags !== 'undefined' && customRbacFlowTags && customRbacFlowTags.length > 0) {
-    const allRbacTags = Array.from(new Set(['Rbac', ...(typeof rbacValidatorServiceTags !== 'undefined' ? rbacValidatorServiceTags : [])]));
+    const allRbacTags = Array.from(new Set([
+      'Rbac',
+      currentServiceTag,
+      ...(typeof rbacValidatorServiceTags !== 'undefined' ? rbacValidatorServiceTags : [])
+    ])).filter(Boolean);
     customRbacFlowTags.forEach(function(flowTag) {
       const tagUpper = flowTag[0].toUpperCase() + flowTag.slice(1);
       allRbacTags.forEach(function(tag) {
@@ -309,6 +304,17 @@ function roleConfigs() {
 <% }); -%>
 <% } -%>
 <% if (rbac || (rbacValidatorServiceTags && rbacValidatorServiceTags.length > 0)) { -%>
+        {
+          Sid: 'FlowObjectsInvokeValidatorRbac',
+          Effect: 'Allow',
+          Action: ['lambda:InvokeFunction'],
+          Resource: [
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'ValidatorRbacHdrInv', 'Rbac')}`<% if (rbac) { %>,
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'ValidatorRbacHdrInv')}`<% } %><% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'ValidatorRbacHdrInv', '<%= tag %>')}`<% }); %>
+          ]
+        },
+
         {
           Sid: 'FlowObjectsPublishValidatorRbacTopics',
           Effect: 'Allow',
@@ -316,7 +322,8 @@ function roleConfigs() {
           Resource: [
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ConfirmUsage_In', 'Rbac')}`,
-            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CancelUsage_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'CancelUsage_In', 'Rbac')}`<% if (rbac) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In')}`<% } %><% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
           ]
         },
@@ -330,12 +337,23 @@ function roleConfigs() {
     {
       roleName: 'FlowRbac',
       statement: [
+        {
+          Sid: 'FlowRbacInvokeValidatorRbac',
+          Effect: 'Allow',
+          Action: ['lambda:InvokeFunction'],
+          Resource: [
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'ValidatorRbacHdrInv', 'Rbac')}`<% if (rbac) { %>,
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'ValidatorRbacHdrInv')}`<% } %><% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:lambda:${process.env.iz_region}:${process.env.iz_accountId}:function:${lambdaSharedLib.lambdaFunctionName(_izContext, 'ValidatorRbacHdrInv', '<%= tag %>')}`<% }); %>
+          ]
+        },
         {
           Sid: 'FlowRbacPublishValidatorRbacTopics',
           Effect: 'Allow',
           Action: ['sns:Publish'],
           Resource: [
-            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', 'Rbac')}`,
+            `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In')}`<% (rbacValidatorServiceTags || []).forEach(function(tag) { %>,
             `arn:aws:sns:${process.env.iz_region}:${process.env.iz_accountId}:${snsSharedLib.snsTopicNameByFlowSchema(_izContext, 'ValidatorRbac_In', '<%= tag %>')}`<% }); %>
           ]
         }

package/src/emit/crud/crudActionPlan.js

@@ -32,7 +32,7 @@ export function createCrudActionPlan(
     hasRbac: actionHasRbac,
     hasQuotaReservation,
     hasComplete: outputTopic && (actionHasRbac || hasGraph),
-    hasRbacCallback: outputTopic && actionHasRbac && hasGraph,
+    hasRbacCallback: false,
     hasCreateNodeCallback:
       outputTopic && action === 'Create' && actionHasRbac && hasGraph && hasQuotaReservation
   };

package/src/emit/crud/emitCrudApplicationArtifacts.js

@@ -35,11 +35,17 @@ export async function emitCrudApplicationArtifacts({
         objectType: obj?.objectType ?? '(undefined)',
         generatedBy: obj?.generatedBy ?? '(missing)'
       }));
-      logger?.warn?.(
-        `[WARN] [CRUD Application] Skipped FlowObjects application artifacts generation: No valid CRUD ObjectSchema found. ` +
+      const warnMsg =
+        `[WARN] [CRUD Application] Skipped FlowObjects application artifacts ` +
+        `generation: No valid CRUD ObjectSchema found. ` +
         `Checked ${objects.length} object(s): ${JSON.stringify(summary)}. ` +
-        `Expected "generatedBy" to be one of: ${Array.from(VALID_CRUD_GENERATED_BY).join(', ')}`
-      );
+        `Expected "generatedBy" to be one of: ` +
+        `${Array.from(VALID_CRUD_GENERATED_BY).join(', ')}`;
+      if (logger?.warn) {
+        logger.warn(warnMsg);
+      } else {
+        console.log(warnMsg);
+      }
     }
     return [];
   }

package/src/emit/crud/emitDynamicCrudFlowSchemas.js

@@ -29,11 +29,17 @@ export function emitDynamicCrudFlowSchemas({
         objectType: obj?.objectType ?? '(undefined)',
         generatedBy: obj?.generatedBy ?? '(missing)'
       }));
-      logger?.warn?.(
-        `[WARN] [CRUD FlowSchemas] Skipped FlowObjects FlowSchemas generation: No valid CRUD ObjectSchema found. ` +
+      const warnMsg =
+        `[WARN] [CRUD FlowSchemas] Skipped FlowObjects FlowSchemas ` +
+        `generation: No valid CRUD ObjectSchema found. ` +
         `Checked ${objects.length} object(s): ${JSON.stringify(summary)}. ` +
-        `Expected "generatedBy" to be one of: ${Array.from(VALID_CRUD_GENERATED_BY).join(', ')}`
-      );
+        `Expected "generatedBy" to be one of: ` +
+        `${Array.from(VALID_CRUD_GENERATED_BY).join(', ')}`;
+      if (logger?.warn) {
+        logger.warn(warnMsg);
+      } else {
+        console.log(warnMsg);
+      }
     }
     return [];
   }
@@ -67,16 +73,17 @@ function _createDynamicFlow(action, plan, serviceTag = '', initiateBy = 'user')
       }
     );
   } else if (plan.hasComplete) {
+    const nextStepName = plan.hasCreateNodeCallback ? 'CreateNodeCallback' : 'Complete';
     startNextSteps.push({
       targetType: 'ownTopic',
-      stepName: 'Complete'
+      stepName: nextStepName
     });
     if (plan.hasGraph) {
       startNextSteps.push({
         targetType: 'extTopic',
         serviceTag: 'GraphHandler',
         topicName: `${action}Node_In`,
-        toStepNames: ['Complete']
+        toStepNames: [nextStepName]
       });
     }
   }
@@ -137,19 +144,20 @@ function _createDynamicFlow(action, plan, serviceTag = '', initiateBy = 'user')
   }
 
   if (plan.hasCreateNodeCallback) {
+    const prevStepName = plan.hasRbacCallback ? 'RbacCallback' : 'Start';
     flowSteps.push({
       stepName: 'CreateNodeCallback',
       event: ['extTopic'],
       previousSteps: [
         {
           sourceType: 'ownTopic',
-          stepName: 'RbacCallback'
+          stepName: prevStepName
         },
         {
           sourceType: 'extTopic',
           serviceTag: 'GraphHandler',
           topicName: 'CreateNode_Out',
-          fromStepNames: ['RbacCallback']
+          fromStepNames: [prevStepName]
         }
       ],
       nextSteps: [

package/src/emit/crud/templates/CreateEndpoint_Main.ejs

@@ -381,11 +381,12 @@ export default async function <%- flowTag %>(
         },
         parameterGroups,
         {
+          targetIdentifiers,
           rbacObjType: {
             serviceTag: <%- rbacServiceTags.length === 1 ? rbacServiceTags[0] : `{ ${Object.entries(rbacServiceTagMap).map(([k, v]) => `'${k}': ${v}`).join(', ')} }[requestParams.objectType] || process.env.iz_serviceTag` %>
           },
           requestParams: requestParams,
-          nextFlowStepName: '<%- plan?.hasRbacCallback ? `${flowTag}RbacCallback` : `${flowTag}Complete` %>'
+          sync: true
         }
       );
 
@@ -394,10 +395,18 @@ export default async function <%- flowTag %>(
         resultPermissionCheck
       );
 
+      if (resultPermissionCheck && resultPermissionCheck.permission !== true) {
+        errorsFound.push('Permission denied');
+        return await <%- flowTag %>LogicalLib(
+          _izContext,
+          requestParams,
+          callingFlowConfig,
+          errorsFound
+        );
+      }
+
       //(<rbacPublish_<%- flowTag %>)
       //(</rbacPublish_<%- flowTag %>)
-
-      return resultPermissionCheck;
     }
     <%_ } _%>
 

package/src/emit/crud/templates/CreateLogicalLib.ejs

@@ -385,21 +385,51 @@ export async function autoProvisionOwnerTargetRole(_izContext, { node, submitted
     }
 
     const identifiers = node.objInstanceFull.identifiers;
-    const targetIdentKeys = Object.entries(identifiers)
-      .filter(([k]) => k !== 'submittedByUserId')
-      .map(([k, v]) => `${k}#${v}`)
-      .join('|');
-
-    const targetIdentifiersConcat =
-      targetIdentKeys ||
-      (identifiers[Object.keys(identifiers)[0]]
-        ? `${Object.keys(identifiers)[0]}#${identifiers[Object.keys(identifiers)[0]]}`
-        : '');
+    const sortedKeys = Object.keys(identifiers)
+      .filter(
+        (k) =>
+          k !== 'submittedByUserId' &&
+          k !== 'identifierConcat' &&
+          k !== 'identifiersConcat'
+      )
+      .sort();
+    const parts = [];
+    for (const key of sortedKeys) {
+      const value = identifiers[key];
+      if (value !== undefined && value !== null) {
+        parts.push(`${key}#${value}`);
+      }
+    }
+    const targetIdentifiersConcat = parts.join('|');
 
     if (!targetIdentifiersConcat) {
       return;
     }
 
+    const targetPlanTier =
+      node?.objInstanceFull?.planTier ||
+      node?.objInstanceFull?.targetIdentifiers?.planTier ||
+      'tier-free';
+    let planTierName = 'Free Plan';
+    if (targetPlanTier === 'tier-pro') {
+      planTierName = 'Professional Plan';
+    } else if (targetPlanTier === 'tier-enterprise') {
+      planTierName = 'Enterprise Plan';
+    }
+
+    await dynamodbSharedLib.putItem(
+      _izContext,
+      dynamodbSharedLib.tableName(_izContext, 'TargetRoles'),
+      {
+        identifiersConcat: targetIdentifiersConcat,
+        roleIdKey: targetPlanTier,
+        roleType: 'plan_tier',
+        roleName: planTierName,
+        submittedByUserId,
+        createdAt: new Date().toISOString()
+      }
+    );
+
     const roleIdKey = `${targetIdentifiersConcat}_owner`;
     _izContext.logger.debug(
       '[CreateNodeCallback] Auto-provisioning owner TargetRole:',
@@ -417,8 +447,9 @@ export async function autoProvisionOwnerTargetRole(_izContext, { node, submitted
       {
         identifiersConcat: targetIdentifiersConcat,
         roleIdKey,
+        roleType: 'tenant_role',
+        roleName: 'Owner',
         submittedByUserId,
-        roleName: 'owner',
         assignedAt: new Date().toISOString()
       }
     );
@@ -816,16 +847,49 @@ export async function autoProvisionOwnerTargetRoleForDynamoOnly(
       _izContext.correlationIds?.get(coreConsts.SUBMITTED_BY_USER_ID);
 
     if (submittedByUserId) {
-      const targetIdentKeys = Object.entries(identifiersForCreateData)
-        .map(([k, v]) => `${k}#${v}`)
-        .join('|');
-      const targetIdentifiersConcat =
-        targetIdentKeys ||
-        (identifiersForCreateData[Object.keys(identifiersForCreateData)[0]]
-          ? `${Object.keys(identifiersForCreateData)[0]}#${identifiersForCreateData[Object.keys(identifiersForCreateData)[0]]}`
-          : '');
+      const sortedKeys = Object.keys(identifiersForCreateData)
+        .filter(
+          (k) =>
+            k !== 'submittedByUserId' &&
+            k !== 'identifierConcat' &&
+            k !== 'identifiersConcat'
+        )
+        .sort();
+      const parts = [];
+      for (const key of sortedKeys) {
+        const value = identifiersForCreateData[key];
+        if (value !== undefined && value !== null) {
+          parts.push(`${key}#${value}`);
+        }
+      }
+      const targetIdentifiersConcat = parts.join('|');
 
       if (targetIdentifiersConcat) {
+        const targetPlanTier =
+          actionData?.planTier ||
+          requestParams?.planTier ||
+          requestParams?.passBackProperties?.planTier ||
+          'tier-free';
+        let planTierName = 'Free Plan';
+        if (targetPlanTier === 'tier-pro') {
+          planTierName = 'Professional Plan';
+        } else if (targetPlanTier === 'tier-enterprise') {
+          planTierName = 'Enterprise Plan';
+        }
+
+        await dynamodbSharedLib.putItem(
+          _izContext,
+          dynamodbSharedLib.tableName(_izContext, 'TargetRoles'),
+          {
+            identifiersConcat: targetIdentifiersConcat,
+            roleIdKey: targetPlanTier,
+            roleType: 'plan_tier',
+            roleName: planTierName,
+            submittedByUserId,
+            createdAt: new Date().toISOString()
+          }
+        );
+
         const roleIdKey = `${targetIdentifiersConcat}_owner`;
         _izContext.logger.debug(
           '[<%- flowTag %>LogicalLib] Auto-provisioning owner TargetRole for DynamoDB-only:',
@@ -843,8 +907,9 @@ export async function autoProvisionOwnerTargetRoleForDynamoOnly(
           {
             identifiersConcat: targetIdentifiersConcat,
             roleIdKey,
+            roleType: 'tenant_role',
+            roleName: 'Owner',
             submittedByUserId,
-            roleName: 'owner',
             assignedAt: new Date().toISOString()
           }
         );

package/src/emit/crud/templates/DeleteEndpoint_Main.ejs

@@ -85,6 +85,7 @@ export default async function <%- flowTag %>(
         _izContext.correlationIds.get(coreConsts.SUBMITTED_BY_USER_ID);
 
       targetIdentifiers = requestParams.targetIdentifiers;
+      delete requestParams.targetIdentifiers;
 
       if (!targetIdentifiers && objectSchema.belongTo?.objectType === 'user' && submittedByUserId) {
         targetIdentifiers = { submittedByUserId };
@@ -99,12 +100,11 @@ export default async function <%- flowTag %>(
         if (!targetIdentifiers.submittedByUserId && submittedByUserId) {
           targetIdentifiers.submittedByUserId = submittedByUserId;
         }
-        requestParams.targetIdentifiers = targetIdentifiers;
       }
 
       _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Identity & Target Context Resolved:`,  {
         submittedByUserId: requestParams.submittedByUserId,
-        targetIdentifiers: requestParams.targetIdentifiers,
+        targetIdentifiers,
         belongTo: objectSchema.belongTo,
         generatedBy: objectSchema.generatedBy
       });
@@ -116,6 +116,37 @@ export default async function <%- flowTag %>(
     // ── Build identifiers used by asynchronous processing ────────────────────
     const identifiers = requestParams.identifiers;
 
+    if (!objectSchema.hasOwnProperty('belongTo')) {
+      if (!targetIdentifiers && identifiers) {
+        targetIdentifiers = { ...identifiers };
+      } else if (targetIdentifiers && identifiers) {
+        for (const [key, value] of Object.entries(identifiers)) {
+          if (targetIdentifiers[key] === undefined && value !== undefined) {
+            targetIdentifiers[key] = value;
+          }
+        }
+      }
+      if (targetIdentifiers) {
+        if (!targetIdentifiers.submittedByUserId && submittedByUserId) {
+          targetIdentifiers.submittedByUserId = submittedByUserId;
+        }
+      }
+    }
+
+    if (targetIdentifiers && identifiers) {
+      for (const [key, value] of Object.entries(identifiers)) {
+        if (
+          targetIdentifiers[key] !== undefined &&
+          value !== undefined &&
+          targetIdentifiers[key] !== value
+        ) {
+          errorsFound.push(
+            `targetIdentifiers.${key} must match identifiers.${key}`
+          );
+        }
+      }
+    }
+
     if (errorsFound.length > 0)
       return await <%- flowTag %>LogicalLib(
         _izContext,
@@ -131,8 +162,8 @@ export default async function <%- flowTag %>(
     for (const o of rbacObjects) {
       const belongToTargets = o?.belongTo
         ? Array.isArray(o.belongTo)
-          ? o.belongTo
-          : [o.belongTo]
+        ? o.belongTo
+        : [o.belongTo]
         : [];
       if (belongToTargets.length > 0 && belongToTargets[0]?.serviceTag) {
         rbacServiceTagMap[o.objectType] = `'${belongToTargets[0].serviceTag}'`;
@@ -164,11 +195,13 @@ export default async function <%- flowTag %>(
         },
         parameterGroups,
         {
+          targetIdentifiers,
           rbacObjType: {
             serviceTag: <%- rbacServiceTags.length === 1 ? rbacServiceTags[0] : `{ ${Object.entries(rbacServiceTagMap).map(([k, v]) => `'${k}': ${v}`).join(', ')} }[requestParams.objectType] || process.env.iz_serviceTag` %>
           },
           requestParams: requestParams,
-          nextFlowStepName: '<%- plan?.hasRbacCallback ? `${flowTag}RbacCallback` : `${flowTag}Complete` %>'
+          nextFlowStepName: '<%- plan?.hasRbacCallback ? `${flowTag}RbacCallback` : `${flowTag}Complete` %>',
+          sync: true
         }
       );
 
@@ -177,10 +210,18 @@ export default async function <%- flowTag %>(
         resultPermissionCheck
       );
 
+      if (resultPermissionCheck && resultPermissionCheck.permission !== true) {
+        errorsFound.push('Permission denied');
+        return await <%- flowTag %>LogicalLib(
+          _izContext,
+          requestParams,
+          callingFlowConfig,
+          errorsFound
+        );
+      }
+
       //(<rbacPublish_<%- flowTag %>)
       //(</rbacPublish_<%- flowTag %>)
-
-      return resultPermissionCheck;
     }
     <%_ } _%>