@izara_project/izara-core-generate-service-code 1.0.85 → 1.0.87

package/src/emit/function/functionYamlArtifact.js

@@ -319,8 +319,10 @@ function _sqsFilterPatterns(
           - body:
               MessageAttributes:
                 callingFlow:
-                  Value:
-                    - exists: false
+                  - exists: false
+          - body:
+              MessageAttributes:
+                - exists: false
         #<#/${hookFunctionName}FilterPatterns#>
 `;
 }

package/src/emit/rbac/emitDynamicRbacFlowSchemas.js

@@ -4,20 +4,20 @@ import { rbacFlowTag } from './rbacFlowTag.js';
 
 const RBAC_CORE_FLOW_DEFINITIONS = [
   { flowTag: 'CreateTargetRole', event: ['ownTopic'] },
-  { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
+  { flowTag: 'UpdateTargetRole', event: ['ownTopic'] },
   { flowTag: 'DeleteTargetRole', event: ['ownTopic'] },
+  { flowTag: 'GetTargetRole', event: ['lambdaSyncApi'] },
+  { flowTag: 'ListTargetRole', event: ['lambdaSyncApi'] },
   { flowTag: 'CreateRolePermissions', event: ['ownTopic'] },
   { flowTag: 'ListRolePermissions', event: ['lambdaSyncApi'] },
   { flowTag: 'DeleteRolePermissions', event: ['ownTopic'] },
   { flowTag: 'CreateUserRole', event: ['ownTopic'] },
   { flowTag: 'ListUserInRoles', event: ['lambdaSyncApi'] },
-  { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] }
+  { flowTag: 'DeleteUserFromRole', event: ['ownTopic'] },
+  { flowTag: 'GetMyPermissions', event: ['lambdaSyncApi'] }
 ];
 
 const LIMIT_FLOW_DEFINITIONS = [
-  { flowTag: 'CreateRoleLimit', event: ['ownTopic'] },
-  { flowTag: 'ListRoleLimits', event: ['lambdaSyncApi'] },
-  { flowTag: 'DeleteRoleLimit', event: ['ownTopic'] },
   { flowTag: 'ReservedDynamicUsage', event: ['ownTopic'] },
   { flowTag: 'ConfirmUsage', event: ['ownTopic'] },
   { flowTag: 'CancelUsage', event: ['ownTopic'] }

package/src/emit/rbac/emitRbacApplicationArtifacts.js

@@ -29,6 +29,19 @@ export async function emitRbacApplicationArtifacts(objects) {
     ...(hasSelfRbac
       ? [
           createTargetRoleHandler(),
+          createCustomRbacOwnTopicHandler(
+            'UpdateTargetRole',
+            'UpdateTargetRole_Main.ejs'
+          ),
+          createCustomRbacOwnTopicHandler(
+            'DeleteTargetRole',
+            'DeleteTargetRole_Main.ejs'
+          ),
+          createCustomRbacApiHandler('GetTargetRole', 'GetTargetRole_Main.ejs'),
+          createCustomRbacApiHandler(
+            'GetMyPermissions',
+            'GetMyPermissions_Main.ejs'
+          ),
           ...LIST_DEFINITIONS.map(createListHandler),
           ...MUTATION_DEFINITIONS.map(createMutationHandler),
           ...USER_ROLE_MUTATIONS.map(createUserRoleMutationHandler)
@@ -39,11 +52,7 @@ export async function emitRbacApplicationArtifacts(objects) {
 
   const limitHandlers = await Promise.all(
     hasSelfRbac
-      ? [
-          ...LIMIT_LIST_DEFINITIONS.map(createLimitListHandler),
-          ...LIMIT_MUTATION_DEFINITIONS.map(createLimitMutationHandler),
-          ...ACCOUNT_LIMIT_HANDLERS.map(createAccountLimitHandler)
-        ]
+      ? ACCOUNT_LIMIT_HANDLERS.map(createAccountLimitHandler)
       : []
   );
 
@@ -91,14 +100,6 @@ const LIST_DEFINITIONS = [
   }
 ];
 
-const LIMIT_LIST_DEFINITIONS = [
-  {
-    flowTag: 'ListRoleLimits',
-    tableName: 'RoleLimit',
-    requestProperty: 'roleLimitId'
-  }
-];
-
 const MUTATION_DEFINITIONS = [
   {
     flowTag: 'CreateRolePermissions',
@@ -111,27 +112,6 @@ const MUTATION_DEFINITIONS = [
     tableName: 'RolePermissions',
     method: 'deleteItem',
     fields: ['roleIdKey', 'flowTypeConcat']
-  },
-  {
-    flowTag: 'DeleteTargetRole',
-    tableName: 'TargetRoles',
-    method: 'deleteItem',
-    fields: ['identifiersConcat', 'roleIdKey']
-  }
-];
-
-const LIMIT_MUTATION_DEFINITIONS = [
-  {
-    flowTag: 'CreateRoleLimit',
-    tableName: 'RoleLimit',
-    method: 'putItem',
-    fields: ['roleLimitId', 'limitType', 'limitValue', 'actionType']
-  },
-  {
-    flowTag: 'DeleteRoleLimit',
-    tableName: 'RoleLimit',
-    method: 'deleteItem',
-    fields: ['roleLimitId', 'limitType']
   }
 ];
 
@@ -151,6 +131,20 @@ const STATIC_RBAC_APPLICATION_PATHS = [
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrSqs.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_WbsMain.js',
   'app/src/generatedCode/FlowRbac/CreateTargetRole/source/CreateTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_WbsMain.js',
+  'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_WbsMain.js',
+  'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_HdrWbs.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_Main.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_HdrApi.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_Main.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_HdrSqs.js',
+  'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_HdrApi.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_HdrSqs.js',
   'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_WbsMain.js',
@@ -176,17 +170,6 @@ const STATIC_RBAC_APPLICATION_PATHS = [
 ];
 
 const STATIC_LIMIT_APPLICATION_PATHS = [
-  ...LIMIT_LIST_DEFINITIONS.flatMap(({ flowTag }) => [
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrApi.js`
-  ]),
-  ...LIMIT_MUTATION_DEFINITIONS.flatMap(({ flowTag }) => [
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_WbsMain.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrWbs.js`
-  ]),
   ...ACCOUNT_LIMIT_HANDLERS.flatMap((flowTag) => [
     `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
     `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
@@ -253,80 +236,78 @@ async function createAccountLimitHandler(flowTag) {
   };
 }
 
-async function createLimitListHandler(definition) {
-  const sourcePath = `app/src/generatedCode/FlowLimit/${definition.flowTag}/source`;
-  const handlerPath = `src/generatedCode/FlowLimit/${definition.flowTag}/source`;
+
+async function createCustomRbacOwnTopicHandler(flowTag, mainTemplateName) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${flowTag}/source`;
+  const webSocket = await createWebSocketEntry(
+    flowTag,
+    sourcePath,
+    handlerPath
+  );
   return {
     artifacts: [
       {
-        path: `${sourcePath}/${definition.flowTag}_Main.js`,
-        content: await renderRbacTemplate('ListRbac_Main.ejs', {
-          ...definition,
-          useContextUserId: definition.useContextUserId ?? false
-        })
+        path: `${sourcePath}/${flowTag}_Main.js`,
+        content: await renderRbacTemplate(mainTemplateName, { flowTag })
       },
       {
-        path: `${sourcePath}/${definition.flowTag}_HdrSqs.js`,
-        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', definition)
+        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
       },
-      {
-        path: `${sourcePath}/${definition.flowTag}_HdrApi.js`,
-        content: await renderRbacTemplate('ListRbac_HdrApi.ejs', definition)
-      }
+      ...webSocket.artifacts
     ],
     functions: [
       {
         type: 'sqs',
-        functionName: `${definition.flowTag}HdrSqs`,
-        handlerPath: `${handlerPath}/${definition.flowTag}_HdrSqs.main`,
+        functionName: `${flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
         roleName: 'FlowRbacRole',
-        queueName: `${definition.flowTag}HdrSqs`,
-        flowTag: definition.flowTag,
+        queueName: `${flowTag}HdrSqs`,
+        flowTag: flowTag,
         flowStepName: ''
       },
-      {
-        type: 'api',
-        functionName: `${definition.flowTag}HdrApi`,
-        handlerPath: `${handlerPath}/${definition.flowTag}_HdrApi.main`,
-        roleName: 'FlowRbacRole',
-        flowTag: definition.flowTag,
-        flowStepName: ''
-      }
+      ...webSocket.functions
     ]
   };
 }
 
-async function createLimitMutationHandler(definition) {
-  const sourcePath = `app/src/generatedCode/FlowLimit/${definition.flowTag}/source`;
-  const handlerPath = `src/generatedCode/FlowLimit/${definition.flowTag}/source`;
-  const webSocket = await createWebSocketEntry(
-    definition.flowTag,
-    sourcePath,
-    handlerPath
-  );
+async function createCustomRbacApiHandler(flowTag, mainTemplateName) {
+  const sourcePath = `app/src/generatedCode/FlowRbac/${flowTag}/source`;
+  const handlerPath = `src/generatedCode/FlowRbac/${flowTag}/source`;
   return {
     artifacts: [
       {
-        path: `${sourcePath}/${definition.flowTag}_Main.js`,
-        content: await renderRbacTemplate('RbacMutation_Main.ejs', definition)
+        path: `${sourcePath}/${flowTag}_Main.js`,
+        content: await renderRbacTemplate(mainTemplateName, { flowTag })
       },
       {
-        path: `${sourcePath}/${definition.flowTag}_HdrSqs.js`,
-        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', definition)
+        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
       },
-      ...webSocket.artifacts
+      {
+        path: `${sourcePath}/${flowTag}_HdrApi.js`,
+        content: await renderRbacTemplate('ListRbac_HdrApi.ejs', { flowTag })
+      }
     ],
     functions: [
       {
         type: 'sqs',
-        functionName: `${definition.flowTag}HdrSqs`,
-        handlerPath: `${handlerPath}/${definition.flowTag}_HdrSqs.main`,
+        functionName: `${flowTag}HdrSqs`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
         roleName: 'FlowRbacRole',
-        queueName: `${definition.flowTag}HdrSqs`,
-        flowTag: definition.flowTag,
+        queueName: `${flowTag}HdrSqs`,
+        flowTag: flowTag,
         flowStepName: ''
       },
-      ...webSocket.functions
+      {
+        type: 'api',
+        functionName: `${flowTag}HdrApi`,
+        handlerPath: `${handlerPath}/${flowTag}_HdrApi.main`,
+        roleName: 'FlowRbacRole',
+        flowTag: flowTag,
+        flowStepName: ''
+      }
     ]
   };
 }

package/src/emit/rbac/templates/CancelUsage_Main.ejs

@@ -39,21 +39,25 @@ export default async function CancelUsage(_izContext, requestParams) {
       requestParams?.limitTag;
 
     const targetIdentifiers = requestParams?.targetIdentifiers;
-    let identifiersConcat = requestParams?.identifiersConcat;
+    let identifiersConcat =
+      requestParams?.identifiersConcat || requestParams?.identifierConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        identifiersConcat = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        identifiersConcat =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }

package/src/emit/rbac/templates/ConfirmUsage_Main.ejs

@@ -39,21 +39,25 @@ export default async function ConfirmUsage(_izContext, requestParams) {
       requestParams?.limitTag;
 
     const targetIdentifiers = requestParams?.targetIdentifiers;
-    let identifiersConcat = requestParams?.identifiersConcat;
+    let identifiersConcat =
+      requestParams?.identifiersConcat || requestParams?.identifierConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        identifiersConcat = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        identifiersConcat =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }

package/src/emit/rbac/templates/CreateTargetRole_Main.ejs

@@ -28,21 +28,25 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
 
     const targetIdentifiers = requestParams.targetIdentifiers;
-    let identifiersConcat = requestParams.identifiersConcat;
+    let identifiersConcat =
+      requestParams.identifiersConcat || requestParams.identifierConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        identifiersConcat = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        identifiersConcat =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }
@@ -55,8 +59,17 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       identifiersConcat = submittedByUserId;
     }
 
-    const { roleName = 'owner', roleId: inputRoleId } = requestParams;
-    const roleId = inputRoleId || roleName || identifierUuid();
+    const {
+      roleName = 'owner',
+      roleId: inputRoleId,
+      permissions = [],
+      assignUserIds = []
+    } = requestParams;
+    let defaultRoleId = identifierUuid();
+    if (roleName === 'owner') {
+      defaultRoleId = 'owner';
+    }
+    const roleId = inputRoleId || defaultRoleId;
     const roleIdKey = `${identifiersConcat}_${roleId}`;
 
     await dynamodbSharedLib.putItem(
@@ -65,26 +78,53 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       {
         identifiersConcat,
         roleIdKey,
+        roleType: 'tenant_role',
         roleName,
-        submittedByUserId
+        submittedByUserId,
+        createdAt: new Date().toISOString()
       }
     );
 
-    if (submittedByUserId) {
+    if (Array.isArray(permissions) && permissions.length > 0) {
+      const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+      for (const perm of permissions) {
+        const flowTypeConcat = typeof perm === 'string' ? perm : perm.flowTypeConcat;
+        if (flowTypeConcat) {
+          const permission =
+            typeof perm === 'object' && perm.permission !== undefined
+              ? perm.permission
+              : true;
+          const parameterGroups = (typeof perm === 'object' && perm.parameterGroups) || {};
+          await dynamodbSharedLib.putItem(_izContext, rolePermissionsTable, {
+            roleIdKey,
+            flowTypeConcat,
+            permission,
+            parameterGroups
+          });
+        }
+      }
+    }
+
+    const usersToAssign =
+      Array.isArray(assignUserIds) && assignUserIds.length > 0
+        ? assignUserIds
+        : (roleName === 'owner' && submittedByUserId ? [submittedByUserId] : []);
+
+    for (const userId of usersToAssign) {
       try {
         await dynamodbSharedLib.transactWriteItems(_izContext, [
           {
             action: 'put',
             params: {
               tableName: dynamodbSharedLib.tableName(_izContext, 'RoleUsers'),
-              attributes: { roleIdKey, submittedByUserId }
+              attributes: { roleIdKey, userId, submittedByUserId }
             }
           },
           {
             action: 'put',
             params: {
               tableName: dynamodbSharedLib.tableName(_izContext, 'UserRoles'),
-              attributes: { submittedByUserId, roleIdKey }
+              attributes: { userId, roleIdKey, submittedByUserId }
             }
           }
         ]);

package/src/emit/rbac/templates/DeleteTargetRole_Main.ejs

@@ -0,0 +1,96 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function DeleteTargetRole(_izContext, requestParams) {
+  try {
+    const { identifiersConcat, roleIdKey } = requestParams;
+    if (!roleIdKey) {
+      throw new NoRetryError('roleIdKey is required');
+    }
+
+    if (roleIdKey.endsWith('_owner')) {
+      throw new NoRetryError('Cannot delete system owner role');
+    }
+
+    const targetRolesTable = dynamodbSharedLib.tableName(_izContext, 'TargetRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+    const roleUsersTable = dynamodbSharedLib.tableName(_izContext, 'RoleUsers');
+    const userRolesTable = dynamodbSharedLib.tableName(_izContext, 'UserRoles');
+
+    // 1. Delete from TargetRoles
+    await dynamodbSharedLib.deleteItem(
+      _izContext,
+      targetRolesTable,
+      { identifiersConcat, roleIdKey }
+    );
+
+    // 2. Cascade delete all permissions for this roleIdKey
+    const permsResult = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+      roleIdKey
+    });
+    for (const perm of (permsResult?.Items || [])) {
+      await dynamodbSharedLib.deleteItem(_izContext, rolePermissionsTable, {
+        roleIdKey,
+        flowTypeConcat: perm.flowTypeConcat
+      });
+    }
+
+    // 3. Cascade delete user assignments in RoleUsers and UserRoles
+    const usersResult = await dynamodbSharedLib.query(_izContext, roleUsersTable, {
+      roleIdKey
+    });
+    for (const userItem of (usersResult?.Items || [])) {
+      const userId = userItem.userId;
+      try {
+        await dynamodbSharedLib.transactWriteItems(_izContext, [
+          {
+            action: 'delete',
+            params: {
+              tableName: roleUsersTable,
+              keyValues: { roleIdKey, userId }
+            }
+          },
+          {
+            action: 'delete',
+            params: {
+              tableName: userRolesTable,
+              keyValues: { userId, roleIdKey }
+            }
+          }
+        ]);
+      } catch (err) {
+        _izContext.logger.debug(`[${process.env.iz_serviceTag}:DeleteTargetRole] Cascade user cleanup ignored:`, err);
+      }
+    }
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: { identifiersConcat, roleIdKey, status: 'deleted' } },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'DeleteTargetRole_Out'
+      )
+    });
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:DeleteTargetRole] error:`, error);
+    throw error;
+  }
+}

package/src/emit/rbac/templates/GetMyPermissions_Main.ejs

@@ -0,0 +1,110 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import snsSharedLib from '@izara_project/izara-core-library-sns';
+import { sns } from '@izara_project/izara-core-library-external-request';
+import { consts, NoRetryError } from '@izara_project/izara-core-library-core';
+
+export default async function GetMyPermissions(_izContext, requestParams) {
+  try {
+    const submittedByUserId =
+      requestParams.submittedByUserId ||
+      _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
+
+    if (!submittedByUserId) {
+      throw new NoRetryError('User identity not found in context.');
+    }
+
+    const targetIdentifiers = requestParams.targetIdentifiers;
+    let identifiersConcat =
+      requestParams.identifiersConcat || requestParams.identifierConcat;
+    if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        identifiersConcat =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
+      } else {
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
+        const parts = [];
+        for (const key of sortedKeys) {
+          const value = targetIdentifiers[key];
+          if (value !== undefined && value !== null) {
+            parts.push(`${key}#${value}`);
+          }
+        }
+        if (parts.length > 0) {
+          identifiersConcat = parts.join('|');
+        }
+      }
+    }
+
+    const userRolesTable = dynamodbSharedLib.tableName(_izContext, 'UserRoles');
+    const rolePermissionsTable = dynamodbSharedLib.tableName(_izContext, 'RolePermissions');
+
+    const userRolesResult = await dynamodbSharedLib.query(_izContext, userRolesTable, {
+      userId: submittedByUserId
+    });
+    const userRoleItems = userRolesResult?.Items || [];
+
+    const matchingRoles = identifiersConcat
+      ? userRoleItems.filter((item) => item.roleIdKey?.startsWith(identifiersConcat))
+      : userRoleItems;
+
+    const permissionsMap = {};
+    const rolesList = [];
+
+    for (const roleItem of matchingRoles) {
+      rolesList.push(roleItem.roleIdKey);
+      const permsResult = await dynamodbSharedLib.query(_izContext, rolePermissionsTable, {
+        roleIdKey: roleItem.roleIdKey
+      });
+      for (const p of (permsResult?.Items || [])) {
+        if (p.permission === true) {
+          permissionsMap[p.flowTypeConcat] = true;
+        } else if (permissionsMap[p.flowTypeConcat] === undefined) {
+          permissionsMap[p.flowTypeConcat] = false;
+        }
+      }
+    }
+
+    const result = {
+      userId: submittedByUserId,
+      identifiersConcat: identifiersConcat || null,
+      roles: rolesList,
+      permissions: permissionsMap
+    };
+
+    await sns.publishMessage(_izContext, {
+      message: { returnResult: result },
+      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+        _izContext,
+        'GetMyPermissions_Out'
+      )
+    });
+    return result;
+  } catch (error) {
+    _izContext.logger.error(`[${process.env.iz_serviceTag}:GetMyPermissions] error:`, error);
+    throw error;
+  }
+}