@izara_project/izara-core-generate-service-code 1.0.85 → 1.0.87

package/src/emit/resource/templates/SystemDynamoDB_Yaml.ejs

@@ -138,6 +138,18 @@ Resources:
           KeyType: RANGE
 
   <% if (hasRbac) { %>
+  RolesTable:
+    Type: 'AWS::DynamoDB::Table'
+    Properties:
+      TableName: ${self:custom.iz_resourcePrefix}Roles
+      BillingMode: PAY_PER_REQUEST
+      AttributeDefinitions:
+        - AttributeName: roleIdKey
+          AttributeType: S
+      KeySchema:
+        - AttributeName: roleIdKey
+          KeyType: HASH
+
   TargetRolesTable:
     Type: 'AWS::DynamoDB::Table'
     Properties:
@@ -221,22 +233,6 @@ Resources:
         AttributeName: ttlTimestamp
         Enabled: true
 
-  RoleLimitTable:
-    Type: 'AWS::DynamoDB::Table'
-    Properties:
-      TableName: ${self:custom.iz_resourcePrefix}RoleLimit
-      BillingMode: PAY_PER_REQUEST
-      AttributeDefinitions:
-        - AttributeName: roleLimitId
-          AttributeType: S
-        - AttributeName: limitType
-          AttributeType: S
-      KeySchema:
-        - AttributeName: roleLimitId
-          KeyType: HASH
-        - AttributeName: limitType
-          KeyType: RANGE
-
   RunningTotalUsageTable:
     Type: 'AWS::DynamoDB::Table'
     Properties:
@@ -245,12 +241,12 @@ Resources:
       AttributeDefinitions:
         - AttributeName: identifiersConcat
           AttributeType: S
-        - AttributeName: limitTag
+        - AttributeName: flowTypeConcat
           AttributeType: S
       KeySchema:
         - AttributeName: identifiersConcat
           KeyType: HASH
-        - AttributeName: limitTag
+        - AttributeName: flowTypeConcat
           KeyType: RANGE
 
   RunningTotalReservedUsageTable:

package/src/emit/system/templates/WebSocketComplete_Yaml.ejs

@@ -16,6 +16,8 @@ WebSocketCompleteHdrSqs:
           - body:
               MessageAttributes:
                 callingFlow:
-                  Value:
-                    - exists: false
+                  - exists: false
+          - body:
+              MessageAttributes:
+                - exists: false
         #<#/WebSocketCompleteHdrSqsFilterPatterns#>

package/src/emit/systemText/emitSystemTextSchemas.js

@@ -17,14 +17,17 @@ const RELATIONSHIP_ACTIONS = [
 ];
 const RBAC_SHARED_FLOW_TAGS = [
   'CreateTargetRole',
-  'ListTargetRole',
+  'UpdateTargetRole',
   'DeleteTargetRole',
+  'GetTargetRole',
+  'ListTargetRole',
   'CreateRolePermissions',
   'ListRolePermissions',
   'DeleteRolePermissions',
   'CreateUserRole',
   'ListUserInRoles',
-  'DeleteUserFromRole'
+  'DeleteUserFromRole',
+  'GetMyPermissions'
 ];
 
 export function systemTextSchemaManagedPaths() {

package/src/generate.js

@@ -64,12 +64,10 @@ import {
 
 export async function generate(rootPath, options = {}) {
   const startedAt = Date.now();
-  const logger = options.logger;
-  logger?.info?.(`[INFO] [Generate] STATUS=STARTED | rootPath=${rootPath}`);
+  console.log(`[INFO] [Generate] STATUS=STARTED | rootPath=${rootPath}`);
   try {
     const project = compileProject({ ...options, rootPath });
     const schemaLoadOptions = {
-      logger,
       skipValidation: options.skipValidation
     };
     const [rawObjects, relationships, flows, notifications] = await Promise.all([
@@ -92,8 +90,10 @@ export async function generate(rootPath, options = {}) {
       relationships,
       schemaBucketName
     );
-    logger?.debug?.(
-      `[DEBUG] [Generate] STATUS=SCHEMAS_LOADED | objects=${objects.length} relationships=${relationships.length} flows=${flows.length}`
+    console.log(
+      `[DEBUG] [Generate] STATUS=SCHEMAS_LOADED | ` +
+      `objects=${objects.length} ` +
+      `relationships=${relationships.length} flows=${flows.length}`
     );
     const groups = await _emitGroups({
       project,
@@ -103,10 +103,14 @@ export async function generate(rootPath, options = {}) {
       notifications,
       objectGraphServiceTags,
       relationshipGraphServiceTags,
-      logger
+      logger: options.logger
+    });
+    const scopeCounts = groups.map((group) => {
+      return `${group.scope}=${group.artifacts.length}`;
     });
-    logger?.debug?.(
-      `[DEBUG] [Generate] STATUS=ARTIFACTS_EMITTED | ${groups.map((group) => `${group.scope}=${group.artifacts.length}`).join(' ')}`
+    const emittedScopeSummary = scopeCounts.join(' ');
+    console.log(
+      `[DEBUG] [Generate] STATUS=ARTIFACTS_EMITTED | ${emittedScopeSummary}`
     );
     let files = [];
     if (groups.length > 0) {
@@ -123,14 +127,16 @@ export async function generate(rootPath, options = {}) {
       );
     }
     const durationMs = Date.now() - startedAt;
-    logger?.info?.(
-      `[INFO] [Generate] STATUS=FINISHED | files=${files.length} durationMs=${durationMs}`
+    console.log(
+      `[INFO] [Generate] STATUS=FINISHED | ` +
+      `files=${files.length} durationMs=${durationMs}`
     );
 
     return { project, durationMs, files };
   } catch (error) {
-    logger?.error?.(
-      `[ERROR] [Generate] STATUS=FAILED | durationMs=${Date.now() - startedAt}`,
+    console.log(
+      `[ERROR] [Generate] STATUS=FAILED | ` +
+      `durationMs=${Date.now() - startedAt}`,
       error
     );
     throw error;

package/src/generateResources/IntTest/generateResources/generateResources.js

@@ -103,7 +103,7 @@ async function generateCodeWithTemplate(_izContext, savePath, settings) {
 
     return allCreateSource;
   } catch (error) {
-    _izContext.logger.error(
+    console.log(
       'Error generating code with template propertyNode schema:',
       error
     );

package/src/generateResources/IntTest/generateTests/generateTemplate.js

@@ -71,7 +71,7 @@ async function generateCodeWithTemplate(_izContext, savePath, settings) {
 
     return allCreateSource;
   } catch (error) {
-    _izContext.logger.error(
+    console.log(
       'Error generating code with template propertyNode schema:',
       error
     );

package/src/generateResources/IntTest/upload/uploadIntTest.js

@@ -17,10 +17,16 @@ import fs from 'fs';
 import path from 'path';
 
 import { s3 } from '@izara_project/izara-core-library-s3';
-import Logger from '@izara_project/izara-core-library-logger';
+
+const consoleLogger = {
+  debug: console.log,
+  info: console.log,
+  warn: console.log,
+  error: console.error
+};
 
 const DEFAULT_BUCKET = 'integrationtest-config-us-east-2';
-const _izContext = { Logger };
+const _izContext = { logger: consoleLogger, Logger: consoleLogger };
 
 function _getAllFiles(dirPath, filePaths = []) {
   if (!fs.existsSync(dirPath)) {

package/test/createTargetRoleHandler.test.js

@@ -9,21 +9,18 @@ import { generateCreateTargetRoleHandler } from '../src/emit/rbac/generateCreate
 const roots = new Set();
 const OWN_TOPIC_FLOWS = [
   'CreateTargetRole',
+  'UpdateTargetRole',
   'CreateRolePermissions',
   'DeleteRolePermissions',
   'DeleteTargetRole',
   'CreateUserRole',
   'DeleteUserFromRole',
-  'CreateRoleLimit',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
 ];
 
 const LIMIT_FLOWS = [
-  'CreateRoleLimit',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
@@ -39,7 +36,7 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
   const rootPath = await createProject(true);
   const result = await generateCreateTargetRoleHandler(rootPath);
 
-  assert.equal(result.files.length, 60);
+  assert.equal(result.files.length, 59);
   assert.match(
     await readFile(join(rootPath, result.files[0].path), 'utf8'),
     /CreateTargetRole/
@@ -48,6 +45,46 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     await readFile(join(rootPath, result.files[0].path), 'utf8'),
     /roleName = 'owner'/
   );
+  assert.match(
+    await readFile(
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowRbac/UpdateTargetRole/source/UpdateTargetRole_Main.js'
+      ),
+      'utf8'
+    ),
+    /Cannot modify system owner role/
+  );
+  assert.match(
+    await readFile(
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowRbac/DeleteTargetRole/source/DeleteTargetRole_Main.js'
+      ),
+      'utf8'
+    ),
+    /Cannot delete system owner role/
+  );
+  assert.match(
+    await readFile(
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowRbac/GetTargetRole/source/GetTargetRole_Main.js'
+      ),
+      'utf8'
+    ),
+    /GetTargetRole/
+  );
+  assert.match(
+    await readFile(
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowRbac/GetMyPermissions/source/GetMyPermissions_Main.js'
+      ),
+      'utf8'
+    ),
+    /GetMyPermissions/
+  );
   assert.match(
     await readFile(join(rootPath, result.files[1].path), 'utf8'),
     /CreateTargetRoleHdrSqs/
@@ -89,16 +126,6 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     ),
     /Math\.min\(maxIncrease, minDecrease\)/
   );
-  assert.match(
-    await readFile(
-      join(
-        rootPath,
-        'app/src/generatedCode/FlowLimit/CreateRoleLimit/source/CreateRoleLimit_Main.js'
-      ),
-      'utf8'
-    ),
-    /actionType/
-  );
   const rbacYaml = await readFile(
     join(rootPath, 'app/sls_yaml/generatedCode/source/flow-rbac.yml'),
     'utf8'

package/test/crudApplicationArtifacts.test.js

@@ -239,7 +239,7 @@ test('emits a single Complete RBAC handler for Update without Graph', async () =
   );
 });
 
-test('emits RbacCallback and Complete handlers for Update with Graph', async () => {
+test('emits Complete handlers and inlines sync RBAC for Update with Graph', async () => {
   const rootPath = await createRbacProject(false, true);
   const result = await generateCrudApplicationArtifacts(rootPath, {
     serviceTag: 'orders'
@@ -248,19 +248,25 @@ test('emits RbacCallback and Complete handlers for Update with Graph', async ()
     .map((file) => file.path)
     .filter((path) => path.includes('/FlowObjects/Update/source/'));
 
-  assert.ok(updatePaths.includes(
+  assert.ok(!updatePaths.includes(
     'app/src/generatedCode/FlowObjects/Update/source/UpdateRbacCallback_Main.js'
   ));
   assert.ok(updatePaths.includes(
     'app/src/generatedCode/FlowObjects/Update/source/UpdateComplete_Main.js'
   ));
+  const updateMainContent = await readFile(
+    join(rootPath, 'app/src/generatedCode/FlowObjects/Update/source/Update_Main.js'),
+    'utf8'
+  );
+  assert.match(updateMainContent, /checkRbacPermission/);
+  assert.match(updateMainContent, /sync: true/);
   execFileSync(
     process.execPath,
     [
       '--check',
       join(
         rootPath,
-        'app/src/generatedCode/FlowObjects/Update/source/UpdateRbacCallback_Main.js'
+        'app/src/generatedCode/FlowObjects/Update/source/UpdateComplete_Main.js'
       )
     ],
     { stdio: 'inherit' }
@@ -357,6 +363,59 @@ test('logs warning when ObjectSchema has invalid or non-CRUD generatedBy in crud
   );
 });
 
+test('emits targetIdentifiers consistency check and fallback in Update_Main.js and Delete_Main.js', async () => {
+  const rootPath = await createProject(true);
+  await generateCrudApplicationArtifacts(rootPath, {
+    serviceTag: 'orders'
+  });
+
+  const updateMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Update/source/Update_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(updateMain, /targetIdentifiers\.\$\{key\} must match objInstanceFull\.identifiers\.\$\{key\}/);
+  assert.match(updateMain, /if \(!objectSchema\.hasOwnProperty\('belongTo'\)\)/);
+  assert.doesNotMatch(updateMain, /requestParams\.targetIdentifiers\s*=/);
+
+  const deleteMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Delete/source/Delete_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(deleteMain, /targetIdentifiers\.\$\{key\} must match identifiers\.\$\{key\}/);
+  assert.match(deleteMain, /if \(!objectSchema\.hasOwnProperty\('belongTo'\)\)/);
+  assert.doesNotMatch(deleteMain, /requestParams\.targetIdentifiers\s*=/);
+});
+
+test('emits targetIdentifiers passed directly to checkRbacPermission options in RBAC project', async () => {
+  const rootPath = await createRbacProject();
+  await generateCrudApplicationArtifacts(rootPath, {
+    serviceTag: 'orders'
+  });
+
+  const updateMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Update/source/Update_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(updateMain, /checkRbacPermission\([\s\S]*targetIdentifiers,[\s\S]*rbacObjType/);
+
+  const deleteMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Delete/source/Delete_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(deleteMain, /checkRbacPermission\([\s\S]*targetIdentifiers,[\s\S]*rbacObjType/);
+});
 
 async function createProject(withCrudObject) {
   const rootPath = await mkdtemp(

package/test/customFlowApplicationArtifacts.test.js

@@ -895,7 +895,7 @@ test('registers SQS queue, SNS subscription, and SNS out topic for custom flowSc
   );
 });
 
-test('renders RBAC Validator subscriptions in InitialSetupConfig when object has belongTo to external RBAC service', async () => {
+test('uses synchronous RBAC without obsolete callback SQS subscriptions in InitialSetupConfig', async () => {
   const rootPath = await createProject();
   await writeFile(
     join(rootPath, 'app/src/schemas/ObjectSchemas/Member.js'),
@@ -920,10 +920,8 @@ test('renders RBAC Validator subscriptions in InitialSetupConfig when object has
     ),
     'utf8'
   );
-  assert.match(initialSetupConfigContent, /serviceTag: 'UserAccount'/);
-  assert.match(initialSetupConfigContent, /topicName: 'ValidatorRbac_Out'/);
-  assert.match(initialSetupConfigContent, /sqsEndpoint: 'UpdateRbacCallbackHdrSqs'/);
-  assert.match(initialSetupConfigContent, /sqsEndpoint: 'DeleteRbacCallbackHdrSqs'/);
+  assert.doesNotMatch(initialSetupConfigContent, /sqsEndpoint: 'UpdateRbacCallbackHdrSqs'/);
+  assert.doesNotMatch(initialSetupConfigContent, /sqsEndpoint: 'DeleteRbacCallbackHdrSqs'/);
 });
 
 test('deduplicates duplicate nextSteps topics across flowSteps in InitialSetupConfig', async () => {

package/test/dynamicCrudFlowSchemas.test.js

@@ -142,7 +142,7 @@ test('generates a direct Complete step for RBAC-only Update flows', async () =>
   assert.equal(update.flowSteps[1].properties.length, 0);
 });
 
-test('generates RbacCallback and Complete for Create when RBAC and Graph are present', async () => {
+test('generates CreateNodeCallback and Complete for Create when RBAC and Graph are present', async () => {
   const rootPath = await createProject({
     generatedBy: 'user',
   });
@@ -160,13 +160,12 @@ test('generates RbacCallback and Complete for Create when RBAC and Graph are pre
   const create = await readGeneratedFlow(rootPath, 'Create');
   assert.deepEqual(create.flowSteps.map((step) => step.stepName), [
     'Start',
-    'RbacCallback',
     'CreateNodeCallback',
     'Complete'
   ]);
 });
 
-test('uses the renamed RBAC callback step when Graph storage is present', async () => {
+test('uses CreateNodeCallback step when Graph storage is present with sync RBAC', async () => {
   const rootPath = await mkdtemp(
     join(tmpdir(), 'generate-service-code-v2-crud-rbac-graph-')
   );
@@ -186,11 +185,10 @@ test('uses the renamed RBAC callback step when Graph storage is present', async
   const create = await readGeneratedFlow(rootPath, 'Create');
   assert.deepEqual(create.flowSteps.map((step) => step.stepName), [
     'Start',
-    'RbacCallback',
     'CreateNodeCallback',
     'Complete'
   ]);
-  assert.deepEqual(create.flowSteps[2].properties, [
+  assert.deepEqual(create.flowSteps[1].properties, [
     'returnValue',
     'parentFlowId',
     'status',
@@ -199,7 +197,7 @@ test('uses the renamed RBAC callback step when Graph storage is present', async
   ]);
 });
 
-test('chains RbacCallback and Complete for Update with RBAC and Graph', async () => {
+test('chains Start and Complete for Update with RBAC and Graph', async () => {
   const rootPath = await mkdtemp(
     join(tmpdir(), 'generate-service-code-v2-crud-update-rbac-graph-')
   );
@@ -219,19 +217,9 @@ test('chains RbacCallback and Complete for Update with RBAC and Graph', async ()
   const update = await readGeneratedFlow(rootPath, 'Update');
   assert.deepEqual(update.flowSteps.map((step) => step.stepName), [
     'Start',
-    'RbacCallback',
     'Complete'
   ]);
   assert.deepEqual(update.flowSteps[0].nextSteps, [
-    { targetType: 'ownTopic', stepName: 'RbacCallback' },
-    {
-      targetType: 'extTopic',
-      serviceTag: 'Rbac',
-      topicName: 'ValidatorRbac_In',
-      toStepNames: ['RbacCallback']
-    }
-  ]);
-  assert.deepEqual(update.flowSteps[1].nextSteps, [
     { targetType: 'ownTopic', stepName: 'Complete' },
     {
       targetType: 'extTopic',
@@ -240,7 +228,7 @@ test('chains RbacCallback and Complete for Update with RBAC and Graph', async ()
       toStepNames: ['Complete']
     }
   ]);
-  assert.deepEqual(update.flowSteps[2].properties, [
+  assert.deepEqual(update.flowSteps[1].properties, [
     'returnValue',
     'parentFlowId',
     'status',

package/test/dynamicRbacFlowSchemas.test.js

@@ -10,20 +10,20 @@ import { generateDynamicRbacFlowSchemas } from '../src/emit/rbac/generateDynamic
 const projectRoots = new Set();
 const STATIC_RBAC_ACTIONS = [
   'CreateTargetRole',
-  'ListTargetRole',
+  'UpdateTargetRole',
   'DeleteTargetRole',
+  'GetTargetRole',
+  'ListTargetRole',
   'CreateRolePermissions',
   'ListRolePermissions',
   'DeleteRolePermissions',
   'CreateUserRole',
   'ListUserInRoles',
-  'DeleteUserFromRole'
+  'DeleteUserFromRole',
+  'GetMyPermissions'
 ];
 
 const STATIC_LIMIT_ACTIONS = [
-  'CreateRoleLimit',
-  'ListRoleLimits',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'

package/test/functionYamlArtifact.test.js

@@ -83,12 +83,14 @@ test('filters all SQS functions by their calling flow', () => {
     /#<#CreateCompleteHdrSqsFilterPatterns#>[\s\S]*filterPatterns:[\s\S]*\$\{self:custom\.iz_resourcePrefix\}CreateCompleteHdrSqs/
   );
   assert.match(completion, /#<#\/CreateCompleteHdrSqsFilterPatterns#>/);
-  assert.match(completion, /exists: false/);
+  assert.match(completion, /callingFlow:\s*\n\s*- exists: false/);
+  assert.match(completion, /MessageAttributes:\s*\n\s*- exists: false/);
   assert.match(
     ordinary,
     /#<#CreateHdrSqsFilterPatterns#>[\s\S]*filterPatterns:[\s\S]*\$\{self:custom\.iz_resourcePrefix\}CreateHdrSqs/
   );
   assert.match(ordinary, /#<#\/CreateHdrSqsFilterPatterns#>/);
-  assert.match(ordinary, /exists: false/);
+  assert.match(ordinary, /callingFlow:\s*\n\s*- exists: false/);
+  assert.match(ordinary, /MessageAttributes:\s*\n\s*- exists: false/);
 });
 

package/test/publicApi.test.js

@@ -57,24 +57,28 @@ test('generate commits schemas, application artifacts, and resources in one publ
   );
 });
 
-test('generate logs its lifecycle through the supplied logger', async () => {
+test('generate logs its lifecycle through console.log', async () => {
   const rootPath = await createCrudProject();
   const messages = [];
-  const logger = Object.fromEntries(
-    ['info', 'debug', 'error'].map((level) => [
-      level,
-      (message) => messages.push(message)
-    ])
-  );
+  const originalLog = console.log;
+  console.log = (...args) => {
+    messages.push(args.join(' '));
+  };
 
-  await generate(rootPath, { logger });
+  try {
+    await generate(rootPath);
 
-  assert.match(messages[0], /STATUS=STARTED/);
-  assert.ok(messages.some((message) => /STATUS=SCHEMAS_LOADED/.test(message)));
-  assert.ok(
-    messages.some((message) => /STATUS=ARTIFACTS_EMITTED/.test(message))
-  );
-  assert.match(messages.at(-1), /STATUS=FINISHED/);
+    assert.match(messages[0], /STATUS=STARTED/);
+    assert.ok(messages.some((message) => {
+      return /STATUS=SCHEMAS_LOADED/.test(message);
+    }));
+    assert.ok(messages.some((message) => {
+      return /STATUS=ARTIFACTS_EMITTED/.test(message);
+    }));
+    assert.match(messages.at(-1), /STATUS=FINISHED/);
+  } finally {
+    console.log = originalLog;
+  }
 });
 
 test('generate commits RBAC WebSocket entries for own-topic mutation flows', async () => {

package/test/resourceArtifacts.test.js

@@ -76,8 +76,9 @@ test('emits queues, topics, tables, and IAM roles from schema data', async () =>
   assert.match(dynamoYaml, /OrdersTable:/);
   assert.match(dynamoYaml, /#<#OrdersTableSetting#>/);
   assert.match(dynamoYaml, /#<#\/OrdersTableSetting#>/);
+  assert.match(dynamoYaml, /RolesTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+TableName: \${self:custom\.iz_resourcePrefix}Roles/);
   assert.match(dynamoYaml, /TargetRolesTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+AttributeName: identifiersConcat/);
-  assert.match(dynamoYaml, /RoleLimitTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+TableName: \${self:custom\.iz_resourcePrefix}RoleLimit/);
+  assert.doesNotMatch(dynamoYaml, /RoleLimitTable:/);
   assert.match(dynamoYaml, /RunningTotalUsageTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+TableName: \${self:custom\.iz_resourcePrefix}RunningTotalUsage/);
   assert.match(dynamoYaml, /RunningTotalReservedUsageTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+TableName: \${self:custom\.iz_resourcePrefix}RunningTotalReservedUsage/);
   const iam = await readFile(
@@ -108,9 +109,9 @@ test('emits queues, topics, tables, and IAM roles from schema data', async () =>
     roleBlock(iam, 'FlowRbacRole'),
     /RolePermissions|ProcessCreateTargetRoleHdrSqs/
   );
-  assert.match(roleBlock(iam, 'FlowRbacRole'), /RoleLimit/);
+  assert.doesNotMatch(roleBlock(iam, 'FlowRbacRole'), /RoleLimit/);
   assert.match(roleBlock(iam, 'FlowRbacRole'), /RunningTotalUsage/);
-  assert.match(roleBlock(iam, 'FlowObjectsRole'), /RoleLimit/);
+  assert.doesNotMatch(roleBlock(iam, 'FlowObjectsRole'), /RoleLimit/);
   // Per-object RBAC flow queue (e.g. ValidatorRbacHdrSqs from Order with rbac add-on)
   assert.match(roleBlock(iam, 'FlowRbacRole'), /ValidatorRbacHdrSqs/);
 
@@ -365,6 +366,9 @@ test('emits CreateNodeCallbackHdrSqs in FlowObjectsRole when object has graph an
   const role = roleBlock(iam, 'FlowObjectsRole');
   assert.match(role, /CreateNodeCallbackHdrSqs/);
   assert.match(role, /CreateNodeCallbackHdrSqsDLQ/);
+  assert.match(role, /RolePermissions/);
+  assert.match(role, /ValidatorRbac_In/);
+  assert.match(role, /Rbac_\$\{self:custom\.iz_stage\}_ValidatorRbac_In/);
 });
 
 function roleBlock(iam, roleName) {