@izara_project/izara-core-generate-service-code 1.0.86 → 1.0.87

package/src/emit/rbac/templates/CreateTargetRole_Main.ejs

@@ -28,21 +28,25 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       _izContext.correlationIds?.get(consts.SUBMITTED_BY_USER_ID);
 
     const targetIdentifiers = requestParams.targetIdentifiers;
-    let identifiersConcat = requestParams.identifiersConcat;
+    let identifiersConcat =
+      requestParams.identifiersConcat || requestParams.identifierConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        identifiersConcat = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        identifiersConcat =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }
@@ -61,7 +65,11 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       permissions = [],
       assignUserIds = []
     } = requestParams;
-    const roleId = inputRoleId || roleName || identifierUuid();
+    let defaultRoleId = identifierUuid();
+    if (roleName === 'owner') {
+      defaultRoleId = 'owner';
+    }
+    const roleId = inputRoleId || defaultRoleId;
     const roleIdKey = `${identifiersConcat}_${roleId}`;
 
     await dynamodbSharedLib.putItem(
@@ -70,8 +78,10 @@ export default async function CreateTargetRole(_izContext, requestParams) {
       {
         identifiersConcat,
         roleIdKey,
+        roleType: 'tenant_role',
         roleName,
-        submittedByUserId
+        submittedByUserId,
+        createdAt: new Date().toISOString()
       }
     );
 

package/src/emit/rbac/templates/GetMyPermissions_Main.ejs

@@ -31,21 +31,25 @@ export default async function GetMyPermissions(_izContext, requestParams) {
     }
 
     const targetIdentifiers = requestParams.targetIdentifiers;
-    let identifiersConcat = requestParams.identifiersConcat;
+    let identifiersConcat =
+      requestParams.identifiersConcat || requestParams.identifierConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        identifiersConcat = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        identifiersConcat =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }

package/src/emit/rbac/templates/ReservedDynamicUsage_Main.ejs

@@ -35,21 +35,25 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     } = requestParams;
 
     const targetIdentifiers = requestParams.targetIdentifiers;
-    let identifiersConcat = requestParams.identifiersConcat;
+    let identifiersConcat =
+      requestParams.identifiersConcat || requestParams.identifierConcat;
     if (!identifiersConcat && targetIdentifiers && typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        identifiersConcat = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        identifiersConcat =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }
@@ -70,41 +74,79 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     }
 
     const uniqueIdentify = `${usedTimestamp}_${_izContext.uniqueRequestId || Date.now()}`;
-    const roleLimitKeys = Array.isArray(requestParams.roleLimitIds)
-      ? requestParams.roleLimitIds
-      : [roleLimitId || `${identifiersConcat}_${flowTypeConcat}`];
 
-    let maxLimit = Infinity;
-    const limitRecords = [];
-
-    for (const key of roleLimitKeys) {
-      const record = await dynamodbSharedLib.getItem(
+    let targetPlanTier = requestParams.planTier || null;
+    if (!targetPlanTier && identifiersConcat) {
+      const targetRolesResult = await dynamodbSharedLib.query(
         _izContext,
-        dynamodbSharedLib.tableName(_izContext, 'RoleLimit'),
-        { roleLimitId: key, limitType: 'runningTotal' }
+        dynamodbSharedLib.tableName(_izContext, 'TargetRoles'),
+        { identifiersConcat }
       );
-      if (record && typeof record.limitValue === 'number') {
-        limitRecords.push(record);
+      let targetRoleItems = [];
+      if (Array.isArray(targetRolesResult)) {
+        targetRoleItems = targetRolesResult;
+      } else if (targetRolesResult && targetRolesResult.Items) {
+        targetRoleItems = targetRolesResult.Items;
+      }
+      for (const roleItem of targetRoleItems) {
+        if (roleItem.roleType === 'plan_tier') {
+          targetPlanTier = roleItem.roleIdKey;
+          break;
+        }
+      }
+    }
+    if (!targetPlanTier) {
+      targetPlanTier = 'tier-free';
+    }
+
+    const limitRecords = [];
+    const tierPermission = await dynamodbSharedLib.getItem(
+      _izContext,
+      dynamodbSharedLib.tableName(_izContext, 'RolePermissions'),
+      { roleIdKey: targetPlanTier, flowTypeConcat }
+    );
+    if (tierPermission && typeof tierPermission.limitValue === 'number') {
+      limitRecords.push(tierPermission);
+    }
+
+    if (Array.isArray(requestParams.roleIdKeys)) {
+      for (const rKey of requestParams.roleIdKeys) {
+        const perm = await dynamodbSharedLib.getItem(
+          _izContext,
+          dynamodbSharedLib.tableName(_izContext, 'RolePermissions'),
+          { roleIdKey: rKey, flowTypeConcat }
+        );
+        if (perm && typeof perm.limitValue === 'number') {
+          limitRecords.push(perm);
+        }
       }
     }
 
+    let maxLimit = Infinity;
     if (limitRecords.length > 0) {
-      const isDecrease = (rec) =>
-        rec.effect === 'decrease' ||
-        rec.actionType === 'decrease' ||
-        rec.action === 'decrease';
+      const isDecrease = function (rec) {
+        if (
+          rec.effect === 'decrease' ||
+          rec.actionType === 'decrease' ||
+          rec.action === 'decrease'
+        ) {
+          return true;
+        }
+        return false;
+      };
 
       const increaseLimits = limitRecords.filter((rec) => !isDecrease(rec));
       const decreaseLimits = limitRecords.filter((rec) => isDecrease(rec));
 
-      const maxIncrease =
-        increaseLimits.length > 0
-          ? Math.max(...increaseLimits.map((r) => r.limitValue))
-          : Infinity;
-      const minDecrease =
-        decreaseLimits.length > 0
-          ? Math.min(...decreaseLimits.map((r) => r.limitValue))
-          : Infinity;
+      let maxIncrease = Infinity;
+      if (increaseLimits.length > 0) {
+        maxIncrease = Math.max(...increaseLimits.map((r) => r.limitValue));
+      }
+
+      let minDecrease = Infinity;
+      if (decreaseLimits.length > 0) {
+        minDecrease = Math.min(...decreaseLimits.map((r) => r.limitValue));
+      }
 
       maxLimit = Math.min(maxIncrease, minDecrease);
     }

package/src/emit/rbac/templates/UserRbacFlow_Main.ejs

@@ -101,19 +101,22 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     if (typeof targetIdentifiers === 'string') {
       targetId = targetIdentifiers;
     } else if (typeof targetIdentifiers === 'object') {
-      if (targetIdentifiers.identifierConcat) {
-        targetId = targetIdentifiers.identifierConcat;
+      if (targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat) {
+        targetId =
+          targetIdentifiers.identifiersConcat || targetIdentifiers.identifierConcat;
       } else {
-        const sortedKeys = Object.keys(targetIdentifiers).sort();
+        const sortedKeys = Object.keys(targetIdentifiers)
+          .filter(
+            (k) =>
+              k !== 'submittedByUserId' &&
+              k !== 'identifierConcat' &&
+              k !== 'identifiersConcat'
+          )
+          .sort();
         const parts = [];
         for (const key of sortedKeys) {
           const value = targetIdentifiers[key];
-          if (
-            key !== 'submittedByUserId' &&
-            key !== 'identifierConcat' &&
-            value !== undefined &&
-            value !== null
-          ) {
+          if (value !== undefined && value !== null) {
             parts.push(`${key}#${value}`);
           }
         }

package/src/emit/resource/emitResourceArtifacts.js

@@ -43,9 +43,6 @@ const RBAC_ACTIONS = [
   'DeleteUserFromRole',
   'GetMyPermissions',
   'ValidatorRbac',
-  'CreateRoleLimit',
-  'ListRoleLimits',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
@@ -62,12 +59,12 @@ const SYSTEM_TABLES = [
   'AwaitingStep'
 ];
 const RBAC_TABLES = [
+  'Roles',
   'TargetRoles',
   'RolePermissions',
   'RoleUsers',
   'UserRoles',
   'RbacPermissionCaches',
-  'RoleLimit',
   'RunningTotalUsage',
   'RunningTotalReservedUsage',
   'WebSocketTask'
@@ -417,12 +414,12 @@ function createResourceState({ objects, relationships, flows }) {
   const systemTables = [...SYSTEM_TABLES];
   if (rbac) {
     systemTables.push(
+      'Roles',
       'TargetRoles',
       'RolePermissions',
       'RoleUsers',
       'UserRoles',
       'RbacPermissionCaches',
-      'RoleLimit',
       'RunningTotalUsage',
       'RunningTotalReservedUsage'
     );
@@ -736,6 +733,11 @@ function roleStatements(state, roleName) {
       ...roleExternalTopicArns(state, roleName)
     ]
   );
+  addStatement(
+    statements,
+    ['lambda:InvokeFunction'],
+    roleExternalLambdaArns(state, roleName)
+  );
   if (state.webSocketRoles.has(roleName)) {
     statements.push({
       action: ['execute-api:ManageConnections'],
@@ -771,11 +773,11 @@ function roleTableNames(state, roleName) {
       'WebSocketTask',
       ...(state.rbac
         ? [
+            'Roles',
             'TargetRoles',
             'RolePermissions',
             'RoleUsers',
             'UserRoles',
-            'RoleLimit',
             'RunningTotalUsage',
             'RunningTotalReservedUsage'
           ]
@@ -1064,6 +1066,30 @@ function roleExternalTopicArns(state, roleName) {
   return [];
 }
 
+function roleExternalLambdaArns(state, roleName) {
+  if (!state.rbac) {
+    return [];
+  }
+  const extraTags = getRbacValidatorServiceTags(state).filter(
+    (tag) => tag && tag !== 'Rbac'
+  );
+  const extraLambdas = extraTags.map(
+    (tag) =>
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ValidatorRbacHdrInv`
+  );
+  if (
+    roleName === 'FlowObjectsRole' ||
+    roleName === 'FlowRbacRole' ||
+    roleName === 'FlowRelationshipRole'
+  ) {
+    return [
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
+      ...extraLambdas
+    ];
+  }
+  return [];
+}
+
 function queueArns(queueNames) {
   return [...new Set(queueNames)]
     .sort()

package/src/emit/resource/templates/SystemDynamoDB_Yaml.ejs

@@ -138,6 +138,18 @@ Resources:
           KeyType: RANGE
 
   <% if (hasRbac) { %>
+  RolesTable:
+    Type: 'AWS::DynamoDB::Table'
+    Properties:
+      TableName: ${self:custom.iz_resourcePrefix}Roles
+      BillingMode: PAY_PER_REQUEST
+      AttributeDefinitions:
+        - AttributeName: roleIdKey
+          AttributeType: S
+      KeySchema:
+        - AttributeName: roleIdKey
+          KeyType: HASH
+
   TargetRolesTable:
     Type: 'AWS::DynamoDB::Table'
     Properties:
@@ -221,22 +233,6 @@ Resources:
         AttributeName: ttlTimestamp
         Enabled: true
 
-  RoleLimitTable:
-    Type: 'AWS::DynamoDB::Table'
-    Properties:
-      TableName: ${self:custom.iz_resourcePrefix}RoleLimit
-      BillingMode: PAY_PER_REQUEST
-      AttributeDefinitions:
-        - AttributeName: roleLimitId
-          AttributeType: S
-        - AttributeName: limitType
-          AttributeType: S
-      KeySchema:
-        - AttributeName: roleLimitId
-          KeyType: HASH
-        - AttributeName: limitType
-          KeyType: RANGE
-
   RunningTotalUsageTable:
     Type: 'AWS::DynamoDB::Table'
     Properties:
@@ -245,12 +241,12 @@ Resources:
       AttributeDefinitions:
         - AttributeName: identifiersConcat
           AttributeType: S
-        - AttributeName: limitTag
+        - AttributeName: flowTypeConcat
           AttributeType: S
       KeySchema:
         - AttributeName: identifiersConcat
           KeyType: HASH
-        - AttributeName: limitTag
+        - AttributeName: flowTypeConcat
           KeyType: RANGE
 
   RunningTotalReservedUsageTable:

package/src/emit/system/templates/WebSocketComplete_Yaml.ejs

@@ -16,6 +16,8 @@ WebSocketCompleteHdrSqs:
           - body:
               MessageAttributes:
                 callingFlow:
-                  Value:
-                    - exists: false
+                  - exists: false
+          - body:
+              MessageAttributes:
+                - exists: false
         #<#/WebSocketCompleteHdrSqsFilterPatterns#>

package/test/createTargetRoleHandler.test.js

@@ -15,16 +15,12 @@ const OWN_TOPIC_FLOWS = [
   'DeleteTargetRole',
   'CreateUserRole',
   'DeleteUserFromRole',
-  'CreateRoleLimit',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
 ];
 
 const LIMIT_FLOWS = [
-  'CreateRoleLimit',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
@@ -40,7 +36,7 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
   const rootPath = await createProject(true);
   const result = await generateCreateTargetRoleHandler(rootPath);
 
-  assert.equal(result.files.length, 70);
+  assert.equal(result.files.length, 59);
   assert.match(
     await readFile(join(rootPath, result.files[0].path), 'utf8'),
     /CreateTargetRole/
@@ -130,16 +126,6 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     ),
     /Math\.min\(maxIncrease, minDecrease\)/
   );
-  assert.match(
-    await readFile(
-      join(
-        rootPath,
-        'app/src/generatedCode/FlowLimit/CreateRoleLimit/source/CreateRoleLimit_Main.js'
-      ),
-      'utf8'
-    ),
-    /actionType/
-  );
   const rbacYaml = await readFile(
     join(rootPath, 'app/sls_yaml/generatedCode/source/flow-rbac.yml'),
     'utf8'

package/test/crudApplicationArtifacts.test.js

@@ -239,7 +239,7 @@ test('emits a single Complete RBAC handler for Update without Graph', async () =
   );
 });
 
-test('emits RbacCallback and Complete handlers for Update with Graph', async () => {
+test('emits Complete handlers and inlines sync RBAC for Update with Graph', async () => {
   const rootPath = await createRbacProject(false, true);
   const result = await generateCrudApplicationArtifacts(rootPath, {
     serviceTag: 'orders'
@@ -248,19 +248,25 @@ test('emits RbacCallback and Complete handlers for Update with Graph', async ()
     .map((file) => file.path)
     .filter((path) => path.includes('/FlowObjects/Update/source/'));
 
-  assert.ok(updatePaths.includes(
+  assert.ok(!updatePaths.includes(
     'app/src/generatedCode/FlowObjects/Update/source/UpdateRbacCallback_Main.js'
   ));
   assert.ok(updatePaths.includes(
     'app/src/generatedCode/FlowObjects/Update/source/UpdateComplete_Main.js'
   ));
+  const updateMainContent = await readFile(
+    join(rootPath, 'app/src/generatedCode/FlowObjects/Update/source/Update_Main.js'),
+    'utf8'
+  );
+  assert.match(updateMainContent, /checkRbacPermission/);
+  assert.match(updateMainContent, /sync: true/);
   execFileSync(
     process.execPath,
     [
       '--check',
       join(
         rootPath,
-        'app/src/generatedCode/FlowObjects/Update/source/UpdateRbacCallback_Main.js'
+        'app/src/generatedCode/FlowObjects/Update/source/UpdateComplete_Main.js'
       )
     ],
     { stdio: 'inherit' }

package/test/customFlowApplicationArtifacts.test.js

@@ -895,7 +895,7 @@ test('registers SQS queue, SNS subscription, and SNS out topic for custom flowSc
   );
 });
 
-test('renders RBAC Validator subscriptions in InitialSetupConfig when object has belongTo to external RBAC service', async () => {
+test('uses synchronous RBAC without obsolete callback SQS subscriptions in InitialSetupConfig', async () => {
   const rootPath = await createProject();
   await writeFile(
     join(rootPath, 'app/src/schemas/ObjectSchemas/Member.js'),
@@ -920,10 +920,8 @@ test('renders RBAC Validator subscriptions in InitialSetupConfig when object has
     ),
     'utf8'
   );
-  assert.match(initialSetupConfigContent, /serviceTag: 'UserAccount'/);
-  assert.match(initialSetupConfigContent, /topicName: 'ValidatorRbac_Out'/);
-  assert.match(initialSetupConfigContent, /sqsEndpoint: 'UpdateRbacCallbackHdrSqs'/);
-  assert.match(initialSetupConfigContent, /sqsEndpoint: 'DeleteRbacCallbackHdrSqs'/);
+  assert.doesNotMatch(initialSetupConfigContent, /sqsEndpoint: 'UpdateRbacCallbackHdrSqs'/);
+  assert.doesNotMatch(initialSetupConfigContent, /sqsEndpoint: 'DeleteRbacCallbackHdrSqs'/);
 });
 
 test('deduplicates duplicate nextSteps topics across flowSteps in InitialSetupConfig', async () => {

package/test/dynamicCrudFlowSchemas.test.js

@@ -142,7 +142,7 @@ test('generates a direct Complete step for RBAC-only Update flows', async () =>
   assert.equal(update.flowSteps[1].properties.length, 0);
 });
 
-test('generates RbacCallback and Complete for Create when RBAC and Graph are present', async () => {
+test('generates CreateNodeCallback and Complete for Create when RBAC and Graph are present', async () => {
   const rootPath = await createProject({
     generatedBy: 'user',
   });
@@ -160,13 +160,12 @@ test('generates RbacCallback and Complete for Create when RBAC and Graph are pre
   const create = await readGeneratedFlow(rootPath, 'Create');
   assert.deepEqual(create.flowSteps.map((step) => step.stepName), [
     'Start',
-    'RbacCallback',
     'CreateNodeCallback',
     'Complete'
   ]);
 });
 
-test('uses the renamed RBAC callback step when Graph storage is present', async () => {
+test('uses CreateNodeCallback step when Graph storage is present with sync RBAC', async () => {
   const rootPath = await mkdtemp(
     join(tmpdir(), 'generate-service-code-v2-crud-rbac-graph-')
   );
@@ -186,11 +185,10 @@ test('uses the renamed RBAC callback step when Graph storage is present', async
   const create = await readGeneratedFlow(rootPath, 'Create');
   assert.deepEqual(create.flowSteps.map((step) => step.stepName), [
     'Start',
-    'RbacCallback',
     'CreateNodeCallback',
     'Complete'
   ]);
-  assert.deepEqual(create.flowSteps[2].properties, [
+  assert.deepEqual(create.flowSteps[1].properties, [
     'returnValue',
     'parentFlowId',
     'status',
@@ -199,7 +197,7 @@ test('uses the renamed RBAC callback step when Graph storage is present', async
   ]);
 });
 
-test('chains RbacCallback and Complete for Update with RBAC and Graph', async () => {
+test('chains Start and Complete for Update with RBAC and Graph', async () => {
   const rootPath = await mkdtemp(
     join(tmpdir(), 'generate-service-code-v2-crud-update-rbac-graph-')
   );
@@ -219,19 +217,9 @@ test('chains RbacCallback and Complete for Update with RBAC and Graph', async ()
   const update = await readGeneratedFlow(rootPath, 'Update');
   assert.deepEqual(update.flowSteps.map((step) => step.stepName), [
     'Start',
-    'RbacCallback',
     'Complete'
   ]);
   assert.deepEqual(update.flowSteps[0].nextSteps, [
-    { targetType: 'ownTopic', stepName: 'RbacCallback' },
-    {
-      targetType: 'extTopic',
-      serviceTag: 'Rbac',
-      topicName: 'ValidatorRbac_In',
-      toStepNames: ['RbacCallback']
-    }
-  ]);
-  assert.deepEqual(update.flowSteps[1].nextSteps, [
     { targetType: 'ownTopic', stepName: 'Complete' },
     {
       targetType: 'extTopic',
@@ -240,7 +228,7 @@ test('chains RbacCallback and Complete for Update with RBAC and Graph', async ()
       toStepNames: ['Complete']
     }
   ]);
-  assert.deepEqual(update.flowSteps[2].properties, [
+  assert.deepEqual(update.flowSteps[1].properties, [
     'returnValue',
     'parentFlowId',
     'status',

package/test/dynamicRbacFlowSchemas.test.js

@@ -24,9 +24,6 @@ const STATIC_RBAC_ACTIONS = [
 ];
 
 const STATIC_LIMIT_ACTIONS = [
-  'CreateRoleLimit',
-  'ListRoleLimits',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'

package/test/functionYamlArtifact.test.js

@@ -83,12 +83,14 @@ test('filters all SQS functions by their calling flow', () => {
     /#<#CreateCompleteHdrSqsFilterPatterns#>[\s\S]*filterPatterns:[\s\S]*\$\{self:custom\.iz_resourcePrefix\}CreateCompleteHdrSqs/
   );
   assert.match(completion, /#<#\/CreateCompleteHdrSqsFilterPatterns#>/);
-  assert.match(completion, /exists: false/);
+  assert.match(completion, /callingFlow:\s*\n\s*- exists: false/);
+  assert.match(completion, /MessageAttributes:\s*\n\s*- exists: false/);
   assert.match(
     ordinary,
     /#<#CreateHdrSqsFilterPatterns#>[\s\S]*filterPatterns:[\s\S]*\$\{self:custom\.iz_resourcePrefix\}CreateHdrSqs/
   );
   assert.match(ordinary, /#<#\/CreateHdrSqsFilterPatterns#>/);
-  assert.match(ordinary, /exists: false/);
+  assert.match(ordinary, /callingFlow:\s*\n\s*- exists: false/);
+  assert.match(ordinary, /MessageAttributes:\s*\n\s*- exists: false/);
 });
 

package/test/resourceArtifacts.test.js

@@ -76,8 +76,9 @@ test('emits queues, topics, tables, and IAM roles from schema data', async () =>
   assert.match(dynamoYaml, /OrdersTable:/);
   assert.match(dynamoYaml, /#<#OrdersTableSetting#>/);
   assert.match(dynamoYaml, /#<#\/OrdersTableSetting#>/);
+  assert.match(dynamoYaml, /RolesTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+TableName: \${self:custom\.iz_resourcePrefix}Roles/);
   assert.match(dynamoYaml, /TargetRolesTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+AttributeName: identifiersConcat/);
-  assert.match(dynamoYaml, /RoleLimitTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+TableName: \${self:custom\.iz_resourcePrefix}RoleLimit/);
+  assert.doesNotMatch(dynamoYaml, /RoleLimitTable:/);
   assert.match(dynamoYaml, /RunningTotalUsageTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+TableName: \${self:custom\.iz_resourcePrefix}RunningTotalUsage/);
   assert.match(dynamoYaml, /RunningTotalReservedUsageTable:\s+Type: 'AWS::DynamoDB::Table'[\s\S]+TableName: \${self:custom\.iz_resourcePrefix}RunningTotalReservedUsage/);
   const iam = await readFile(
@@ -108,9 +109,9 @@ test('emits queues, topics, tables, and IAM roles from schema data', async () =>
     roleBlock(iam, 'FlowRbacRole'),
     /RolePermissions|ProcessCreateTargetRoleHdrSqs/
   );
-  assert.match(roleBlock(iam, 'FlowRbacRole'), /RoleLimit/);
+  assert.doesNotMatch(roleBlock(iam, 'FlowRbacRole'), /RoleLimit/);
   assert.match(roleBlock(iam, 'FlowRbacRole'), /RunningTotalUsage/);
-  assert.match(roleBlock(iam, 'FlowObjectsRole'), /RoleLimit/);
+  assert.doesNotMatch(roleBlock(iam, 'FlowObjectsRole'), /RoleLimit/);
   // Per-object RBAC flow queue (e.g. ValidatorRbacHdrSqs from Order with rbac add-on)
   assert.match(roleBlock(iam, 'FlowRbacRole'), /ValidatorRbacHdrSqs/);