@izara_project/izara-core-generate-service-code 1.0.86 → 1.0.88

package/src/emit/resource/emitResourceArtifacts.js

@@ -12,10 +12,7 @@ import {
 } from '../custom/customFlows.js';
 import { hasSystemWebSocket } from '../system/emitSystemWebSocketArtifacts.js';
 import { rbacFlowTag } from '../rbac/rbacFlowTag.js';
-import {
-  CRUD_ACTIONS,
-  createCrudActionPlans
-} from '../crud/crudActionPlan.js';
+import { CRUD_ACTIONS, createCrudActionPlans } from '../crud/crudActionPlan.js';
 
 const TEMPLATE_URL = new URL('./templates/', import.meta.url);
 const RESOURCE_ROOT = 'resource/sls_yaml/generatedCode/source';
@@ -43,9 +40,6 @@ const RBAC_ACTIONS = [
   'DeleteUserFromRole',
   'GetMyPermissions',
   'ValidatorRbac',
-  'CreateRoleLimit',
-  'ListRoleLimits',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
@@ -62,12 +56,12 @@ const SYSTEM_TABLES = [
   'AwaitingStep'
 ];
 const RBAC_TABLES = [
+  'Roles',
   'TargetRoles',
   'RolePermissions',
   'RoleUsers',
   'UserRoles',
   'RbacPermissionCaches',
-  'RoleLimit',
   'RunningTotalUsage',
   'RunningTotalReservedUsage',
   'WebSocketTask'
@@ -211,7 +205,7 @@ function createResourceState({ objects, relationships, flows }) {
   const crud = objects.some(isCrudObject);
   const selfRbac = objects.some(hasSelfRbacAddOn);
   const rbac = objects.some(hasSelfRbacAddOn);
-  const crudActionPlans = createCrudActionPlans(objects);
+  const crudActionPlans = createCrudActionPlans(objects, flows);
 
   const crudOwnTopics = crud ? [...CRUD_ACTIONS] : [];
   const crudSqsQueues = [];
@@ -221,21 +215,26 @@ function createResourceState({ objects, relationships, flows }) {
       if (plan.hasCreateNodeCallback) {
         crudSqsQueues.push(`${action}NodeCallbackHdrSqs`);
       }
+      if (plan.hasBeforeHookCallback) {
+        crudSqsQueues.push(`${action}BeforeHookCallbackHdrSqs`);
+      }
+      if (plan.hasAfterHookCallback) {
+        crudSqsQueues.push(`${action}AfterHookCallbackHdrSqs`);
+      }
       if (plan.hasComplete) {
         crudSqsQueues.push(`${action}CompleteHdrSqs`);
       }
     }
   }
 
-  const relationshipOwnTopics = relationships.length > 0
-    ? [...RELATIONSHIP_ACTIONS]
-    : [];
-  const relationshipSqsQueues = relationships.length > 0
-    ? RELATIONSHIP_ACTIONS.map((action) => `${action}CompleteHdrSqs`)
-    : [];
-  const relationshipDsqQueues = relationships.length > 0
-    ? ['GetRelationshipHdrDsq']
-    : [];
+  const relationshipOwnTopics =
+    relationships.length > 0 ? [...RELATIONSHIP_ACTIONS] : [];
+  const relationshipSqsQueues =
+    relationships.length > 0
+      ? RELATIONSHIP_ACTIONS.map((action) => `${action}CompleteHdrSqs`)
+      : [];
+  const relationshipDsqQueues =
+    relationships.length > 0 ? ['GetRelationshipHdrDsq'] : [];
 
   const rbacOwnTopics = [];
   const rbacSqsQueues = [];
@@ -311,9 +310,7 @@ function createResourceState({ objects, relationships, flows }) {
   const systemOwnTopics = ['ProcessLogical', 'FindData'];
   const systemSqsQueues = [
     'PaginateProcessLogicalHdrSqs',
-    ...(websocket
-      ? ['WebSocketCompleteHdrSqs', 'RegisterCompleteHdrSqs']
-      : [])
+    ...(websocket ? ['WebSocketCompleteHdrSqs', 'RegisterCompleteHdrSqs'] : [])
   ];
   const systemDsqQueues = ['PaginateProcessLogicalHdrDsq'];
 
@@ -351,9 +348,7 @@ function createResourceState({ objects, relationships, flows }) {
       ...flowExtTopicSteps(flows).map(({ flow }) =>
         customFlowRoleName(flow.flowTag)
       ),
-      ...flowDsqSteps(flows).map(({ flow }) =>
-        customFlowRoleName(flow.flowTag)
-      )
+      ...flowDsqSteps(flows).map(({ flow }) => customFlowRoleName(flow.flowTag))
     ])
   ];
   const webSocketRoles = new Set();
@@ -403,9 +398,9 @@ function createResourceState({ objects, relationships, flows }) {
       const outputTopicStr =
         typeof flow.outputTopic === 'string' ? flow.outputTopic : null;
       const topicName = outputTopicStr
-        ? (outputTopicStr.startsWith('Out')
+        ? outputTopicStr.startsWith('Out')
           ? outputTopicStr
-          : `Out${upperFirst(outputTopicStr)}`)
+          : `Out${upperFirst(outputTopicStr)}`
         : flow.s3Subscription?.topicName || 'OutCreate';
       const queueName =
         flow.s3Subscription?.queueName || `${tag}ReservedLimitHdrSqs`;
@@ -417,12 +412,12 @@ function createResourceState({ objects, relationships, flows }) {
   const systemTables = [...SYSTEM_TABLES];
   if (rbac) {
     systemTables.push(
+      'Roles',
       'TargetRoles',
       'RolePermissions',
       'RoleUsers',
       'UserRoles',
       'RbacPermissionCaches',
-      'RoleLimit',
       'RunningTotalUsage',
       'RunningTotalReservedUsage'
     );
@@ -558,9 +553,7 @@ async function renderResourceGroup({
   if (!hasResources) return '';
 
   const chunks = await Promise.all([
-    ...ownTopics.map((queueName) =>
-      render('ResourceYaml.ejs', { queueName })
-    ),
+    ...ownTopics.map((queueName) => render('ResourceYaml.ejs', { queueName })),
     ...sqsQueues.map((queueName) =>
       render('ResourceSqsYaml.ejs', { queueName })
     ),
@@ -574,13 +567,12 @@ async function renderResourceGroup({
     )
   );
   const s3Subs = await Promise.all(
-    s3Subscriptions.map(
-      ({ subscriptionName, topicName, queueName }) =>
-        render('S3Subscription_Yaml.ejs', {
-          subscriptionName,
-          topicName,
-          queueName
-        })
+    s3Subscriptions.map(({ subscriptionName, topicName, queueName }) =>
+      render('S3Subscription_Yaml.ejs', {
+        subscriptionName,
+        topicName,
+        queueName
+      })
     )
   );
   const parts = [chunks.join('\n')];
@@ -634,7 +626,9 @@ async function renderSystemInSqs(state) {
 async function renderOut(state) {
   const body = (
     await Promise.all(
-      state.outTopics.map((topicName) => render('FlowOut_Yaml.ejs', { topicName }))
+      state.outTopics.map((topicName) =>
+        render('FlowOut_Yaml.ejs', { topicName })
+      )
     )
   ).join('\n');
   return `Resources:\n${indentYaml(body, 2)}`;
@@ -703,15 +697,11 @@ function roleStatements(state, roleName) {
   if (roleNeedsSchemaRead(state, roleName)) {
     statements.push({
       action: ['s3:GetObject'],
-      resource: [
-        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/*'
-      ]
+      resource: ['arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/*']
     });
     statements.push({
       action: ['s3:ListBucket'],
-      resource: [
-        'arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}'
-      ]
+      resource: ['arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}']
     });
   }
   addStatement(statements, dynamoActionsForRole(roleName), [
@@ -736,6 +726,14 @@ function roleStatements(state, roleName) {
       ...roleExternalTopicArns(state, roleName)
     ]
   );
+  addStatement(
+    statements,
+    ['lambda:InvokeFunction'],
+    [
+      ...roleExternalLambdaArns(state, roleName),
+      ...roleHookLambdaArns(state, roleName)
+    ]
+  );
   if (state.webSocketRoles.has(roleName)) {
     statements.push({
       action: ['execute-api:ManageConnections'],
@@ -771,11 +769,11 @@ function roleTableNames(state, roleName) {
       'WebSocketTask',
       ...(state.rbac
         ? [
+            'Roles',
             'TargetRoles',
             'RolePermissions',
             'RoleUsers',
             'UserRoles',
-            'RoleLimit',
             'RunningTotalUsage',
             'RunningTotalReservedUsage'
           ]
@@ -805,7 +803,8 @@ function roleTableNames(state, roleName) {
   const tables = [];
   if (includesEvent(flow, 'ownTopic') || includesEvent(flow, 's3'))
     tables.push('WebSocketTask');
-  if (includesEvent(flow, 's3')) tables.push('UserUploadRecords', 'ReservedDataMain');
+  if (includesEvent(flow, 's3'))
+    tables.push('UserUploadRecords', 'ReservedDataMain');
   if (flow.statusType === 'storedCache') {
     const object = state.objectTablesByType.get(flow.objType?.objectType);
     if (object) tables.push(object);
@@ -815,7 +814,12 @@ function roleTableNames(state, roleName) {
 
 function dynamoActionsForRole(roleName) {
   if (roleName === 'ProcFindDataRole')
-    return ['dynamodb:GetItem', 'dynamodb:Query', 'dynamodb:UpdateItem'];
+    return [
+      'dynamodb:GetItem',
+      'dynamodb:PutItem',
+      'dynamodb:Query',
+      'dynamodb:UpdateItem'
+    ];
   if (roleName === 'WebSocketMainRole')
     return ['dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:Query'];
   if (roleName === 'FlowRbacRole' || roleName === 'FlowObjectsRole')
@@ -845,12 +849,10 @@ function roleQueueNames(state, roleName) {
       if (!plan.outputTopic) return [];
       return [
         `${action}HdrSqs`,
-        ...(plan.hasCreateNodeCallback
-          ? [`${action}NodeCallbackHdrSqs`]
-          : []),
-        ...(plan.hasRbacCallback
-          ? [`${action}RbacCallbackHdrSqs`]
-          : []),
+        ...(plan.hasCreateNodeCallback ? [`${action}NodeCallbackHdrSqs`] : []),
+        ...(plan.hasBeforeHookCallback ? [`${action}BeforeHookCallbackHdrSqs`] : []),
+        ...(plan.hasAfterHookCallback ? [`${action}AfterHookCallbackHdrSqs`] : []),
+        ...(plan.hasRbacCallback ? [`${action}RbacCallbackHdrSqs`] : []),
         ...(plan.hasComplete ? [`${action}CompleteHdrSqs`] : [])
       ];
     });
@@ -921,9 +923,13 @@ function roleDlqQueueNames(state, roleName) {
 
 function roleTopicNames(state, roleName) {
   if (roleName === 'ProcFindDataRole')
-    return state.outTopics.filter((topic) => topic === 'FindData').map((t) => `${t}_Out`);
+    return state.outTopics
+      .filter((topic) => topic === 'FindData')
+      .map((t) => `${t}_Out`);
   if (roleName === 'FlowObjectsRole') {
-    const actions = state.outTopics.filter((topic) => CRUD_ACTIONS.includes(topic));
+    const actions = state.outTopics.filter((topic) =>
+      CRUD_ACTIONS.includes(topic)
+    );
     const topics = [];
     for (const action of actions) {
       if (action === 'Get') {
@@ -935,10 +941,29 @@ function roleTopicNames(state, roleName) {
     if (state.rbac) {
       topics.push('ValidatorRbac_In');
     }
+    for (const action of ['Create', 'Update', 'Delete']) {
+      const plan = state.crudActionPlans?.[action];
+      if (plan?.hasBeforeHookAsync) {
+        for (const hook of plan.beforeHooks) {
+          if (hook?.generatedCodeConfig?.invocationType === 'ownTopic') {
+            topics.push(`${upperFirst(hook.flowTag)}_In`);
+          }
+        }
+      }
+      if (plan?.hasAfterHookAsync) {
+        for (const hook of plan.afterHooks) {
+          if (hook?.generatedCodeConfig?.invocationType === 'ownTopic') {
+            topics.push(`${upperFirst(hook.flowTag)}_In`);
+          }
+        }
+      }
+    }
     return topics;
   }
   if (roleName === 'FlowRelationshipRole') {
-    const actions = state.outTopics.filter((topic) => RELATIONSHIP_ACTIONS.includes(topic));
+    const actions = state.outTopics.filter((topic) =>
+      RELATIONSHIP_ACTIONS.includes(topic)
+    );
     const topics = [];
     for (const action of actions) {
       if (action === 'GetRelationship') {
@@ -953,7 +978,9 @@ function roleTopicNames(state, roleName) {
     return topics;
   }
   if (roleName === 'FlowRbacRole') {
-    const actions = state.outTopics.filter((topic) => RBAC_ACTIONS.includes(topic));
+    const actions = state.outTopics.filter((topic) =>
+      RBAC_ACTIONS.includes(topic)
+    );
     const topics = [];
     for (const action of actions) {
       if (action.startsWith('List')) {
@@ -1064,6 +1091,61 @@ function roleExternalTopicArns(state, roleName) {
   return [];
 }
 
+function roleExternalLambdaArns(state, roleName) {
+  if (!state.rbac) {
+    return [];
+  }
+  const extraTags = getRbacValidatorServiceTags(state).filter(
+    (tag) => tag && tag !== 'Rbac'
+  );
+  const extraLambdas = extraTags.map(
+    (tag) =>
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ValidatorRbacHdrInv`
+  );
+  if (
+    roleName === 'FlowObjectsRole' ||
+    roleName === 'FlowRbacRole' ||
+    roleName === 'FlowRelationshipRole'
+  ) {
+    return [
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
+      ...extraLambdas
+    ];
+  }
+  return [];
+}
+
+function roleHookLambdaArns(state, roleName) {
+  if (roleName !== 'FlowObjectsRole') {
+    return [];
+  }
+  const hookLambdas = [];
+  for (const action of ['Create', 'Update', 'Delete']) {
+    const plan = state.crudActionPlans?.[action];
+    if (plan?.hasBeforeHookSync) {
+      for (const hook of plan.beforeHooks) {
+        if (hook?.generatedCodeConfig?.invocationType === 'lambdaSyncInv') {
+          const hookTag = upperFirst(hook.flowTag);
+          hookLambdas.push(
+            `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:\${self:custom.iz_resourcePrefix}${hookTag}*`
+          );
+        }
+      }
+    }
+    if (plan?.hasAfterHookSync) {
+      for (const hook of plan.afterHooks) {
+        if (hook?.generatedCodeConfig?.invocationType === 'lambdaSyncInv') {
+          const hookTag = upperFirst(hook.flowTag);
+          hookLambdas.push(
+            `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:\${self:custom.iz_resourcePrefix}${hookTag}*`
+          );
+        }
+      }
+    }
+  }
+  return [...new Set(hookLambdas)];
+}
+
 function queueArns(queueNames) {
   return [...new Set(queueNames)]
     .sort()
@@ -1095,8 +1177,7 @@ function collectTables(schemas) {
       : [];
     const pkIdentifier = identifiers.find(
       (identifier) =>
-        identifier.type === 'partitionKey' ||
-        identifier.type === 'identifier'
+        identifier.type === 'partitionKey' || identifier.type === 'identifier'
     );
     const skIdentifier = identifiers.find(
       (identifier) => identifier.type === 'sortKey'
@@ -1211,9 +1292,7 @@ function hasRbacAddOn(object) {
  */
 function rbacFlowQueueNames(state) {
   const flowTags = [
-    ...new Set(
-      (state.objects ?? []).filter(hasRbacAddOn).map(rbacFlowTag)
-    )
+    ...new Set((state.objects ?? []).filter(hasRbacAddOn).map(rbacFlowTag))
   ];
   return flowTags.map((flowTag) => `${flowTag}HdrSqs`);
 }

package/src/emit/resource/templates/SystemDynamoDB_Yaml.ejs

@@ -138,6 +138,18 @@ Resources:
           KeyType: RANGE
 
   <% if (hasRbac) { %>
+  RolesTable:
+    Type: 'AWS::DynamoDB::Table'
+    Properties:
+      TableName: ${self:custom.iz_resourcePrefix}Roles
+      BillingMode: PAY_PER_REQUEST
+      AttributeDefinitions:
+        - AttributeName: roleIdKey
+          AttributeType: S
+      KeySchema:
+        - AttributeName: roleIdKey
+          KeyType: HASH
+
   TargetRolesTable:
     Type: 'AWS::DynamoDB::Table'
     Properties:
@@ -221,22 +233,6 @@ Resources:
         AttributeName: ttlTimestamp
         Enabled: true
 
-  RoleLimitTable:
-    Type: 'AWS::DynamoDB::Table'
-    Properties:
-      TableName: ${self:custom.iz_resourcePrefix}RoleLimit
-      BillingMode: PAY_PER_REQUEST
-      AttributeDefinitions:
-        - AttributeName: roleLimitId
-          AttributeType: S
-        - AttributeName: limitType
-          AttributeType: S
-      KeySchema:
-        - AttributeName: roleLimitId
-          KeyType: HASH
-        - AttributeName: limitType
-          KeyType: RANGE
-
   RunningTotalUsageTable:
     Type: 'AWS::DynamoDB::Table'
     Properties:
@@ -245,12 +241,12 @@ Resources:
       AttributeDefinitions:
         - AttributeName: identifiersConcat
           AttributeType: S
-        - AttributeName: limitTag
+        - AttributeName: flowTypeConcat
           AttributeType: S
       KeySchema:
         - AttributeName: identifiersConcat
           KeyType: HASH
-        - AttributeName: limitTag
+        - AttributeName: flowTypeConcat
           KeyType: RANGE
 
   RunningTotalReservedUsageTable:

package/src/emit/system/templates/WebSocketComplete_Yaml.ejs

@@ -16,6 +16,8 @@ WebSocketCompleteHdrSqs:
           - body:
               MessageAttributes:
                 callingFlow:
-                  Value:
-                    - exists: false
+                  - exists: false
+          - body:
+              MessageAttributes:
+                - exists: false
         #<#/WebSocketCompleteHdrSqsFilterPatterns#>

package/test/createTargetRoleHandler.test.js

@@ -15,16 +15,12 @@ const OWN_TOPIC_FLOWS = [
   'DeleteTargetRole',
   'CreateUserRole',
   'DeleteUserFromRole',
-  'CreateRoleLimit',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
 ];
 
 const LIMIT_FLOWS = [
-  'CreateRoleLimit',
-  'DeleteRoleLimit',
   'ReservedDynamicUsage',
   'ConfirmUsage',
   'CancelUsage'
@@ -40,7 +36,7 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
   const rootPath = await createProject(true);
   const result = await generateCreateTargetRoleHandler(rootPath);
 
-  assert.equal(result.files.length, 70);
+  assert.equal(result.files.length, 59);
   assert.match(
     await readFile(join(rootPath, result.files[0].path), 'utf8'),
     /CreateTargetRole/
@@ -130,16 +126,6 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     ),
     /Math\.min\(maxIncrease, minDecrease\)/
   );
-  assert.match(
-    await readFile(
-      join(
-        rootPath,
-        'app/src/generatedCode/FlowLimit/CreateRoleLimit/source/CreateRoleLimit_Main.js'
-      ),
-      'utf8'
-    ),
-    /actionType/
-  );
   const rbacYaml = await readFile(
     join(rootPath, 'app/sls_yaml/generatedCode/source/flow-rbac.yml'),
     'utf8'