@izara_project/izara-core-generate-service-code 1.0.88 → 1.0.90

package/src/emit/rbac/templates/UserRbacFlow_Main.ejs

@@ -172,7 +172,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     _setL1Cache(fullCacheKey, result);
     await _setL2Cache(_izContext, submittedByUserId, cacheSubKey, result);
     await _publicMessageOut(_izContext, { ...result, parentFlowId });
-    return 'Completed';
+    return result;
   }
 
   // 1. Check L1 In-Memory Cache
@@ -180,7 +180,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   if (l1Hit) {
     _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:`, l1Hit);
     await _publicMessageOut(_izContext, { ...l1Hit, parentFlowId });
-    return;
+    return l1Hit;
   }
 
   // 2. Check L2 Shared DynamoDB Cache
@@ -189,7 +189,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:`, l2Hit);
     _setL1Cache(fullCacheKey, l2Hit);
     await _publicMessageOut(_izContext, { ...l2Hit, parentFlowId });
-    return;
+    return l2Hit;
   }
 
   _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB`);
@@ -237,7 +237,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     _setL1Cache(fullCacheKey, result);
     await _setL2Cache(_izContext, submittedByUserId, cacheSubKey, result);
     await _publicMessageOut(_izContext, { ...result, parentFlowId });
-    return;
+    return result;
   }
 
   const rolePermissionsTable = dynamodbSharedLib.tableName(
@@ -289,19 +289,26 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
 
   await _publicMessageOut(_izContext, { ...cacheResult, parentFlowId });
 
-  return 'Completed';
+  return cacheResult;
 }
 
 async function _publicMessageOut(_izContext, message) {
-  const topicOut = snsSharedLib.snsTopicArnByFlowSchema(
-    _izContext,
-    process.env.iz_flowTag + '_Out'
-  );
+  try {
+    const topicOut = snsSharedLib.snsTopicArnByFlowSchema(
+      _izContext,
+      process.env.iz_flowTag + '_Out'
+    );
 
-  await sns.publishAsync(_izContext, {
-    TopicArn: topicOut,
-    Message: JSON.stringify(message)
-  });
+    await sns.publishAsync(_izContext, {
+      TopicArn: topicOut,
+      Message: JSON.stringify(message)
+    });
+  } catch (error) {
+    _izContext.logger.warn(
+      `[${process.env.iz_serviceTag}:_publicMessageOut] Failed to publish message out:`,
+      error
+    );
+  }
 }
 
 function _matchesParameterGroups(groups, input) {

package/src/emit/resource/emitResourceArtifacts.js

@@ -204,7 +204,7 @@ export const resourceArtifactPaths = [
 function createResourceState({ objects, relationships, flows }) {
   const crud = objects.some(isCrudObject);
   const selfRbac = objects.some(hasSelfRbacAddOn);
-  const rbac = objects.some(hasSelfRbacAddOn);
+  const rbac = objects.some((obj) => hasRbacAddOn(obj, objects));
   const crudActionPlans = createCrudActionPlans(objects, flows);
 
   const crudOwnTopics = crud ? [...CRUD_ACTIONS] : [];
@@ -244,9 +244,9 @@ function createResourceState({ objects, relationships, flows }) {
       rbacSqsQueues.push(`Process${action}HdrSqs`);
     }
   }
-  if (rbac) {
+  if (selfRbac) {
     const flowTags = [
-      ...new Set(objects.filter(hasRbacAddOn).map(rbacFlowTag))
+      ...new Set(objects.filter(hasSelfRbacAddOn).map(rbacFlowTag))
     ];
     for (const flowTag of flowTags) {
       rbacOwnTopics.push(flowTag);
@@ -433,6 +433,7 @@ function createResourceState({ objects, relationships, flows }) {
   return {
     crud,
     rbac,
+    selfRbac,
     crudActionPlans,
     crudOwnTopics: [...new Set(crudOwnTopics)].filter(Boolean).sort(),
     crudSqsQueues: [...new Set(crudSqsQueues)].filter(Boolean).sort(),
@@ -638,7 +639,7 @@ async function renderDynamo(state) {
   const [system, ...tables] = await Promise.all([
     render('SystemDynamoDB_Yaml.ejs', {
       hasS3: state.s3FlowTags.length > 0,
-      hasRbac: state.rbac
+      hasRbac: state.selfRbac
     }),
     ...state.tables.map((table) => render('DynamoDBTable_Yaml.ejs', table))
   ]);
@@ -650,7 +651,7 @@ async function renderIam(state) {
   const roles = ['ProcFindDataRole', 'RegisterRole'];
   if (state.crud) roles.push('FlowObjectsRole');
   if (state.relationships) roles.push('FlowRelationshipRole');
-  if (state.rbac) roles.push('FlowRbacRole');
+  if (state.selfRbac) roles.push('FlowRbacRole');
   if (state.websocket) roles.push('WebSocketMainRole');
   roles.push(...state.customRoles);
   const sortedRoles = roles.sort();
@@ -668,8 +669,21 @@ async function renderIam(state) {
 function getRbacValidatorServiceTags(state) {
   const tags = new Set();
   for (const obj of state.objects || []) {
-    if (obj.belongTo?.serviceTag && obj.belongTo.serviceTag !== 'Rbac') {
-      tags.add(obj.belongTo.serviceTag);
+    const targets = obj?.belongTo
+      ? Array.isArray(obj.belongTo)
+        ? obj.belongTo
+        : [obj.belongTo]
+      : [];
+    for (const target of targets) {
+      if (target?.serviceTag && target.serviceTag !== 'Rbac') {
+        tags.add(target.serviceTag);
+      }
+    }
+    if (
+      obj.belongToSchema?.serviceTag &&
+      obj.belongToSchema.serviceTag !== 'Rbac'
+    ) {
+      tags.add(obj.belongToSchema.serviceTag);
     }
   }
   return Array.from(tags).sort();
@@ -751,7 +765,7 @@ function addStatement(statements, action, resource) {
 
 function roleNeedsSchemaRead(state, roleName) {
   if (!roleName.endsWith('Role') || !roleName) return false;
-  return roleName !== 'FlowRbacRole' || state.rbac;
+  return roleName !== 'FlowRbacRole' || state.selfRbac;
 }
 
 function roleTableNames(state, roleName) {
@@ -767,7 +781,7 @@ function roleTableNames(state, roleName) {
       'AwaitingMultipleSteps',
       'AwaitingMultipleStepByPending',
       'WebSocketTask',
-      ...(state.rbac
+      ...(state.selfRbac
         ? [
             'Roles',
             'TargetRoles',
@@ -958,7 +972,7 @@ function roleTopicNames(state, roleName) {
         }
       }
     }
-    return topics;
+    return [...new Set(topics)];
   }
   if (roleName === 'FlowRelationshipRole') {
     const actions = state.outTopics.filter((topic) =>
@@ -1102,8 +1116,15 @@ function roleExternalLambdaArns(state, roleName) {
     (tag) =>
       `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ValidatorRbacHdrInv`
   );
+  if (roleName === 'FlowObjectsRole') {
+    return [
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ConfirmUsageHdrInv`,
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}CancelUsageHdrInv`,
+      ...extraLambdas
+    ];
+  }
   if (
-    roleName === 'FlowObjectsRole' ||
     roleName === 'FlowRbacRole' ||
     roleName === 'FlowRelationshipRole'
   ) {
@@ -1281,8 +1302,28 @@ function hasSelfRbacAddOn(object) {
   );
 }
 
-function hasRbacAddOn(object) {
-  return hasSelfRbacAddOn(object);
+function hasRbacAddOn(object, objects = []) {
+  const selfHasRbac = hasSelfRbacAddOn(object);
+  const belongToTargets = object?.belongTo
+    ? Array.isArray(object.belongTo)
+      ? object.belongTo
+      : [object.belongTo]
+    : [];
+  const belongToHasRbac =
+    (Array.isArray(object?.belongToSchema?.addOnDataStructure) &&
+      object.belongToSchema.addOnDataStructure.some(
+        (addOn) => addOn?.type === 'rbac'
+      )) ||
+    belongToTargets.some((target) => {
+      if (target?.serviceTag === 'UserAccount') return true;
+      const matched = objects.find(
+        (candidate) =>
+          candidate?.serviceTag === target?.serviceTag &&
+          candidate?.objectType === target?.objectType
+      );
+      return hasSelfRbacAddOn(matched);
+    });
+  return selfHasRbac || belongToHasRbac;
 }
 
 /**
@@ -1292,7 +1333,7 @@ function hasRbacAddOn(object) {
  */
 function rbacFlowQueueNames(state) {
   const flowTags = [
-    ...new Set((state.objects ?? []).filter(hasRbacAddOn).map(rbacFlowTag))
+    ...new Set((state.objects ?? []).filter(hasSelfRbacAddOn).map(rbacFlowTag))
   ];
   return flowTags.map((flowTag) => `${flowTag}HdrSqs`);
 }

package/test/createTargetRoleHandler.test.js

@@ -106,16 +106,19 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     ),
     /ListTargetRole/
   );
-  assert.match(
-    await readFile(
-      join(
-        rootPath,
-        'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js'
-      ),
-      'utf8'
+  const validatorRbac = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js'
     ),
-    /Fast-path triggered: user self-action/
+    'utf8'
   );
+  assert.match(validatorRbac, /Fast-path triggered: user self-action/);
+  assert.match(validatorRbac, /return l1Hit;/);
+  assert.match(validatorRbac, /return l2Hit;/);
+  assert.match(validatorRbac, /return cacheResult;/);
+  assert.doesNotMatch(validatorRbac, /L1 Cache hit:[^;]+;\s*return;/);
+  assert.doesNotMatch(validatorRbac, /L2 Cache hit:[^;]+;\s*return;/);
   assert.match(
     await readFile(
       join(