@izara_project/izara-core-generate-service-code 1.0.89 → 1.0.90

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@izara_project/izara-core-generate-service-code",
-  "version": "1.0.89",
+  "version": "1.0.90",
   "description": "Code for locally generating per service files",
   "homepage": "https://bitbucket.org/izara-core-support-services/izara-core-support-services-generate-service-code#readme",
   "repository": {

package/src/emit/crud/templates/CreateComplete_Main.ejs

@@ -1,8 +1,12 @@
 import asyncFlowSharedLib from '@izara_project/izara-core-library-asynchronous-flow';
 import callingFlowSharedLib from '@izara_project/izara-core-library-calling-flow';
 import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import lambdaSharedLib from '@izara_project/izara-core-library-lambda';
 import snsSharedLib from '@izara_project/izara-core-library-sns';
-import { sns } from '@izara_project/izara-core-library-external-request';
+import {
+  sns,
+  lambda
+} from '@izara_project/izara-core-library-external-request';
 import { consts } from '@izara_project/izara-core-library-service-schemas';
 import { NoRetryError } from '@izara_project/izara-core-library-core';
 
@@ -142,18 +146,138 @@ export default async function CreateComplete(
       const callingFlowConfig =
         result?.additionalAttributes?.callingFlowConfig ||
         passBackProperties;
+      const actionData = {
+        objType: returnValue.requestParams.objType,
+        objInstanceFull: node.objInstanceFull,
+        relationships: node.relationships,
+        parentFlowId: parentFlowId || returnValue?.parentFlowId,
+        existsNode,
+        status,
+        errorsFound
+      };
+
+      <%_ if (plan?.hasAfterHookSync) { _%>
+      // ── Synchronous After Hooks ──
+      <%_ plan.afterHooks.filter(h => h?.generatedCodeConfig?.invocationType === 'lambdaSyncInv').forEach(hook => { _%>
+      <%_ if (hook.targetObjectTypes && hook.targetObjectTypes.length === 1) { _%>
+      if (returnValue.requestParams?.objType?.objectType === '<%= hook.targetObjectTypes[0] %>') {
+      <%_ } else if (hook.targetObjectTypes && hook.targetObjectTypes.length > 1) { _%>
+      if (<%- JSON.stringify(hook.targetObjectTypes) %>.includes(returnValue.requestParams?.objType?.objectType)) {
+      <%_ } _%>
+      try {
+        let hookPayload_<%= hook.flowTag %> = {
+          objType: returnValue.requestParams.objType,
+          objInstanceFull: node.objInstanceFull,
+          relationships: node.relationships || [],
+          targetIdentifiers: requestParams.targetIdentifiers,
+          submittedByUserId: returnValue?.requestParams?.submittedByUserId || requestParams?.submittedByUserId
+        };
+        //(<beforeSendHook_<%= hook.flowTag %>>)
+        //(</beforeSendHook_<%= hook.flowTag %>>)
+        const hookResult = await lambda.invokeSync(
+          _izContext,
+          await lambdaSharedLib.lambdaFunctionName(
+            _izContext,
+            '<%= hook.flowTag %>'
+          ),
+          {
+            requestParams: hookPayload_<%= hook.flowTag %>,
+            callingFlowConfig
+          }
+        );
+        if (hookResult?.errorsFound?.length > 0 || hookResult?.status === 'error') {
+          errorsFound.push(...(hookResult.errorsFound || ['Hook <%= hook.flowTag %> failed']));
+        }
+      } catch (hookErr) {
+        _izContext.logger.error('[CreateComplete] Sync hook <%= hook.flowTag %> error:', hookErr);
+        errorsFound.push(hookErr.message || 'Hook <%= hook.flowTag %> failed');
+      }
+      <%_ if (hook.targetObjectTypes && hook.targetObjectTypes.length > 0) { _%>
+      }
+      <%_ } _%>
+      <%_ }) _%>
+      <%_ } _%>
+
+      <%_ if (plan?.hasAfterHookAsync) { _%>
+      // ── Asynchronous After Hooks ──
+      let afterHookDispatched = false;
+      <%_ plan.afterHooks.filter(h => h?.generatedCodeConfig?.invocationType === 'ownTopic').forEach(hook => { _%>
+      <%_ if (hook.targetObjectTypes && hook.targetObjectTypes.length === 1) { _%>
+      if (returnValue.requestParams?.objType?.objectType === '<%= hook.targetObjectTypes[0] %>') {
+      <%_ } else if (hook.targetObjectTypes && hook.targetObjectTypes.length > 1) { _%>
+      if (<%- JSON.stringify(hook.targetObjectTypes) %>.includes(returnValue.requestParams?.objType?.objectType)) {
+      <%_ } _%>
+        afterHookDispatched = true;
+        let hookPayload_<%= hook.flowTag %> = {
+          objType: returnValue.requestParams.objType,
+          objInstanceFull: node.objInstanceFull,
+          relationships: node.relationships || [],
+          targetIdentifiers: requestParams.targetIdentifiers,
+          submittedByUserId: returnValue?.requestParams?.submittedByUserId || requestParams?.submittedByUserId
+        };
+        //(<beforeSendHook_<%= hook.flowTag %>>)
+        //(</beforeSendHook_<%= hook.flowTag %>>)
+        const hookMsg_<%= hook.flowTag %> = callingFlowSharedLib.addCallingFlowToSnsRequestMessageObject(
+          hookPayload_<%= hook.flowTag %>,
+          callingFlowSharedLib.addParentCallingFlowConfig(
+            callingFlowConfig,
+            callingFlowSharedLib.createCallingFlowConfig(
+              await lambdaSharedLib.lambdaFunctionName(
+                _izContext,
+                'CreateAfterHookCallbackHdrSqs'
+              ),
+              {
+                actionData
+              }
+            )
+          )
+        );
+
+        await sns.publishAsync(_izContext, {
+          TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+            _izContext,
+            '<%= hook.flowTag %>_In'
+          ),
+          Message: JSON.stringify(hookMsg_<%= hook.flowTag %>),
+          MessageAttributes: sns.createStringMessageAttributes(_izContext, {})
+        });
+      <%_ if (hook.targetObjectTypes && hook.targetObjectTypes.length > 0) { _%>
+      }
+      <%_ } _%>
+      <%_ }) _%>
+      if (!afterHookDispatched) {
+        const message =
+          callingFlowSharedLib.addParentPassBackPropertiesToSnsResponseMessageObject(
+            callingFlowConfig,
+            actionData
+          );
+        const messageAttributes =
+          callingFlowSharedLib.addParentPassBackCallingFlowToSnsResponseMessageAttributes(
+            callingFlowConfig,
+            {}
+          );
+        const topicArn = snsSharedLib.snsTopicArnByFlowSchema(
+          _izContext,
+          TOPIC_NAME_GENERATE_CODE.outCreateNodeComplete
+        );
+        _izContext.logger.debug('[CreateComplete] publishing to SNS', {
+          TopicArn: topicArn,
+          message
+        });
+        await sns.publishAsync(_izContext, {
+          Message: JSON.stringify(message),
+          MessageAttributes: sns.createStringMessageAttributes(
+            _izContext,
+            messageAttributes
+          ),
+          TopicArn: topicArn
+        });
+      }
+      <%_ } else { _%>
       const message =
         callingFlowSharedLib.addParentPassBackPropertiesToSnsResponseMessageObject(
           callingFlowConfig,
-          {
-            objType: returnValue.requestParams.objType,
-            objInstanceFull: node.objInstanceFull,
-            relationships: node.relationships,
-            parentFlowId: parentFlowId || returnValue?.parentFlowId,
-            existsNode,
-            status,
-            errorsFound
-          }
+          actionData
         );
       const messageAttributes =
         callingFlowSharedLib.addParentPassBackCallingFlowToSnsResponseMessageAttributes(
@@ -176,6 +300,7 @@ export default async function CreateComplete(
         ),
         TopicArn: topicArn
       });
+      <%_ } _%>
       //(<afterSendMessage>)
       //(</afterSendMessage>)
     }

package/src/emit/crud/templates/CreateLogicalLib.ejs

@@ -89,7 +89,11 @@ export async function resolveSchemaAndIdentity(_izContext, requestParams, errors
 
     targetIdentifiers = requestParams.targetIdentifiers;
 
-    if (!targetIdentifiers && submittedByUserId) {
+    if (
+      !targetIdentifiers &&
+      objectSchema.belongTo?.objectType === 'user' &&
+      submittedByUserId
+    ) {
       targetIdentifiers = { submittedByUserId };
     }
 
@@ -98,10 +102,6 @@ export async function resolveSchemaAndIdentity(_izContext, requestParams, errors
       errorsFound.push('not have targetIdentifiers');
 
     if (targetIdentifiers) {
-      if (!targetIdentifiers.submittedByUserId && submittedByUserId) {
-        targetIdentifiers.submittedByUserId = submittedByUserId;
-      }
-
       // if (Array.isArray(objectSchema.identifiers)) {
       //   for (const identifier of objectSchema.identifiers) {
       //     if (identifier.fieldName) {
@@ -126,7 +126,7 @@ export async function resolveSchemaAndIdentity(_izContext, requestParams, errors
     }
 
     if (requestParams.rbacTargetIdentifiers === undefined && targetIdentifiers) {
-      requestParams.rbacTargetIdentifiers = targetIdentifiers;
+      requestParams.rbacTargetIdentifiers = { ...targetIdentifiers };
     }
 
     _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Identity & Target Context Resolved:`, {
@@ -487,14 +487,43 @@ export async function saveDynamoDbRecords(_izContext, listOfRecords) {
   );
 }
 
+<%_
+const rootRbacObjects = (objects || []).filter(obj => {
+  const hasSelfRbac = Array.isArray(obj?.addOnDataStructure) && obj.addOnDataStructure.some(addOn => addOn?.type === 'rbac');
+  return hasSelfRbac && !obj?.belongTo && obj?.objectType !== 'user' && obj?.generatedBy !== 'systemNoUser';
+});
+_%>
+const ROOT_RBAC_OBJECT_TYPES = new Set([
+<%_ for (const obj of rootRbacObjects) { _%>
+  '<%- obj.objectType %>',
+<%_ } _%>
+]);
+
 /**
  * Auto-provisions owner TargetRole for Root RBAC object after Graph and DynamoDB write
  * @param {Object} _izContext - Izara context object
  * @param {Object} options - Target node and submitter details
  * @returns {Promise<void>}
  */
-export async function autoProvisionOwnerTargetRole(_izContext, { node, submittedByUserId }) {
+export async function autoProvisionOwnerTargetRole(_izContext, { node, submittedByUserId, objType }) {
   try {
+    let objectType = null;
+    if (typeof objType === 'string') {
+      objectType = objType;
+    } else if (objType && objType.objectType) {
+      objectType = objType.objectType;
+    } else if (typeof node?.objType === 'string') {
+      objectType = node.objType;
+    } else if (node?.objType?.objectType) {
+      objectType = node.objType.objectType;
+    } else if (node?.objectType) {
+      objectType = node.objectType;
+    }
+
+    if (!objectType || !ROOT_RBAC_OBJECT_TYPES.has(objectType)) {
+      return;
+    }
+
     if (!submittedByUserId || !node?.objInstanceFull?.identifiers) {
       return;
     }

package/src/emit/crud/templates/CreateNodeCallback_Main.ejs

@@ -167,10 +167,17 @@ export default async function CreateNodeCallbackMain(
           _izContext.correlationIds?.get(coreConsts.SUBMITTED_BY_USER_ID) ||
           _izContext.correlationIds?.get('submittedByUserId');
 
+        <%_ const rootRbacObjs = (objects || []).filter(obj => {
+          const hasSelfRbac = Array.isArray(obj?.addOnDataStructure) && obj.addOnDataStructure.some(addOn => addOn?.type === 'rbac');
+          return hasSelfRbac && !obj?.belongTo && obj?.objectType !== 'user' && obj?.generatedBy !== 'systemNoUser';
+        }); _%>
+        <%_ if (rootRbacObjs.length > 0) { _%>
         await autoProvisionOwnerTargetRole(_izContext, {
           node,
-          submittedByUserId
+          submittedByUserId,
+          objType: returnValue?.requestParams?.objType
         });
+        <%_ } _%>
 
         <%_ if (plan?.hasAfterHookSync) { _%>
         // ── Synchronous After Hooks ──

package/src/emit/crud/templates/DeleteLogicalLib.ejs

@@ -100,9 +100,7 @@ export async function resolveSchemaAndIdentity(
 
     requestParams.submittedByUserId = submittedByUserId;
     if (targetIdentifiers) {
-      if (!targetIdentifiers.submittedByUserId && submittedByUserId) {
-        targetIdentifiers.submittedByUserId = submittedByUserId;
-      }
+      requestParams.targetIdentifiers = targetIdentifiers;
     }
 
     _izContext.logger.debug(

package/src/emit/crud/templates/UpdateLogicalLib.ejs

@@ -105,9 +105,6 @@ export async function resolveSchemaAndIdentity(_izContext, requestParams, errors
 
     requestParams.submittedByUserId = submittedByUserId;
     if (targetIdentifiers) {
-      if (!targetIdentifiers.submittedByUserId && submittedByUserId) {
-        targetIdentifiers.submittedByUserId = submittedByUserId;
-      }
       // requestParams.targetIdentifiers = targetIdentifiers;
     }
 

package/src/emit/rbac/templates/UserRbacFlow_Main.ejs

@@ -172,7 +172,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     _setL1Cache(fullCacheKey, result);
     await _setL2Cache(_izContext, submittedByUserId, cacheSubKey, result);
     await _publicMessageOut(_izContext, { ...result, parentFlowId });
-    return 'Completed';
+    return result;
   }
 
   // 1. Check L1 In-Memory Cache
@@ -180,7 +180,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
   if (l1Hit) {
     _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L1 Cache hit:`, l1Hit);
     await _publicMessageOut(_izContext, { ...l1Hit, parentFlowId });
-    return;
+    return l1Hit;
   }
 
   // 2. Check L2 Shared DynamoDB Cache
@@ -189,7 +189,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] L2 Cache hit:`, l2Hit);
     _setL1Cache(fullCacheKey, l2Hit);
     await _publicMessageOut(_izContext, { ...l2Hit, parentFlowId });
-    return;
+    return l2Hit;
   }
 
   _izContext.logger.debug(`[${process.env.iz_serviceTag}:<%- flowTag %>] Cache miss — querying DynamoDB`);
@@ -237,7 +237,7 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
     _setL1Cache(fullCacheKey, result);
     await _setL2Cache(_izContext, submittedByUserId, cacheSubKey, result);
     await _publicMessageOut(_izContext, { ...result, parentFlowId });
-    return;
+    return result;
   }
 
   const rolePermissionsTable = dynamodbSharedLib.tableName(
@@ -289,19 +289,26 @@ export default async function <%- flowTag %>(_izContext, requestParams = {}) {
 
   await _publicMessageOut(_izContext, { ...cacheResult, parentFlowId });
 
-  return 'Completed';
+  return cacheResult;
 }
 
 async function _publicMessageOut(_izContext, message) {
-  const topicOut = snsSharedLib.snsTopicArnByFlowSchema(
-    _izContext,
-    process.env.iz_flowTag + '_Out'
-  );
+  try {
+    const topicOut = snsSharedLib.snsTopicArnByFlowSchema(
+      _izContext,
+      process.env.iz_flowTag + '_Out'
+    );
 
-  await sns.publishAsync(_izContext, {
-    TopicArn: topicOut,
-    Message: JSON.stringify(message)
-  });
+    await sns.publishAsync(_izContext, {
+      TopicArn: topicOut,
+      Message: JSON.stringify(message)
+    });
+  } catch (error) {
+    _izContext.logger.warn(
+      `[${process.env.iz_serviceTag}:_publicMessageOut] Failed to publish message out:`,
+      error
+    );
+  }
 }
 
 function _matchesParameterGroups(groups, input) {

package/src/emit/resource/emitResourceArtifacts.js

@@ -204,7 +204,7 @@ export const resourceArtifactPaths = [
 function createResourceState({ objects, relationships, flows }) {
   const crud = objects.some(isCrudObject);
   const selfRbac = objects.some(hasSelfRbacAddOn);
-  const rbac = objects.some(hasSelfRbacAddOn);
+  const rbac = objects.some((obj) => hasRbacAddOn(obj, objects));
   const crudActionPlans = createCrudActionPlans(objects, flows);
 
   const crudOwnTopics = crud ? [...CRUD_ACTIONS] : [];
@@ -244,9 +244,9 @@ function createResourceState({ objects, relationships, flows }) {
       rbacSqsQueues.push(`Process${action}HdrSqs`);
     }
   }
-  if (rbac) {
+  if (selfRbac) {
     const flowTags = [
-      ...new Set(objects.filter(hasRbacAddOn).map(rbacFlowTag))
+      ...new Set(objects.filter(hasSelfRbacAddOn).map(rbacFlowTag))
     ];
     for (const flowTag of flowTags) {
       rbacOwnTopics.push(flowTag);
@@ -433,6 +433,7 @@ function createResourceState({ objects, relationships, flows }) {
   return {
     crud,
     rbac,
+    selfRbac,
     crudActionPlans,
     crudOwnTopics: [...new Set(crudOwnTopics)].filter(Boolean).sort(),
     crudSqsQueues: [...new Set(crudSqsQueues)].filter(Boolean).sort(),
@@ -638,7 +639,7 @@ async function renderDynamo(state) {
   const [system, ...tables] = await Promise.all([
     render('SystemDynamoDB_Yaml.ejs', {
       hasS3: state.s3FlowTags.length > 0,
-      hasRbac: state.rbac
+      hasRbac: state.selfRbac
     }),
     ...state.tables.map((table) => render('DynamoDBTable_Yaml.ejs', table))
   ]);
@@ -650,7 +651,7 @@ async function renderIam(state) {
   const roles = ['ProcFindDataRole', 'RegisterRole'];
   if (state.crud) roles.push('FlowObjectsRole');
   if (state.relationships) roles.push('FlowRelationshipRole');
-  if (state.rbac) roles.push('FlowRbacRole');
+  if (state.selfRbac) roles.push('FlowRbacRole');
   if (state.websocket) roles.push('WebSocketMainRole');
   roles.push(...state.customRoles);
   const sortedRoles = roles.sort();
@@ -668,8 +669,21 @@ async function renderIam(state) {
 function getRbacValidatorServiceTags(state) {
   const tags = new Set();
   for (const obj of state.objects || []) {
-    if (obj.belongTo?.serviceTag && obj.belongTo.serviceTag !== 'Rbac') {
-      tags.add(obj.belongTo.serviceTag);
+    const targets = obj?.belongTo
+      ? Array.isArray(obj.belongTo)
+        ? obj.belongTo
+        : [obj.belongTo]
+      : [];
+    for (const target of targets) {
+      if (target?.serviceTag && target.serviceTag !== 'Rbac') {
+        tags.add(target.serviceTag);
+      }
+    }
+    if (
+      obj.belongToSchema?.serviceTag &&
+      obj.belongToSchema.serviceTag !== 'Rbac'
+    ) {
+      tags.add(obj.belongToSchema.serviceTag);
     }
   }
   return Array.from(tags).sort();
@@ -751,7 +765,7 @@ function addStatement(statements, action, resource) {
 
 function roleNeedsSchemaRead(state, roleName) {
   if (!roleName.endsWith('Role') || !roleName) return false;
-  return roleName !== 'FlowRbacRole' || state.rbac;
+  return roleName !== 'FlowRbacRole' || state.selfRbac;
 }
 
 function roleTableNames(state, roleName) {
@@ -767,7 +781,7 @@ function roleTableNames(state, roleName) {
       'AwaitingMultipleSteps',
       'AwaitingMultipleStepByPending',
       'WebSocketTask',
-      ...(state.rbac
+      ...(state.selfRbac
         ? [
             'Roles',
             'TargetRoles',
@@ -1288,8 +1302,28 @@ function hasSelfRbacAddOn(object) {
   );
 }
 
-function hasRbacAddOn(object) {
-  return hasSelfRbacAddOn(object);
+function hasRbacAddOn(object, objects = []) {
+  const selfHasRbac = hasSelfRbacAddOn(object);
+  const belongToTargets = object?.belongTo
+    ? Array.isArray(object.belongTo)
+      ? object.belongTo
+      : [object.belongTo]
+    : [];
+  const belongToHasRbac =
+    (Array.isArray(object?.belongToSchema?.addOnDataStructure) &&
+      object.belongToSchema.addOnDataStructure.some(
+        (addOn) => addOn?.type === 'rbac'
+      )) ||
+    belongToTargets.some((target) => {
+      if (target?.serviceTag === 'UserAccount') return true;
+      const matched = objects.find(
+        (candidate) =>
+          candidate?.serviceTag === target?.serviceTag &&
+          candidate?.objectType === target?.objectType
+      );
+      return hasSelfRbacAddOn(matched);
+    });
+  return selfHasRbac || belongToHasRbac;
 }
 
 /**
@@ -1299,7 +1333,7 @@ function hasRbacAddOn(object) {
  */
 function rbacFlowQueueNames(state) {
   const flowTags = [
-    ...new Set((state.objects ?? []).filter(hasRbacAddOn).map(rbacFlowTag))
+    ...new Set((state.objects ?? []).filter(hasSelfRbacAddOn).map(rbacFlowTag))
   ];
   return flowTags.map((flowTag) => `${flowTag}HdrSqs`);
 }

package/test/createTargetRoleHandler.test.js

@@ -106,16 +106,19 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     ),
     /ListTargetRole/
   );
-  assert.match(
-    await readFile(
-      join(
-        rootPath,
-        'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js'
-      ),
-      'utf8'
+  const validatorRbac = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js'
     ),
-    /Fast-path triggered: user self-action/
+    'utf8'
   );
+  assert.match(validatorRbac, /Fast-path triggered: user self-action/);
+  assert.match(validatorRbac, /return l1Hit;/);
+  assert.match(validatorRbac, /return l2Hit;/);
+  assert.match(validatorRbac, /return cacheResult;/);
+  assert.doesNotMatch(validatorRbac, /L1 Cache hit:[^;]+;\s*return;/);
+  assert.doesNotMatch(validatorRbac, /L2 Cache hit:[^;]+;\s*return;/);
   assert.match(
     await readFile(
       join(

package/test/crudApplicationArtifacts.test.js

@@ -66,6 +66,10 @@ test('emits CRUD handlers and function YAML from schema data without reading gen
     createLogicalLib,
     /export function validateFieldNames\(\s*_izContext,\s*requestParams,\s*objectSchemas,\s*errorsFound\s*\)/
   );
+  assert.doesNotMatch(
+    createLogicalLib,
+    /targetIdentifiers\.submittedByUserId\s*=/
+  );
   assert.doesNotMatch(createMain, /FlowHook|beforeLogical|codeHookTag/);
   const yaml = await readFile(
     join(rootPath, 'app/sls_yaml/generatedCode/source/flow-objects.yml'),
@@ -637,6 +641,31 @@ test('emits async after-hook callback and SNS publish in CreateLogicalLib and fl
     { stdio: 'inherit' }
   );
 
+  const createCompleteMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateComplete_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(
+    createCompleteMain,
+    /snsTopicArnByFlowSchema\(\s*_izContext,\s*'notifyAfterCreate_In'\s*\)/
+  );
+  assert.match(createCompleteMain, /CreateAfterHookCallbackHdrSqs/);
+
+  execFileSync(
+    process.execPath,
+    [
+      '--check',
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowObjects/Create/source/CreateComplete_Main.js'
+      )
+    ],
+    { stdio: 'inherit' }
+  );
+
   const yaml = await readFile(
     join(rootPath, 'app/sls_yaml/generatedCode/source/flow-objects.yml'),
     'utf8'
@@ -1293,6 +1322,72 @@ test('supports objType in generatedCodeConfig with string, array, and global hoo
   assert.match(deleteMain, /hookPayload_globalDeleteHook/);
 });
 
+test('omits autoProvisionOwnerTargetRole in CreateNodeCallback when service only has child RBAC objects', async () => {
+  const rootPath = await createRbacProject(false, true);
+  await generateCrudApplicationArtifacts(rootPath, {
+    serviceTag: 'orders'
+  });
+
+  const callbackMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateNodeCallback_Main.js'
+    ),
+    'utf8'
+  );
+  assert.doesNotMatch(callbackMain, /autoProvisionOwnerTargetRole\(_izContext/);
+
+  const logicalLib = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateLogicalLib.js'
+    ),
+    'utf8'
+  );
+  assert.match(logicalLib, /const ROOT_RBAC_OBJECT_TYPES = new Set\(\[\s*\]\);/);
+});
+
+test('emits autoProvisionOwnerTargetRole in CreateNodeCallback when service has root RBAC object', async () => {
+  const rootPath = await mkdtemp(
+    join(tmpdir(), 'generate-service-code-v2-crud-root-rbac-')
+  );
+  roots.add(rootPath);
+  const schemaRoot = join(rootPath, 'app/src/schemas');
+  await mkdir(join(schemaRoot, 'ObjectSchemas'), { recursive: true });
+  await mkdir(join(schemaRoot, 'FlowSchemas'), { recursive: true });
+  await writeFile(
+    join(schemaRoot, 'ObjectSchemas/Workspace.js'),
+    "export default { objectType: 'workspace', generatedBy: 'user', addOnDataStructure: [{ type: 'rbac' }], storageResources: { graph: { storageType: 'graph' } } };\n"
+  );
+  await generateCrudApplicationArtifacts(rootPath, {
+    serviceTag: 'workspaces'
+  });
+
+  const callbackMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateNodeCallback_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(
+    callbackMain,
+    /await autoProvisionOwnerTargetRole\(_izContext,\s*\{\s*node,\s*submittedByUserId,\s*objType: returnValue\?\.requestParams\?\.objType\s*\}\);/
+  );
+
+  const logicalLib = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateLogicalLib.js'
+    ),
+    'utf8'
+  );
+  assert.match(
+    logicalLib,
+    /const ROOT_RBAC_OBJECT_TYPES = new Set\(\[\s*'workspace',\s*\]\);/
+  );
+});
+
 async function createProject(withCrudObject) {
   const rootPath = await mkdtemp(
     join(tmpdir(), 'generate-service-code-v2-crud-application-')

package/test/resourceArtifacts.test.js

@@ -418,6 +418,48 @@ test('emits CreateNodeCallbackHdrSqs in FlowObjectsRole when object has graph an
   assert.match(role, /CancelUsageHdrInv/);
 });
 
+test('emits correct permissions in FlowObjectsRole when object is child RBAC node with graph', async () => {
+  const rootPath = await createProject();
+  const schemas = join(rootPath, 'app/src/schemas');
+  await rm(join(schemas, 'ObjectSchemas/Order.js'));
+  await writeFile(
+    join(schemas, 'ObjectSchemas/ChildNode.js'),
+    "export default { objectType: 'childNode', generatedBy: 'user', belongTo: [{ serviceTag: 'UserAccount', objectType: 'user' }], identifiers: [{ type: 'partitionKey', fieldName: 'childId' }], storageResources: { main: { storageType: 'graph', tableName: 'ChildNodes' } } };\n"
+  );
+  await generateResourceArtifacts(rootPath);
+
+  const iam = await readFile(
+    join(
+      rootPath,
+      'app/sls_yaml/generatedCode/source/generate-shared-resource.yml'
+    ),
+    'utf8'
+  );
+  const role = roleBlock(iam, 'FlowObjectsRole');
+  assert.match(role, /CreateNodeCallbackHdrSqs/);
+  assert.match(role, /CreateNodeCallbackHdrSqsDLQ/);
+  assert.match(role, /ValidatorRbac_In/);
+  assert.match(role, /Rbac_\$\{self:custom\.iz_stage\}_ValidatorRbac_In/);
+  assert.match(role, /UserAccount_\$\{self:custom\.iz_stage\}_ValidatorRbac_In/);
+  assert.match(role, /ConfirmUsageHdrInv/);
+  assert.match(role, /CancelUsageHdrInv/);
+  assert.match(role, /UserAccount\$\{self:custom\.iz_stage\}ValidatorRbacHdrInv/);
+  // Child node service is not RBAC provider: no TargetRoles or Roles table in DynamoDB permissions
+  assert.doesNotMatch(role, /TargetRoles/);
+  assert.doesNotMatch(role, /RolePermissions/);
+  assert.doesNotMatch(iam, /FlowRbacRole:/);
+
+  const dynamo = await readFile(
+    join(
+      rootPath,
+      'resource/sls_yaml/generatedCode/source/generated-dynamoDB-table.yml'
+    ),
+    'utf8'
+  );
+  assert.doesNotMatch(dynamo, /TargetRolesTable:/);
+  assert.doesNotMatch(dynamo, /RolesTable:/);
+});
+
 test('emits CreateAfterHookCallbackHdrSqs in SQS resources and FlowObjectsRole when flow has after hook with ownTopic', async () => {
   const rootPath = await createProject();
   const schemas = join(rootPath, 'app/src/schemas');