@izara_project/izara-core-generate-service-code 1.0.89 → 1.0.91

package/src/emit/shared/templates/FindData_Main.ejs

@@ -87,7 +87,7 @@ export default async function findData(
       }
     };
 
-    let errorsFound = [];
+    let foundErrors = [];
 
     let standardErrorParams = [
       _izContext,
@@ -139,8 +139,8 @@ export default async function findData(
         _izContext.logger.debug('objInstanceBase: ', objInstanceBase)
 
         if (!objInstanceBase) {
-          errorsFound.push(`can't get data in dynamo by ${identifiersBase}`)
-          standardErrorParams.push(errorsFound)
+          foundErrors.push(`can't get data in dynamo by ${identifiersBase}`)
+          standardErrorParams.push(foundErrors)
           await findDataSharedLib.completeFindDataMain(...standardErrorParams);
           return {
             returnResponse: 'FindData cannot get data in dynamo'
@@ -148,8 +148,8 @@ export default async function findData(
         }
 
         if (!objInstanceBase.hasOwnProperty(fieldName.fieldName)) {
-          errorsFound.push(`data in dynamoDB have no ${fieldName.fieldName}`)
-          standardErrorParams.push(errorsFound)
+          foundErrors.push(`data in dynamoDB have no ${fieldName.fieldName}`)
+          standardErrorParams.push(foundErrors)
           await findDataSharedLib.completeFindDataMain(...standardErrorParams);
           return {
             returnResponse: 'Data have no fieldName'
@@ -195,8 +195,8 @@ export default async function findData(
         _izContext.logger.debug('objInstanceBase: ', objInstanceBase)
 
         if (!objInstanceBase) {
-          errorsFound.push(`can't get data in dynamo by ${identifiersBase}`)
-          standardErrorParams.push(errorsFound)
+          foundErrors.push(`can't get data in dynamo by ${identifiersBase}`)
+          standardErrorParams.push(foundErrors)
           await findDataSharedLib.completeFindDataMain(...standardErrorParams);
           return {
             returnResponse: 'FindData cannot get data in dynamo'
@@ -204,8 +204,8 @@ export default async function findData(
         }
 
         if (!objInstanceBase.hasOwnProperty(fieldName.fieldName)) {
-          errorsFound.push(`data in dynamoDB have no ${fieldName.fieldName}`)
-          standardErrorParams.push(errorsFound)
+          foundErrors.push(`data in dynamoDB have no ${fieldName.fieldName}`)
+          standardErrorParams.push(foundErrors)
           await findDataSharedLib.completeFindDataMain(...standardErrorParams);
           return {
             returnResponse: 'Data have no fieldName'
@@ -255,8 +255,8 @@ export default async function findData(
         _izContext.logger.debug('getDataByGraph: ', getDataByGraph)
 
         if (!getDataByGraph) {
-          errorsFound.push(`can't get data  of ${objType.objectType} in graph`)
-          standardErrorParams.push(errorsFound)
+          foundErrors.push(`can't get data  of ${objType.objectType} in graph`)
+          standardErrorParams.push(foundErrors)
           await findDataSharedLib.completeFindDataMain(...standardErrorParams);
           return {
             returnResponse: 'FindData cannot get data in graph'
@@ -271,8 +271,8 @@ export default async function findData(
 
 <%       if (graphDetail.getInIdentifiers) { %>
         if (!objInstanceFull.identifiers.hasOwnProperty(fieldName.fieldName)) {
-          errorsFound.push(`nodeProperties have no this ${fieldName.fieldName}`)
-          standardErrorParams.push(errorsFound)
+          foundErrors.push(`nodeProperties have no this ${fieldName.fieldName}`)
+          standardErrorParams.push(foundErrors)
           await findDataSharedLib.completeFindDataMain(...standardErrorParams);
           return {
             returnResponse: 'Data have no fieldName'
@@ -283,8 +283,8 @@ export default async function findData(
         _izContext.logger.debug('this fieldName is identifier, get dataValue in identifiers: ', dataValue)
 <%       } else { %>
         if (!objInstanceFull.fields.hasOwnProperty(fieldName.fieldName)) {
-          errorsFound.push(`nodeProperties have no this ${fieldName.fieldName}`)
-          standardErrorParams.push(errorsFound)
+          foundErrors.push(`nodeProperties have no this ${fieldName.fieldName}`)
+          standardErrorParams.push(foundErrors)
           await findDataSharedLib.completeFindDataMain(...standardErrorParams);
           return {
             returnResponse: 'Data have no fieldName'
@@ -314,8 +314,8 @@ export default async function findData(
         else
 
 <%   } %>  {
-          errorsFound.push('unrecognized fieldName')
-          standardErrorParams.push(errorsFound)
+          foundErrors.push('unrecognized fieldName')
+          standardErrorParams.push(foundErrors)
           await findDataSharedLib.completeFindDataMain(...standardErrorParams);
           return;
         }
@@ -326,8 +326,8 @@ export default async function findData(
       else
 
 <% } %>  {
-      errorsFound.push('unrecognized objectType')
-      standardErrorParams.push(errorsFound)
+      foundErrors.push('unrecognized objectType')
+      standardErrorParams.push(foundErrors)
       await findDataSharedLib.completeFindDataMain(...standardErrorParams);
       return {
         returnResponse: 'Function FindData Error'

package/src/emit/shared/templates/PaginateProcessLogical_Main.ejs

@@ -98,7 +98,7 @@ export default async function paginateProcessLogical(
       };
     }
 
-    let errorsFound = [];
+    let foundErrors = [];
     let standardErrorParams = [
       _izContext,
       logicalResultId,
@@ -153,8 +153,8 @@ export default async function paginateProcessLogical(
 
     if (!startKey && queryDatas.Items.length == 0) {
       _izContext.logger.debug(`can't find data in table ${tableName}`);
-      errorsFound.push(`can't find data in table ${tableName}`);
-      standardErrorParams.push(errorsFound);
+      foundErrors.push(`can't find data in table ${tableName}`);
+      standardErrorParams.push(foundErrors);
       await logicalResultsSharedLib.completeLogicalResultsMain(
         ...standardErrorParams
       );

package/src/emit/shared/templates/ProcessLogical_Main.ejs

@@ -96,7 +96,7 @@ export default async function processLogical(
       };
     }
 
-    let errorsFound = [];
+    let foundErrors = [];
 
     let standardErrorParams = [
       _izContext,
@@ -114,16 +114,16 @@ export default async function processLogical(
         element.comparison
       )
     ) {
-      errorsFound.push('comparison is not possible comparison');
+      foundErrors.push('comparison is not possible comparison');
     }
 
     // validate partitionKeyValues
     if (!element.hasOwnProperty('partitionKeyValues')) {
       _izContext.logger.debug('element not have partitionKeyValues');
-      errorsFound.push('element not have partitionKeyValues');
+      foundErrors.push('element not have partitionKeyValues');
     } else if (Object.keys(element.partitionKeyValues).length === 0) {
       _izContext.logger.debug('partitionKeyValues is empty');
-      errorsFound.push('partitionKeyValues is empty');
+      foundErrors.push('partitionKeyValues is empty');
     }
 
     const objectSchemas = await getObjectSchema.getObjSchemaS3WithHierarchy(
@@ -186,7 +186,7 @@ export default async function processLogical(
           if (element.hasOwnProperty('sortKeyValues')) {
             continue;
           } else {
-            errorsFound.push(
+            foundErrors.push(
               'schema error: dynamo storageResource set to groupByPartitionKeyField but no sortKey'
             );
             break;
@@ -219,7 +219,7 @@ export default async function processLogical(
     }
 
     if (!tableName) {
-      errorsFound.push('no valid dynamo storageResource found');
+      foundErrors.push('no valid dynamo storageResource found');
     }
 
     if (
@@ -230,19 +230,19 @@ export default async function processLogical(
       _izContext.logger.debug(
         'element have sortKeyValues but cannot find sortKey in object schemas'
       );
-      errorsFound.push(
+      foundErrors.push(
         'element have sortKeyValues but cannot find sortKey in object schemas'
       );
     }
 
-    if (errorsFound.length > 0) {
-      _izContext.logger.debug('Have errorsFound: ', errorsFound);
-      standardErrorParams.push(errorsFound);
+    if (foundErrors.length > 0) {
+      _izContext.logger.debug('Have foundErrors: ', foundErrors);
+      standardErrorParams.push(foundErrors);
       await logicalResultsSharedLib.completeLogicalResultsMain(
         ...standardErrorParams
       );
       return {
-        returnResponse: 'Have errorsFound'
+        returnResponse: 'Have foundErrors'
       };
     }
 
@@ -332,8 +332,8 @@ export default async function processLogical(
 
         if (queryDatas.Items.length == 0) {
           _izContext.logger.debug(`can't find data in ${tableName}`);
-          errorsFound.push(`can't find data in ${tableName}`);
-          standardErrorParams.push(errorsFound);
+          foundErrors.push(`can't find data in ${tableName}`);
+          standardErrorParams.push(foundErrors);
           await logicalResultsSharedLib.completeLogicalResultsMain(
             ...standardErrorParams
           );
@@ -411,8 +411,8 @@ export default async function processLogical(
           );
         } else {
           _izContext.logger.debug(`can't find data in ${tableName}`);
-          errorsFound.push(`can't find data in ${tableName}`);
-          standardErrorParams.push(errorsFound);
+          foundErrors.push(`can't find data in ${tableName}`);
+          standardErrorParams.push(foundErrors);
           await logicalResultsSharedLib.completeLogicalResultsMain(
             ...standardErrorParams
           );

package/test/createTargetRoleHandler.test.js

@@ -36,7 +36,7 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
   const rootPath = await createProject(true);
   const result = await generateCreateTargetRoleHandler(rootPath);
 
-  assert.equal(result.files.length, 59);
+  assert.equal(result.files.length, 60);
   assert.match(
     await readFile(join(rootPath, result.files[0].path), 'utf8'),
     /CreateTargetRole/
@@ -106,16 +106,67 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     ),
     /ListTargetRole/
   );
+  const validatorRbac = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(validatorRbac, /Fast-path triggered: user self-action/);
+  assert.match(validatorRbac, /return l1Hit;/);
+  assert.match(validatorRbac, /return l2Hit;/);
+  assert.match(validatorRbac, /return cacheResult;/);
+  assert.doesNotMatch(validatorRbac, /L1 Cache hit:[^;]+;\s*return;/);
+  const validatorHdrInv = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_HdrInv.js'
+    ),
+    'utf8'
+  );
   assert.match(
-    await readFile(
+    validatorHdrInv,
+    /import ValidatorRbac from '\.\/ValidatorRbac_Main\.js';/
+  );
+  assert.match(
+    validatorHdrInv,
+    /middleware\.setValidatorSchema\(validatorSchema\);/
+  );
+  assert.match(
+    validatorHdrInv,
+    /await ValidatorRbac\(event\._izContext, \.\.\.passOnProperties\);/
+  );
+
+  const validatorHdrApi = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_HdrApi.js'
+    ),
+    'utf8'
+  );
+  assert.match(
+    validatorHdrApi,
+    /import ValidatorRbac from '\.\/ValidatorRbac_Main\.js';/
+  );
+  assert.match(
+    validatorHdrApi,
+    /middleware\.setValidatorSchema\(validatorSchema, { noAuthorizer: true }\);/
+  );
+  assert.match(
+    validatorHdrApi,
+    /await ValidatorRbac\(\s*event\._izContext,\s*\.\.\.passOnProperties\s*\);/
+  );
+
+  await assert.rejects(
+    readFile(
       join(
         rootPath,
-        'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_Main.js'
-      ),
-      'utf8'
-    ),
-    /Fast-path triggered: user self-action/
+        'app/src/generatedCode/FlowRbac/ValidatorRbac/source/ValidatorRbac_HdrSqs.js'
+      )
+    )
   );
+
   assert.match(
     await readFile(
       join(
@@ -130,6 +181,16 @@ test('generates RBAC own-topic WebSocket entries alongside their SQS handlers',
     join(rootPath, 'app/sls_yaml/generatedCode/source/flow-rbac.yml'),
     'utf8'
   );
+  assert.match(
+    rbacYaml,
+    /ValidatorRbacHdrInv:\n\s+handler: src\/generatedCode\/FlowRbac\/ValidatorRbac\/source\/ValidatorRbac_HdrInv\.main/
+  );
+  assert.match(
+    rbacYaml,
+    /ValidatorRbacHdrApi:\n\s+handler: src\/generatedCode\/FlowRbac\/ValidatorRbac\/source\/ValidatorRbac_HdrApi\.main/
+  );
+  assert.doesNotMatch(rbacYaml, /ValidatorRbacHdrSqs:/);
+
   const limitYaml = await readFile(
     join(rootPath, 'app/sls_yaml/generatedCode/source/flow-limits.yml'),
     'utf8'
@@ -158,7 +219,7 @@ test('removes CreateTargetRole handler when RBAC is removed', async () => {
   await generateCreateTargetRoleHandler(rootPath);
   await writeFile(
     objectPath,
-    "export default { objectType: 'user', addOnDataStructure: [] };\n"
+    "export default { objectType: 'user', generatedBy: 'user', fieldNames: { userId: { type: 'string', canUpdate: false, storageResourceTags: ['main'] } }, identifiers: [{ type: 'partitionKey', fieldName: 'userId' }], storageResources: { main: { storageType: 'dynamoDB', tableName: 'Users' } }, addOnDataStructure: [] };\n"
   );
 
   assert.deepEqual((await generateCreateTargetRoleHandler(rootPath)).files, []);
@@ -193,7 +254,7 @@ async function createProject(hasRbac) {
   await mkdir(directory, { recursive: true });
   await writeFile(
     join(directory, 'User.js'),
-    `export default { objectType: 'user', fieldNames: [], identifiers: [], addOnDataStructure: ${addOns} };\n`
+    `export default { objectType: 'user', generatedBy: 'user', fieldNames: { userId: { type: 'string', canUpdate: false, storageResourceTags: ['main'] } }, identifiers: [{ type: 'partitionKey', fieldName: 'userId' }], storageResources: { main: { storageType: 'dynamoDB', tableName: 'Users' } }, addOnDataStructure: ${addOns} };\n`
   );
   return rootPath;
 }

package/test/crudApplicationArtifacts.test.js

@@ -44,7 +44,7 @@ test('emits CRUD handlers and function YAML from schema data without reading gen
   assert.match(createMain, /CreateLogicalLib/);
   assert.match(
     createMain,
-    /validateFieldNames\(_izContext, requestParams, objectSchemas, errorsFound\)/
+    /validateFieldNames\(_izContext, requestParams, objectSchemas, foundErrors\)/
   );
   assert.doesNotMatch(
     createMain,
@@ -59,12 +59,16 @@ test('emits CRUD handlers and function YAML from schema data without reading gen
   );
   assert.match(
     createLogicalLib,
-    /export async function resolveAndGenerateIdentifiers\(\s*_izContext,\s*requestParams,\s*objectSchema,\s*errorsFound\s*\)/
+    /export async function resolveAndGenerateIdentifiers\(\s*_izContext,\s*requestParams,\s*objectSchema,\s*foundErrors\s*\)/
   );
   assert.match(createLogicalLib, /return \{\s*objectSchemas\s*\};/);
   assert.match(
     createLogicalLib,
-    /export function validateFieldNames\(\s*_izContext,\s*requestParams,\s*objectSchemas,\s*errorsFound\s*\)/
+    /export function validateFieldNames\(\s*_izContext,\s*requestParams,\s*objectSchemas,\s*foundErrors\s*\)/
+  );
+  assert.doesNotMatch(
+    createLogicalLib,
+    /targetIdentifiers\.submittedByUserId\s*=/
   );
   assert.doesNotMatch(createMain, /FlowHook|beforeLogical|codeHookTag/);
   const yaml = await readFile(
@@ -637,6 +641,31 @@ test('emits async after-hook callback and SNS publish in CreateLogicalLib and fl
     { stdio: 'inherit' }
   );
 
+  const createCompleteMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateComplete_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(
+    createCompleteMain,
+    /snsTopicArnByFlowSchema\(\s*_izContext,\s*'notifyAfterCreate_In'\s*\)/
+  );
+  assert.match(createCompleteMain, /CreateAfterHookCallbackHdrSqs/);
+
+  execFileSync(
+    process.execPath,
+    [
+      '--check',
+      join(
+        rootPath,
+        'app/src/generatedCode/FlowObjects/Create/source/CreateComplete_Main.js'
+      )
+    ],
+    { stdio: 'inherit' }
+  );
+
   const yaml = await readFile(
     join(rootPath, 'app/sls_yaml/generatedCode/source/flow-objects.yml'),
     'utf8'
@@ -1293,6 +1322,72 @@ test('supports objType in generatedCodeConfig with string, array, and global hoo
   assert.match(deleteMain, /hookPayload_globalDeleteHook/);
 });
 
+test('omits autoProvisionOwnerTargetRole in CreateNodeCallback when service only has child RBAC objects', async () => {
+  const rootPath = await createRbacProject(false, true);
+  await generateCrudApplicationArtifacts(rootPath, {
+    serviceTag: 'orders'
+  });
+
+  const callbackMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateNodeCallback_Main.js'
+    ),
+    'utf8'
+  );
+  assert.doesNotMatch(callbackMain, /autoProvisionOwnerTargetRole\(_izContext/);
+
+  const logicalLib = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateLogicalLib.js'
+    ),
+    'utf8'
+  );
+  assert.match(logicalLib, /const ROOT_RBAC_OBJECT_TYPES = new Set\(\[\s*\]\);/);
+});
+
+test('emits autoProvisionOwnerTargetRole in CreateNodeCallback when service has root RBAC object', async () => {
+  const rootPath = await mkdtemp(
+    join(tmpdir(), 'generate-service-code-v2-crud-root-rbac-')
+  );
+  roots.add(rootPath);
+  const schemaRoot = join(rootPath, 'app/src/schemas');
+  await mkdir(join(schemaRoot, 'ObjectSchemas'), { recursive: true });
+  await mkdir(join(schemaRoot, 'FlowSchemas'), { recursive: true });
+  await writeFile(
+    join(schemaRoot, 'ObjectSchemas/Workspace.js'),
+    "export default { objectType: 'workspace', generatedBy: 'user', addOnDataStructure: [{ type: 'rbac' }], storageResources: { graph: { storageType: 'graph' } } };\n"
+  );
+  await generateCrudApplicationArtifacts(rootPath, {
+    serviceTag: 'workspaces'
+  });
+
+  const callbackMain = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateNodeCallback_Main.js'
+    ),
+    'utf8'
+  );
+  assert.match(
+    callbackMain,
+    /await autoProvisionOwnerTargetRole\(_izContext,\s*\{\s*node,\s*submittedByUserId,\s*objType: returnValue\?\.requestParams\?\.objType\s*\}\);/
+  );
+
+  const logicalLib = await readFile(
+    join(
+      rootPath,
+      'app/src/generatedCode/FlowObjects/Create/source/CreateLogicalLib.js'
+    ),
+    'utf8'
+  );
+  assert.match(
+    logicalLib,
+    /const ROOT_RBAC_OBJECT_TYPES = new Set\(\[\s*'workspace',\s*\]\);/
+  );
+});
+
 async function createProject(withCrudObject) {
   const rootPath = await mkdtemp(
     join(tmpdir(), 'generate-service-code-v2-crud-application-')

package/test/dynamicCrudFlowSchemas.test.js

@@ -197,7 +197,7 @@ test('uses CreateNodeCallback step when Graph storage is present with sync RBAC'
     'returnValue',
     'parentFlowId',
     'status',
-    'errorsFound',
+    'foundErrors',
     'graphServiceTag'
   ]);
 });
@@ -237,7 +237,7 @@ test('chains Start and Complete for Update with RBAC and Graph', async () => {
     'returnValue',
     'parentFlowId',
     'status',
-    'errorsFound',
+    'foundErrors',
     'graphServiceTag'
   ]);
 });

package/test/dynamicRbacFlowSchemas.test.js

@@ -67,8 +67,36 @@ test('generates shared and object-specific RBAC flow schemas', async () => {
     properties: ['returnResult'],
     messageAttributes: []
   });
-  assert.deepEqual(user.event, ['ownTopic']);
-  assert.equal(user.steps, undefined);
+  assert.deepEqual(user.event, ['lambdaSyncInv', 'lambdaSyncApi']);
+  assert.equal(user.initiateBy, 'systemWithUser');
+  assert.deepEqual(user.stepProperties, {
+    parentFlowId: {
+      propertyName: 'parentFlowId',
+      type: 'string'
+    },
+    flowTypeConcat: {
+      propertyName: 'flowTypeConcat',
+      type: 'string'
+    },
+    parameterGroups: {
+      propertyName: 'parameterGroups',
+      type: 'object'
+    }
+  });
+  assert.deepEqual(user.stepMessageAttributes, {
+    submittedByUserId: {
+      propertyName: 'x-correlation-submitted-by-user-id',
+      type: 'string'
+    }
+  });
+  assert.deepEqual(user.flowSteps[0].properties, [
+    { key: 'parentFlowId', required: false },
+    { key: 'flowTypeConcat', required: true },
+    { key: 'parameterGroups', default: {} }
+  ]);
+  assert.deepEqual(user.flowSteps[0].messageAttributes, [
+    { key: 'submittedByUserId', required: false }
+  ]);
 
   const confirmUsage = await readGeneratedFlow(
     rootPath,
@@ -98,7 +126,7 @@ test('removes RBAC schemas when the last RBAC object is removed', async () => {
   await generateDynamicRbacFlowSchemas(rootPath, { serviceTag: 'UserAccount' });
   await writeFile(
     objectPath,
-    "export default { objectType: 'user', addOnDataStructure: [] };\n"
+    "export default { objectType: 'user', generatedBy: 'user', fieldNames: { userId: { type: 'string', canUpdate: false, storageResourceTags: ['main'] } }, identifiers: [{ type: 'partitionKey', fieldName: 'userId' }], storageResources: { main: { storageType: 'dynamoDB', tableName: 'Users' } }, addOnDataStructure: [] };\n"
   );
 
   const result = await generateDynamicRbacFlowSchemas(rootPath);
@@ -160,7 +188,7 @@ async function createProject({ hasRbac = false } = {}) {
   await mkdir(objectDirectory, { recursive: true });
   await writeFile(
     join(objectDirectory, 'User.js'),
-    `export default { objectType: 'user', fieldNames: [], identifiers: [], addOnDataStructure: ${hasRbac ? "[{ type: 'rbac' }]" : '[]'} };\n`
+    `export default { objectType: 'user', generatedBy: 'user', fieldNames: { userId: { type: 'string', canUpdate: false, storageResourceTags: ['main'] } }, identifiers: [{ type: 'partitionKey', fieldName: 'userId' }], storageResources: { main: { storageType: 'dynamoDB', tableName: 'Users' } }, addOnDataStructure: ${hasRbac ? "[{ type: 'rbac' }]" : '[]'} };\n`
   );
   return rootPath;
 }

package/test/relationshipApplicationArtifacts.test.js

@@ -115,7 +115,7 @@ test('emits relationship action and complete handlers with data-first function Y
   );
   assert.match(
     createCompleteContent,
-    /const {\s*returnValue,\s*parentFlowId,\s*status,\s*errorsFound,\s*graphServiceTag\s*} = requestParams;/
+    /const {\s*returnValue,\s*parentFlowId,\s*status,\s*foundErrors,\s*graphServiceTag\s*} = requestParams;/
   );
   assert.doesNotMatch(
     createCompleteContent,

package/test/resourceArtifacts.test.js

@@ -418,6 +418,48 @@ test('emits CreateNodeCallbackHdrSqs in FlowObjectsRole when object has graph an
   assert.match(role, /CancelUsageHdrInv/);
 });
 
+test('emits correct permissions in FlowObjectsRole when object is child RBAC node with graph', async () => {
+  const rootPath = await createProject();
+  const schemas = join(rootPath, 'app/src/schemas');
+  await rm(join(schemas, 'ObjectSchemas/Order.js'));
+  await writeFile(
+    join(schemas, 'ObjectSchemas/ChildNode.js'),
+    "export default { objectType: 'childNode', generatedBy: 'user', belongTo: [{ serviceTag: 'UserAccount', objectType: 'user' }], identifiers: [{ type: 'partitionKey', fieldName: 'childId' }], storageResources: { main: { storageType: 'graph', tableName: 'ChildNodes' } } };\n"
+  );
+  await generateResourceArtifacts(rootPath);
+
+  const iam = await readFile(
+    join(
+      rootPath,
+      'app/sls_yaml/generatedCode/source/generate-shared-resource.yml'
+    ),
+    'utf8'
+  );
+  const role = roleBlock(iam, 'FlowObjectsRole');
+  assert.match(role, /CreateNodeCallbackHdrSqs/);
+  assert.match(role, /CreateNodeCallbackHdrSqsDLQ/);
+  assert.match(role, /ValidatorRbac_In/);
+  assert.match(role, /Rbac_\$\{self:custom\.iz_stage\}_ValidatorRbac_In/);
+  assert.match(role, /UserAccount_\$\{self:custom\.iz_stage\}_ValidatorRbac_In/);
+  assert.match(role, /ConfirmUsageHdrInv/);
+  assert.match(role, /CancelUsageHdrInv/);
+  assert.match(role, /UserAccount\$\{self:custom\.iz_stage\}ValidatorRbacHdrInv/);
+  // Child node service is not RBAC provider: no TargetRoles or Roles table in DynamoDB permissions
+  assert.doesNotMatch(role, /TargetRoles/);
+  assert.doesNotMatch(role, /RolePermissions/);
+  assert.doesNotMatch(iam, /FlowRbacRole:/);
+
+  const dynamo = await readFile(
+    join(
+      rootPath,
+      'resource/sls_yaml/generatedCode/source/generated-dynamoDB-table.yml'
+    ),
+    'utf8'
+  );
+  assert.doesNotMatch(dynamo, /TargetRolesTable:/);
+  assert.doesNotMatch(dynamo, /RolesTable:/);
+});
+
 test('emits CreateAfterHookCallbackHdrSqs in SQS resources and FlowObjectsRole when flow has after hook with ownTopic', async () => {
   const rootPath = await createProject();
   const schemas = join(rootPath, 'app/src/schemas');