@izara_project/izara-core-generate-service-code 1.0.91 → 1.0.92

package/src/emit/resource/generateResourceArtifacts.js

@@ -1,29 +1,29 @@
-import { buildGenerationPlan } from '../../plan/buildGenerationPlan.js';
-import { commitArtifacts } from '../../output/commitArtifacts.js';
-import { compileProject } from '../../compile/compileProject.js';
 import { loadLocalSchemaDirectory } from '../../compile/loadSchemas.js';
+import { runSubsystemGeneration } from '../shared/runSubsystemGeneration.js';
 import {
   emitResourceArtifacts,
   resourceArtifactPaths
 } from './emitResourceArtifacts.js';
 
 export async function generateResourceArtifacts(rootPath, options = {}) {
-  const project = compileProject({ ...options, rootPath });
-  const [objects, relationships, flows] = await Promise.all([
-    loadLocalSchemaDirectory(project, 'ObjectSchemas'),
-    loadLocalSchemaDirectory(project, 'RelationshipSchemas'),
-    loadLocalSchemaDirectory(project, 'FlowSchemas')
-  ]);
-  const artifacts = await emitResourceArtifacts({
-    objects,
-    relationships,
-    flows
+  return await runSubsystemGeneration({
+    rootPath,
+    options,
+    loadInputs: async (project) => {
+      const [objects, relationships, flows] = await Promise.all([
+        loadLocalSchemaDirectory(project, 'ObjectSchemas'),
+        loadLocalSchemaDirectory(project, 'RelationshipSchemas'),
+        loadLocalSchemaDirectory(project, 'FlowSchemas')
+      ]);
+      return { objects, relationships, flows };
+    },
+    emitArtifacts: ({ objects, relationships, flows }) =>
+      emitResourceArtifacts({
+        objects,
+        relationships,
+        flows
+      }),
+    managedScope: 'shared-resources',
+    resolveManagedPaths: resourceArtifactPaths
   });
-  const files = await commitArtifacts(
-    buildGenerationPlan(project, artifacts, {
-      managedPaths: resourceArtifactPaths,
-      managedScope: 'shared-resources'
-    })
-  );
-  return { project, files };
 }

package/src/emit/resource/iamResourceArtifacts.js

@@ -0,0 +1,612 @@
+import { renderResourceTemplate } from './resourceTemplate.js';
+import { CRUD_ACTIONS } from '../crud/crudActionPlan.js';
+import {
+  customFlowRoleName,
+  flowDsqSteps,
+  flowExtTopicSteps,
+  flowHasRbac
+} from '../custom/customFlows.js';
+import {
+  RELATIONSHIP_ACTIONS,
+  RBAC_ACTIONS,
+  RBAC_TABLES,
+  rbacFlowQueueNames,
+  includesEvent,
+  flowHasOwnTopic,
+  upperFirst
+} from './resourceState.js';
+
+export const DYNAMO_ACTIONS = [
+  'dynamodb:DeleteItem',
+  'dynamodb:GetItem',
+  'dynamodb:PutItem',
+  'dynamodb:Query',
+  'dynamodb:UpdateItem'
+];
+
+export const SQS_CONSUMER_ACTIONS = [
+  'sqs:DeleteMessage',
+  'sqs:GetQueueAttributes',
+  'sqs:ReceiveMessage'
+];
+
+export const SQS_DLQ_ACTIONS = [
+  'sqs:DeleteMessage',
+  'sqs:GetQueueAttributes',
+  'sqs:ReceiveMessage',
+  'sqs:SendMessage'
+];
+
+export const LEGACY_PROCESS_QUEUES = [
+  'FindDataHdrSqs',
+  'ProcessLogicalHdrSqs',
+  'PaginateProcessLogicalHdrDsq',
+  'PaginateProcessLogicalHdrSqs'
+];
+
+export async function renderIam(state) {
+  const roles = ['ProcFindDataRole', 'RegisterRole'];
+  if (state.crud) {
+    roles.push('FlowObjectsRole');
+  }
+  if (state.relationships) {
+    roles.push('FlowRelationshipRole');
+  }
+  if (state.selfRbac) {
+    roles.push('FlowRbacRole');
+  }
+  if (state.websocket) {
+    roles.push('WebSocketMainRole');
+  }
+  roles.push(...state.customRoles);
+  const sortedRoles = roles.sort();
+  return {
+    iamContent: await renderResourceTemplate('SharedResource_Yaml.ejs', {
+      roles: sortedRoles.map((roleName) => ({
+        roleName,
+        statements: roleStatements(state, roleName)
+      }))
+    }),
+    roleNameConfigContent: renderRoleNameConfigYaml(sortedRoles)
+  };
+}
+
+export function getRbacValidatorServiceTags(state) {
+  const tags = new Set();
+  for (const obj of state.objects || []) {
+    const targets = obj?.belongTo
+      ? Array.isArray(obj.belongTo)
+        ? obj.belongTo
+        : [obj.belongTo]
+      : [];
+    for (const target of targets) {
+      if (target?.serviceTag && target.serviceTag !== 'Rbac') {
+        tags.add(target.serviceTag);
+      }
+    }
+    if (
+      obj.belongToSchema?.serviceTag &&
+      obj.belongToSchema.serviceTag !== 'Rbac'
+    ) {
+      tags.add(obj.belongToSchema.serviceTag);
+    }
+  }
+  return Array.from(tags).sort();
+}
+
+export async function renderLambdaRoleConfig(state) {
+  const s3Flows = state.flows
+    .filter((flow) => includesEvent(flow, 's3'))
+    .map((flow) => ({
+      roleName: upperFirst(flow.flowTag)
+    }));
+  const rbacValidatorServiceTags = getRbacValidatorServiceTags(state);
+  return renderResourceTemplate('GeneratedLambdaRoleServiceConfig.ejs', {
+    crud: state.crud,
+    relationships: state.relationships,
+    rbac: state.rbac,
+    rbacValidatorServiceTags,
+    objectGraphServiceTags: state.objectGraphServiceTags,
+    s3Flows
+  });
+}
+
+export function roleStatements(state, roleName) {
+  const statements = [];
+  if (roleNeedsSchemaRead(state, roleName)) {
+    statements.push({
+      action: ['s3:GetObject'],
+      resource: ['arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}/*']
+    });
+    statements.push({
+      action: ['s3:ListBucket'],
+      resource: ['arn:aws:s3:::${self:custom.iz_serviceSchemaBucketName}']
+    });
+  }
+  addStatement(statements, dynamoActionsForRole(roleName), [
+    ...dynamoArns(roleTableNames(state, roleName)),
+    ...externalDynamoArns(roleExternalDynamoTables(state, roleName))
+  ]);
+  addStatement(
+    statements,
+    SQS_CONSUMER_ACTIONS,
+    queueArns(roleQueueNames(state, roleName))
+  );
+  addStatement(
+    statements,
+    SQS_DLQ_ACTIONS,
+    queueArns(roleDlqQueueNames(state, roleName))
+  );
+  addStatement(
+    statements,
+    ['sns:Publish'],
+    [
+      ...topicArns(roleTopicNames(state, roleName)),
+      ...roleExternalTopicArns(state, roleName)
+    ]
+  );
+  addStatement(
+    statements,
+    ['lambda:InvokeFunction'],
+    [
+      ...roleExternalLambdaArns(state, roleName),
+      ...roleHookLambdaArns(state, roleName)
+    ]
+  );
+  if (state.webSocketRoles.has(roleName)) {
+    statements.push({
+      action: ['execute-api:ManageConnections'],
+      resource: [
+        'arn:aws:execute-api:${self:custom.iz_region}:${self:custom.iz_accountId}:*/*'
+      ]
+    });
+  }
+  return statements;
+}
+
+export function addStatement(statements, action, resource) {
+  if (resource.length > 0) {
+    statements.push({ action, resource });
+  }
+}
+
+export function roleNeedsSchemaRead(state, roleName) {
+  if (!roleName.endsWith('Role') || !roleName) {
+    return false;
+  }
+  return roleName !== 'FlowRbacRole' || state.selfRbac;
+}
+
+export function roleTableNames(state, roleName) {
+  if (roleName === 'RegisterRole') {
+    if (state.websocket) {
+      return ['WebSocketTask', 'RegisterRecords'];
+    }
+    return [];
+  }
+  if (roleName === 'WebSocketMainRole') {
+    return ['UserUploadRecords', 'WebSocketTask'];
+  }
+  if (roleName === 'FlowObjectsRole') {
+    const tables = [
+      ...state.objectTableNames,
+      'AwaitingMultipleSteps',
+      'AwaitingMultipleStepByPending',
+      'WebSocketTask'
+    ];
+    if (state.selfRbac) {
+      tables.push(
+        'Roles',
+        'TargetRoles',
+        'RolePermissions',
+        'RoleUsers',
+        'UserRoles',
+        'RunningTotalUsage',
+        'RunningTotalReservedUsage'
+      );
+    }
+    return tables;
+  }
+  if (roleName === 'FlowRelationshipRole') {
+    return [
+      ...state.objectTableNames,
+      ...state.relationshipTableNames,
+      'AwaitingMultipleSteps',
+      'AwaitingMultipleStepByPending',
+      'WebSocketTask'
+    ];
+  }
+  if (roleName === 'FlowRbacRole') {
+    return RBAC_TABLES;
+  }
+  if (roleName === 'ProcFindDataRole') {
+    return [
+      ...state.objectTableNames,
+      ...state.relationshipTableNames,
+      'FindDataMain',
+      'LogicalResultsMain',
+      'LogicalResultsData'
+    ];
+  }
+  const flow = state.flows.find(
+    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+  );
+  if (!flow) {
+    return [];
+  }
+  const tables = [];
+  if (flowHasOwnTopic(flow) || includesEvent(flow, 's3')) {
+    tables.push('WebSocketTask');
+  }
+  if (includesEvent(flow, 's3')) {
+    tables.push('UserUploadRecords', 'ReservedDataMain');
+  }
+  if (flow.statusType === 'storedCache') {
+    const object = state.objectTablesByType.get(flow.objType?.objectType);
+    if (object) {
+      tables.push(object);
+    }
+  }
+  return [...new Set(tables)];
+}
+
+export function dynamoActionsForRole(roleName) {
+  if (roleName === 'ProcFindDataRole') {
+    return [
+      'dynamodb:GetItem',
+      'dynamodb:PutItem',
+      'dynamodb:Query',
+      'dynamodb:UpdateItem'
+    ];
+  }
+  if (roleName === 'WebSocketMainRole') {
+    return ['dynamodb:DeleteItem', 'dynamodb:PutItem', 'dynamodb:Query'];
+  }
+  if (roleName === 'FlowRbacRole' || roleName === 'FlowObjectsRole') {
+    return [...DYNAMO_ACTIONS, 'dynamodb:TransactWriteItems'];
+  }
+  return DYNAMO_ACTIONS;
+}
+
+export function roleQueueNames(state, roleName) {
+  if (roleName === 'ProcFindDataRole') {
+    return LEGACY_PROCESS_QUEUES;
+  }
+  if (roleName === 'WebSocketMainRole') {
+    if (state.websocket) {
+      return ['WebSocketCompleteHdrSqs'];
+    }
+    return [];
+  }
+  if (roleName === 'RegisterRole') {
+    if (state.websocket) {
+      return ['RegisterCompleteHdrSqs'];
+    }
+    return [];
+  }
+  if (roleName === 'FlowObjectsRole') {
+    return CRUD_ACTIONS.flatMap((action) => {
+      const plan = state.crudActionPlans[action];
+      if (!plan.outputTopic) return [];
+      return [
+        `${action}HdrSqs`,
+        ...(plan.hasCreateNodeCallback ? [`${action}NodeCallbackHdrSqs`] : []),
+        ...(plan.hasBeforeHookCallback
+          ? [`${action}BeforeHookCallbackHdrSqs`]
+          : []),
+        ...(plan.hasAfterHookCallback
+          ? [`${action}AfterHookCallbackHdrSqs`]
+          : []),
+        ...(plan.hasRbacCallback ? [`${action}RbacCallbackHdrSqs`] : []),
+        ...(plan.hasComplete ? [`${action}CompleteHdrSqs`] : [])
+      ];
+    });
+  }
+  if (roleName === 'FlowRelationshipRole') {
+    return [
+      ...RELATIONSHIP_ACTIONS.flatMap((action) => [
+        `${action}HdrSqs`,
+        `${action}CompleteHdrSqs`
+      ]),
+      'GetRelationshipHdrDsq'
+    ];
+  }
+  if (roleName === 'FlowRbacRole') {
+    return [
+      ...RBAC_ACTIONS.map((action) => `${action}HdrSqs`),
+      ...rbacFlowQueueNames(state)
+    ];
+  }
+  const flow = state.flows.find(
+    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+  );
+  if (!flow) {
+    return [];
+  }
+  const tag = upperFirst(flow.flowTag);
+  const queueList = [];
+  if (includesEvent(flow, 'extTopic')) {
+    queueList.push(`${tag}HdrSqs`);
+  }
+  if (flowHasOwnTopic(flow)) {
+    queueList.push(`${tag}HdrSqs`);
+  }
+  if (includesEvent(flow, 'dsq')) {
+    queueList.push(`${tag}HdrDsq`);
+  }
+  if (flowHasRbac(flow, state.objects)) {
+    queueList.push(`${tag}RbacCallbackHdrSqs`);
+  }
+  queueList.push(
+    ...flowExtTopicSteps([flow]).map(
+      ({ flowTag, stepName }) => `${flowTag}${stepName}HdrSqs`
+    )
+  );
+  queueList.push(
+    ...flowDsqSteps([flow]).map(
+      ({ flowTag, stepName }) => `${flowTag}${stepName}HdrDsq`
+    )
+  );
+  queueList.push(
+    ...state.sqsQueues.filter(
+      (queueName) => includesEvent(flow, 's3') && queueName.startsWith(tag)
+    )
+  );
+  if (flow.outputTopic) {
+    queueList.push(`${tag}CompleteHdrSqs`);
+  }
+  return queueList;
+}
+
+export function roleDlqQueueNames(state, roleName) {
+  const queues = roleQueueNames(state, roleName);
+  if (!Array.isArray(queues) || queues.length === 0) {
+    return [];
+  }
+  return queues.map((q) => (q.endsWith('DLQ') ? q : `${q}DLQ`));
+}
+
+export function roleTopicNames(state, roleName) {
+  if (roleName === 'ProcFindDataRole') {
+    return state.outTopics
+      .filter((topic) => topic === 'FindData')
+      .map((t) => `${t}_Out`);
+  }
+  if (roleName === 'FlowObjectsRole') {
+    const actions = state.outTopics.filter((topic) =>
+      CRUD_ACTIONS.includes(topic)
+    );
+    const topics = [];
+    for (const action of actions) {
+      if (action === 'Get') {
+        topics.push(`${action}_Out`);
+      } else {
+        topics.push(`${action}_In`, `${action}_Out`);
+      }
+    }
+    if (state.rbac) {
+      topics.push('ValidatorRbac_In');
+    }
+    for (const action of ['Create', 'Update', 'Delete']) {
+      const plan = state.crudActionPlans?.[action];
+      if (plan?.hasBeforeHookAsync) {
+        for (const hook of plan.beforeHooks) {
+          if (hook?.generatedCodeConfig?.invocationType === 'ownTopic') {
+            topics.push(`${upperFirst(hook.flowTag)}_In`);
+          }
+        }
+      }
+      if (plan?.hasAfterHookAsync) {
+        for (const hook of plan.afterHooks) {
+          if (hook?.generatedCodeConfig?.invocationType === 'ownTopic') {
+            topics.push(`${upperFirst(hook.flowTag)}_In`);
+          }
+        }
+      }
+    }
+    return [...new Set(topics)];
+  }
+  if (roleName === 'FlowRelationshipRole') {
+    const actions = state.outTopics.filter((topic) =>
+      RELATIONSHIP_ACTIONS.includes(topic)
+    );
+    const topics = [];
+    for (const action of actions) {
+      if (action === 'GetRelationship') {
+        topics.push(`${action}_Out`);
+      } else {
+        topics.push(`${action}_In`, `${action}_Out`);
+      }
+    }
+    if (state.rbac) {
+      topics.push('ValidatorRbac_In');
+    }
+    return topics;
+  }
+  if (roleName === 'FlowRbacRole') {
+    const actions = state.outTopics.filter((topic) =>
+      RBAC_ACTIONS.includes(topic)
+    );
+    const topics = [];
+    for (const action of actions) {
+      if (action.startsWith('List')) {
+        topics.push(`${action}_Out`);
+      } else {
+        topics.push(`${action}_In`, `${action}_Out`);
+      }
+    }
+    return topics;
+  }
+  const flow = state.flows.find(
+    (candidate) => customFlowRoleName(candidate?.flowTag ?? '') === roleName
+  );
+  if (flow && flow.flowTag) {
+    const name = upperFirst(flow.flowTag);
+    const topics = [];
+    if (state.outTopics.includes(name)) {
+      topics.push(`${name}_Out`);
+    }
+    if (flowHasOwnTopic(flow)) {
+      topics.push(`${name}_In`);
+    }
+    return topics;
+  }
+  return [];
+}
+
+export function dynamoArns(tableNames) {
+  return [...new Set(tableNames)]
+    .sort()
+    .map(
+      (tableName) =>
+        `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${'${self:custom.iz_resourcePrefix}'}${tableName}`
+    );
+}
+
+export function externalDynamoArns(externalTables) {
+  const seen = new Set();
+  const unique = [];
+  for (const table of externalTables) {
+    const dedupeKey = `${table.serviceTag}::${table.tableName}`;
+    if (!seen.has(dedupeKey)) {
+      seen.add(dedupeKey);
+      unique.push(table);
+    }
+  }
+  return unique
+    .sort((a, b) =>
+      `${a.serviceTag}_${a.tableName}`.localeCompare(
+        `${b.serviceTag}_${b.tableName}`
+      )
+    )
+    .map(
+      ({ serviceTag, tableName }) =>
+        `arn:aws:dynamodb:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:table/${serviceTag}${'${self:custom.iz_stage}'}${tableName}`
+    );
+}
+
+export function roleExternalDynamoTables(state, roleName) {
+  if (
+    roleName === 'FlowObjectsRole' ||
+    roleName === 'FlowRelationshipRole' ||
+    roleName === 'ProcFindDataRole'
+  ) {
+    return state.externalDynamoTables;
+  }
+  return [];
+}
+
+export function roleExternalTopicArns(state, roleName) {
+  if (!state.rbac) {
+    return [];
+  }
+  const extraTags = getRbacValidatorServiceTags(state).filter(
+    (tag) => tag && tag !== 'Rbac'
+  );
+  const extraTopics = extraTags.map(
+    (tag) =>
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:${tag}_\${self:custom.iz_stage}_ValidatorRbac_In`
+  );
+  if (roleName === 'FlowObjectsRole') {
+    return [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ConfirmUsage_In`,
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_CancelUsage_In`,
+      ...extraTopics
+    ];
+  }
+  if (roleName === 'FlowRbacRole' || roleName === 'FlowRelationshipRole') {
+    return [
+      `arn:aws:sns:\${self:custom.iz_region}:\${self:custom.iz_accountId}:Rbac_\${self:custom.iz_stage}_ValidatorRbac_In`,
+      ...extraTopics
+    ];
+  }
+  return [];
+}
+
+export function roleExternalLambdaArns(state, roleName) {
+  if (!state.rbac) {
+    return [];
+  }
+  const extraTags = getRbacValidatorServiceTags(state).filter(
+    (tag) => tag && tag !== 'Rbac'
+  );
+  const extraLambdas = extraTags.map(
+    (tag) =>
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:${tag}\${self:custom.iz_stage}ValidatorRbacHdrInv`
+  );
+  if (roleName === 'FlowObjectsRole') {
+    return [
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ConfirmUsageHdrInv`,
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}CancelUsageHdrInv`,
+      ...extraLambdas
+    ];
+  }
+  if (roleName === 'FlowRbacRole' || roleName === 'FlowRelationshipRole') {
+    return [
+      `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:Rbac\${self:custom.iz_stage}ValidatorRbacHdrInv`,
+      ...extraLambdas
+    ];
+  }
+  return [];
+}
+
+export function roleHookLambdaArns(state, roleName) {
+  if (roleName !== 'FlowObjectsRole') {
+    return [];
+  }
+  const hookLambdas = [];
+  for (const action of ['Create', 'Update', 'Delete']) {
+    const plan = state.crudActionPlans?.[action];
+    if (plan?.hasBeforeHookSync) {
+      for (const hook of plan.beforeHooks) {
+        if (hook?.generatedCodeConfig?.invocationType === 'lambdaSyncInv') {
+          const hookTag = upperFirst(hook.flowTag);
+          hookLambdas.push(
+            `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:\${self:custom.iz_resourcePrefix}${hookTag}*`
+          );
+        }
+      }
+    }
+    if (plan?.hasAfterHookSync) {
+      for (const hook of plan.afterHooks) {
+        if (hook?.generatedCodeConfig?.invocationType === 'lambdaSyncInv') {
+          const hookTag = upperFirst(hook.flowTag);
+          hookLambdas.push(
+            `arn:aws:lambda:\${self:custom.iz_region}:\${self:custom.iz_accountId}:function:\${self:custom.iz_resourcePrefix}${hookTag}*`
+          );
+        }
+      }
+    }
+  }
+  return [...new Set(hookLambdas)];
+}
+
+export function queueArns(queueNames) {
+  return [...new Set(queueNames)]
+    .sort()
+    .map(
+      (queueName) =>
+        `arn:aws:sqs:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_resourcePrefix}'}${queueName}`
+    );
+}
+
+export function topicArns(topicNames) {
+  return [...new Set(topicNames)]
+    .sort()
+    .map(
+      (topic) =>
+        `arn:aws:sns:${'${self:custom.iz_region}'}:${'${self:custom.iz_accountId}'}:${'${self:custom.iz_serviceTag}'}_${'${self:custom.iz_stage}'}_${topic}`
+    );
+}
+
+export function renderRoleNameConfigYaml(roles) {
+  return [
+    '# for createIamRole',
+    ...roles.map(
+      (roleName) =>
+        `- arn:aws:iam::\${self:custom.iz_accountId}:role/\${self:custom.iz_resourcePrefix}${roleName}`
+    )
+  ].join('\n');
+}