@izara_project/izara-core-generate-service-code 1.0.98 → 1.0.100

package/src/emit/application/custom/templates/s3/Start_Main.ejs

@@ -0,0 +1,197 @@
+/*
+Copyright (C) 2026 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { v7 as uuidv7 } from 'uuid';
+import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+import { S3Client } from '@aws-sdk/client-s3';
+import { consts } from '@izara_project/izara-middleware';
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+import { webSocket } from '@izara_project/izara-core-library-external-request';
+const { postToConnection } = webSocket;
+import { utils } from '@izara_project/izara-core-library-service-schemas';
+const { createFlowTypeConcat } = utils;
+
+const client = new S3Client({ region: process.env.AWS_REGION });
+
+//(<optionalRequired>)
+//(</optionalRequired>)
+
+/**
+ * Step 1: Start (Deferred-Node S3 Pipeline - ADR-016)
+ * Generates UUIDv7, computes S3 Presigned POST in-memory, writes ephemeral WebSocketTask,
+ * and returns upload parameters to client without writing entity records to the database.
+ *
+ * @param {Object} _izContext
+ * @param {Object} requestParams
+ * @param {Object} callingFlowConfig
+ * @returns {Promise<Object>}
+ */
+export default async function <%- functionName %>(
+  _izContext,
+  requestParams,
+  callingFlowConfig = {}
+  //(<additionalParams>)
+  //(</additionalParams>)
+) {
+  try {
+    _izContext.logger.debug('<%- functionName %> started', {
+      requestParams,
+      callingFlowConfig
+    });
+
+    const connectionId = _izContext.correlationIds.get(consts.CONNECTION_ID);
+    const submittedByUserId = _izContext.correlationIds?.get(
+      consts.SUBMITTED_BY_USER_ID
+    );
+    if (!submittedByUserId) {
+      throw new Error('Submitted by user id is required');
+    }
+
+    //(<beforeCreateObjectHook>)
+    //(</beforeCreateObjectHook>)
+
+<% if (isRbac) { -%>
+    const { checkRbacPermission } =
+      await import('@izara_project/izara-authorization');
+
+    //(<rbacParameterGroups_<%- flowTag %>>)
+    const parameterGroups = {};
+    //(</rbacParameterGroups_<%- flowTag %>>)
+
+    const resultPermissionCheck = await checkRbacPermission(
+      _izContext,
+      {
+        flowTag: requestParams.flowTag || '<%- flowTag %>',
+        serviceTag: process.env.iz_serviceTag
+      },
+      parameterGroups,
+      {
+        targetIdentifiers: requestParams.targetIdentifiers,
+        rbacObjType: {
+          serviceTag: '<%- parentServiceTag || rbacServiceTag %>',
+          objectType: '<%- parentObjectType || objectType %>'
+        },
+        sync: true
+      }
+    );
+
+    _izContext.logger.debug(
+      `[${process.env.iz_serviceTag}:<%- flowTag %>] checkRbacPermission result:`,
+      resultPermissionCheck
+    );
+
+    if (resultPermissionCheck && resultPermissionCheck.permission !== true) {
+      throw new Error('Permission denied');
+    }
+<% } -%>
+
+    const <%- objectType %>Id = uuidv7();
+
+<% if (typeof parentIdKeys !== 'undefined' && parentIdKeys && parentIdKeys.length > 0) { -%>
+    const targetParentId = requestParams.targetIdentifiers?.<%- parentIdKeys[0] %>;
+<%   for (const key of parentIdKeys) { -%>
+    const target<%- key.charAt(0).toUpperCase() + key.slice(1) %> = requestParams.targetIdentifiers?.<%- key %>;
+    if (!target<%- key.charAt(0).toUpperCase() + key.slice(1) %>) {
+      throw new Error('targetIdentifiers.<%- key %> is required');
+    }
+<%   } -%>
+<% } -%>
+
+    let maxFileSizeMb = <%- maxFileSizeMb %>;
+    if (requestParams.file?.size) {
+      maxFileSizeMb = Math.ceil(requestParams.file.size / 1048576);
+    } else if (requestParams.file?.fileSize) {
+      maxFileSizeMb = requestParams.file.fileSize;
+    } else if (requestParams.fieldNames?.fileSize) {
+      maxFileSizeMb = requestParams.fieldNames.fileSize;
+    }
+
+    //(<createKeyForUploadFile>)
+    let importType = '<%- defaultImportType %>';
+    let uploadPath = '';
+    //(</createKeyForUploadFile>)
+    const Key = `<%- s3KeyPrefix %>${uploadPath}`;
+    const maximumSize = maxFileSizeMb * 1048576;
+
+    let createPreSignUrlParam = {
+      Bucket: '<%- bucketName %>',
+      Key: Key,
+      Conditions: [
+        ['content-length-range', 0, maximumSize],
+        ['eq', '$x-amz-meta-<%- objectType %>Id', <%- objectType %>Id],
+<% if (typeof parentIdKeys !== 'undefined' && parentIdKeys && parentIdKeys.length > 0) { -%>
+<%   for (const key of parentIdKeys) { -%>
+        ['eq', '$x-amz-meta-<%- key %>', target<%- key.charAt(0).toUpperCase() + key.slice(1) %>],
+<%   } -%>
+<% } -%>
+        ['starts-with', '$x-amz-meta-submittedByUserId', ''],
+        ['starts-with', '$Content-Type', '<%- contentTypePrefix %>']
+        //(<conditionCreateUrlLink>)
+        //(</conditionCreateUrlLink>)
+      ],
+      Fields: {
+        'x-amz-meta-<%- objectType %>Id': <%- objectType %>Id,
+<% if (typeof parentIdKeys !== 'undefined' && parentIdKeys && parentIdKeys.length > 0) { -%>
+<%   for (const key of parentIdKeys) { -%>
+        'x-amz-meta-<%- key %>': target<%- key.charAt(0).toUpperCase() + key.slice(1) %>,
+<%   } -%>
+<% } -%>
+        'x-amz-meta-submittedByUserId': submittedByUserId,
+        //(<fieldCreateUrlLink>)
+        //(</fieldCreateUrlLink>)
+      },
+      Expires: <%- expires %>
+    };
+
+    //(<modifyPreSignUrlParam>)
+    //(</modifyPreSignUrlParam>)
+
+    const uploadUrl = await createPresignedPost(client, createPreSignUrlParam);
+
+    if (connectionId) {
+      await dynamodbSharedLib.putItem(
+        _izContext,
+        await dynamodbSharedLib.tableName(_izContext, 'WebSocketTask'),
+        {
+          taskKey: `${createFlowTypeConcat(_izContext, { flowTag: '<%- flowTag %>', serviceTag: process.env.iz_serviceTag })}${<%- objectType %>Id}`,
+          connectionId: connectionId,
+          expirationTime: Math.floor(Date.now() / 1000) + 7200
+        }
+      );
+
+      await postToConnection(
+        _izContext,
+        {
+          status: 'success',
+          data: {
+            uploadUrl: uploadUrl,
+            <%- objectType %>Id: <%- objectType %>Id
+          }
+        },
+        connectionId
+      );
+    }
+
+    return {
+      uploadUrl: uploadUrl,
+      <%- objectType %>Id: <%- objectType %>Id
+    };
+  } catch (err) {
+    _izContext.logger.error('Error in <%- functionName %>:', err);
+    throw err;
+  }
+}

package/src/emit/application/rbac/emitDynamicRbacFlowSchemas.js

@@ -18,7 +18,10 @@ const RBAC_CORE_FLOW_DEFINITIONS = [
 ];
 
 const LIMIT_FLOW_DEFINITIONS = [
-  { flowTag: 'ReservedDynamicUsage', event: ['ownTopic'] },
+  {
+    flowTag: 'ReservedDynamicUsage',
+    event: ['lambdaSyncInv', 'lambdaSyncApi']
+  },
   {
     flowTag: 'ConfirmUsage',
     event: ['ownTopic', 'lambdaSyncInv', 'lambdaSyncApi']
@@ -26,6 +29,10 @@ const LIMIT_FLOW_DEFINITIONS = [
   {
     flowTag: 'CancelUsage',
     event: ['ownTopic', 'lambdaSyncInv', 'lambdaSyncApi']
+  },
+  {
+    flowTag: 'ReservedUsageTtlExpired',
+    event: ['dss']
   }
 ];
 

package/src/emit/application/rbac/emitRbacApplicationArtifacts.js

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises';
 
 import {
   renderApiFunctionYaml,
+  renderDssFunctionYaml,
   renderInvFunctionYaml,
   renderSqsFunctionYaml,
   renderWbsFunctionYaml
@@ -53,7 +54,10 @@ export async function emitRbacApplicationArtifacts(objects) {
 
   const limitHandlers = await Promise.all(
     hasSelfRbac
-      ? ACCOUNT_LIMIT_HANDLERS.map(createAccountLimitHandler)
+      ? [
+          ...ACCOUNT_LIMIT_HANDLERS.map(createAccountLimitHandler),
+          createReservedUsageTtlExpiredHandler()
+        ]
       : []
   );
 
@@ -170,12 +174,22 @@ const STATIC_RBAC_APPLICATION_PATHS = [
 ];
 
 const STATIC_LIMIT_APPLICATION_PATHS = [
-  ...ACCOUNT_LIMIT_HANDLERS.flatMap((flowTag) => [
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_WbsMain.js`,
-    `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrWbs.js`
-  ]),
+  ...ACCOUNT_LIMIT_HANDLERS.flatMap((flowTag) => {
+    const paths = [
+      `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_Main.js`,
+      `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrInv.js`,
+      `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrApi.js`
+    ];
+    if (flowTag !== 'ReservedDynamicUsage') {
+      paths.splice(
+        1,
+        0,
+        `app/src/generatedCode/FlowLimit/${flowTag}/source/${flowTag}_HdrSqs.js`
+      );
+    }
+    return paths;
+  }),
+  'app/src/generatedCode/FlowLimit/ReservedUsageTtlExpired/source/ReservedUsageTtlExpired_HdrDss.js',
   FLOW_LIMITS_YAML_PATH
 ];
 
@@ -205,34 +219,101 @@ export function rbacApplicationManagedPaths(objects = []) {
 async function createAccountLimitHandler(flowTag) {
   const sourcePath = `app/src/generatedCode/FlowLimit/${flowTag}/source`;
   const handlerPath = `src/generatedCode/FlowLimit/${flowTag}/source`;
-  const webSocket = await createWebSocketEntry(
+  const shared = {
     flowTag,
-    sourcePath,
-    handlerPath
+    flowStepName: '',
+    mainFileName: `${flowTag}_Main`,
+    functionName: flowTag
+  };
+  const artifacts = [
+    {
+      path: `${sourcePath}/${flowTag}_Main.js`,
+      content: await renderRbacTemplate(`${flowTag}_Main.ejs`, { flowTag })
+    }
+  ];
+  const functions = [];
+  if (flowTag !== 'ReservedDynamicUsage') {
+    artifacts.push({
+      path: `${sourcePath}/${flowTag}_HdrSqs.js`,
+      content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
+    });
+    functions.push({
+      type: 'sqs',
+      functionName: `${flowTag}HdrSqs`,
+      handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
+      roleName: 'FlowRbacRole',
+      queueName: `${flowTag}HdrSqs`,
+      flowTag: flowTag,
+      flowStepName: ''
+    });
+  }
+  artifacts.push(
+    {
+      path: `${sourcePath}/${flowTag}_HdrInv.js`,
+      content: await renderSharedTemplate('FlowHandler_HdrInv.ejs', shared)
+    },
+    {
+      path: `${sourcePath}/${flowTag}_HdrApi.js`,
+      content: await renderSharedTemplate('FlowHandler_HdrApi.ejs', shared)
+    }
   );
+  functions.push(
+    {
+      type: 'inv',
+      functionName: `${flowTag}HdrInv`,
+      handlerPath: `${handlerPath}/${flowTag}_HdrInv.main`,
+      roleName: 'FlowRbacRole',
+      flowTag: flowTag,
+      flowStepName: ''
+    },
+    {
+      type: 'api',
+      functionName: `${flowTag}HdrApi`,
+      handlerPath: `${handlerPath}/${flowTag}_HdrApi.main`,
+      roleName: 'FlowRbacRole',
+      flowTag: flowTag,
+      flowStepName: ''
+    }
+  );
+  return {
+    artifacts,
+    functions
+  };
+}
+
+async function createReservedUsageTtlExpiredHandler() {
+  const sourcePath =
+    'app/src/generatedCode/FlowLimit/ReservedUsageTtlExpired/source';
+  const handlerPath =
+    'src/generatedCode/FlowLimit/ReservedUsageTtlExpired/source';
   return {
     artifacts: [
       {
-        path: `${sourcePath}/${flowTag}_Main.js`,
-        content: await renderRbacTemplate(`${flowTag}_Main.ejs`, { flowTag })
-      },
-      {
-        path: `${sourcePath}/${flowTag}_HdrSqs.js`,
-        content: await renderRbacTemplate('ListRbac_HdrSqs.ejs', { flowTag })
-      },
-      ...webSocket.artifacts
+        path: `${sourcePath}/ReservedUsageTtlExpired_HdrDss.js`,
+        content: await renderRbacTemplate('ReservedUsageTtlExpired_HdrDss.ejs')
+      }
     ],
     functions: [
       {
-        type: 'sqs',
-        functionName: `${flowTag}HdrSqs`,
-        handlerPath: `${handlerPath}/${flowTag}_HdrSqs.main`,
+        type: 'dss',
+        functionName: 'ReservedUsageTtlExpiredHdrDss',
+        handlerPath: `${handlerPath}/ReservedUsageTtlExpired_HdrDss.main`,
         roleName: 'FlowRbacRole',
-        queueName: `${flowTag}HdrSqs`,
-        flowTag: flowTag,
+        tableName: 'RunningTotalReservedUsage',
+        batchSize: 100,
+        startingPosition: 'TRIM_HORIZON',
+        filterPatterns: [
+          {
+            eventName: ['REMOVE'],
+            userIdentity: {
+              type: ['Service'],
+              principalId: ['dynamodb.amazonaws.com']
+            }
+          }
+        ],
+        flowTag: 'ReservedUsageTtlExpired',
         flowStepName: ''
-      },
-      ...webSocket.functions
+      }
     ]
   };
 }
@@ -523,6 +604,7 @@ function renderFunctionYaml(descriptor) {
   if (descriptor.type === 'api') return renderApiFunctionYaml(descriptor);
   if (descriptor.type === 'inv') return renderInvFunctionYaml(descriptor);
   if (descriptor.type === 'wbs') return renderWbsFunctionYaml(descriptor);
+  if (descriptor.type === 'dss') return renderDssFunctionYaml(descriptor);
   return renderSqsFunctionYaml(descriptor);
 }
 

package/src/emit/application/rbac/templates/ReservedDynamicUsage_Main.ejs

@@ -161,7 +161,7 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
     let passStatus = false;
     if (currentTotal + value <= maxLimit) {
       passStatus = true;
-      const ttlTimestamp = Math.floor(Date.now() / 1000) + 3600;
+      const expirationTime = Math.floor(Date.now() / 1000) + 3600;
 
       await dynamodbSharedLib.putItem(
         _izContext,
@@ -169,9 +169,11 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
         {
           runningTotalReservedId: `${identifiersConcat}_${flowTypeConcat}`,
           usedTimestampId: uniqueIdentify,
+          identifiersConcat,
+          flowTypeConcat,
           usageCount: value,
           runningTotalUsageStatus: 'reserved',
-          ttlTimestamp
+          expirationTime
         }
       );
 
@@ -194,13 +196,31 @@ export default async function ReservedDynamicUsage(_izContext, requestParams) {
       identifiersConcat
     };
 
-    await sns.publishMessage(_izContext, {
-      message: { returnResult },
-      TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
-        _izContext,
-        'ReservedDynamicUsage_Out'
-      )
-    });
+    const eventSourceTag =
+      _izContext.izEventSource?.eventSourceTag ||
+      requestParams?.izEventSource?.eventSourceTag;
+
+    let isSync = false;
+    if (
+      eventSourceTag === 'DirectInvoke' ||
+      eventSourceTag === 'ApiGateway' ||
+      eventSourceTag === 'ApiGatewayV2' ||
+      requestParams?.hasOwnProperty('__context__')
+    ) {
+      isSync = true;
+    }
+
+    if (!isSync) {
+      await sns.publishMessage(_izContext, {
+        message: { returnResult },
+        TopicArn: snsSharedLib.snsTopicArnByFlowSchema(
+          _izContext,
+          'ReservedDynamicUsage_Out'
+        )
+      });
+    }
+
+    return returnResult;
   } catch (error) {
     _izContext.logger.error(`[${process.env.iz_serviceTag}:ReservedDynamicUsage] error:`, error);
     throw error;

package/src/emit/application/rbac/templates/ReservedUsageTtlExpired_HdrDss.ejs

@@ -0,0 +1,176 @@
+/*
+Copyright (C) 2020 Sven Mason <http://izara.io>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { middlewareHandler as middleware } from '@izara_project/izara-middleware';
+import Logger from '@izara_project/izara-core-library-logger';
+import dynamodbSharedLib from '@izara_project/izara-core-library-dynamodb';
+
+/**
+ * DynamoDB Stream handler for TTL expired records in RunningTotalReservedUsage.
+ * Automatically refunds abandoned reservations with atomic decrement.
+ */
+export const main = middleware.wrap(async (event, context) => {
+  try {
+    if (!event || !Array.isArray(event.Records)) {
+      Logger.debug('No records in DynamoDB stream event');
+      return;
+    }
+
+    let _izContext = event._izContext;
+    if (!_izContext) {
+      _izContext = {
+        logger: Logger,
+        correlationIds: new Map()
+      };
+    }
+
+    for (const record of event.Records) {
+      let recordContext = record._izContext;
+      if (!recordContext) {
+        recordContext = _izContext;
+      }
+      let recordLogger = recordContext.logger;
+      if (!recordLogger) {
+        recordLogger = Logger;
+      }
+
+      const isTtlDelete =
+        record.eventName === 'REMOVE' &&
+        record.userIdentity &&
+        record.userIdentity.type === 'Service' &&
+        record.userIdentity.principalId === 'dynamodb.amazonaws.com';
+
+      if (!isTtlDelete) {
+        continue;
+      }
+
+      const oldImage = record.dynamodb && record.dynamodb.OldImage;
+      if (!oldImage) {
+        continue;
+      }
+
+      let oldStatus = null;
+      if (oldImage.runningTotalUsageStatus && oldImage.runningTotalUsageStatus.S) {
+        oldStatus = oldImage.runningTotalUsageStatus.S;
+      }
+
+      if (oldStatus !== 'reserved') {
+        continue;
+      }
+
+      let identifiersConcat = null;
+      if (oldImage.identifiersConcat && oldImage.identifiersConcat.S) {
+        identifiersConcat = oldImage.identifiersConcat.S;
+      }
+      let flowTypeConcat = null;
+      if (oldImage.flowTypeConcat && oldImage.flowTypeConcat.S) {
+        flowTypeConcat = oldImage.flowTypeConcat.S;
+      }
+
+      if ((!identifiersConcat || !flowTypeConcat) && oldImage.runningTotalReservedId && oldImage.runningTotalReservedId.S) {
+        const reservedId = oldImage.runningTotalReservedId.S;
+        const lastUnderscoreIndex = reservedId.lastIndexOf('_');
+        if (lastUnderscoreIndex > 0) {
+          if (!identifiersConcat) {
+            identifiersConcat = reservedId.substring(0, lastUnderscoreIndex);
+          }
+          if (!flowTypeConcat) {
+            flowTypeConcat = reservedId.substring(lastUnderscoreIndex + 1);
+          }
+        }
+      }
+
+      let usageCount = 1;
+      if (oldImage.usageCount && oldImage.usageCount.N) {
+        usageCount = Number(oldImage.usageCount.N);
+      }
+
+      if (identifiersConcat && flowTypeConcat && usageCount > 0) {
+        const usageTable = dynamodbSharedLib.tableName(
+          recordContext,
+          'RunningTotalUsage'
+        );
+
+        const usageRecord = await dynamodbSharedLib.getItem(
+          recordContext,
+          usageTable,
+          {
+            identifiersConcat: identifiersConcat,
+            flowTypeConcat: flowTypeConcat
+          }
+        );
+
+        if (usageRecord) {
+          let currentTotal = 0;
+          if (typeof usageRecord.totalCount === 'number') {
+            currentTotal = usageRecord.totalCount;
+          }
+          const newTotal = Math.max(0, currentTotal - usageCount);
+          const updateUuid = recordContext.uniqueRequestId || `${Date.now()}`;
+
+          const queryElementsWhenUpdate = {
+            additionalAttributes: { currentUuid: usageRecord.updateUuid },
+            logicalElements: [
+              {
+                type: 'logical',
+                comparison: 'equals',
+                lhsAttribute: 'updateUuid',
+                rhsReference: 'currentUuid'
+              }
+            ],
+            returnValues: 'ALL_NEW'
+          };
+
+          const updateAttributes = [
+            { attributeName: 'totalCount', action: 'set', value: newTotal },
+            { attributeName: 'updateUuid', action: 'set', value: updateUuid }
+          ];
+
+          await dynamodbSharedLib.updateItem(
+            recordContext,
+            usageTable,
+            {
+              identifiersConcat: identifiersConcat,
+              flowTypeConcat: flowTypeConcat
+            },
+            updateAttributes,
+            queryElementsWhenUpdate,
+            {
+              complexAttributes: true,
+              errorOnConditionalExpNotPass: false
+            }
+          ).catch(() => null);
+
+          recordLogger.info({
+            message: '[ReservedUsageTtlExpired] Auto-refunded expired reservation',
+            identifiersConcat: identifiersConcat,
+            flowTypeConcat: flowTypeConcat,
+            usageCount: usageCount,
+            previousTotal: currentTotal,
+            newTotal: newTotal
+          });
+        }
+      }
+    }
+  } catch (err) {
+    Logger.error({
+      message: 'Unhandled error in ReservedUsageTtlExpired_HdrDss',
+      error: err
+    });
+    throw err;
+  }
+});

package/src/emit/application/rbac/templates/UserRbacFlow_Main.ejs

@@ -55,7 +55,8 @@ async function _getL2Cache(_izContext, submittedByUserId, cacheSubKey) {
       userId: submittedByUserId,
       cacheKey: cacheSubKey
     });
-    if (result && result.ttlTimestamp && result.ttlTimestamp > Math.floor(Date.now() / 1000)) {
+    const expTime = result && (result.expirationTime || result.ttlTimestamp);
+    if (expTime && expTime > Math.floor(Date.now() / 1000)) {
       return {
         returnValue: {
           permission: Boolean(result.permission),
@@ -75,14 +76,14 @@ async function _getL2Cache(_izContext, submittedByUserId, cacheSubKey) {
 async function _setL2Cache(_izContext, submittedByUserId, cacheSubKey, value) {
   try {
     const tableName = dynamodbSharedLib.tableName(_izContext, 'RbacPermissionCaches');
-    const ttlTimestamp = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
+    const expirationTime = Math.floor(Date.now() / 1000) + L2_TTL_SECONDS;
     await dynamodbSharedLib.putItem(_izContext, tableName, {
       userId: submittedByUserId,
       cacheKey: cacheSubKey,
       permission: value.returnValue ? value.returnValue.permission : value.permission,
       roleIdKey: value.returnValue ? value.returnValue.roleIdKey : value.roleIdKey,
       rbacType: 'target',
-      ttlTimestamp
+      expirationTime
     });
   } catch (error) {
     // Safely ignore L2 write errors if table is not configured

package/src/emit/application/system/templates/Register_HdrWbs.ejs

@@ -27,7 +27,8 @@ export const main = middleware.wrap(async (event, context) => {
             await dynamodbSharedLib.tableName(event._izContext, 'WebSocketTask'),
             {
               taskKey: correlationId,
-              connectionId: connectionId
+              connectionId: connectionId,
+              expirationTime: Math.floor(Date.now() / 1000) + 7200
             }
           );