serverless-plugin-module-registry 1.0.12 → 1.0.13

package/src/internal-infrastructure/__tests__/stream-processor.test.ts

@@ -0,0 +1,994 @@
+/**
+ * Stream Processor Handler Tests
+ * Tests for the DynamoDB Stream event processor that publishes to SQS
+ */
+
+// Mock AWS SDK before imports
+const mockSQSSend = jest.fn()
+const mockEventBridgeSend = jest.fn()
+jest.mock('@aws-sdk/client-sqs', () => ({
+  SQSClient: jest.fn(() => ({
+    send: mockSQSSend,
+  })),
+  SendMessageCommand: jest.fn((input) => input),
+}))
+jest.mock('@aws-sdk/client-eventbridge', () => ({
+  EventBridgeClient: jest.fn(() => ({
+    send: mockEventBridgeSend,
+  })),
+  PutEventsCommand: jest.fn((input) => input),
+}))
+
+import { DynamoDBStreamEvent } from 'aws-lambda'
+import { handler } from '../handlers/stream-processor'
+
+describe('Stream Processor Handler', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockSQSSend.mockReset()
+    mockEventBridgeSend.mockReset()
+    // Set environment variables for each test
+    process.env.QUEUE_URL = 'https://sqs.us-east-1.amazonaws.com/123456789012/role-update-queue'
+    process.env.EVENT_BUS_NAME = 'module-registry-event-bus'
+  })
+
+  describe('Event filtering', () => {
+    it('should filter and process only ROLE# records', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#sign' },
+                SK: { S: 'FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#sign' },
+                SK: { S: 'FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+
+      await handler(event)
+
+      // Should only publish 1 message (for ROLE# record)
+      expect(mockSQSSend).toHaveBeenCalledTimes(1)
+    })
+
+    it('should handle records with lowercase pk/sk keys', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                pk: { S: 'ROLE#authenticated' },
+                sk: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                pk: { S: 'ROLE#authenticated' },
+                sk: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+
+      await handler(event)
+
+      expect(mockSQSSend).toHaveBeenCalledTimes(1)
+    })
+  })
+
+  describe('Message parsing', () => {
+    it('should parse roleName and moduleName correctly', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+
+      await handler(event)
+
+      expect(mockSQSSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          MessageBody: expect.stringContaining('"roleName":"authenticated"'),
+        })
+      )
+      expect(mockSQSSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          MessageBody: expect.stringContaining('"moduleName":"sign"'),
+        })
+      )
+    })
+
+    it('should handle REMOVE events using OldImage', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'REMOVE',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              OldImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+
+      await handler(event)
+
+      expect(mockSQSSend).toHaveBeenCalledTimes(1)
+      expect(mockSQSSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          MessageBody: expect.stringContaining('"eventType":"REMOVE"'),
+        })
+      )
+    })
+  })
+
+  describe('Message deduplication', () => {
+    it('should deduplicate multiple events for same role+module', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#fkpvztwW' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#fkpvztwW' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '3',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#7tmARMbS' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#7tmARMbS' },
+              },
+              SequenceNumber: '333',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+
+      await handler(event)
+
+      // Should deduplicate to 1 message (all same role+module)
+      expect(mockSQSSend).toHaveBeenCalledTimes(1)
+    })
+
+    it('should not deduplicate events for different role+module combos', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#workflow#FEATURE#abc123' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#workflow#FEATURE#abc123' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '3',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#unauthenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#unauthenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '333',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+
+      await handler(event)
+
+      // Should publish 3 messages (different role+module combos)
+      expect(mockSQSSend).toHaveBeenCalledTimes(3)
+    })
+  })
+
+  describe('SQS message publishing', () => {
+    it('should publish message with correct structure', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+
+      await handler(event)
+
+      expect(mockSQSSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          QueueUrl: 'https://sqs.us-east-1.amazonaws.com/123456789012/role-update-queue',
+          MessageGroupId: 'authenticated',
+          MessageBody: expect.any(String),
+          MessageDeduplicationId: expect.any(String),
+        })
+      )
+
+      const messageBody = JSON.parse(mockSQSSend.mock.calls[0][0].MessageBody)
+      expect(messageBody).toMatchObject({
+        roleName: 'authenticated',
+        moduleName: 'sign',
+        eventType: 'INSERT',
+        timestamp: expect.any(String),
+      })
+    })
+  })
+
+  describe('Error handling', () => {
+    it('should throw error if QUEUE_URL not set', async () => {
+      const savedQueueUrl = process.env.QUEUE_URL
+      delete process.env.QUEUE_URL
+
+      const event: DynamoDBStreamEvent = {
+        Records: [],
+      }
+
+      await expect(handler(event)).rejects.toThrow('QUEUE_URL environment variable not set')
+
+      // Restore for next test
+      process.env.QUEUE_URL = savedQueueUrl
+    })
+
+    it('should continue processing other records if one fails', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'INVALID_SK_FORMAT' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'INVALID_SK_FORMAT' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+
+      await handler(event)
+
+      // Should still publish the valid message
+      expect(mockSQSSend).toHaveBeenCalledTimes(1)
+    })
+
+    it('should continue publishing even if one message fails', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#unauthenticated' },
+                SK: { S: 'MODULE#workflow#FEATURE#abc123' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#unauthenticated' },
+                SK: { S: 'MODULE#workflow#FEATURE#abc123' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend
+        .mockRejectedValueOnce(new Error('SQS error'))
+        .mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // Should attempt to publish both messages
+      expect(mockSQSSend).toHaveBeenCalledTimes(2)
+    })
+  })
+
+  describe('Empty event handling', () => {
+    it('should handle empty Records array', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [],
+      }
+
+      await handler(event)
+
+      expect(mockSQSSend).not.toHaveBeenCalled()
+      expect(mockEventBridgeSend).not.toHaveBeenCalled()
+    })
+
+    it('should handle events with no ROLE# records', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#sign' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#sign' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockEventBridgeSend.mockResolvedValue({})
+
+      await handler(event)
+
+      expect(mockSQSSend).not.toHaveBeenCalled()
+      // Should publish FEATURE# record to EventBridge
+      expect(mockEventBridgeSend).toHaveBeenCalledTimes(1)
+    })
+  })
+
+  describe('FEATURE# record processing', () => {
+    it('should process FEATURE# records and publish to EventBridge', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#public' },
+                SK: { S: 'MODULE#public#FEATURE#abc123' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#public' },
+                SK: { S: 'MODULE#public#FEATURE#abc123' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockEventBridgeSend.mockResolvedValue({})
+
+      await handler(event)
+
+      expect(mockEventBridgeSend).toHaveBeenCalledTimes(1)
+      expect(mockEventBridgeSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          Entries: expect.arrayContaining([
+            expect.objectContaining({
+              Source: 'module-registry',
+              DetailType: 'FeatureChange',
+              Detail: expect.stringContaining('"moduleName":"public"'),
+              EventBusName: 'module-registry-event-bus',
+            }),
+          ]),
+        })
+      )
+    })
+
+    it('should filter MODULE# records correctly', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#sign' },
+                SK: { S: 'MODULE#sign#FEATURE#xyz789' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#sign' },
+                SK: { S: 'MODULE#sign#FEATURE#xyz789' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+      mockEventBridgeSend.mockResolvedValue({})
+
+      await handler(event)
+
+      // Should publish 1 ROLE# to SQS and 1 FEATURE# to EventBridge
+      expect(mockSQSSend).toHaveBeenCalledTimes(1)
+      expect(mockEventBridgeSend).toHaveBeenCalledTimes(1)
+    })
+
+    it('should parse moduleName and featureId from FEATURE# records', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'MODIFY',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#workflow' },
+                SK: { S: 'MODULE#workflow#FEATURE#test456' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#workflow' },
+                SK: { S: 'MODULE#workflow#FEATURE#test456' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockEventBridgeSend.mockResolvedValue({})
+
+      await handler(event)
+
+      expect(mockEventBridgeSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          Entries: expect.arrayContaining([
+            expect.objectContaining({
+              Detail: expect.stringContaining('"moduleName":"workflow"'),
+            }),
+          ]),
+        })
+      )
+      expect(mockEventBridgeSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          Entries: expect.arrayContaining([
+            expect.objectContaining({
+              Detail: expect.stringContaining('"featureId":"test456"'),
+            }),
+          ]),
+        })
+      )
+      expect(mockEventBridgeSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          Entries: expect.arrayContaining([
+            expect.objectContaining({
+              Detail: expect.stringContaining('"eventType":"MODIFY"'),
+            }),
+          ]),
+        })
+      )
+    })
+
+    it('should ensure ROLE# processing unaffected when FEATURE# records present', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#public' },
+                SK: { S: 'MODULE#public#FEATURE#abc123' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#public' },
+                SK: { S: 'MODULE#public#FEATURE#abc123' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+      mockEventBridgeSend.mockResolvedValue({})
+
+      await handler(event)
+
+      // Verify ROLE# still publishes to SQS
+      expect(mockSQSSend).toHaveBeenCalledTimes(1)
+      expect(mockSQSSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          MessageBody: expect.stringContaining('"roleName":"authenticated"'),
+        })
+      )
+
+      // Verify FEATURE# publishes to EventBridge
+      expect(mockEventBridgeSend).toHaveBeenCalledTimes(1)
+    })
+
+    it('should ensure EventBridge failure does not break ROLE# processing', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#public' },
+                SK: { S: 'MODULE#public#FEATURE#abc123' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#public' },
+                SK: { S: 'MODULE#public#FEATURE#abc123' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+      mockEventBridgeSend.mockRejectedValue(new Error('EventBridge error'))
+
+      await handler(event)
+
+      // Verify ROLE# still published successfully despite EventBridge failure
+      expect(mockSQSSend).toHaveBeenCalledTimes(1)
+      expect(mockEventBridgeSend).toHaveBeenCalledTimes(1)
+    })
+
+    it('should handle mixed ROLE# and FEATURE# records in same batch', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#feat1' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#authenticated' },
+                SK: { S: 'MODULE#sign#FEATURE#feat1' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '2',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#public' },
+                SK: { S: 'MODULE#public#FEATURE#feat2' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#public' },
+                SK: { S: 'MODULE#public#FEATURE#feat2' },
+              },
+              SequenceNumber: '222',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '3',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'ROLE#unauthenticated' },
+                SK: { S: 'MODULE#workflow#FEATURE#feat3' },
+              },
+              NewImage: {
+                PK: { S: 'ROLE#unauthenticated' },
+                SK: { S: 'MODULE#workflow#FEATURE#feat3' },
+              },
+              SequenceNumber: '333',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+          {
+            eventID: '4',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                PK: { S: 'MODULE#sign' },
+                SK: { S: 'MODULE#sign#FEATURE#feat4' },
+              },
+              NewImage: {
+                PK: { S: 'MODULE#sign' },
+                SK: { S: 'MODULE#sign#FEATURE#feat4' },
+              },
+              SequenceNumber: '444',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockSQSSend.mockResolvedValue({})
+      mockEventBridgeSend.mockResolvedValue({})
+
+      await handler(event)
+
+      // Should publish 2 ROLE# messages to SQS
+      expect(mockSQSSend).toHaveBeenCalledTimes(2)
+      // Should publish 2 FEATURE# events to EventBridge (in 1 batch)
+      expect(mockEventBridgeSend).toHaveBeenCalledTimes(1)
+
+      // Verify EventBridge batch contains 2 entries
+      const eventBridgeCall = mockEventBridgeSend.mock.calls[0][0]
+      expect(eventBridgeCall.Entries).toHaveLength(2)
+    })
+
+    it('should handle lowercase pk/sk keys for FEATURE# records', async () => {
+      const event: DynamoDBStreamEvent = {
+        Records: [
+          {
+            eventID: '1',
+            eventName: 'INSERT',
+            eventVersion: '1.1',
+            eventSource: 'aws:dynamodb',
+            awsRegion: 'us-east-1',
+            dynamodb: {
+              Keys: {
+                pk: { S: 'MODULE#public' },
+                sk: { S: 'MODULE#public#FEATURE#abc123' },
+              },
+              NewImage: {
+                pk: { S: 'MODULE#public' },
+                sk: { S: 'MODULE#public#FEATURE#abc123' },
+              },
+              SequenceNumber: '111',
+              SizeBytes: 100,
+              StreamViewType: 'NEW_AND_OLD_IMAGES',
+            },
+          },
+        ],
+      }
+
+      mockEventBridgeSend.mockResolvedValue({})
+
+      await handler(event)
+
+      expect(mockEventBridgeSend).toHaveBeenCalledTimes(1)
+    })
+  })
+})