IAM Roles | Store roles in accounts with type=role instead of a separate iam_roles collection

Signed-off-by: Aayush Chouhan <achouhan@redhat.com>

Author: aayushchouhan09

src/sdk/nb.d.ts

@@ -92,26 +92,30 @@ interface Account extends Base {
     email: SensitiveString;
     next_password_change: Date;
     is_support?: boolean;
+    // Optional identity kind: account | user | role. Absent on legacy docs.
+    type?: 'account' | 'user' | 'role';
     access_keys: Array<{
         access_key: SensitiveString;
         secret_key: SensitiveString;
     }>;
     master_key_id: ID;
-}
-
-interface IamRole extends Base {
-    _id: ID;
-    owner: ID;
-    name: string;
-    iam_path: string;
+    iam_path?: string;
+    iam_user_policies?: object[];
     description?: string;
     max_session_duration?: number;
-    assume_role_policy_document: object;
+    assume_role_policy_document?: object;
     iam_role_policies?: object[];
-    creation_date: Date;
+    creation_date?: Date;
     deleted?: Date;
 }
 
+/** IAM role identity stored in accounts with type === 'role'. */
+type IamRole = Account & {
+    type: 'role';
+    owner: ID;
+    assume_role_policy_document: object;
+};
+
 interface NodeAPI extends Base {
     _id: ID;
     name: string;

src/sdk/object_sdk.js

@@ -65,10 +65,12 @@ const account_cache = new LRUCache({
     validate: (data, params) => _validate_account(data, params),
 });
 
-// IAM role cache — keyed by owner + role_name (role names are unique per account, not globally)
+// IAM role cache — keyed by owner + role_name (unique per account; email uses lowercase name)
 const iam_roles_cache = new LRUCache({
     name: 'IamRolesCache',
     expiry_ms: config.IAM_ROLES_CACHE_EXPIRY_MS,
+    // Align with bucket_namespace_cache; RolesPerAccount max is 1000
+    max_usage: 1000,
     /**
      * Set type for the generic template
      * @param {{
@@ -77,7 +79,7 @@ const iam_roles_cache = new LRUCache({
      *      bucketspace: nb.BucketSpace;
      * }} params
      */
-    make_key: ({ role_name, owner_account_id }) => `${owner_account_id}:${role_name}`,
+    make_key: ({ role_name, owner_account_id }) => `${owner_account_id}:${role_name.toLowerCase()}`,
     load: async ({ bucketspace, role_name, owner_account_id }) =>
         bucketspace.read_role_by_name({ role_name, owner_account_id }),
 });