We don't have a database method to remove the SessionItem, because there was no need to remove it explicitly. The item record is removed by the DynamoDB TTL. We don't have any device "logout" for implementing the remove method and removing it explicitly from the tunnelbroker side.
Now we need to remove the SessionItem record from the database explicitly in tests (we'll insert, check and remove).
Instead of two separate (action === 'edit_role') blocks, could we merge the two?
We could move await dbQuery(query); within both the (action === 'create_role') (line 139) and else if (action === 'edit_role') (line 144) blocks?
Not a huge deal, whatever you prefer