diff --git a/CHANGELOG.md b/CHANGELOG.md index 895699ca..afcc9f5b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,16 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m ## Unreleased +- learn(bug-ledger): **published REST answers 404, not 403, for a user without the allowed role** (TK-046, Mendix runtime behaviour; write 404 into the contract) — a five-app lab project +- learn(bug-ledger): **the Business Events consumer silently drops a record whose ce_id is over 36 characters** (TK-045, Business Events module owner; use a UUID) — a five-app lab project +- learn(testing): **`mxcli test --local` takes `--app-port` / `--admin-port` from v0.27.0, so it no longer refuses while another app holds 8081** (TK-044, fixed upstream; ledger only, the skill line waits on an A/B) — a five-app lab project +- learn(bug-ledger): **`run --local` starts with scheduled events off** (TK-043; skill text already in testing-shape.md, now findable by symptom) — a five-app lab project +- learn(bug-ledger): **`marketplace install` pulls no dependency and leaves CE0463 widgets; `install --file` and `fix widgets` are the workaround** (TK-042; overlaps merged upstream #1151) — a five-app lab project +- learn(bug-ledger): **a Business Events AppId is copied with the model and shown by no command** (TK-041, upstream draft) — a five-app lab project +- learn(bug-ledger): **`create business event service` gaps: String(200) only, CloudEvent id collision, V2 subject and channel name need patching** (TK-040, upstream draft) — a five-app lab project +- learn(secrets): **`describe constant` and `show constants` print a stored credential verbatim; keep secret constants empty and pass `--constant`** (TK-039, HIGH, upstream draft; skill line + ledger) — a five-app lab project +- learn(bug-ledger): **a workflow call-microflow with a System.Workflow parameter: check demands the mapping, mxbuild says CE0117** (TK-038, upstream draft, workaround recorded) — a five-app lab project +- learn(bug-ledger): **an undefined menu glyph is only a warning and kills the build with no error file; a partial navigation modify resets the menu** (TK-037, upstream draft, workaround recorded) — a five-app lab project - fix(verify-module): the graph, coverage and journeys rung budgets are variables (`VM_TMO_GRAPH`, `VM_TMO_COVERAGE`, `VM_TMO_JOURNEYS`; defaults unchanged at 300/300/900, like the existing `VM_TMO_CONFORMANCE`), so a large build plan or a loaded machine can raise the 300 s that reported a clean coverage run as a timeout (TK-008) — five-app lab project (Mendix 11.15, mxcli v0.26.0) - fix(app-restart): mask the value of any `Name=value` whose name holds password/secret/token/key (e.g. `--constant Module.XPassword=v`), not only values after secret-named flags; the printed `start:` line leaked them (TK-003) — five-app lab project (Mendix 11.15, mxcli v0.26.0) - learn(bug-logs): **six BUG-DRAFT entries from a five-app lab project (mxcli v0.26.0, Mendix 11.15)**: `check` expression gaps (formatDecimal, Decimal toString, raw backslash in replaceAll), declare/retrieve partial checks, microflow splice and alter variable scope, create without commit, Data grid 2 write defects, describe round-trip and DateTime localization. Each gives the workaround; none is filed upstream yet, upstream issue numbers named where they exist (#580, #1489, #1111, #891). Read on demand through `bin/bug-lookup.sh`. — MendixMau, five-app lab report TK-027 to TK-036 diff --git a/bug-logs/mxcli-bugs.md b/bug-logs/mxcli-bugs.md index 7450876f..14edcde1 100644 --- a/bug-logs/mxcli-bugs.md +++ b/bug-logs/mxcli-bugs.md @@ -7092,3 +7092,123 @@ Both flagged flows are Data grid 2 datasources on pages in the same module and w **Version:** mxcli v0.26.0 (retested on v0.27.0 where noted), Mendix 11.15, from a five-app lab project. **What happens.** The described snippet text has no `DataSource: $View` on its root data view, so exec of it fails CE0488. A page describe omitted a pill, a text and a link widget, so a design audit reads "partially read". A DateTime attribute created `not localized` keeps that after `create or modify entity` and after `alter ... modify attribute X: DateTime`; only writing `DateTime localized` flips it. `not localized` makes the client compare the UTC wall clock with local now, so overdue chips were wrong. **Toolkit side (workaround):** after a snippet round trip add the datasource by hand; count widgets in the described text against the page before trusting an audit; always write `DateTime localized` explicitly, then `describe entity` to read it back. + +## BUG-DRAFT-nav-glyph-reset-home: an undefined menu glyph is only a `check` warning (MDL078) and kills mxbuild with no error file, a partial `create or modify navigation` resets the menu, and a default home page is not checked per role (2026-10-15) + +> **NOT YET FILED.** Upstream issue drafted. MDL078 is a deliberate warning upstream (the font table is a snapshot); the lint rule MPR007 covers the role/home case. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** (1) `icon glyph 57388` passes `check` with MDL078 as a warning, exec applies it, mxbuild exits 1 (`Sequence contains no matching element`) and writes no `last-mxbuild-errors.json`, so the gate reports only "failed to run (exit 1)". (2) A partial `create or modify navigation ` rewrites the profile: items not restated are gone, so the final profile needs its own last script. (3) `home page M.P` on the default profile gives CE2729 per role that cannot open P. + +**Workaround:** `show glyphs [like '...']` and use a listed code; treat an MDL078 warning as a build blocker; keep ONE final navigation script that restates every item; use `home page M.P for ` per role, and run `mxcli lint` (MPR007) before the build. + +**Toolkit side:** ledger only; `skills/learned-sidebar-collapse-icons.md` covers the icon requirement. + +## BUG-DRAFT-workflow-call-microflow-system-workflow-param: a workflow `call microflow` target with a `System.Workflow` parameter: `check` demands the mapping, mxbuild says CE0117 for every spelling (2026-10-15) + +> **NOT YET FILED.** Upstream issue drafted; none found upstream. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** A microflow with a `System.Workflow` parameter, called from a workflow `call microflow` with `Workflow = ...` mapped: `check` insists on the mapping, the build gate reports CE0117 "Unknown variable 'Workflow'". Separately, `close` is a keyword and cannot name a workflow activity. + +**Workaround:** drop the parameter and find the instance through `System.Workflow_ParentWorkflow` (or the context entity's association); rename the activity (`closeCase`, not `close`). + +**Toolkit side:** ledger only; `skills/workflow-structure-rules.md` has the other measured workflow signatures. + +## BUG-DRAFT-describe-show-constants-print-secrets: `describe constant` and `show constants` print the stored default, so a demo password lands in the transcript (2026-10-15), HIGH + +> **NOT YET FILED.** Upstream issue drafted. The v0.27.0 source has no masking and no `--reveal` flag. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** After a constant's default has been filled with a credential, `describe constant M.Name` and `show constants in M` print it verbatim (seen in two apps' transcripts). Names matching Password, Secret or Token are not masked. + +**Workaround:** never run either command on a project whose constants may hold a secret; keep secret constants EMPTY in the model and pass the value at run time with `--constant Module.Name=value` (written nowhere). + +**Toolkit side:** one line in `skills/learned-constants-and-secrets.md` (step 3). + +## BUG-DRAFT-business-event-mdl-gaps: `create business event service` has String(200) attributes only, collides with the inherited CloudEvent id attribute, and needs BSON patches for the V2 publish subject and a shared channel name (2026-10-15) + +> **NOT YET FILED.** Upstream issue drafted. Related and closed: mendixlabs/mxcli#476 (reserved attribute names), PR #533 (duplicate channels). + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** (1) A message attribute is String(200); a long payload attribute needs unlimited length and the entity side must match or mxbuild reports a max-length mismatch. (2) A message attribute named `EventId` duplicates a member of the inherited CloudEvent entity. (3) The `PublishBusinessEvent_V2` Subject written through MDL needs a refresh (CE0115). (4) `ChannelName` is random per service, so publisher and subscriber apps land on different topics. + +**Workaround:** BSON patch scripts for unlimited length, subject and channel name, then `mxcli fix hashes --repair`; avoid `EventId` as an attribute name; check that publisher and subscriber channel names are equal before running. Measured: 16 of 16 channels matched on the broker after the patch. + +**Toolkit side:** ledger only (`project-bin/mxpatch.py` is the place for a shipped patcher if this recurs). + +## BUG-DRAFT-business-events-appid-copied: a Business Events AppId is the project unit id, is copied with the model, and no mxcli command prints it (2026-10-15) + +> **NOT YET FILED.** Upstream issue drafted; none found upstream. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** Copying an app model keeps the project unit id, which Business Events uses as the AppId. It is not in `describe settings` or `show settings`. Two apps with the same AppId subscribing to the same message join one consumer group and compete for records. + +**Workaround:** read each app's AppId statically before wiring a second subscriber (the `Projects$Project` unit id in the unpacked `mprcontents`); one subscriber per message is safe. + +**Toolkit side:** ledger only. + +## BUG-DRAFT-marketplace-install-deps-and-widgets: `marketplace install` pulls no dependent module and leaves CE0463 widget definitions (2026-10-15) + +> **NOT YET FILED.** Upstream: `marketplace install --file` shipped (mendixlabs/mxcli#1150, PR #1151, merged). Dependency resolution and the widget fix inside install are not covered by it. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** Installing a connector module without the module it depends on gives about 50 mxbuild CE errors; installing the dependency with `install --file ` worked. A Marketplace module can install under a folded name (Workflow Commons as one word) and leaves CE0463 widget definitions that `mxcli fix widgets` repairs (41 units). + +**Workaround:** read the module's dependencies on its Marketplace page, install them first (by content id or `install --file`), then `mxcli fix widgets -p .mpr` before the first mxbuild. + +**Toolkit side:** ledger only; `skills/decompose-app.md` already lists the `fix widgets` step. + +## BUG-DRAFT-run-local-scheduled-events-off: `run --local` boots with scheduled events off and says so only in the runtime log (2026-10-15) + +> **NOT YET FILED.** Upstream issue drafted. `--runtime-setting` exists in v0.27.0; nothing prints or defaults the setting. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** A lapse or retry scheduled event never runs; the log says "Synchronizing scheduled events: None". `--runtime-setting ScheduledEventExecution=ALL` fixes it. Passing it through a restart wrapper that rewrites the shared start command overwrote that command. + +**Workaround:** start once with `--runtime-setting ScheduledEventExecution=ALL` and keep it in the project's own start line. Already taught for tests in `skills/testing-shape.md` ("`run --local` starts with scheduled events off"). + +**Toolkit side:** the skill paragraph exists; this entry makes it findable by symptom. + +## BUG-DRAFT-test-local-fixed-ports: `mxcli test --local` hard-codes ports 8081/8091 and refuses while another app holds 8081, FIXED in mxcli v0.27.0 (2026-10-15) + +> **FIXED UPSTREAM** in v0.27.0: `mxcli test --app-port / --admin-port / --serve-port` (CHANGELOG 0.27.0, Added). No upstream issue needed. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens (v0.26.0 and older).** With another app on :8081, `bin/test-scratch.sh` reports ":8081 already answers" for as long as it runs; `--attach` needs a restart in test-endpoint mode. + +**Workaround:** on v0.27.0 and later pass `--app-port` and `--admin-port` to `mxcli test --local`. On v0.26.0 stop the other app, or prove behaviour with REST scripts against the running app. + +**Toolkit side:** ledger only for now; a `skills/testing-shape.md` line naming the flags waits on a behaviour A/B (baseline file). `bin/test-scratch.sh` still takes its lock on the fixed 8081/8091; moving it to the new flags needs a field run and is left open. + +## BUG-DRAFT-business-events-oversize-ce-id: the Business Events consumer drops a record whose `ce_id` is over 36 characters, commits the offset and leaves no row (2026-10-15) + +> **NOT YET FILED.** Owner: the Business Events Marketplace module (Mendix), not mxcli. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** A produced event with `ce_id` longer than 36 characters (for example `HE--`) is dropped by the consumer: the log has "error processing record ... maximum length of 36", the offset is committed, there is no EventLog row and no retry. `ConsumedBusinessEvent.EventId` is String(36). + +**Workaround:** use a UUID for `ce_id`; carry an application idempotency key in the payload instead of the CloudEvent id. + +**Toolkit side:** ledger only. + +## NOTE-published-rest-404-for-missing-role: a published REST operation answers 404, not 403, for an authenticated user without the allowed role (Mendix runtime, 2026-10-15) + +> **Not an mxcli bug.** Mendix runtime behaviour; a support question is drafted. + +**Discovered:** 2026-10-14/15, a five-app lab project. **mxcli version:** v0.26.0 (checked against the v0.27.0 source). **Mendix:** 11.15.0. macOS. + +**What happens.** Valid credentials but no allowed module role on the service: the runtime answers 404 "Resource not found"; 401 only for missing or wrong credentials. A contract that says 403 fails its own test. + +**Workaround:** write 404 (and 401) into the API contract and the proof script, or add an explicit role check in the operation's microflow that returns 403. + +**Toolkit side:** ledger only. diff --git a/skills/learned-constants-and-secrets.md b/skills/learned-constants-and-secrets.md index 773f485c..ce330cc8 100644 --- a/skills/learned-constants-and-secrets.md +++ b/skills/learned-constants-and-secrets.md @@ -177,6 +177,8 @@ runtime inside the same misleading error family. --- +**`describe constant` and `show constants` print the stored default verbatim (mxcli v0.26.0 and v0.27.0, no masking).** Never run them on a project whose constants may hold a credential: the value lands in the transcript. Keep secret constants empty in the model and pass them with `--constant Module.Name=value`. + ## Step 4 — Write the decision down where the next session will read it One file per project: `docs/constants-register.md`. It carries two things.