fix(check): report a microflow without entity access calling one with it, MDL-SEC22 (mendixlabs/mxcli#1500)

[ako]

Fixes mendixlabs#1500.

Reported symptom

mxbuild (11.14.0) refuses with

CE0114 A microflow that does not apply entity access can only call microflows that also do not apply entity access.

while check -p --references printed "no flow change exec would refuse … no used flow left without access" and "Check passed!".

Measured (fresh mxcli new projects, 11.13.0 and 11.14.0)

Caller → callee	Result
entity access off → microflow on	CE0114
entity access off → decision calling a rule that applies entity access	CE0114 (same message, "rules")
on → off, on → on, off → off	clean
nanoflow caller, excluded caller	clean

Fires at security level Off and Prototype alike, so the rule is an error regardless of level.

Fix

New mdl/executor/validate_entity_access_calls.go (MDL-SEC22), wired into the project checks in cmd/mxcli/cmd_check.go:

• reads stored microflows and rules and their calls, then replays the script's create / drop / alter;
• an omitted @applyentityaccess keeps the stored setting, through the same function exec uses;
• a decision counts as a rule call only if the rule exists at that point in the script (as exec decides when building the flow);
• catches a callee in the project or created earlier in the script; reports only what the script changes; silent when the callee cannot be resolved.

Gating: not version-gated (judgment call) — it predicts a build error and exec does not refuse on it, the same choice MDL-SEC21 made for CE0106.

Tests

10 executor tests (MockBackend) in validate_entity_access_calls_test.go: both reported shapes, the clean directions, an unresolved callee, rule decisions, nanoflow and excluded callers, omitted annotations, the script changing the callee, an existing problem left alone, and alter … insert.

Proof by revert: with the check disabled, 6 positive tests fail with "got 0"; removing the callee-setting resolution fails the off→off control.

Two-variant mxbuild run (fresh 11.14 project, callee stored)

• Issue script: check reports MDL-SEC22 and exits 1; exec'd anyway, mxcli docker check reports 1× CE0114.
• Caller set to @applyentityaccess(true): check passes; docker check reports 0 errors.
• mdl-examples/bug-tests/1500-entity-access-call-mismatch.mdl yields exactly one MDL-SEC22 and one CE0114.

Also

• Finding, CHANGELOG entry, docs-site/src/appendixes/error-messages.md section, pitfalls.md note.
• SEC21/SEC22 detail moved to .claude/skills/mendix/check-syntax/reference/cross-document-flow-rules.md (the skill body cap).
• Regenerated manage-navigation/SKILL.md's line index, which is stale on main and would fail make check-skill-index on every PR (no-op once main carries it).

Validation

go test ./... (see note), make check-mdl, make check-findings, make check-conformance, make lint-go, check-skill-index pass. Note: locally TestSyncCompanion only failed because the rsync-less sandbox copied mods/ tests into the embed dir; it passes once pruned as the Makefile fallback does. No describe/writer change, so roundtrip not run.

Not covered

A call that alter microflow removes is not tracked (only added calls); excluded callees not judged (not measured).

🤖 Generated with Claude Code

https://claude.ai/code/session_01VKmbj53BC2vuUWYmgWgfQ5

---

Generated by Claude Code