fix(modelsdk): emit grant execute for microflow/nanoflow allowed roles

DESCRIBE MICROFLOW/NANOFLOW on the modelsdk engine omitted the
"grant execute on microflow … to <roles>;" line that the legacy engine
emits. microflowFromGen/nanoflowFromGen never read the document's allowed
module roles, so Microflow.AllowedModuleRoles was empty and the describer
skipped the grant block entirely.

Populate AllowedModuleRoles from the gen AllowedModuleRolesQualifiedNames()
(BY_NAME role references, stored as qualified-name strings). Covered by an
integration test against the fixture (Administration.ChangeMyPassword grants
to Administrator + User). modelsdk now matches legacy byte-for-byte.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ako

.claude/skills/fix-issue.md

@@ -32,6 +32,7 @@ to the symptom table below, so the next similar issue costs fewer reads.
 | `DESCRIBE microflow` puts shared activities inside an `if … then` block — they should appear after `end if;` | Nested guard split inside `traverseFlowUntilMerge` crosses the outer merge boundary | `mdl/executor/cmd_microflows_show_helpers.go` — guard path in `traverseFlowUntilMerge` (~line 854) | Add `if contID != mergeID` guard before the `isMerge` skip-through so the guard continuation never crosses the outer merge |
 | `DESCRIBE microflow` on the **modelsdk** engine renders a branching microflow as `if cond then end if;` — the entire then/when body is dropped (legacy engine renders it fully). Affects projects Studio Pro saved with the older single-case storage | The split's branch case is stored under the BSON storage name `NewCaseValue` (single child), but (1) the codec had no `CaseValue`→`NewCaseValue` alias so it was never decoded, and (2) the adapter read only the plural `CaseValuesItems()`, not the singular `CaseValue()` | `modelsdk/codec/decoder.go` (`fieldAliases`) + `mdl/backend/modelsdk/microflow.go` (`caseValueFromGen`/`mapGenCaseValue`) | Add `"CaseValue": "NewCaseValue"` to `fieldAliases` (mirrors `Type`↔`NewType`); read the singular `g.CaseValue()` first, then the plural list, mapping `EnumerationCase`/`InheritanceCase`. A round-trip MDL bug-test can't reproduce it (the write path emits the new format) — covered by codec + adapter unit tests |
 | `DESCRIBE microflow` on the **modelsdk** engine renders a rule-based split as `if true then …` instead of the real `Module.Rule_X(args)` condition (body renders, only the condition text is wrong) | `splitConditionFromGen` only handled `*ExpressionSplitCondition`; a `RuleSplitCondition` returned nil → renderer fell back to `true`. Even when handled, the rule name lives under the `RuleCall.Microflow` storage key, but gen decodes the property as `Rule` (and `ByNameRef` decode bypasses `fieldAliases`), so `RuleQualifiedName()` is empty | `mdl/backend/modelsdk/microflow.go` (`splitConditionFromGen`) | Reconstruct `*microflows.RuleSplitCondition` from the gen `RuleCall`; read the rule name from `rc.Raw().Lookup("Microflow")` when `RuleQualifiedName()` is empty (same raw-storage-key pattern the action readers use). The existing `formatSplitCondition` renders it |
+| `DESCRIBE microflow`/`nanoflow` on the **modelsdk** engine omits the `grant execute on microflow … to <roles>;` line that legacy emits | `microflowFromGen`/`nanoflowFromGen` never read the allowed module roles, so `Microflow.AllowedModuleRoles` was empty and the describer skipped the grant block | `mdl/backend/modelsdk/microflow.go` (`microflowFromGen`/`nanoflowFromGen`) | Populate `out.AllowedModuleRoles` from the gen `AllowedModuleRolesQualifiedNames()` (BY_NAME role refs, stored as qualified-name strings) |
 | MDL widget property `mxcli check`s clean but Studio Pro renders the default (e.g. `dataview ... (FormOrientation: Vertical)` always Horizontal) | V3 grammar generic-property branch parks the value in `w.Properties`, but the V3 builder never reads it and the writer never emits it; the widget struct has no field for it | `mdl/executor/cmd_pages_builder_v3_widgets.go` (`buildXxxV3`) + `sdk/mpr/writer_widgets_*.go` (`serializeXxx`) + `sdk/pages/pages_widgets_*.go` | Add field to `pages.Xxx`; read via `w.GetStringProp` / `w.GetIntProp`; write in `serializeXxx`. If the Studio Pro UI label differs from the BSON storage name (e.g. DataView "Form Orientation" → `LabelWidth: 0/N`), confirm by diffing a Studio Pro-saved page against the reflection-data defaults |
 | `ALTER <DOC TYPE> ...` parse error "no viable alternative at input 'ALTER<TYPE>'" but `CREATE <DOC TYPE> ...` works | The grammar lists ALTER variants explicitly per document type; a new doc type was added to `createStatement` but not to `alterStatement` | `mdl/grammar/MDLParser.g4` `alterStatement` block + dedicated visitor + new `Alter*Stmt` AST type + `register_stubs.go` | Add ALTER rule (mirror the closest sibling — `ALTER ODATA CLIENT` for SET-only, `ALTER PUBLISHED REST SERVICE` for SET+ADD/DROP); regenerate grammar; add `Alter*Stmt` with `Changes map[string]string`; route via `exitAlterStatement` dispatcher; register handler. Add the new AST type to `registry_test.go`'s `allKnownStatements()` |
 | Pluggable widget datasource property (`optionsSourceAssociationDataSource: Module.Entity`) passes `check` + `exec` but `mx check` reports CE0642 "Property 'Entity' is required" | A `datasource`-operation property was authored by name; the engine reads the widget's `datasource:` clause (`Properties["DataSource"]`), not the named key, so the value is silently dropped (and `hasDataSource` mode-selection also misfires) | `mdl/executor/validate_widgets.go` (`datasourceTypedKeys`) — and author via the `datasource:` clause | `check` now rejects named datasource-typed props (MDL-WIDGET05); the fix for the user is `datasource: database Module.Entity`. Persisting a *named* datasource property (multi-datasource widgets) needs a Studio-Pro-verified mapping — deferred. Real-but-unmapped props get MDL-WIDGET06 warning via def.json `knownProperties` (not a false MDL-WIDGET01) |

mdl/backend/modelsdk/microflow.go

@@ -82,6 +82,9 @@ func nanoflowFromGen(nf *genMf.Nanoflow, containerID model.ID) *microflows.Nanof
 		ReturnType:    dataTypeFromGen(nf.MicroflowReturnType()),
 	}
 	out.ID = model.ID(nf.ID())
+	for _, qn := range nf.AllowedModuleRolesQualifiedNames() {
+		out.AllowedModuleRoles = append(out.AllowedModuleRoles, model.ID(qn))
+	}
 	params, objs := splitFlowObjects(nf.ObjectCollection())
 	out.Parameters = params
 	flows := flowsFromGen(nf.FlowsItems())
@@ -102,6 +105,11 @@ func microflowFromGen(mf *genMf.Microflow, containerID model.ID) *microflows.Mic
 		ReturnType:         dataTypeFromGen(mf.MicroflowReturnType()),
 	}
 	out.ID = model.ID(mf.ID())
+	// AllowedModuleRoles (BY_NAME role references) — without these DESCRIBE omits
+	// the "grant execute on microflow … to …" line that legacy emits.
+	for _, qn := range mf.AllowedModuleRolesQualifiedNames() {
+		out.AllowedModuleRoles = append(out.AllowedModuleRoles, model.ID(qn))
+	}
 	params, objs := splitFlowObjects(mf.ObjectCollection())
 	out.Parameters = params
 	// Flows live on the gen Microflow, but the model keeps them in the object

mdl/backend/modelsdk/microflow_roles_test.go

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package modelsdkbackend
+
+import "testing"
+
+// TestMicroflowFromGen_ReadsAllowedModuleRoles guards the "grant execute on
+// microflow … to …" line in DESCRIBE MICROFLOW. The allowed module roles are
+// BY_NAME references the gen exposes via AllowedModuleRolesQualifiedNames();
+// the adapter must surface them as Microflow.AllowedModuleRoles or DESCRIBE
+// drops the grant line that the legacy engine emits.
+func TestMicroflowFromGen_ReadsAllowedModuleRoles(t *testing.T) {
+	b := New()
+	if err := b.Connect(fixture); err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	t.Cleanup(func() { _ = b.Disconnect() })
+
+	mfs, err := b.ListMicroflows()
+	if err != nil {
+		t.Fatalf("ListMicroflows: %v", err)
+	}
+	var roles []string
+	for _, mf := range mfs {
+		if mf.Name == "ChangeMyPassword" {
+			for _, r := range mf.AllowedModuleRoles {
+				roles = append(roles, string(r))
+			}
+		}
+	}
+	if roles == nil {
+		t.Fatal("ChangeMyPassword not found or has no AllowedModuleRoles")
+	}
+	want := map[string]bool{"Administration.Administrator": false, "Administration.User": false}
+	for _, r := range roles {
+		if _, ok := want[r]; ok {
+			want[r] = true
+		}
+	}
+	for role, seen := range want {
+		if !seen {
+			t.Errorf("AllowedModuleRoles missing %q (got %v)", role, roles)
+		}
+	}
+}