Merge branch 'issues-2'

Author: ako

cmd/mxcli/cmd_marketplace_test.go

@@ -56,11 +56,11 @@ func runMarketplace(t *testing.T, handler http.HandlerFunc, args ...string) (str
 
 func TestMarketplaceSearch_TableOutput(t *testing.T) {
 	out, err := runMarketplace(t, func(w http.ResponseWriter, r *http.Request) {
-		if !strings.Contains(r.URL.RawQuery, "search=database") {
-			t.Errorf("expected search=database in query, got %q", r.URL.RawQuery)
+		if !strings.Contains(r.URL.RawQuery, "search=community") {
+			t.Errorf("expected search=community in query, got %q", r.URL.RawQuery)
 		}
 		_, _ = w.Write([]byte(sampleContentList))
-	}, "search", "database")
+	}, "search", "community")
 
 	if err != nil {
 		t.Fatalf("run: %v\noutput: %s", err, out)
@@ -76,7 +76,7 @@ func TestMarketplaceSearch_TableOutput(t *testing.T) {
 func TestMarketplaceSearch_JSON(t *testing.T) {
 	out, err := runMarketplace(t, func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = w.Write([]byte(sampleContentList))
-	}, "search", "database", "--json")
+	}, "search", "community", "--json")
 
 	if err != nil {
 		t.Fatal(err)

internal/marketplace/client.go

@@ -10,8 +10,14 @@ import (
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 )
 
+// searchFetchLimit is the number of items fetched from the API when a search
+// query is provided. The marketplace API accepts the ?search= parameter but
+// does not filter server-side, so we fetch a larger page and filter locally.
+const searchFetchLimit = 200
+
 // Client is a typed wrapper around the marketplace REST API. Callers
 // obtain an authenticated http.Client via internal/auth.ClientFor and
 // pass it here.
@@ -38,13 +44,21 @@ func NewWithBaseURL(httpClient *http.Client, baseURL string) *Client {
 
 // Search lists marketplace content matching a query. limit is the
 // maximum number of results to return; pass 0 for the API default.
+//
+// Note: the marketplace API accepts ?search= but does not filter server-side.
+// When query is non-empty, this method fetches a larger page and applies
+// client-side filtering on the item name and publisher (case-insensitive
+// substring match). The user-supplied limit is applied after filtering.
 func (c *Client) Search(ctx context.Context, query string, limit int) (*ContentList, error) {
 	q := url.Values{}
+	fetchLimit := limit
 	if query != "" {
-		q.Set("search", query)
+		// Fetch a larger page so client-side filtering has enough candidates.
+		q.Set("search", query) // kept in case the API ever starts honouring it
+		fetchLimit = searchFetchLimit
 	}
-	if limit > 0 {
-		q.Set("limit", strconv.Itoa(limit))
+	if fetchLimit > 0 {
+		q.Set("limit", strconv.Itoa(fetchLimit))
 	}
 	path := "/v1/content"
 	if len(q) > 0 {
@@ -54,9 +68,33 @@ func (c *Client) Search(ctx context.Context, query string, limit int) (*ContentL
 	if err := c.get(ctx, path, &out); err != nil {
 		return nil, err
 	}
+
+	if query != "" {
+		out.Items = filterItems(out.Items, query)
+		if limit > 0 && len(out.Items) > limit {
+			out.Items = out.Items[:limit]
+		}
+	}
 	return &out, nil
 }
 
+// filterItems returns items whose name or publisher contains query
+// (case-insensitive substring match).
+func filterItems(items []Content, query string) []Content {
+	q := strings.ToLower(query)
+	var matched []Content
+	for _, item := range items {
+		name := ""
+		if item.LatestVersion != nil {
+			name = strings.ToLower(item.LatestVersion.Name)
+		}
+		if strings.Contains(name, q) || strings.Contains(strings.ToLower(item.Publisher), q) {
+			matched = append(matched, item)
+		}
+	}
+	return matched
+}
+
 // Get returns the full detail for a single content item by ID.
 func (c *Client) Get(ctx context.Context, contentID int) (*Content, error) {
 	var out Content

internal/marketplace/client_test.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -36,6 +37,48 @@ const sampleContentList = `{
   ]
 }`
 
+// sampleMultiContentList has two items: one matching "database", one not.
+const sampleMultiContentList = `{
+  "items": [
+    {
+      "contentId": 2888,
+      "publisher": "Mendix",
+      "type": "Module",
+      "latestVersion": {
+        "name": "Database Connector",
+        "versionId": "aaaa",
+        "versionNumber": "3.1.0",
+        "minSupportedMendixVersion": "9.0.0",
+        "publicationDate": "2025-06-01T00:00:00Z"
+      }
+    },
+    {
+      "contentId": 170,
+      "publisher": "Mendix",
+      "type": "Module",
+      "latestVersion": {
+        "name": "Community Commons",
+        "versionId": "bbbb",
+        "versionNumber": "11.5.0",
+        "minSupportedMendixVersion": "10.24.0",
+        "publicationDate": "2026-01-13T00:00:00Z"
+      }
+    },
+    {
+      "contentId": 999,
+      "publisher": "ACME",
+      "type": "Module",
+      "latestVersion": {
+        "name": "Advanced Database Tools",
+        "versionId": "cccc",
+        "versionNumber": "1.0.0",
+        "minSupportedMendixVersion": "9.0.0",
+        "publicationDate": "2024-01-01T00:00:00Z"
+      }
+    }
+  ]
+}`
+
 const sampleContent = `{
   "contentId": 170,
   "publisher": "Mendix",
@@ -79,9 +122,11 @@ func TestSearch_PassesQueryAndLimit(t *testing.T) {
 		gotPath = r.URL.Path
 		gotQuery = r.URL.RawQuery
 		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(sampleContentList))
+		_, _ = w.Write([]byte(sampleMultiContentList))
 	})
 
+	// User requests limit=3 but because the API ignores ?search=, we fetch
+	// searchFetchLimit items and apply client-side filtering.
 	result, err := client.Search(context.Background(), "database", 3)
 	if err != nil {
 		t.Fatalf("Search: %v", err)
@@ -90,13 +135,72 @@ func TestSearch_PassesQueryAndLimit(t *testing.T) {
 		t.Errorf("path: got %q, want /v1/content", gotPath)
 	}
 	if !strings.Contains(gotQuery, "search=database") {
-		t.Errorf("query missing search: %q", gotQuery)
+		t.Errorf("query missing search param: %q", gotQuery)
+	}
+	// API receives searchFetchLimit, not the user's limit=3
+	if !strings.Contains(gotQuery, "limit="+strconv.Itoa(searchFetchLimit)) {
+		t.Errorf("expected API to receive limit=%d, got query %q", searchFetchLimit, gotQuery)
 	}
-	if !strings.Contains(gotQuery, "limit=3") {
-		t.Errorf("query missing limit: %q", gotQuery)
+	// Client-side filter: only items whose name contains "database"
+	if len(result.Items) != 2 {
+		t.Errorf("expected 2 filtered items (Database Connector + Advanced Database Tools), got %d", len(result.Items))
+	}
+}
+
+func TestSearch_ClientSideFiltering(t *testing.T) {
+	client, _ := newMockServer(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleMultiContentList))
+	})
+
+	result, err := client.Search(context.Background(), "community", 20)
+	if err != nil {
+		t.Fatal(err)
 	}
 	if len(result.Items) != 1 || result.Items[0].ContentID != 170 {
-		t.Errorf("unexpected result: %+v", result)
+		t.Errorf("expected only Community Commons (170), got %+v", result.Items)
+	}
+}
+
+func TestSearch_ClientSideFiltering_NoMatch(t *testing.T) {
+	client, _ := newMockServer(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleMultiContentList))
+	})
+
+	result, err := client.Search(context.Background(), "zzzznonexistent", 20)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(result.Items) != 0 {
+		t.Errorf("expected 0 results for nonexistent query, got %d", len(result.Items))
+	}
+}
+
+func TestSearch_ClientSideFiltering_LimitApplied(t *testing.T) {
+	client, _ := newMockServer(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleMultiContentList))
+	})
+
+	// 2 items match "database", but user wants only 1
+	result, err := client.Search(context.Background(), "database", 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(result.Items) != 1 {
+		t.Errorf("expected limit of 1 applied after filtering, got %d items", len(result.Items))
+	}
+}
+
+func TestSearch_PublisherFiltering(t *testing.T) {
+	client, _ := newMockServer(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(sampleMultiContentList))
+	})
+
+	result, err := client.Search(context.Background(), "acme", 20)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(result.Items) != 1 || result.Items[0].ContentID != 999 {
+		t.Errorf("expected ACME item (999), got %+v", result.Items)
 	}
 }
 

mdl-examples/doctype-tests/empty_java_action_argument.mdl

@@ -1,3 +1,15 @@
+create module SampleModule;
+
+create persistent entity SampleModule.Item (
+  Name: string(200)
+);
+
+create java action SampleModule.Recalculate(
+  CompanyId: string,
+  RecalculateAll: boolean not null,
+  ItemList: list of SampleModule.Item
+) returns void;
+
 create microflow SampleModule.ACT_RecalculateOpenItems ()
 returns Void
 begin

mdl-examples/doctype-tests/enum_split_statement.mdl

@@ -20,6 +20,8 @@ begin
       set $IsOpen = false;
     when Closed then
       set $IsOpen = false;
+    when (empty) then
+      set $IsOpen = false;
   end case;
   return $IsOpen;
 end;

mdl/executor/cmd_misc.go

@@ -390,8 +390,15 @@ func execExit(ctx *ExecContext) error {
 	return ErrExit
 }
 
+// maxScriptDepth is the maximum allowed EXECUTE SCRIPT nesting level.
+const maxScriptDepth = 16
+
 // execExecuteScript handles EXECUTE SCRIPT statements.
 func execExecuteScript(ctx *ExecContext, s *ast.ExecuteScriptStmt) error {
+	if ctx.ScriptDepth >= maxScriptDepth {
+		return mdlerrors.NewValidationf("maximum script nesting depth (%d) exceeded — possible recursive EXECUTE SCRIPT", maxScriptDepth)
+	}
+
 	// Resolve path relative to current working directory
 	scriptPath := s.Path
 	if !filepath.IsAbs(scriptPath) {
@@ -426,6 +433,8 @@ func execExecuteScript(ctx *ExecContext, s *ast.ExecuteScriptStmt) error {
 	if ctx.ExecuteFn == nil {
 		return mdlerrors.NewBackend("execute script", errors.New("ExecuteFn not set — ExecContext was not created via Executor dispatch"))
 	}
+	ctx.ScriptDepth++
+	defer func() { ctx.ScriptDepth-- }()
 	for _, stmt := range prog.Statements {
 		if err := ctx.ExecuteFn(stmt); err != nil {
 			// Exit within a script just stops the script, doesn't exit mxcli

mdl/executor/cmd_misc_mock_test.go

@@ -71,3 +71,15 @@ func TestHelp_Mock(t *testing.T) {
 	assertContainsStr(t, out, "MDL Commands")
 	assertContainsStr(t, out, "connect local")
 }
+
+// ---------------------------------------------------------------------------
+// EXECUTE SCRIPT — depth limit
+// ---------------------------------------------------------------------------
+
+func TestExecuteScript_DepthLimitExceeded(t *testing.T) {
+	ctx, _ := newMockCtx(t)
+	ctx.ScriptDepth = maxScriptDepth
+	err := execExecuteScript(ctx, &ast.ExecuteScriptStmt{Path: "/some/script.mdl"})
+	assertError(t, err)
+	assertContainsStr(t, err.Error(), "maximum script nesting depth")
+}

mdl/executor/exec_context.go

@@ -87,6 +87,11 @@ type ExecContext struct {
 	// It lets activity formatting distinguish a terminal void EndEvent from an
 	// empty EndEvent in a value-returning microflow, where bare `return;` is invalid.
 	DescribingMicroflowHasReturnValue bool
+
+	// ScriptDepth tracks the current EXECUTE SCRIPT nesting level.
+	// Incremented on each recursive call; execExecuteScript rejects calls
+	// that exceed maxScriptDepth to prevent infinite self-referencing scripts.
+	ScriptDepth int
 }
 
 // Connected returns true if a project is connected via the Backend.