mxrb 0.1.2 → 0.1.4

data/lib/mxrb/initializer.rb

@@ -5,18 +5,30 @@ require 'tmpdir'
 
 module Mxrb
   # Creates the minimum editable Ruby project accepted by `mxrb generate`.
-  # rubocop:disable Metrics/ClassLength
+  # rubocop:disable Metrics
   class Initializer
     Result = Data.define(:root, :files)
     NAME = /\A[A-Za-z][A-Za-z0-9_-]*\z/
+    MODES = %i[mendix ruby].freeze
     COMPOUND_SUFFIXES = %w[service clinic portal demo api app kit].freeze
 
-    def initialize(name, subject: :project, mxrb_path: nil)
+    attr_reader :mode
+
+    def initialize(name, subject: :project, mxrb_path: nil, mode: :mendix, stack: nil)
       @dir_name = name.to_s
       raise ArgumentError, "#{subject} name must be snake_case or PascalCase" unless NAME.match?(@dir_name)
 
       @module_name = to_pascal_case(@dir_name)
       @mpr_name = "#{@module_name}.mpr"
+      @mode = mode.to_sym
+      raise ArgumentError, 'project mode must be mendix or ruby' unless MODES.include?(@mode)
+
+      @stack = stack&.to_sym
+      raise ArgumentError, 'Ruby stack presets require --mode ruby' if @stack && @mode != :ruby
+      if @stack && !RubyApp::Preset::NAMES.include?(@stack)
+        raise ArgumentError, "Ruby stack must be #{RubyApp::Preset::NAMES.join(' or ')}"
+      end
+
       @mxrb_path = File.expand_path(mxrb_path) if mxrb_path
       raise ArgumentError, "mxrb path does not exist: #{@mxrb_path}" if @mxrb_path && !File.directory?(@mxrb_path)
     end
@@ -28,19 +40,61 @@ module Mxrb
 
       FileUtils.mkdir_p(parent)
       staging = Dir.mktmpdir(".#{@dir_name}.mxrb-init-", parent)
-      write_scaffold(staging)
+      mode == :ruby ? write_ruby_scaffold(staging) : write_scaffold(staging)
+      files = mode == :ruby ? generated_files(staging) : relative_files
       FileUtils.mv(staging, root)
-      Result.new(root, relative_files.map { File.join(root, _1) }.freeze)
+      Result.new(root, files.map { File.join(root, _1) }.freeze)
     ensure
       FileUtils.rm_rf(staging) if staging && File.exist?(staging)
     end
 
     private
 
+    def write_ruby_scaffold(root)
+      bootstrap = File.join(root, '.mxrb-bootstrap')
+      write_scaffold(bootstrap)
+      target = File.join(bootstrap, @mpr_name)
+      previous = ENV['MXRB_OUTPUT_PATH']
+      library = @mxrb_path ? File.join(@mxrb_path, 'lib') : File.expand_path('..', __dir__)
+      added_load_path = !$LOAD_PATH.include?(library)
+      $LOAD_PATH.unshift(library) if added_load_path
+      ENV['MXRB_OUTPUT_PATH'] = target
+      load File.join(bootstrap, 'project.rb')
+      Exporter.new(target, root, mode: :ruby).export!(parallel: false)
+      pin_exported_gemfile(root) if @mxrb_path
+      RubyApp::Preset.apply!(root, @stack) if @stack
+    ensure
+      if previous
+        ENV['MXRB_OUTPUT_PATH'] = previous
+      else
+        ENV.delete('MXRB_OUTPUT_PATH')
+      end
+      $LOAD_PATH.delete(library) if added_load_path
+      FileUtils.rm_rf(bootstrap)
+    end
+
+    def generated_files(root)
+      Dir.glob(File.join(root, '**', '*'), File::FNM_DOTMATCH)
+         .select { File.file?(_1) }
+         .map { Pathname.new(_1).relative_path_from(Pathname.new(root)).to_s }
+         .sort
+    end
+
+    def pin_exported_gemfile(root)
+      File.binwrite(
+        File.join(root, 'Gemfile'),
+        "# frozen_string_literal: true\n\nsource 'https://rubygems.org'\n" \
+        "gem 'mxrb', path: #{@mxrb_path.inspect}\n"
+      )
+    end
+
     def write_scaffold(root)
       write(root, 'Gemfile', gemfile)
       write(root, '.gitignore', gitignore)
       write(root, '.env.example', env_example)
+      environment_names.each do |name|
+        write(File.join(root, 'config', 'environments'), "#{name}.env.example", environment_example(name))
+      end
       write(root, 'project.rb', project_rb)
       write(File.join(root, 'app', 'navigation', 'responsive'), '.keep', '')
       write_design_scaffold(root)
@@ -79,7 +133,8 @@ module Mxrb
       ['Gemfile', '.gitignore', '.env.example', 'project.rb',
        *relative_module_files.map { File.join(module_prefix, _1) },
        File.join('app', 'navigation', 'responsive', '.keep'),
-       *design_files.keys.map { File.join(*_1) }]
+       *design_files.keys.map { File.join(*_1) },
+       *environment_names.map { File.join('config', 'environments', "#{_1}.env.example") }]
     end
 
     def relative_module_files
@@ -121,7 +176,6 @@ module Mxrb
         source "https://rubygems.org"
 
         #{gem_declaration}
-        gem "dotenv", "~> 3.0"
       RUBY
     end
 
@@ -131,6 +185,8 @@ module Mxrb
         .env
         .env.*
         !.env.example
+        config/environments/*.env
+        !config/environments/*.env.example
       TEXT
     end
 
@@ -141,6 +197,21 @@ module Mxrb
       TEXT
     end
 
+    def environment_names = %w[development qa staging production]
+
+    def environment_example(name)
+      <<~TEXT
+        # Copy to #{name}.env. Process ENV still has highest precedence.
+        MXRB_DATABASE_PATH=.mxrb/runtime/#{name}.sqlite3
+        MXRB_SHARED_STORE_PATH=.mxrb/runtime/#{name}-shared.sqlite3
+        MXRB_SESSION_TTL=3600
+        MXRB_SCHEDULER_LEASE_TTL=300
+        MXRB_ALLOW_DESTRUCTIVE_MIGRATIONS=false
+        MXRB_AUTH_TOKENS=
+        MXRB_USERS_JSON=
+      TEXT
+    end
+
     def gem_declaration
       return 'gem "mxrb"' unless @mxrb_path
 
@@ -151,10 +222,10 @@ module Mxrb
       <<~RUBY
         # frozen_string_literal: true
 
-        require "dotenv/load"
-        Dotenv.load(File.join(__dir__, ".env"))
         require "mxrb"
 
+        Mxrb::Environment.load(root: __dir__).apply
+
         output = ENV.fetch("MXRB_OUTPUT_PATH", File.join(__dir__, "#{@mpr_name}"))
 
         Mxrb.define(output) do
@@ -254,5 +325,5 @@ module Mxrb
       RUBY
     end
   end
-  # rubocop:enable Metrics/ClassLength
+  # rubocop:enable Metrics
 end

data/lib/mxrb/integrity/validator.rb

@@ -11,19 +11,26 @@ module Mxrb
     class Validator
       def initialize(path)
         @path = path
+        @progress = Progress::NullTask.instance
       end
 
       def validate
-        @errors = []
-        @warnings = []
-        @mpr = IO::MprFile.open(@path, readonly: true)
-        validate_tables
-        validate_units
-        validate_v2_files
-        Result.new(errors: @errors, warnings: @warnings)
+        Progress.with("Validating #{File.basename(@path)}") do |progress|
+          @progress = progress
+          @errors = []
+          @warnings = []
+          @mpr = IO::MprFile.open(@path, readonly: true)
+          validate_tables
+          progress.advance(detail: "MPR tables")
+          validate_units
+          validate_v2_files
+          progress.advance(detail: "v2 contents")
+          Result.new(errors: @errors, warnings: @warnings)
+        end
       rescue Error => e
         Result.new(errors: [e.message], warnings: @warnings || [])
       ensure
+        @progress = Progress::NullTask.instance
         @mpr&.close
       end
 
@@ -40,8 +47,13 @@ module Mxrb
 
       def validate_units
         @units = @mpr.all_units
+        @legacy_identity_mismatches = @mpr.legacy_unit_identity_mismatches.to_set do |entry|
+          [entry.fetch(:unit_id), entry.fetch(:content_id), entry.fetch(:type)]
+        end
+        @progress.update(total: @units.size + 3, detail: "#{@units.size} units")
         validate_root
         validate_unit_ids
+        @progress.advance(detail: "unit tree")
         validate_contents
       end
 
@@ -78,6 +90,8 @@ module Mxrb
           next unless doc
 
           validate_doc_identity(unit, doc)
+        ensure
+          @progress&.advance(detail: "unit #{unit['UnitID']}")
         end
       end
 
@@ -102,6 +116,17 @@ module Mxrb
         if doc_id.to_s.empty?
           add_error("unit #{unit['UnitID']} missing $ID")
         elsif doc_id != unit["UnitID"]
+          record_identity_mismatch(unit, doc_id, type)
+        end
+      end
+
+      def record_identity_mismatch(unit, doc_id, type)
+        mismatch = [unit["UnitID"], doc_id, type]
+        if @legacy_identity_mismatches&.include?(mismatch)
+          add_warning(
+            "unit #{unit['UnitID']} preserves legacy content $ID mismatch #{doc_id}"
+          )
+        else
           add_error("unit #{unit['UnitID']} content $ID mismatch #{doc_id}")
         end
       end

data/lib/mxrb/io/bson_codec.rb

@@ -11,7 +11,7 @@ module Mxrb
     #   - Arrays have a 4-byte int32 marker as first element (1=by-name, 2=part-secondary, 3=part-primary)
     #   - $ID can appear as String, BSON Binary, or {Data:, Subtype:} map
     #   - $Type uses storage names ("DomainModels$Entity") not SDK qualified names
-    module BsonCodec
+    module BsonCodec # rubocop:disable Metrics/ModuleLength
       # ── UUID / BLOB conversion ─────────────────────────────────────────────
 
       # Convert a 16-byte MS-GUID blob to UUID string.
@@ -49,12 +49,53 @@ module Mxrb
         when BSON::Binary
           blob_to_uuid(value.data)
         when Hash
+          binary = extended_binary(value)
+          return blob_to_uuid(binary.data) if binary
+
           data = value["Data"] || value[:Data]
           return nil unless data
           blob_to_uuid(Base64.strict_decode64(data.to_s))
         end
       end
 
+      BINARY_SUBTYPES = {
+        "00" => :generic, "01" => :function, "02" => :old_binary,
+        "03" => :uuid_old, "04" => :uuid, "05" => :md5,
+        "80" => :user
+      }.freeze
+
+      # Restores BSON values serialized through JSON's canonical extended form.
+      # Architecture metadata uses JSON, so this conversion is required before
+      # a stored native document is written again during a version transition.
+      def self.restore_extended_json(value)
+        case value
+        when Hash
+          binary = extended_binary(value)
+          return binary if binary
+
+          value.to_h { |key, child| [key, restore_extended_json(child)] }
+        when Array
+          value.map { restore_extended_json(_1) }
+        else
+          value
+        end
+      end
+
+      def self.extended_binary(value)
+        payload = value["$binary"] || value[:$binary]
+        return unless payload.is_a?(Hash)
+
+        base64 = payload["base64"] || payload[:base64]
+        return unless base64
+
+        subtype = payload["subType"] || payload[:subType] || "00"
+        BSON::Binary.new(
+          Base64.strict_decode64(base64.to_s.delete(" \t\r\n")),
+          BINARY_SUBTYPES.fetch(subtype.to_s.downcase, :generic)
+        )
+      end
+      private_class_method :extended_binary
+
       # ── Array parsing ───────────────────────────────────────────────────────
 
       # Mendix arrays have an int32 marker as first element.

data/lib/mxrb/io/mpr_file.rb

@@ -162,10 +162,10 @@ module Mxrb
       # ── Writes ────────────────────────────────────────────────────────────
 
       # Insert a new unit. Returns the assigned UUID.
-      def insert_unit(container_uuid:, containment_name:, contents_doc:)
+      def insert_unit(container_uuid:, containment_name:, contents_doc:, unit_uuid: nil)
         raise ReadOnlyError, "Opened in read-only mode" if @readonly
 
-        uuid = BsonCodec.extract_id(contents_doc["$ID"] || contents_doc["\$ID"]) || SecureRandom.uuid
+        uuid = unit_uuid || BsonCodec.extract_id(contents_doc["$ID"] || contents_doc["\$ID"]) || SecureRandom.uuid
         unless contents_doc.key?("$ID") || contents_doc.key?("\$ID")
           contents_doc = { "$ID" => uuid }.merge(contents_doc)
         end
@@ -223,6 +223,31 @@ module Mxrb
         true
       end
 
+      # Repairs stale Unit.ContentsHash metadata without reserializing or
+      # otherwise changing the BSON/mxunit payload. Returns an audit trail.
+      def repair_content_hashes!
+        raise ReadOnlyError, "Opened in read-only mode" if @readonly
+
+        repairs = []
+        transaction do
+          all_units.each do |unit|
+            bytes = content_bytes(unit)
+            next if bytes.to_s.empty?
+
+            previous = unit['ContentsHash'].to_s
+            current = BsonCodec.contents_hash(bytes)
+            next if previous == current
+
+            @db.execute(
+              'UPDATE Unit SET ContentsHash = ? WHERE UnitID = ?',
+              [current, BsonCodec.uuid_to_blob(unit.fetch('UnitID'))]
+            )
+            repairs << { unit_id: unit.fetch('UnitID'), previous:, current: }
+          end
+        end
+        repairs
+      end
+
       def delete_unit(uuid)
         raise ReadOnlyError, "Opened in read-only mode" if @readonly
         @db.execute("DELETE FROM Unit WHERE UnitID = ?", [BsonCodec.uuid_to_blob(uuid)])
@@ -463,7 +488,7 @@ module Mxrb
       def architecture_definition
         return nil unless tables.include?("_MxrbArchitecture")
         json = @db.get_first_value("SELECT Definition FROM _MxrbArchitecture WHERE ID = 1")
-        json && JSON.parse(json, symbolize_names: true)
+        json && BsonCodec.restore_extended_json(JSON.parse(json, symbolize_names: true))
       end
 
       def write_architecture_definition(definition)
@@ -481,6 +506,124 @@ module Mxrb
         )
       end
 
+      # Ruby/React sources are stored outside the Mendix Unit tree. Mendix can
+      # keep editing the native model while MXRB can later restore the exact
+      # conventional application sources on a Ruby-mode export.
+      def ruby_app_sources
+        return [] unless tables.include?("_MxrbRubySource")
+
+        has_mode = table_info("_MxrbRubySource").any? { (_1["name"] || _1[:name]) == "Mode" }
+        columns = has_mode ? "Path, Contents, Sha256, Mode" : "Path, Contents, Sha256"
+        @db.execute("SELECT #{columns} FROM _MxrbRubySource ORDER BY Path").map do |row|
+          fallback = row[0].to_s.start_with?('bin/') ? 0o755 : 0o644
+          { path: row[0], contents: row[1], sha256: row[2], mode: has_mode ? row[3] : fallback }
+        end
+      end
+
+      def write_ruby_app_sources(files)
+        raise ReadOnlyError, "Opened in read-only mode" if @readonly
+
+        @db.execute(<<~SQL)
+          CREATE TABLE IF NOT EXISTS _MxrbRubySource (
+            Path TEXT PRIMARY KEY NOT NULL,
+            Contents BLOB NOT NULL,
+            Sha256 TEXT NOT NULL,
+            Mode INTEGER NOT NULL DEFAULT 420
+          )
+        SQL
+        unless table_info("_MxrbRubySource").any? { (_1["name"] || _1[:name]) == "Mode" }
+          @db.execute("ALTER TABLE _MxrbRubySource ADD COLUMN Mode INTEGER NOT NULL DEFAULT 420")
+        end
+        @db.execute("DELETE FROM _MxrbRubySource")
+        files.each do |file|
+          @db.execute(
+            "INSERT INTO _MxrbRubySource (Path, Contents, Sha256, Mode) VALUES (?, ?, ?, ?)",
+            [
+              file.fetch(:path), SQLite3::Blob.new(file.fetch(:contents)),
+              file.fetch(:sha256), file.fetch(:mode, 0o644)
+            ]
+          )
+        end
+      end
+
+      # Cross-module Mendix associations do not expose native visual
+      # connection fields. Keep their ER-editor anchors in an MXRB-only table
+      # so the diagram remains editable without inventing unsupported BSON.
+      def domain_diagram_anchors
+        return {} unless tables.include?("_MxrbDomainDiagramAssociation")
+
+        @db.execute(<<~SQL).to_h do |row|
+          SELECT AssociationID, SourceAnchor, TargetAnchor
+          FROM _MxrbDomainDiagramAssociation
+        SQL
+          [row[0], { source_anchor: row[1], target_anchor: row[2] }]
+        end
+      end
+
+      def write_domain_diagram_anchors(layouts)
+        raise ReadOnlyError, "Opened in read-only mode" if @readonly
+        items = Array(layouts)
+        return 0 if items.empty?
+
+        @db.execute(<<~SQL)
+          CREATE TABLE IF NOT EXISTS _MxrbDomainDiagramAssociation (
+            AssociationID TEXT PRIMARY KEY NOT NULL,
+            SourceAnchor TEXT NOT NULL,
+            TargetAnchor TEXT NOT NULL
+          )
+        SQL
+        current = domain_diagram_anchors
+        items.count do |layout|
+          id = layout.fetch(:id).to_s
+          anchors = {
+            source_anchor: layout.fetch(:source_anchor).to_s,
+            target_anchor: layout.fetch(:target_anchor).to_s
+          }
+          next false if current[id] == anchors
+
+          @db.execute(
+            "INSERT OR REPLACE INTO _MxrbDomainDiagramAssociation " \
+            "(AssociationID, SourceAnchor, TargetAnchor) VALUES (?, ?, ?)",
+            [id, anchors.fetch(:source_anchor), anchors.fetch(:target_anchor)]
+          )
+          true
+        end
+      end
+
+      def legacy_unit_identity_mismatches
+        return [] unless tables.include?("_MxrbCompatibility")
+
+        @db.execute(<<~SQL).map do |row|
+          SELECT UnitID, ContentID, UnitType
+          FROM _MxrbCompatibility
+          WHERE Kind = 'legacy-unit-identity'
+        SQL
+          { unit_id: row[0], content_id: row[1], type: row[2] }
+        end
+      end
+
+      def write_legacy_unit_identity_mismatches(mismatches)
+        raise ReadOnlyError, "Opened in read-only mode" if @readonly
+
+        @db.execute(<<~SQL)
+          CREATE TABLE IF NOT EXISTS _MxrbCompatibility (
+            Kind TEXT NOT NULL,
+            UnitID TEXT NOT NULL,
+            ContentID TEXT NOT NULL,
+            UnitType TEXT NOT NULL,
+            PRIMARY KEY (Kind, UnitID, ContentID)
+          )
+        SQL
+        @db.execute("DELETE FROM _MxrbCompatibility WHERE Kind = 'legacy-unit-identity'")
+        mismatches.each do |mismatch|
+          @db.execute(
+            "INSERT INTO _MxrbCompatibility (Kind, UnitID, ContentID, UnitType) VALUES (?, ?, ?, ?)",
+            ["legacy-unit-identity", mismatch.fetch(:unit_id),
+             mismatch.fetch(:content_id), mismatch.fetch(:type)]
+          )
+        end
+      end
+
       def close
         @db.close
       end

data/lib/mxrb/model/attribute.rb

@@ -7,6 +7,8 @@ module Mxrb
     # Attributes are embedded in Entity BSON — NOT separate Unit rows.
     # $Type: DomainModels$Attribute
     class Attribute
+      DEFAULT_STRING_LENGTH = 200
+
       # Maps DSL symbol → Mendix storage type name
       TYPE_MAP = {
         string:      "DomainModels$StringAttributeType",
@@ -84,6 +86,7 @@ module Mxrb
       def serialize_type
         storage_type = TYPE_MAP[@type] || TYPE_MAP[:string]
         base = { "$ID" => SecureRandom.uuid, "$Type" => storage_type }
+        base["length"] = @length || DEFAULT_STRING_LENGTH if storage_type == TYPE_MAP[:string]
         base["localizeDate"] = true if @type == :datetime
         base
       end

data/lib/mxrb/model/entity.rb

@@ -10,7 +10,7 @@ module Mxrb
       attr_accessor :id, :name, :qualified_name, :documentation,
                     :persistable, :location, :data_storage_guid,
                     :export_level, :generalization, :access_rules, :indexes,
-                    :system_members
+                    :system_members, :lifecycle, :source, :oql_query, :native_type
 
       # Build from a BSON hash (embedded in DomainModel's "entities" array).
       def self.from_bson(doc, _domain_model_id, mpr)
@@ -19,6 +19,9 @@ module Mxrb
         e.name               = doc["name"]  || doc["Name"]
         e.qualified_name     = doc["$QualifiedName"] || doc["\$QualifiedName"]
         e.documentation      = doc["documentation"] || doc["Documentation"] || ""
+        e.native_type        = doc["$Type"]
+        e.source             = doc["source"] || doc["Source"]
+        e.oql_query          = doc["oqlQuery"] || doc["OqlQuery"] || doc["OQLQuery"]
         e.data_storage_guid  = doc["dataStorageGuid"] || doc["DataStorageGuid"]
         e.export_level       = doc["exportLevel"] || doc["ExportLevel"] || "Hidden"
         e.location           = parse_location(doc["location"] || doc["Location"])
@@ -46,6 +49,8 @@ module Mxrb
         # Access rules (embedded array with marker 3)
         rule_arr = IO::BsonCodec.parse_array(doc["accessRules"] || doc["AccessRules"])[:items]
         e.access_rules = rule_arr.map { parse_access_rule(_1) }
+        event_arr = IO::BsonCodec.parse_array(doc["eventHandlers"] || doc["EventHandlers"])[:items]
+        e.lifecycle = event_arr.map { parse_lifecycle(_1) }
 
         e
       end
@@ -58,6 +63,19 @@ module Mxrb
         @generalization['generalization'] || @generalization['Generalization']
       end
 
+      def oql_view?
+        source_type = @source.is_a?(Hash) ? @source.fetch('$Type', '') : ''
+        @native_type.to_s.match?(/ViewEntity/i) ||
+          source_type.match?(/OqlViewEntitySource/i) ||
+          !@oql_query.to_s.empty?
+      end
+
+      def oql_source_document
+        return unless @source.is_a?(Hash)
+
+        @source['SourceDocument'] || @source['sourceDocument']
+      end
+
       def to_bson
         {
           "$ID"             => @id,
@@ -70,7 +88,7 @@ module Mxrb
           "generalization"  => serialize_generalization,
           "attributes"      => IO::BsonCodec.build_array(@attributes.map(&:to_bson)),
           "validationRules" => IO::BsonCodec.build_array([]),  # must come after attributes
-          "eventHandlers"   => IO::BsonCodec.build_array([]),
+          "eventHandlers"   => IO::BsonCodec.build_array(@lifecycle.to_a.map { lifecycle_bson(_1) }),
           "indexes"         => IO::BsonCodec.build_array([]),
           "accessRules"     => IO::BsonCodec.build_array(@access_rules.to_a),
           "source"          => nil,
@@ -150,6 +168,17 @@ module Mxrb
         }
       end
 
+      def self.parse_lifecycle(doc)
+        moment = doc["Moment"].to_s.downcase
+        event = doc["Event"].to_s.downcase
+        {
+          event: [moment, event].reject(&:empty?).join("_").to_sym,
+          handler: doc["Microflow"].to_s,
+          pass_event_object: doc.fetch("PassEventObject", true) == true,
+          raise_error_on_false: doc["RaiseErrorOnFalse"] == true
+        }
+      end
+
       def self.parse_location(loc)
         if loc.is_a?(String)
           x, y = loc.split(';', 2).map(&:to_i)
@@ -175,6 +204,19 @@ module Mxrb
           "hasChangedBy"    => false,
         }
       end
+
+      def lifecycle_bson(callback)
+        moment, event = callback.fetch(:event).to_s.split("_", 2)
+        {
+          "$ID" => SecureRandom.uuid,
+          "$Type" => "DomainModels$EventHandler",
+          "Event" => event.to_s.capitalize,
+          "Moment" => moment.to_s.capitalize,
+          "Microflow" => callback.fetch(:handler).to_s,
+          "PassEventObject" => callback.fetch(:pass_event_object, true) == true,
+          "RaiseErrorOnFalse" => callback.fetch(:raise_error_on_false, false) == true
+        }
+      end
     end
   end
 end

data/lib/mxrb/model/microflow.rb

@@ -8,7 +8,7 @@ module Mxrb
     # ContainmentName: "Documents"
     class Microflow < Unit
       attr_reader :name, :documentation, :return_variable_name,
-                  :allow_concurrent_execution, :mark_as_used, :excluded,
+                  :allow_concurrent_execution, :apply_entity_access, :mark_as_used, :excluded,
                   :allowed_module_roles, :parameters, :return_type,
                   :objects, :flows
 
@@ -17,6 +17,7 @@ module Mxrb
         @documentation              = doc["Documentation"] || doc["documentation"] || ""
         @return_variable_name       = doc["ReturnVariableName"] || "ReturnValue"
         @allow_concurrent_execution = doc["AllowConcurrentExecution"] != false
+        @apply_entity_access = doc["ApplyEntityAccess"] == true
         @mark_as_used               = doc["MarkAsUsed"] == true
         @excluded                   = doc["Excluded"] == true
         @allowed_module_roles       = parse_array(doc["AllowedModuleRoles"])
@@ -43,6 +44,7 @@ module Mxrb
           "Documentation"             => @documentation || "",
           "ReturnVariableName"        => @return_variable_name || "ReturnValue",
           "AllowConcurrentExecution"  => @allow_concurrent_execution != false,
+          "ApplyEntityAccess" => @apply_entity_access == true,
           "MarkAsUsed"                => @mark_as_used || false,
           "Excluded"                  => @excluded || false,
           "AllowedModuleRoles"        => IO::BsonCodec.build_array(@allowed_module_roles || [], marker: 1),