fix(test): leave the project as mxcli test found it

[ako]

Fixes mendixlabs/mxcli#802, #803 and #804. Split out of #57.

(Issue numbers refer to mendixlabs/mxcli, not this fork.)

Three separately-reported defects that turn out to be one teardown routine — ~60 lines of cmd/mxcli/testrunner/runner.go. They share a single projectState refactor, which is why they land as one commit.

mendixlabs#803 — the after-startup setting was never restored

DESCRIBE SETTINGS separates properties with commas, and getAfterStartup trimmed quotes before punctuation:

input:   AfterStartupMicroflow = 'MyFirstModule.ASU_Startup',
parsed:  MyFirstModule.ASU_Startup',
restore: ALTER SETTINGS MODEL AfterStartupMicroflow = 'MyFirstModule.ASU_Startup','
→ Parse error: mismatched input '<EOF>' expecting IDENTIFIER

Printed as a warning, so the run read as clean while the project was left pointing at MxTest.TestRunner — the microflow cleanup then deleted.

Trailing ,; now comes off first, the value is re-emitted through a helper that doubles embedded quotes (Mendix's escape, never backslashes), and cleanup returns its errors: a failed restore now fails the run and names what was left changed.

mendixlabs#804 — the orphaned MxTest module

Fixed, but not the way the issue proposed. CREATE MODULE is idempotent — it prints "already exists" and reuses it — so an unconditional DROP MODULE MxTest would delete a user's own MxTest module along with everything in it. The run now records whether it created the module and drops it only in that case; otherwise it removes just the generated microflow.

DROP MODULE also errors on a missing module, so cleanup re-checks presence first — otherwise a run that failed before injection landed would report a cleanup failure that never happened.

mendixlabs#802 — the Security Level

Removed entirely, as the reporter suggested. Their finding checks out: the after-startup microflow runs in an administrative context and is not subject to the Security Level, so forcing it OFF bought nothing while breaking custom-auth REST/OData services — and the restore hardcoded PRODUCTION, silently changing projects that legitimately run at another level.

Testing

make build, make test, make lint, make check-mdl pass on this branch alone.

The runner shells out to mxcli and needs Docker, so the setup and cleanup statements are now built by pure functions and the tests assert the actual command lists — including that neither mentions SECURITY LEVEL. (My first instinct was to scan the source text for it; that was wrong and is not what landed.) The repaired restore statement and DROP MODULE were verified against a real project directly.

.claude/skills/mendix/test-microflows.md had a stale "Sets security OFF … Restores original security" description; corrected.

Note

The mendixlabs#802 reporter said they have a working fix ready to submit — worth a comment on the issue before this goes upstream so the work isn't duplicated.

🤖 Generated with Claude Code

https://claude.ai/code/session_012XR649rKk68z6gBpngu6MA

---

Generated by Claude Code