GRANT syntax does not support attribute-level access — READ "Attr1", "Attr2" fails with parse error

[MohamedElNady]

🐛 Bug Report

Summary

The GRANT syntax does not support member-level attribute access control.
When attempting to grant READ or WRITE permissions on specific attributes
using quoted identifiers (e.g. READ "Attr1", "Attr2"), MxCLI throws a parse
error and the operation fails.

---

Context

Discovered during AI-assisted security configuration, where Claude attempted
to apply attribute-level access rules on an entity using the following syntax:
GRANT Mod.Role ON Mod.Entity (CREATE, DELETE, READ "Attr1" "Attr2", WRITE "Attr1")

The command failed with a parse error indicating that only CREATE, DELETE,
READ, and WRITE keywords are expected — not quoted attribute identifiers.

---

Steps to Reproduce

1. Define an entity with multiple attributes (e.g. Name, Email, Salary)
2. Attempt to grant read access on specific attributes only:
   GRANT Mod.Role ON Mod.Entity (READ "Name" "Email", WRITE "Name")
3. MxCLI throws a parse/syntax error ❌

---

Observed vs Expected

	Observed	Expected
READ "Attr1", "Attr2"	Parse error — unexpected quoted identifier	Grant read access on specified attributes only
READ *	Works ✅	Works ✅
WRITE *	Works ✅	Works ✅

---

Current Workaround

Use READ * and WRITE * to grant access on all attributes.
This works but does not support fine-grained, attribute-level security rules.
GRANT Mod.Role ON Mod.Entity (CREATE, DELETE, READ *, WRITE *)

---

Impact

• Attribute-level access control cannot be configured via MxCLI
• AI agents default silently to READ * / WRITE * (full access)
  as a workaround — which may violate security requirements in
  production or government-grade applications
• No way to enforce column-level data restrictions through automation

---

Suggested Fix / Enhancement

Either:

1. Add support for READ "Attr1", "Attr2" syntax in the GRANT command
   to allow attribute-level permission scoping
2. Or clearly document in CLAUDE.md and the GRANT reference that
   attribute-level access is not supported, so AI agents and developers
   don't attempt invalid syntax

---

Environment

• Tool: MxCLI v0.6.0
• Mendix Studio Pro Version: [11.9.0]

[github-actions]

Issue Triage

Summary:
The GRANT command fails to parse quoted attribute identifiers (e.g., READ "Attr1", "Attr2"), preventing attribute‑level access control.

Checklist for bug report completeness

Required info	Present?	Details
mxcli version	❌	Not mentioned
Mendix version	✅	Mendix Studio Pro Version: [11.9.0]
Scenario (what the user was trying to do)	✅	Attempting to grant READ/WRITE on specific attributes via GRANT command
Expected output	✅	Grant read/write access on the listed attributes only
Experienced output (error message, etc.)	✅	Parse error indicating unexpected quoted identifier
AI bug report (mxcli diag --bundle or session log)	❌	Not provided

What’s missing:

• The version of mxcli you’re using (output of mxcli --version or commit/build info).
• The diagnostic bundle or at least the session log from mxcli diag --bundle to see the exact parse error and surrounding context.

Could you please add those details? Once we have them we’ll be able to reproduce the issue and work on a fix. Thanks for reporting!

---

Automated triage via OpenRouter — workflow source

[MohamedElNady]

v0.6.0

[ako]

Thanks for the report! Attribute-level GRANT is actually supported — the syntax in the report just doesn't match the grammar. mxcli expects unquoted identifiers inside parentheses, comma-separated — not quoted strings.

Works today:

GRANT Mod.Role ON Mod.Entity (CREATE, DELETE, READ (Attr1, Attr2), WRITE (Attr1));

What was tried (fails):

GRANT Mod.Role ON Mod.Entity (READ "Attr1", "Attr2", WRITE "Attr1")

Grammar rule (mdl/grammar/MDLParser.g4:463-469):

entityAccessRight
    : CREATE | DELETE
    | READ STAR  | READ  LPAREN IDENTIFIER (COMMA IDENTIFIER)* RPAREN
    | WRITE STAR | WRITE LPAREN IDENTIFIER (COMMA IDENTIFIER)* RPAREN
    ;

This is documented in docs/05-mdl-specification/01-language-reference.md and .claude/skills/mendix/manage-security.md, but the old parse error didn't hint at the correct form — that's the real issue to fix.

Fix: I've added a detector so the parse error now points at the correct syntax:

Syntax errors found:
  - line 1:51 no viable alternative at input 'READ"Attr1"'

  Attribute-level GRANT uses unquoted identifiers inside parentheses,
  not quoted strings. Comma-separate multiple attributes:
    GRANT Mod.Role ON Mod.Entity (READ (Attr1, Attr2), WRITE (Attr1));  (correct)
    GRANT Mod.Role ON Mod.Entity (READ "Attr1", "Attr2");               (wrong — causes parse error)

Closing this as not-a-bug once the error-message improvement lands — AI agents and users should no longer silently fall back to READ *.