---
name: step-02-permissions
description: Generate RBAC permissions using MCP generate_permissions
prev_step: steps/step-01-navigation.md
next_step: steps/step-03-roles.md
---

# Step 2: Permissions Generation

## MANDATORY EXECUTION RULES

- ALWAYS use MCP `generate_permissions` tool - NEVER use templates
- ALWAYS generate BOTH Permissions.cs constants AND PermissionConfiguration.cs HasData
- NEVER skip this step - permissions are MANDATORY for security
- YOU ARE AN ORCHESTRATOR calling MCP, not a generator

## YOUR TASK

Call the SmartStack MCP `generate_permissions` tool to generate:
1. Permissions.cs nested class with constants
2. PermissionConfiguration.cs HasData() entries

---

## AVAILABLE STATE

From previous steps:

| Variable | Description |
|----------|-------------|
| `{level}` | context, application, module, or section |
| `{full_path}` | Complete navigation path (navRoute) |
| `{navigation_guid}` | GUID of the navigation entity |
| `{labels}` | Object with fr, en, it, de |
| `{project_type}` | "core" or "client" |
| `{seeding_strategy}` | "hasdata" or "provider" |

---

## EXECUTION SEQUENCE

### 1. Determine NavRoute

For permissions, the navRoute is the `{full_path}`:

```
navRoute = "{full_path}"
Example: "erp.sales.products"
```

### 2. Call MCP generate_permissions

```
Tool: mcp__smartstack__generate_permissions
Args:
  navRoute: "{full_path}"
  includeStandardActions: true
  includeWildcard: true
```

### 3. Parse MCP Response

The tool returns:
- Permissions.cs nested class structure
- PermissionConfiguration.cs HasData() entries
- Deterministic GUIDs for each permission

### 4. Present Permissions.cs Output

```markdown
## Permissions.cs Constants

Add to `Application/Common/Authorization/Permissions.cs`:

[Show Permissions.cs nested class from MCP response]

**Usage in Controller:**
```csharp
[RequirePermission(Permissions.{Context}.{Application}.{Module}.Read)]
public async Task<ActionResult> GetAll() { ... }
```
```

### 5. Present PermissionConfiguration.cs Output

```markdown
## PermissionConfiguration.cs HasData

Add to `Infrastructure/Persistence/Configurations/PermissionConfiguration.cs`:

[Show HasData entries from MCP response]
```

### 6. Store Permission GUIDs

Store the permission GUIDs for use in step-03-roles:

```
{permission_guids} = {
  wildcard: "guid-for-wildcard",
  read: "guid-for-read",
  create: "guid-for-create",
  update: "guid-for-update",
  delete: "guid-for-delete"
}
```

---

## CLIENT PROJECT HANDLING

> **Condition:** `{seeding_strategy}` = "provider"

### 1. Call MCP generate_permissions normally

The tool always returns:
- Permissions.cs constants (Application layer) - **ALWAYS generated** (identical for core and client)
- PermissionConfiguration.cs HasData - **REDIRECT for client projects**

### 2. Permissions.cs: IDENTICAL

The `Permissions.cs` file in the Application layer is generated identically regardless of project type.
Write it as usual.

### 3. PermissionConfiguration.cs: REDIRECT

**For core (`{seeding_strategy}` = "hasdata"):** Write HasData() in `PermissionConfiguration.cs` (existing pattern)

**For client (`{seeding_strategy}` = "provider"):** DO NOT write in PermissionConfiguration.cs (does not exist in client projects).
Instead, create:
- `Infrastructure/Persistence/Seeding/Data/{Domain}/{Module}PermissionSeedData.cs`

Content: static class with deterministic GUIDs and method `GetPermissionEntries()`.
These entries will be consumed by the `IClientSeedDataProvider` at step 03b.

### 4. Store Permission GUIDs

Identical to the existing pattern - store `{permission_guids}` for step-03.

---

## TWO-FILE REQUIREMENT

**CRITICAL:** SmartStack requires permissions in TWO files:

| File | Layer | Content |
|------|-------|---------|
| `Permissions.cs` | Application | Compile-time constants |
| `PermissionConfiguration.cs` | Infrastructure | EF Core HasData seeds |

Both MUST be kept in sync. Missing one = runtime 403 errors.

> **Client project exception:** For `{seeding_strategy}` = "provider", `PermissionConfiguration.cs` is replaced by
> `{Module}PermissionSeedData.cs` + `IClientSeedDataProvider`. The `Permissions.cs` constants file is still required.

---

## MCP RESPONSE HANDLING

### Success Case

If MCP returns successfully:
- Display Permissions.cs code
- Display PermissionConfiguration.cs HasData code
- Store `{permission_guids}` for next step
- Proceed to step-03-roles.md

### Error Case

If MCP call fails:
- Display error message
- Suggest checking navRoute format
- Do NOT proceed automatically

---

## SUCCESS METRICS

- MCP generate_permissions called successfully
- Permissions.cs code displayed
- PermissionConfiguration.cs HasData displayed
- Deterministic GUIDs (not placeholders)
- Permission GUIDs stored for role assignment
- Proceeded to step-03-roles.md

## FAILURE MODES

- MCP call failed (display error, stop)
- Invalid navRoute format (must be context.application.module)
- Missing navigation entity (return to step-01)

---

## NEXT STEP

After displaying permission code, proceed to `./step-03-roles.md`
