# Role-Permission Generation: Fallback Procedure (When MCP Unavailable)

> Reference for step-03-roles.md — Generates role-permission HasData entries following SmartStack.app patterns.

---

## F1. Read Existing RolePermissionConfiguration.cs

```
Glob: **/Persistence/Configurations/Authorization/RolePermissionConfiguration.cs
```

Read the file to determine:
- Existing role-permission mappings
- The GetSeedData() method structure
- Which roles already have which permissions
- The GUID generation method used (deterministic or hardcoded)

---

## F2. Read Role GUIDs

**System-level roles** (well-known GUIDs):

| Role | GUID |
|------|------|
| SuperAdmin | Resolved by Code at runtime (NEVER hardcoded) |
| PlatformAdmin | Resolved by Code at runtime (NEVER hardcoded) |
| TenantAdmin | Resolved by Code at runtime (NEVER hardcoded) |
| StandardUser | Resolved by Code at runtime (NEVER hardcoded) |

**IMPORTANT:** Read the actual `RoleSeedData.cs` or `RoleConfiguration.cs` in the target project to confirm the actual role GUIDs. The above are defaults; the project may use different values.

**Application-scoped roles** (resolved by Code at runtime):

```csharp
// ALWAYS resolve roles by Code at runtime — NEVER use deterministic/hardcoded GUIDs
// Role IDs are generated via Guid.NewGuid() at seed time
// Lookups use:
var role = await context.Roles.FirstOrDefaultAsync(r => r.Code == "admin", ct);
// roleCode values: "admin", "manager", "contributor", "viewer"
```

Find the `applicationId` from `NavigationApplicationSeedData.cs` matching `{full_path}`.

---

## F3. Determine Application-Based Default Mappings

Based on `{full_path}` application prefix:

| Application Prefix | SuperAdmin | PlatformAdmin | App Admin | App Manager | App Contributor | App Viewer |
|----------------|------------|---------------|-----------|-------------|-----------------|------------|
| `administration.*` | wildcard | Full CRUD | Full CRUD | CRU | CR | R |
| `*` (business apps) | wildcard | Full CRUD | Full CRUD | CRU | CR | R |
| `myspace.*` | wildcard | None | Full CRUD | CRU | CR | R |

---

## F4. Generate RolePermission HasData Entries

Using `{permission_guids}` from step-02:

```csharp
// In RolePermissionConfiguration.cs - GetSeedData() method
var seedDate = SeedConstants.SeedDate;

// ============================================================
// {MODULE_NAME} PERMISSIONS
// ============================================================

// SuperAdmin: already has *.* wildcard - no individual entries needed

// PlatformAdmin (for administration.* scope)
rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });
rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.update}, AssignedAt = seedDate });
rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.delete}, AssignedAt = seedDate });

// Application-scoped: Admin → wildcard
rolePermissions.Add(new { RoleId = appAdminRoleId, PermissionId = {permission_guids.wildcard}, AssignedAt = seedDate });

// Application-scoped: Manager → CRU (read + create + update — no delete)
rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });
rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.update}, AssignedAt = seedDate });

// Application-scoped: Contributor → CR
rolePermissions.Add(new { RoleId = appContributorRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
rolePermissions.Add(new { RoleId = appContributorRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });

// Application-scoped: Viewer → R
rolePermissions.Add(new { RoleId = appViewerRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
```

---

## F5. Write Code to RolePermissionConfiguration.cs

**CRITICAL:** Do NOT just display code. WRITE it to the actual file.

1. Open `RolePermissionConfiguration.cs`
2. Find the `GetSeedData()` method
3. Add the new role-permission entries to the list
4. Add necessary permission GUID references (import from PermissionConfiguration or use inline)
5. Add comments grouping the new entries: `// {MODULE_NAME} PERMISSIONS`

---

## F6. Present Summary

```markdown
## Role-Permission Mappings Generated (Fallback)

| Role | Permissions |
|------|-------------|
| SuperAdmin | Already has wildcard access |
| PlatformAdmin | {full_path}.read, .create, .update, .delete |
| App Admin | {full_path}.* (wildcard) |
| App Manager | {full_path}.read, .create, .update |
| App Contributor | {full_path}.read, .create |
| App Viewer | {full_path}.read |

Written to: RolePermissionConfiguration.cs
```

---

## F7. Offer User Adjustment

If user selects "Custom adjustments", ask which roles/permissions to change and update the file accordingly.

---

## Validation Checklist

Before marking as completed, verify:

- [ ] All role GUIDs correctly identified (system and application-scoped)
- [ ] Role-permission mappings follow application hierarchy
- [ ] Code WRITTEN to files (not just displayed)
- [ ] Permission GUID references correct
- [ ] Comments added for module grouping
- [ ] No gaps or missing permissions
