# Step 3: Client Project Handling (seeding_strategy = "provider")

> Referenced from `steps/step-03-roles.md` — Specific handling for client projects.

---

## ApplicationRolesSeedData.cs (ONCE per application)

**File:** `Infrastructure/Persistence/Seeding/Data/ApplicationRolesSeedData.cs`

**Purpose:** Defines the 4 standard application-scoped roles (Admin, Manager, Contributor, Viewer) with valid `Code` values.

**CRITICAL:** Without this file, role-permission mappings in `SeedRolePermissionsAsync()` will fail silently because `roles.FirstOrDefault(r => r.Code == mapping.RoleCode)` will return null.

See [references/application-roles-template.md](../references/application-roles-template.md) for the complete template.

**Key requirements:**
- Random GUIDs via `Guid.NewGuid()` — roles are resolved by Code at runtime
- 4 roles: Admin, Manager, Contributor, Viewer
- Each role has a valid `Code` property ("admin", "manager", "contributor", "viewer")
- `ApplicationId` references the navigation application GUID
- `IsSystem = false` (application-scoped, not system roles)

**Detection:** Check if ApplicationRolesSeedData.cs exists. If yes, skip creation (already exists from Module 1). If no, create it.

---

## {Module}RolePermissionSeedData.cs (PER module)

**File:** `Infrastructure/Persistence/Seeding/Data/{Domain}/{Module}RolePermissionSeedData.cs`

**Purpose:** Maps permissions to roles by Code (e.g., "admin" → "{navRoute}.*").

Content: static class with method `GetRolePermissionEntries()` that returns the role-permission mapping data.
These entries will be consumed by the `IClientSeedDataProvider` at step 03b.

---

## Default Role Mapping Table

Based on navigation application prefix:

| Application prefix | PlatformAdmin | TenantAdmin | StandardUser |
|---------|---------------|-------------|--------------|
| `administration.*` | Full CRUD | Read only | None |
| `*` (business apps) | Full CRUD | Full CRUD | Read only |
| `myspace.*` | None | Full CRUD | Full CRUD |

---

## Summary

After creating both files:
- Proceed to step-03b-provider.md (which will skip for core projects)
- The provider will consume these SeedData files to seed roles and permissions at runtime
