@atlashub/smartstack-cli 3.39.0 → 3.41.0

package/templates/skills/application/references/roles-fallback-procedure.md

@@ -1,149 +1,149 @@
-# Role-Permission Generation: Fallback Procedure (When MCP Unavailable)
-
-> Reference for step-03-roles.md — Generates role-permission HasData entries following SmartStack.app patterns.
-
----
-
-## F1. Read Existing RolePermissionConfiguration.cs
-
-```
-Glob: **/Persistence/Configurations/Authorization/RolePermissionConfiguration.cs
-```
-
-Read the file to determine:
-- Existing role-permission mappings
-- The GetSeedData() method structure
-- Which roles already have which permissions
-- The GUID generation method used (deterministic or hardcoded)
-
----
-
-## F2. Read Role GUIDs
-
-**System-level roles** (well-known GUIDs):
-
-| Role | GUID |
-|------|------|
-| SuperAdmin | `11111111-1111-1111-1111-111111111111` |
-| PlatformAdmin | `22222222-2222-2222-2222-222222222222` |
-| TenantAdmin | `33333333-3333-3333-3333-333333333333` |
-| StandardUser | `44444444-4444-4444-4444-444444444444` |
-
-**IMPORTANT:** Read the actual `RoleSeedData.cs` or `RoleConfiguration.cs` in the target project to confirm the actual role GUIDs. The above are defaults; the project may use different values.
-
-**Application-scoped roles** (deterministic GUIDs based on application):
-
-```csharp
-// Read the existing GenerateDeterministicGuid method in RolePermissionConfiguration.cs
-// Typically uses MD5 hash:
-private static Guid GenerateDeterministicGuid(Guid applicationId, string roleType)
-{
-    using var md5 = System.Security.Cryptography.MD5.Create();
-    var input = $"{applicationId}-{roleType}";
-    var hash = md5.ComputeHash(System.Text.Encoding.UTF8.GetBytes(input));
-    return new Guid(hash);
-}
-// roleType values: "admin", "manager", "contributor", "viewer"
-```
-
-Find the `applicationId` from `NavigationApplicationSeedData.cs` matching `{full_path}`.
-
----
-
-## F3. Determine Application-Based Default Mappings
-
-Based on `{full_path}` application prefix:
-
-| Application Prefix | SuperAdmin | PlatformAdmin | App Admin | App Manager | App Contributor | App Viewer |
-|----------------|------------|---------------|-----------|-------------|-----------------|------------|
-| `administration.*` | wildcard | Full CRUD | Full CRUD | CRU | CR | R |
-| `*` (business apps) | wildcard | Full CRUD | Full CRUD | CRU | CR | R |
-| `myspace.*` | wildcard | None | Full CRUD | CRU | CR | R |
-
----
-
-## F4. Generate RolePermission HasData Entries
-
-Using `{permission_guids}` from step-02:
-
-```csharp
-// In RolePermissionConfiguration.cs - GetSeedData() method
-var seedDate = SeedConstants.SeedDate;
-
-// ============================================================
-// {MODULE_NAME} PERMISSIONS
-// ============================================================
-
-// SuperAdmin: already has *.* wildcard - no individual entries needed
-
-// PlatformAdmin (for platform.* context)
-rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
-rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });
-rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.update}, AssignedAt = seedDate });
-rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.delete}, AssignedAt = seedDate });
-
-// Application-scoped: Admin → wildcard
-rolePermissions.Add(new { RoleId = appAdminRoleId, PermissionId = {permission_guids.wildcard}, AssignedAt = seedDate });
-
-// Application-scoped: Manager → CRU (read + create + update — no delete)
-rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
-rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });
-rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.update}, AssignedAt = seedDate });
-
-// Application-scoped: Contributor → CR
-rolePermissions.Add(new { RoleId = appContributorRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
-rolePermissions.Add(new { RoleId = appContributorRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });
-
-// Application-scoped: Viewer → R
-rolePermissions.Add(new { RoleId = appViewerRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
-```
-
----
-
-## F5. Write Code to RolePermissionConfiguration.cs
-
-**CRITICAL:** Do NOT just display code. WRITE it to the actual file.
-
-1. Open `RolePermissionConfiguration.cs`
-2. Find the `GetSeedData()` method
-3. Add the new role-permission entries to the list
-4. Add necessary permission GUID references (import from PermissionConfiguration or use inline)
-5. Add comments grouping the new entries: `// {MODULE_NAME} PERMISSIONS`
-
----
-
-## F6. Present Summary
-
-```markdown
-## Role-Permission Mappings Generated (Fallback)
-
-| Role | Permissions |
-|------|-------------|
-| SuperAdmin | Already has wildcard access |
-| PlatformAdmin | {full_path}.read, .create, .update, .delete |
-| App Admin | {full_path}.* (wildcard) |
-| App Manager | {full_path}.read, .create, .update |
-| App Contributor | {full_path}.read, .create |
-| App Viewer | {full_path}.read |
-
-Written to: RolePermissionConfiguration.cs
-```
-
----
-
-## F7. Offer User Adjustment
-
-If user selects "Custom adjustments", ask which roles/permissions to change and update the file accordingly.
-
----
-
-## Validation Checklist
-
-Before marking as completed, verify:
-
-- [ ] All role GUIDs correctly identified (system and application-scoped)
-- [ ] Role-permission mappings follow application hierarchy
-- [ ] Code WRITTEN to files (not just displayed)
-- [ ] Permission GUID references correct
-- [ ] Comments added for module grouping
-- [ ] No gaps or missing permissions
+# Role-Permission Generation: Fallback Procedure (When MCP Unavailable)
+
+> Reference for step-03-roles.md — Generates role-permission HasData entries following SmartStack.app patterns.
+
+---
+
+## F1. Read Existing RolePermissionConfiguration.cs
+
+```
+Glob: **/Persistence/Configurations/Authorization/RolePermissionConfiguration.cs
+```
+
+Read the file to determine:
+- Existing role-permission mappings
+- The GetSeedData() method structure
+- Which roles already have which permissions
+- The GUID generation method used (deterministic or hardcoded)
+
+---
+
+## F2. Read Role GUIDs
+
+**System-level roles** (well-known GUIDs):
+
+| Role | GUID |
+|------|------|
+| SuperAdmin | `11111111-1111-1111-1111-111111111111` |
+| PlatformAdmin | `22222222-2222-2222-2222-222222222222` |
+| TenantAdmin | `33333333-3333-3333-3333-333333333333` |
+| StandardUser | `44444444-4444-4444-4444-444444444444` |
+
+**IMPORTANT:** Read the actual `RoleSeedData.cs` or `RoleConfiguration.cs` in the target project to confirm the actual role GUIDs. The above are defaults; the project may use different values.
+
+**Application-scoped roles** (deterministic GUIDs based on application):
+
+```csharp
+// Read the existing GenerateDeterministicGuid method in RolePermissionConfiguration.cs
+// Typically uses MD5 hash:
+private static Guid GenerateDeterministicGuid(Guid applicationId, string roleType)
+{
+    using var md5 = System.Security.Cryptography.MD5.Create();
+    var input = $"{applicationId}-{roleType}";
+    var hash = md5.ComputeHash(System.Text.Encoding.UTF8.GetBytes(input));
+    return new Guid(hash);
+}
+// roleType values: "admin", "manager", "contributor", "viewer"
+```
+
+Find the `applicationId` from `NavigationApplicationSeedData.cs` matching `{full_path}`.
+
+---
+
+## F3. Determine Application-Based Default Mappings
+
+Based on `{full_path}` application prefix:
+
+| Application Prefix | SuperAdmin | PlatformAdmin | App Admin | App Manager | App Contributor | App Viewer |
+|----------------|------------|---------------|-----------|-------------|-----------------|------------|
+| `administration.*` | wildcard | Full CRUD | Full CRUD | CRU | CR | R |
+| `*` (business apps) | wildcard | Full CRUD | Full CRUD | CRU | CR | R |
+| `myspace.*` | wildcard | None | Full CRUD | CRU | CR | R |
+
+---
+
+## F4. Generate RolePermission HasData Entries
+
+Using `{permission_guids}` from step-02:
+
+```csharp
+// In RolePermissionConfiguration.cs - GetSeedData() method
+var seedDate = SeedConstants.SeedDate;
+
+// ============================================================
+// {MODULE_NAME} PERMISSIONS
+// ============================================================
+
+// SuperAdmin: already has *.* wildcard - no individual entries needed
+
+// PlatformAdmin (for administration.* scope)
+rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
+rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });
+rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.update}, AssignedAt = seedDate });
+rolePermissions.Add(new { RoleId = platformAdminRoleId, PermissionId = {permission_guids.delete}, AssignedAt = seedDate });
+
+// Application-scoped: Admin → wildcard
+rolePermissions.Add(new { RoleId = appAdminRoleId, PermissionId = {permission_guids.wildcard}, AssignedAt = seedDate });
+
+// Application-scoped: Manager → CRU (read + create + update — no delete)
+rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
+rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });
+rolePermissions.Add(new { RoleId = appManagerRoleId, PermissionId = {permission_guids.update}, AssignedAt = seedDate });
+
+// Application-scoped: Contributor → CR
+rolePermissions.Add(new { RoleId = appContributorRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
+rolePermissions.Add(new { RoleId = appContributorRoleId, PermissionId = {permission_guids.create}, AssignedAt = seedDate });
+
+// Application-scoped: Viewer → R
+rolePermissions.Add(new { RoleId = appViewerRoleId, PermissionId = {permission_guids.read}, AssignedAt = seedDate });
+```
+
+---
+
+## F5. Write Code to RolePermissionConfiguration.cs
+
+**CRITICAL:** Do NOT just display code. WRITE it to the actual file.
+
+1. Open `RolePermissionConfiguration.cs`
+2. Find the `GetSeedData()` method
+3. Add the new role-permission entries to the list
+4. Add necessary permission GUID references (import from PermissionConfiguration or use inline)
+5. Add comments grouping the new entries: `// {MODULE_NAME} PERMISSIONS`
+
+---
+
+## F6. Present Summary
+
+```markdown
+## Role-Permission Mappings Generated (Fallback)
+
+| Role | Permissions |
+|------|-------------|
+| SuperAdmin | Already has wildcard access |
+| PlatformAdmin | {full_path}.read, .create, .update, .delete |
+| App Admin | {full_path}.* (wildcard) |
+| App Manager | {full_path}.read, .create, .update |
+| App Contributor | {full_path}.read, .create |
+| App Viewer | {full_path}.read |
+
+Written to: RolePermissionConfiguration.cs
+```
+
+---
+
+## F7. Offer User Adjustment
+
+If user selects "Custom adjustments", ask which roles/permissions to change and update the file accordingly.
+
+---
+
+## Validation Checklist
+
+Before marking as completed, verify:
+
+- [ ] All role GUIDs correctly identified (system and application-scoped)
+- [ ] Role-permission mappings follow application hierarchy
+- [ ] Code WRITTEN to files (not just displayed)
+- [ ] Permission GUID references correct
+- [ ] Comments added for module grouping
+- [ ] No gaps or missing permissions