swallowkit 1.0.0-beta.13 → 1.0.0-beta.14

package/src/core/scaffold/connector-functions-generator.ts

@@ -11,7 +11,9 @@ import {
   RdbModelConnectorConfig,
   ApiModelConnectorConfig,
   ConnectorOperation,
+  ModelAuthPolicy,
 } from "../../types";
+import { generateAuthImportTS, generateAuthGuardTS } from "./auth-generator";
 
 // ─── TypeScript Generators ────────────────────────────────────────
 
@@ -22,7 +24,8 @@ export function generateRdbConnectorFunctionTS(
   model: ModelInfo,
   sharedPackageName: string,
   connectorDef: RdbConnectorConfig,
-  modelConnector: RdbModelConnectorConfig
+  modelConnector: RdbModelConnectorConfig,
+  authPolicy?: ModelAuthPolicy
 ): string {
   const modelCamel = toCamelCase(model.name);
   const schemaName = model.schemaName;
@@ -118,10 +121,20 @@ export function generateRdbConnectorFunctionTS(
         await pool.close();
       }`;
 
+  // Auth guard setup
+  const hasAuth = !!authPolicy;
+  const authImport = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
+  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read')}\n` : '';
+  const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write')}\n` : '';
+  const authCatchBlock = hasAuth
+    ? `      const authErr = handleAuthError(error);
+      if (authErr) return authErr;\n      `
+    : `      `;
+
   let code = `import { app, HttpRequest, HttpResponseInit, InvocationContext } from '@azure/functions';
 import { z } from 'zod/v4';
 import { ${schemaName} } from '${sharedPackageName}';
-${driverImport}
+${driverImport}${authImport}
 
 ${getConnection}
 `;
@@ -134,10 +147,10 @@ app.http('${modelCamel}-get-all', {
   route: '${modelCamel}',
   authLevel: 'anonymous',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${readGuard}
       ${queryAll}
     } catch (error) {
-      context.error(\`Error fetching from ${table}:\`, error);
+      ${authCatchBlock}context.error(\`Error fetching from ${table}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to fetch items' } };
     }
   },
@@ -153,14 +166,14 @@ app.http('${modelCamel}-get-by-id', {
   route: '${modelCamel}/{id}',
   authLevel: 'anonymous',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${readGuard}
       const id = request.params.id;
       if (!id) {
         return { status: 400, jsonBody: { error: 'ID is required' } };
       }
       ${queryById}
     } catch (error) {
-      context.error(\`Error fetching item from ${table}:\`, error);
+      ${authCatchBlock}context.error(\`Error fetching item from ${table}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to fetch item' } };
     }
   },
@@ -178,7 +191,8 @@ export function generateApiConnectorFunctionTS(
   model: ModelInfo,
   sharedPackageName: string,
   connectorDef: ApiConnectorConfig,
-  modelConnector: ApiModelConnectorConfig
+  modelConnector: ApiModelConnectorConfig,
+  authPolicy?: ModelAuthPolicy
 ): string {
   const modelCamel = toCamelCase(model.name);
   const schemaName = model.schemaName;
@@ -188,9 +202,19 @@ export function generateApiConnectorFunctionTS(
 
   const authSetup = generateTSAuthSetup(connectorDef);
 
+  // Auth guard setup (user access control, separate from connector auth to external APIs)
+  const hasAuth = !!authPolicy;
+  const authImportLine = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
+  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read')}\n` : '';
+  const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write')}\n` : '';
+  const authCatchBlock = hasAuth
+    ? `      const authErr = handleAuthError(error);
+      if (authErr) return authErr;\n      `
+    : `      `;
+
   let code = `import { app, HttpRequest, HttpResponseInit, InvocationContext } from '@azure/functions';
 import { z } from 'zod/v4';
-import { ${schemaName} } from '${sharedPackageName}';
+import { ${schemaName} } from '${sharedPackageName}';${authImportLine}
 
 function getBaseUrl(): string {
   return process.env.${baseUrlEnv} || '';
@@ -209,7 +233,7 @@ app.http('${modelCamel}-get-all', {
   route: '${modelCamel}',
   authLevel: 'anonymous',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${readGuard}
       const url = getBaseUrl() + '${epPath}';
       const response = await fetch(url, {
         method: 'GET',
@@ -225,7 +249,7 @@ app.http('${modelCamel}-get-all', {
       const validated = z.array(${schemaName}).parse(data);
       return { status: 200, jsonBody: validated };
     } catch (error) {
-      context.error(\`Error fetching from external API:\`, error);
+      ${authCatchBlock}context.error(\`Error fetching from external API:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to fetch items' } };
     }
   },
@@ -243,7 +267,7 @@ app.http('${modelCamel}-get-by-id', {
   route: '${modelCamel}/{id}',
   authLevel: 'anonymous',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${readGuard}
       const id = request.params.id;
       if (!id) {
         return { status: 400, jsonBody: { error: 'ID is required' } };
@@ -265,7 +289,7 @@ app.http('${modelCamel}-get-by-id', {
       const validated = ${schemaName}.parse(data);
       return { status: 200, jsonBody: validated };
     } catch (error) {
-      context.error(\`Error fetching item from external API:\`, error);
+      ${authCatchBlock}context.error(\`Error fetching item from external API:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to fetch item' } };
     }
   },
@@ -283,7 +307,7 @@ app.http('${modelCamel}-create', {
   route: '${modelCamel}',
   authLevel: 'anonymous',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${writeGuard}
       const body = await request.json();
       const url = getBaseUrl() + '${epPath}';
       const response = await fetch(url, {
@@ -301,7 +325,7 @@ app.http('${modelCamel}-create', {
       const data = await response.json();
       return { status: 201, jsonBody: data };
     } catch (error) {
-      context.error(\`Error creating item via external API:\`, error);
+      ${authCatchBlock}context.error(\`Error creating item via external API:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to create item' } };
     }
   },
@@ -321,7 +345,7 @@ app.http('${modelCamel}-update', {
   route: '${modelCamel}/{id}',
   authLevel: 'anonymous',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${writeGuard}
       const id = request.params.id;
       if (!id) {
         return { status: 400, jsonBody: { error: 'ID is required' } };
@@ -343,7 +367,7 @@ app.http('${modelCamel}-update', {
       const data = await response.json();
       return { status: 200, jsonBody: data };
     } catch (error) {
-      context.error(\`Error updating item via external API:\`, error);
+      ${authCatchBlock}context.error(\`Error updating item via external API:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to update item' } };
     }
   },
@@ -361,7 +385,7 @@ app.http('${modelCamel}-delete', {
   route: '${modelCamel}/{id}',
   authLevel: 'anonymous',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${writeGuard}
       const id = request.params.id;
       if (!id) {
         return { status: 400, jsonBody: { error: 'ID is required' } };
@@ -378,7 +402,7 @@ app.http('${modelCamel}-delete', {
 
       return { status: 204 };
     } catch (error) {
-      context.error(\`Error deleting item via external API:\`, error);
+      ${authCatchBlock}context.error(\`Error deleting item via external API:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to delete item' } };
     }
   },

package/src/core/scaffold/functions-generator.ts

@@ -5,21 +5,32 @@
  */
 
 import { ModelInfo, toCamelCase, toKebabCase } from "./model-parser";
+import { ModelAuthPolicy } from "../../types";
+import { generateAuthImportTS, generateAuthGuardTS } from "./auth-generator";
 
 /**
  * Azure Functions エンティティファイルを生成（インラインハンドラー方式）
  * 各ハンドラーがベタ書きされており、ビジネスロジックの追加・変更が容易
  */
-export function generateCompactAzureFunctionsCRUD(model: ModelInfo, sharedPackageName: string): string {
+export function generateCompactAzureFunctionsCRUD(model: ModelInfo, sharedPackageName: string, authPolicy?: ModelAuthPolicy): string {
   const modelName = model.name;
   const modelCamel = toCamelCase(modelName);
   const modelKebab = toKebabCase(modelName);
   const schemaName = model.schemaName;
 
+  const hasAuth = !!authPolicy;
+  const authImport = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
+  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read')}\n` : '';
+  const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write')}\n` : '';
+  const authCatchBlock = hasAuth
+    ? `      const authErr = handleAuthError(error);
+      if (authErr) return authErr;\n`
+    : '';
+
   return `import { app, HttpRequest, HttpResponseInit, InvocationContext } from '@azure/functions';
 import { z } from 'zod/v4';
 import crypto from 'crypto';
-import { ${schemaName} } from '${sharedPackageName}';
+import { ${schemaName} } from '${sharedPackageName}';${authImport}
 
 const containerName = '${modelName}s';
 
@@ -39,7 +50,7 @@ app.http('${modelCamel}-get-all', {
     },
   ],
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${readGuard}
       const documents = context.extraInputs.get('cosmosInput') as any[];
 
       if (!documents || !Array.isArray(documents)) {
@@ -51,7 +62,7 @@ app.http('${modelCamel}-get-all', {
 
       return { status: 200, jsonBody: validated };
     } catch (error) {
-      context.error(\`Error fetching from \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error fetching from \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to fetch items' } };
     }
   },
@@ -74,7 +85,7 @@ app.http('${modelCamel}-get-by-id', {
     },
   ],
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${readGuard}
       const document = context.extraInputs.get('cosmosInput');
 
       if (!document) {
@@ -84,7 +95,7 @@ app.http('${modelCamel}-get-by-id', {
       const validated = ${schemaName}.parse(document);
       return { status: 200, jsonBody: validated };
     } catch (error) {
-      context.error(\`Error fetching item from \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error fetching item from \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to fetch item' } };
     }
   },
@@ -106,7 +117,7 @@ app.http('${modelCamel}-create', {
     },
   ],
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${writeGuard}
       const body = await request.json() as any;
 
       const { id, createdAt, updatedAt, ...userData } = body;
@@ -128,7 +139,7 @@ app.http('${modelCamel}-create', {
       context.extraOutputs.set('cosmosOutput', result.data);
       return { status: 201, jsonBody: result.data };
     } catch (error) {
-      context.error(\`Error creating item in \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error creating item in \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to create item' } };
     }
   },
@@ -160,7 +171,7 @@ app.http('${modelCamel}-update', {
     },
   ],
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${writeGuard}
       const id = request.params.id;
       if (!id) {
         return { status: 400, jsonBody: { error: 'ID is required' } };
@@ -191,7 +202,7 @@ app.http('${modelCamel}-update', {
       context.extraOutputs.set('cosmosOutput', result.data);
       return { status: 200, jsonBody: result.data };
     } catch (error) {
-      context.error(\`Error updating item in \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error updating item in \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to update item' } };
     }
   },
@@ -203,7 +214,7 @@ app.http('${modelCamel}-delete', {
   route: '${modelCamel}/{id}',
   authLevel: 'anonymous',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${writeGuard}
       const id = request.params.id;
       if (!id) {
         return { status: 400, jsonBody: { error: 'ID is required' } };
@@ -229,7 +240,7 @@ app.http('${modelCamel}-delete', {
       if (error.code === 404) {
         return { status: 404, jsonBody: { error: 'Item not found' } };
       }
-      context.error(\`Error deleting item from \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error deleting item from \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to delete item' } };
     }
   },

package/src/core/scaffold/model-parser.ts

@@ -6,7 +6,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { pathToFileURL } from "url";
 
-import { ModelConnectorConfig } from "../../types";
+import { ModelConnectorConfig, ModelAuthPolicy } from "../../types";
 
 export interface ModelInfo {
   name: string; // モデル名（例: "Todo"）
@@ -19,6 +19,7 @@ export interface ModelInfo {
   hasUpdatedAt: boolean; // updatedAt フィールドがあるか
   nestedSchemaRefs: NestedSchemaRef[]; // ネストしたスキーマ参照
   connectorConfig?: ModelConnectorConfig; // コネクタメタデータ（外部データソース用）
+  authPolicy?: ModelAuthPolicy; // 認可ポリシー（ロールベースアクセス制御用）
 }
 
 export interface FieldInfo {
@@ -85,6 +86,9 @@ export async function parseModelFile(modelPath: string): Promise<ModelInfo> {
 
   // connectorConfig を抽出（外部データソース用メタデータ）
   const connectorConfig = parseConnectorConfig(content);
+
+  // authPolicy を抽出（ロールベースアクセス制御用メタデータ）
+  const authPolicy = parseAuthPolicy(content);
   
   // ネストしたスキーマ参照を検出
   const nestedSchemaRefs = detectNestedSchemaRefs(modelPath, content, schemaName);
@@ -111,6 +115,7 @@ export async function parseModelFile(modelPath: string): Promise<ModelInfo> {
     hasUpdatedAt,
     nestedSchemaRefs,
     ...(connectorConfig ? { connectorConfig } : {}),
+    ...(authPolicy ? { authPolicy } : {}),
   };
 }
 
@@ -727,6 +732,50 @@ export function parseConnectorConfig(content: string): ModelConnectorConfig | un
   };
 }
 
+/**
+ * authPolicy をモデルファイルから抽出
+ * パターン: export const authPolicy = { roles: [...], read: [...], write: [...] }
+ */
+export function parseAuthPolicy(content: string): ModelAuthPolicy | undefined {
+  const policyMatch = content.match(/export\s+const\s+authPolicy\s*=\s*\{/);
+  if (!policyMatch) {
+    return undefined;
+  }
+
+  const startIdx = content.indexOf('{', policyMatch.index!);
+  let braceCount = 1;
+  let endIdx = startIdx + 1;
+  while (braceCount > 0 && endIdx < content.length) {
+    if (content[endIdx] === '{') braceCount++;
+    if (content[endIdx] === '}') braceCount--;
+    endIdx++;
+  }
+
+  const objectStr = content.substring(startIdx, endIdx);
+
+  const extractRoles = (key: string): string[] | undefined => {
+    const match = objectStr.match(new RegExp(`${key}\\s*:\\s*\\[([^\\]]*)\\]`));
+    if (!match) return undefined;
+    const entries = match[1].match(/['"]([^'"]+)['"]/g);
+    if (!entries) return [];
+    return entries.map(e => e.replace(/['"]/g, ''));
+  };
+
+  const roles = extractRoles('roles');
+  const read = extractRoles('read');
+  const write = extractRoles('write');
+
+  if (!roles && !read && !write) {
+    return undefined;
+  }
+
+  return {
+    ...(roles ? { roles } : {}),
+    ...(read ? { read } : {}),
+    ...(write ? { write } : {}),
+  };
+}
+
 /**
  * 文字列を kebab-case に変換
  */

package/src/core/scaffold/ui-generator.ts

@@ -4,15 +4,26 @@
  */
 
 import { ModelInfo, FieldInfo, toCamelCase, toKebabCase, toPascalCase } from "./model-parser";
+import { ModelAuthPolicy } from "../../types";
+
+/** auth が有効かつ authPolicy が存在する場合に渡されるオプション */
+export interface UIAuthOptions {
+  /** モデル固有のロールポリシー */
+  authPolicy: ModelAuthPolicy;
+}
 
 /**
  * 一覧画面を生成
  */
-export function generateListPage(model: ModelInfo, sharedPackageName: string): string {
+export function generateListPage(model: ModelInfo, sharedPackageName: string, authOptions?: UIAuthOptions): string {
   const modelName = model.name;
   const modelCamel = toCamelCase(modelName);
   const modelKebab = toKebabCase(modelName);
   
+  const hasAuth = !!authOptions;
+  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
+  
   // フィールドから表示するカラムを抽出（id以外の最初の3つ）
   const displayFields = model.fields
     .filter(f => f.name !== 'id')
@@ -64,6 +75,7 @@ import { useEffect, useState } from 'react';
 import Link from 'next/link';
 import { z } from 'zod/v4';
 ${schemaImportLine}
+${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
@@ -72,6 +84,9 @@ export default function ${modelName}ListPage() {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
 ${hasForeignKeys ? foreignKeyStates : ''}
+${hasWriteRoles ? `  const { hasAnyRole } = useAuth();
+  const canWrite = hasAnyRole(${JSON.stringify(writeRoles)});` : hasAuth ? `  const { user } = useAuth();
+  const canWrite = !!user;` : ''}
 
   useEffect(() => {
     fetch('/api/${modelCamel}')
@@ -135,12 +150,19 @@ ${hasForeignKeys ? foreignKeyFetches : ''}
       </div>
       <div className="flex justify-between items-center mb-6">
         <h1 className="text-3xl font-bold text-gray-900 dark:text-gray-100">${modelName}</h1>
-        <Link
+${hasAuth ? `        {canWrite && (
+          <Link
+            href="/${modelKebab}/new"
+            className="bg-blue-600 hover:bg-blue-700 dark:bg-blue-500 dark:hover:bg-blue-600 text-white px-4 py-2 rounded"
+          >
+            Create New
+          </Link>
+        )}` : `        <Link
           href="/${modelKebab}/new"
           className="bg-blue-600 hover:bg-blue-700 dark:bg-blue-500 dark:hover:bg-blue-600 text-white px-4 py-2 rounded"
         >
           Create New
-        </Link>
+        </Link>`}
       </div>
 
       {${modelCamel}s.length === 0 ? (
@@ -199,7 +221,22 @@ ${displayFields.map(f => {
                     >
                       View
                     </Link>
-                    <Link
+${hasAuth ? `                    {canWrite && (
+                      <>
+                        <Link
+                          href={\`/${modelKebab}/\${item.id}/edit\`}
+                          className="text-green-600 dark:text-green-400 hover:text-green-900 dark:hover:text-green-300 mr-4"
+                        >
+                          Edit
+                        </Link>
+                        <button
+                          onClick={() => handleDelete(item.id)}
+                          className="text-red-600 dark:text-red-400 hover:text-red-900 dark:hover:text-red-300"
+                        >
+                          Delete
+                        </button>
+                      </>
+                    )}` : `                    <Link
                       href={\`/${modelKebab}/\${item.id}/edit\`}
                       className="text-green-600 dark:text-green-400 hover:text-green-900 dark:hover:text-green-300 mr-4"
                     >
@@ -210,7 +247,7 @@ ${displayFields.map(f => {
                       className="text-red-600 dark:text-red-400 hover:text-red-900 dark:hover:text-red-300"
                     >
                       Delete
-                    </button>
+                    </button>`}
                   </td>
                 </tr>
               ))}
@@ -227,11 +264,15 @@ ${displayFields.map(f => {
 /**
  * 詳細画面を生成
  */
-export function generateDetailPage(model: ModelInfo, sharedPackageName: string): string {
+export function generateDetailPage(model: ModelInfo, sharedPackageName: string, authOptions?: UIAuthOptions): string {
   const modelName = model.name;
   const modelCamel = toCamelCase(modelName);
   const modelKebab = toKebabCase(modelName);
   
+  const hasAuth = !!authOptions;
+  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
+  
   // 外部キーフィールドを検出
   const foreignKeyFields = model.fields.filter(f => f.isForeignKey);
   const hasForeignKeys = foreignKeyFields.length > 0;
@@ -274,6 +315,7 @@ import { useParams, useRouter } from 'next/navigation';
 import Link from 'next/link';
 import { z } from 'zod/v4';
 ${schemaImportLine}
+${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
@@ -284,6 +326,9 @@ export default function ${modelName}DetailPage() {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
 ${hasForeignKeys ? foreignKeyStates : ''}
+${hasWriteRoles ? `  const { hasAnyRole } = useAuth();
+  const canWrite = hasAnyRole(${JSON.stringify(writeRoles)});` : hasAuth ? `  const { user } = useAuth();
+  const canWrite = !!user;` : ''}
 
   useEffect(() => {
     const id = params?.id as string;
@@ -343,7 +388,22 @@ ${hasForeignKeys ? foreignKeyFetches : ''}
       <div className="max-w-2xl mx-auto">
         <div className="flex justify-between items-center mb-6">
           <h1 className="text-3xl font-bold text-gray-900 dark:text-gray-100">${modelName} Details</h1>
-          <div className="space-x-2">
+${hasAuth ? `          {canWrite && (
+            <div className="space-x-2">
+              <Link
+                href={\`/${modelKebab}/\${${modelCamel}.id}/edit\`}
+                className="inline-flex items-center bg-green-600 hover:bg-green-700 dark:bg-green-500 dark:hover:bg-green-600 text-white px-4 py-2 rounded"
+              >
+                Edit
+              </Link>
+              <button
+                onClick={handleDelete}
+                className="inline-flex items-center bg-red-600 hover:bg-red-700 dark:bg-red-500 dark:hover:bg-red-600 text-white px-4 py-2 rounded"
+              >
+                Delete
+              </button>
+            </div>
+          )}` : `          <div className="space-x-2">
             <Link
               href={\`/${modelKebab}/\${${modelCamel}.id}/edit\`}
               className="inline-flex items-center bg-green-600 hover:bg-green-700 dark:bg-green-500 dark:hover:bg-green-600 text-white px-4 py-2 rounded"
@@ -356,7 +416,7 @@ ${hasForeignKeys ? foreignKeyFetches : ''}
             >
               Delete
             </button>
-          </div>
+          </div>`}
         </div>
 
         <div className="bg-white dark:bg-gray-800 shadow-md rounded-lg p-6">
@@ -849,13 +909,57 @@ ${f.enumValues.map(v => `          <option value="${v}">${v}</option>`).join('\n
 /**
  * 新規作成画面を生成
  */
-export function generateNewPage(model: ModelInfo): string {
+export function generateNewPage(model: ModelInfo, authOptions?: UIAuthOptions): string {
   const modelName = model.name;
   const modelKebab = toKebabCase(modelName);
   
-  return `import ${modelName}Form from '../_components/${modelName}Form';
+  const hasAuth = !!authOptions;
+  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
+  
+  if (!hasAuth) {
+    return `import ${modelName}Form from '../_components/${modelName}Form';
+
+export default function New${modelName}Page() {
+  return (
+    <div className="container mx-auto px-4 py-8">
+      <div className="max-w-2xl mx-auto">
+        <h1 className="text-3xl font-bold mb-6">Create New ${modelName}</h1>
+        <div className="bg-white dark:bg-gray-800 shadow-md rounded-lg p-6">
+          <${modelName}Form />
+        </div>
+      </div>
+    </div>
+  );
+}
+`;
+  }
+  
+  return `'use client';
+
+import { useEffect } from 'react';
+import { useRouter } from 'next/navigation';
+import ${modelName}Form from '../_components/${modelName}Form';
+import { useAuth } from '@/lib/auth/auth-context';
 
 export default function New${modelName}Page() {
+  const router = useRouter();
+${hasWriteRoles ? `  const { hasAnyRole, loading } = useAuth();
+  const canWrite = hasAnyRole(${JSON.stringify(writeRoles)});` : `  const { user, loading } = useAuth();
+  const canWrite = !!user;`}
+
+  useEffect(() => {
+    if (!loading && !canWrite) {
+      router.push('/${modelKebab}');
+    }
+  }, [loading, canWrite, router]);
+
+  if (loading) {
+    return <div className="flex items-center justify-center min-h-screen"><div className="text-lg">Loading...</div></div>;
+  }
+
+  if (!canWrite) return null;
+
   return (
     <div className="container mx-auto px-4 py-8">
       <div className="max-w-2xl mx-auto">
@@ -873,11 +977,15 @@ export default function New${modelName}Page() {
 /**
  * 編集画面を生成
  */
-export function generateEditPage(model: ModelInfo, sharedPackageName: string): string {
+export function generateEditPage(model: ModelInfo, sharedPackageName: string, authOptions?: UIAuthOptions): string {
   const modelName = model.name;
   const modelCamel = toCamelCase(modelName);
   const modelKebab = toKebabCase(modelName);
   
+  const hasAuth = !!authOptions;
+  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
+  
   const schemaName = model.schemaName;
   // Zod公式パターン対応: schemaNameとmodelNameが同じ場合はimportエイリアスで名前衝突を回避
   const needsAlias = schemaName === modelName;
@@ -889,17 +997,29 @@ export function generateEditPage(model: ModelInfo, sharedPackageName: string): s
   return `'use client';
 
 import { useEffect, useState } from 'react';
-import { useParams } from 'next/navigation';
+import { useParams, useRouter } from 'next/navigation';
 import ${modelName}Form from '../../_components/${modelName}Form';
 import { z } from 'zod/v4';
 ${schemaImportLine}
+${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
 export default function Edit${modelName}Page() {
   const params = useParams();
+${hasAuth ? '  const router = useRouter();' : ''}
   const [${modelCamel}, set${modelName}] = useState<${modelName} | null>(null);
   const [loading, setLoading] = useState(true);
+${hasWriteRoles ? `  const { hasAnyRole, loading: authLoading } = useAuth();
+  const canWrite = hasAnyRole(${JSON.stringify(writeRoles)});` : hasAuth ? `  const { user, loading: authLoading } = useAuth();
+  const canWrite = !!user;` : ''}
+${hasAuth ? `
+  useEffect(() => {
+    if (!authLoading && !canWrite) {
+      router.push('/${modelKebab}');
+    }
+  }, [authLoading, canWrite, router]);
+` : ''}
 
   useEffect(() => {
     const id = params?.id as string;