swallowkit 1.0.0-beta.45 → 1.0.0-beta.47

package/src/cli/commands/dev.ts

@@ -38,10 +38,13 @@ export interface DevOptions {
   noFunctions?: boolean;
   seedEnv?: string;
   mockConnectors?: boolean;
+  swaPort?: string;
+  noSwa?: boolean;
 }
 
 type ParsedDevActionOptions = DevOptions & {
   functions?: boolean;
+  swa?: boolean;
 };
 
 interface FunctionsCoreToolsCommand {
@@ -57,6 +60,7 @@ function normalizeParsedDevOptions(options: ParsedDevActionOptions): DevOptions
   return {
     ...options,
     noFunctions: options.noFunctions ?? options.functions === false,
+    noSwa: options.noSwa ?? options.swa === false,
   };
 }
 
@@ -121,6 +125,23 @@ export function buildFunctionsBaseUrl(host: string | undefined, functionsPort: s
   return `http://${host || 'localhost'}:${functionsPort}`;
 }
 
+export function buildSwaStartArgs(host: string | undefined, nextPort: string, swaPort: string): string[] {
+  return [
+    'start',
+    `http://${host || 'localhost'}:${nextPort}`,
+    '--swa-config-location',
+    '.',
+    '--port',
+    swaPort,
+  ];
+}
+
+export function getSwaCliInstallCommand(pm: string): string {
+  return pm === 'pnpm'
+    ? 'pnpm add -Dw @azure/static-web-apps-cli'
+    : 'npm install -D @azure/static-web-apps-cli';
+}
+
 export function getFunctionsReadinessTimeoutMs(backendLanguage: BackendLanguage): number {
   return backendLanguage === 'csharp' ? 90_000 : 30_000;
 }
@@ -506,6 +527,8 @@ export function buildDevCommand(
     .option('--no-functions', 'Skip Azure Functions startup')
     .option('--seed-env <environment>', 'Replace Cosmos DB Emulator data from dev-seeds/<environment> before startup')
     .option('--mock-connectors', 'Start mock server for connector models (serves Zod-generated data)', false)
+    .option('--swa-port <port>', 'SWA authentication emulator port', '4280')
+    .option('--no-swa', 'Skip the SWA authentication emulator')
     .action(async (options: ParsedDevActionOptions) => {
       const normalizedOptions = normalizeParsedDevOptions(options);
 
@@ -618,11 +641,24 @@ async function initializeCosmosDB(databaseName: string): Promise<CosmosInitializ
 async function startDevEnvironment(options: DevOptions) {
   const port = options.port || '3000';
   const functionsPort = options.functionsPort || '7071';
+  const swaPort = options.swaPort || '4280';
   
   // Detect package manager from project lockfile
   const pm = detectFromProject();
   const pmCmd = getCommands(pm);
   const backendLanguage = getBackendLanguage();
+  const authConfig = getAuthConfig();
+  const useSwaEmulator = authConfig?.provider === 'swa' && !options.noSwa;
+  const swaCommand = useSwaEmulator ? await resolveSwaCliCommand(process.cwd()) : null;
+
+  if (useSwaEmulator && !swaCommand) {
+    const installCommand = getSwaCliInstallCommand(pm);
+    console.error('❌ SWA authentication requires Azure Static Web Apps CLI for local development.');
+    console.error('   Install it in this project and retry:');
+    console.error(`\n   ${installCommand}\n`);
+    process.exitCode = 1;
+    return;
+  }
   
   // プロセスを管理する配列
   const processes: ChildProcess[] = [];
@@ -925,7 +961,6 @@ async function startDevEnvironment(options: DevOptions) {
       const connectorModels = allModels.filter((m) => m.connectorConfig);
 
       // Resolve auth config — auth functions use RDB connectors, mocked alongside other models
-      const authConfig = getAuthConfig();
       let mockAuthConfig: { jwtSecret: string; tokenExpiry?: string; customJwt?: { userTable: string; loginIdColumn: string; passwordHashColumn: string; rolesColumn: string }; defaultPolicy?: "authenticated" | "anonymous" } | undefined;
       if (authConfig?.provider === 'custom-jwt' && authConfig.customJwt) {
         // Read JWT_SECRET from functions/local.settings.json if available
@@ -985,18 +1020,6 @@ async function startDevEnvironment(options: DevOptions) {
     // 5. Start Next.js development server
     const nextArgs = buildNextDevArgs(pm, port);
     
-    if (options.open) {
-      // Next.js 14+ deprecated --open option, so we open browser manually
-      setTimeout(() => {
-        const url = `http://${options.host || 'localhost'}:${port}`;
-        console.log(`\n🌐 Opening browser: ${url}`);
-        
-        const start = process.platform === 'darwin' ? 'open' :
-                      process.platform === 'win32' ? 'start' : 'xdg-open';
-        spawn(start, [url], { shell: true });
-      }, 3000);
-    }
-
     // Ensure .env.local points to bffTargetPort so Next.js reads the correct backend URL.
     // When --mock-connectors is active, bffTargetPort = mock port (7072); otherwise = Functions port (7071).
     // Next.js may load .env.local values that override spawn env vars, so we must keep them in sync.
@@ -1063,10 +1086,52 @@ async function startDevEnvironment(options: DevOptions) {
       }
     }
 
+    let swaReady = false;
+    if (useSwaEmulator && swaCommand) {
+      const nextUrl = `http://${options.host || 'localhost'}:${port}`;
+      console.log(`⏳ Waiting for Next.js before starting the SWA emulator at ${nextUrl}...`);
+      const nextReady = await waitForHttpServerReady(nextUrl);
+      if (!nextReady) {
+        throw new Error(`Next.js did not become ready at ${nextUrl}`);
+      }
+
+      console.log(`🔐 Starting SWA authentication emulator (port: ${swaPort})...`);
+      const swaProcess = spawn(swaCommand, buildSwaStartArgs(options.host, port, swaPort), {
+        cwd: process.cwd(),
+        shell: true,
+        stdio: 'inherit',
+        env: process.env,
+      });
+      processes.push(swaProcess);
+      swaProcess.on('error', (error) => {
+        console.error('❌ SWA CLI startup error:', error.message);
+      });
+
+      const swaUrl = `http://${options.host || 'localhost'}:${swaPort}`;
+      swaReady = await waitForHttpServerReady(swaUrl);
+      if (!swaReady) {
+        throw new Error(`SWA authentication emulator did not become ready at ${swaUrl}`);
+      }
+    }
+
     console.log('');
     console.log('✅ SwallowKit development environment is running!');
     console.log('');
-    console.log(`📱 Next.js: http://${options.host || 'localhost'}:${port}`);
+    if (useSwaEmulator) {
+      const swaUrl = `http://${options.host || 'localhost'}:${swaPort}`;
+      console.log('🔐 SWA authenticated app:');
+      console.log(`   ${swaUrl}`);
+      console.log('');
+      console.log('🔑 Local sign-in:');
+      console.log(`   ${swaUrl}/.auth/login/aad`);
+      console.log('   Enter any username and select Login.');
+      console.log('   The "authenticated" role is added automatically.');
+      console.log('');
+      console.log('📱 Next.js direct access (authentication is not emulated):');
+      console.log(`   http://${options.host || 'localhost'}:${port}`);
+    } else {
+      console.log(`📱 Next.js: http://${options.host || 'localhost'}:${port}`);
+    }
     if (hasFunctions && !options.noFunctions) {
       console.log(`${functionsReady ? '⚡ Azure Functions' : '⏳ Azure Functions (starting)'}: ${functionsBaseUrl}`);
     }
@@ -1082,7 +1147,22 @@ async function startDevEnvironment(options: DevOptions) {
     if (mockServer) {
       console.log('💡 Connector models served from mock server (Zod-generated data)');
     }
+    if (swaReady) {
+      console.log('💡 Open the app through the SWA port when testing authenticated pages and CRUD APIs.');
+    }
     console.log('');
+
+    if (options.open) {
+      const url = useSwaEmulator
+        ? `http://${options.host || 'localhost'}:${swaPort}`
+        : `http://${options.host || 'localhost'}:${port}`;
+      console.log(`🌐 Opening browser: ${url}`);
+      const start = process.platform === 'darwin' ? 'open' :
+                    process.platform === 'win32' ? 'start' : 'xdg-open';
+      spawn(start, [url], { shell: true });
+      console.log('');
+    }
+
     console.log('🛑 Press Ctrl+C to stop');
     console.log('');
 
@@ -1097,6 +1177,23 @@ async function startDevEnvironment(options: DevOptions) {
   }
 }
 
+async function resolveSwaCliCommand(projectRoot: string): Promise<string | null> {
+  const binaryName = process.platform === 'win32' ? 'swa.cmd' : 'swa';
+  const localCommand = path.join(projectRoot, 'node_modules', '.bin', binaryName);
+  if (fs.existsSync(localCommand) && await checkCommand(localCommand, ['--version'], {
+    cwd: projectRoot,
+    shell: process.platform === 'win32',
+  })) {
+    return localCommand;
+  }
+
+  if (await checkCommand('swa', ['--version'], { cwd: projectRoot })) {
+    return 'swa';
+  }
+
+  return null;
+}
+
 async function runCommand(
   command: string,
   args: string[],

package/src/cli/commands/init.ts

@@ -446,6 +446,7 @@ export async function withNpmLockfileSafeManifests(projectDir: string, action: (
   const functionsPackageJsonPath = path.join(projectDir, 'functions', 'package.json');
   const sharedPackageJsonPath = path.join(projectDir, 'shared', 'package.json');
   const originalFiles = new Map<string, string>();
+  const hiddenNodeModules = new Map<string, string>();
 
   function rememberOriginal(filePath: string): void {
     if (!originalFiles.has(filePath)) {
@@ -493,11 +494,30 @@ export async function withNpmLockfileSafeManifests(projectDir: string, action: (
     writeJson(filePath, packageJson);
   }
 
+  function hideNodeModules(directory: string): void {
+    const nodeModulesPath = path.join(directory, 'node_modules');
+    if (!fs.existsSync(nodeModulesPath)) return;
+
+    const hiddenPath = path.join(directory, `.node_modules.swallowkit-npm-lockfile-${process.pid}`);
+    fs.renameSync(nodeModulesPath, hiddenPath);
+    hiddenNodeModules.set(nodeModulesPath, hiddenPath);
+  }
+
   try {
     normalizePackageJson(packageJsonPath, 'file:shared');
     normalizePackageJson(functionsPackageJsonPath, 'file:../shared');
+    hideNodeModules(projectDir);
+    hideNodeModules(path.join(projectDir, 'shared'));
+    hideNodeModules(path.join(projectDir, 'functions'));
     await action();
   } finally {
+    for (const [nodeModulesPath, hiddenPath] of hiddenNodeModules) {
+      if (fs.existsSync(nodeModulesPath)) {
+        fs.rmSync(nodeModulesPath, { recursive: true, force: true });
+      }
+      fs.renameSync(hiddenPath, nodeModulesPath);
+    }
+
     for (const [filePath, content] of originalFiles) {
       fs.writeFileSync(filePath, content);
     }
@@ -710,6 +730,7 @@ export function buildGeneratedProjectDependencies(projectName: string): Record<s
   return {
     '@azure/cosmos': '^4.0.0',
     'applicationinsights': '^3.3.0',
+    'zod': '^4.0.0',
     [`@${projectName}/shared`]: 'workspace:*',
   };
 }
@@ -872,6 +893,13 @@ function getFunctionsBaseUrl(): string {
   return process.env.BACKEND_FUNCTIONS_BASE_URL || process.env.FUNCTIONS_BASE_URL || 'http://localhost:7071';
 }
 
+function getFunctionsKeyHeaders(functionsBaseUrl: string): Record<string, string> {
+  const key = process.env.BACKEND_FUNCTIONS_KEY;
+  if (key) return { 'x-functions-key': key };
+  if (functionsBaseUrl.startsWith('http://localhost:') || functionsBaseUrl.startsWith('http://127.0.0.1:')) return {};
+  throw new Error('BACKEND_FUNCTIONS_KEY is required for non-local Functions calls');
+}
+
 /**
  * Simple HTTP client for calling backend APIs
  * Use this to make requests to BFF API routes (which forward to Azure Functions)
@@ -883,6 +911,7 @@ async function request<T>(
   queryParams?: Record<string, string>
 ): Promise<T> {
   const functionsBaseUrl = getFunctionsBaseUrl();
+  const keyHeaders = getFunctionsKeyHeaders(functionsBaseUrl);
   let url = \`\${functionsBaseUrl}\${endpoint}\`;
   if (queryParams) {
     const params = new URLSearchParams(queryParams);
@@ -894,6 +923,7 @@ async function request<T>(
       method,
       headers: {
         'Content-Type': 'application/json',
+        ...keyHeaders,
       },
       body: body ? JSON.stringify(body) : undefined,
     });
@@ -977,6 +1007,7 @@ export const api = {
   // 6. Create .env.example
   const envExample = `# Azure Functions Backend URL
 BACKEND_FUNCTIONS_BASE_URL=http://localhost:7071
+BACKEND_FUNCTIONS_KEY=
 
 # Azure Configuration
 AZURE_RESOURCE_GROUP=your-resource-group
@@ -1062,6 +1093,7 @@ export async function register() {
   const envLocalContent = [
     '# Azure Functions Backend URL (Local)',
     'BACKEND_FUNCTIONS_BASE_URL=http://localhost:7071',
+    'BACKEND_FUNCTIONS_KEY=',
     ''
   ].join('\n');
   fs.writeFileSync(path.join(projectDir, '.env.local'), envLocalContent);
@@ -1358,7 +1390,7 @@ export async function greet(request: HttpRequest, context: InvocationContext): P
 
 app.http('greet', {
   methods: ['GET', 'POST'],
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: greet
 });
 `);
@@ -1390,7 +1422,7 @@ public sealed class GreetFunction
 {
     [Function("greet")]
     public async Task<HttpResponseData> Run(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = "greet")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = "greet")] HttpRequestData request)
     {
         var query = request.Url.Query.TrimStart('?').Split('&', StringSplitOptions.RemoveEmptyEntries);
         var name = "SwallowKit";
@@ -1458,7 +1490,7 @@ def greet(req: func.HttpRequest) -> func.HttpResponse:
 
 from blueprints.greet import bp as greet_bp
 
-app = func.FunctionApp(http_auth_level=func.AuthLevel.ANONYMOUS)
+app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION)
 
 app.register_blueprint(greet_bp)
 # SwallowKit scaffold registrations
@@ -2089,7 +2121,7 @@ const containerName = 'Models'; // PascalCase + 's'
 app.http('{model}-get-all', {
   methods: ['GET'],
   route: '{model}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [{ type: 'cosmosDB', name: 'cosmosInput', containerName, ... }],
   handler: async (request, context) => {
     const documents = context.extraInputs.get('cosmosInput');
@@ -2380,7 +2412,7 @@ import { ModelSchema } from '@${projectName}/shared';
 app.http('{model}-get-all', {
   methods: ['GET'],
   route: '{model}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [cosmosInput],
   handler: async (request, context) => {
     const documents = context.extraInputs.get(cosmosInput);
@@ -2411,6 +2443,43 @@ app.http('{model}-get-all', {
   console.log('');
 }
 
+export function buildFunctionsHostKeyBicepExpression(): string {
+  return "listKeys('${functionsFlex.outputs.id}/host/default', '2023-12-01').functionKeys.default";
+}
+
+export function buildStaticWebAppConfigBicepSource(): string {
+  return `@description('Static Web App name')
+param staticWebAppName string
+
+@description('Functions App default hostname for backend API calls')
+param functionsDefaultHostname string
+
+@secure()
+@description('Functions host key used only by the server-side BFF')
+param functionsHostKey string
+
+@description('Application Insights connection string for SWA')
+param appInsightsConnectionString string
+
+resource staticWebApp 'Microsoft.Web/staticSites@2023-01-01' existing = {
+  name: staticWebAppName
+}
+
+resource staticWebAppConfig 'Microsoft.Web/staticSites/config@2023-01-01' = {
+  parent: staticWebApp
+  name: 'appsettings'
+  properties: {
+    APPLICATIONINSIGHTS_CONNECTION_STRING: appInsightsConnectionString
+    ApplicationInsightsAgent_EXTENSION_VERSION: '~3'
+    BACKEND_FUNCTIONS_BASE_URL: 'https://\${functionsDefaultHostname}'
+    BACKEND_FUNCTIONS_KEY: functionsHostKey
+  }
+}
+
+output configName string = staticWebAppConfig.name
+`;
+}
+
 async function createInfrastructure(
   projectDir: string,
   projectName: string,
@@ -2585,6 +2654,7 @@ module staticWebAppConfig 'modules/staticwebapp-config.bicep' = {
   params: {
     staticWebAppName: staticWebApp.outputs.name
     functionsDefaultHostname: functionsFlex.outputs.defaultHostname
+    functionsHostKey: ${buildFunctionsHostKeyBicepExpression()}
     appInsightsConnectionString: appInsightsSwa.outputs.connectionString
   }
   dependsOn: [
@@ -2678,31 +2748,7 @@ output defaultHostname string = staticWebApp.properties.defaultHostname
   fs.writeFileSync(path.join(modulesDir, 'staticwebapp.bicep'), staticWebAppBicep);
 
   // modules/staticwebapp-config.bicep (for updating config after Functions deployment)
-  const staticWebAppConfigBicep = `@description('Static Web App name')
-param staticWebAppName string
-
-@description('Functions App default hostname for backend API calls')
-param functionsDefaultHostname string
-
-@description('Application Insights connection string for SWA')
-param appInsightsConnectionString string
-
-resource staticWebApp 'Microsoft.Web/staticSites@2023-01-01' existing = {
-  name: staticWebAppName
-}
-
-resource staticWebAppConfig 'Microsoft.Web/staticSites/config@2023-01-01' = {
-  parent: staticWebApp
-  name: 'appsettings'
-  properties: {
-    APPLICATIONINSIGHTS_CONNECTION_STRING: appInsightsConnectionString
-    ApplicationInsightsAgent_EXTENSION_VERSION: '~3'
-    BACKEND_FUNCTIONS_BASE_URL: 'https://\${functionsDefaultHostname}'
-  }
-}
-
-output configName string = staticWebAppConfig.name
-`;
+  const staticWebAppConfigBicep = buildStaticWebAppConfigBicepSource();
   fs.writeFileSync(path.join(modulesDir, 'staticwebapp-config.bicep'), staticWebAppConfigBicep);
   
   // modules/loganalytics.bicep (Shared Log Analytics Workspace)

package/src/cli/commands/scaffold.ts

@@ -162,6 +162,9 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
           ? { authPolicy: uiAuthPolicy }
           : undefined;
       await generateUIComponents(modelInfo, sharedPackageName, uiAuthOptions);
+      if (uiAuthConfig?.provider === 'external-token') {
+        applyExternalTokenFetchToGeneratedUi(modelInfo);
+      }
       await updateNavigationMenu(modelInfo);
     }
 
@@ -190,6 +193,31 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
   }
 }
 
+function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo): void {
+  const uiRoot = path.join(process.cwd(), 'app', toKebabCase(modelInfo.name));
+  if (!fs.existsSync(uiRoot)) return;
+  const visit = (dir: string): void => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const target = path.join(dir, entry.name);
+      if (entry.isDirectory()) { visit(target); continue; }
+      if (!entry.name.endsWith('.tsx')) continue;
+      let content = fs.readFileSync(target, 'utf-8');
+      if (!content.includes('fetch(')) continue;
+      content = content.replace(/\bfetch\(/g, 'authenticatedFetch(');
+      content = content.replace(
+        /(if \(!res\.ok\) throw new Error\([^\n]+\);)/g,
+        `if (res.status === 401) throw new Error('Authentication required');\n        $1`
+      );
+      if (!content.includes("@/lib/auth/authenticated-fetch")) {
+        const directive = content.match(/^'use client';\s*\r?\n/)?.[0] ?? '';
+        content = `${directive}import { authenticatedFetch } from '@/lib/auth/authenticated-fetch';\n${content.slice(directive.length)}`;
+      }
+      fs.writeFileSync(target, content, 'utf-8');
+    }
+  };
+  visit(uiRoot);
+}
+
 /**
  * モデルの authPolicy と auth config から実効的な認可ポリシーを解決
  * - モデルに authPolicy があればそれを使用
@@ -305,8 +333,10 @@ async function generateCallFunctionHelper(): Promise<void> {
   const hasAuth = authConfig && authConfig.provider !== 'none';
   let helperCode: string;
   if (hasAuth) {
-    const { generateBFFCallFunctionWithAuth } = await import("../../core/scaffold/auth-generator");
-    helperCode = generateBFFCallFunctionWithAuth();
+    const { generateBFFCallFunctionWithAuth, generateBFFCallFunctionWithSwaAuth } = await import("../../core/scaffold/auth-generator");
+    helperCode = authConfig?.provider === "swa"
+      ? generateBFFCallFunctionWithSwaAuth()
+      : generateBFFCallFunctionWithAuth();
   } else {
     helperCode = generateBFFCallFunction();
   }
@@ -347,7 +377,7 @@ async function generateFunctionsCode(
       fs.mkdirSync(functionDir, { recursive: true });
     }
 
-    const code = generateCompactAzureFunctionsCRUD(modelInfo, sharedPackageName, authPolicy);
+    const code = generateCompactAzureFunctionsCRUD(modelInfo, sharedPackageName, authPolicy, authConfig?.provider);
     fs.writeFileSync(functionFilePath, code, "utf-8");
     console.log(`✅ Created: ${functionFilePath}`);
     return;
@@ -425,14 +455,16 @@ async function generateConnectorFunctionsCode(
         modelInfo, sharedPackageName,
         connectorDef as RdbConnectorConfig,
         connectorConfig as RdbModelConnectorConfig,
-        authPolicy
+        authPolicy,
+        authConfig?.provider
       );
     } else {
       code = generateApiConnectorFunctionTS(
         modelInfo, sharedPackageName,
         connectorDef as ApiConnectorConfig,
         connectorConfig as ApiModelConnectorConfig,
-        authPolicy
+        authPolicy,
+        authConfig?.provider
       );
     }
 

package/src/cli/index.ts

@@ -26,6 +26,8 @@ const DEV_OPTION_ARITY = new Map<string, 0 | 1>([
   ["--verbose", 0],
   ["--no-functions", 0],
   ["--mock-connectors", 0],
+  ["--swa-port", 1],
+  ["--no-swa", 0],
 ]);
 
 function ensureUtf8ConsoleOnWindows(): void {
@@ -168,7 +170,7 @@ export function createProgram(devCommandOverride: Command = devCommand): Command
   program
     .command("add-auth")
     .description("Add authentication and authorization to the project")
-    .option("--provider <provider>", "Auth provider: custom-jwt | swa | swa-custom | none", "custom-jwt")
+    .option("--provider <provider>", "Auth provider: custom-jwt | swa | external-token | swa-custom | none", "custom-jwt")
     .action((options) => {
       addAuthCommand({
         provider: options.provider,