swallowkit 1.0.0-beta.46 → 1.0.0-beta.48

package/src/cli/commands/init.ts

@@ -730,6 +730,7 @@ export function buildGeneratedProjectDependencies(projectName: string): Record<s
   return {
     '@azure/cosmos': '^4.0.0',
     'applicationinsights': '^3.3.0',
+    'zod': '^4.0.0',
     [`@${projectName}/shared`]: 'workspace:*',
   };
 }
@@ -892,6 +893,13 @@ function getFunctionsBaseUrl(): string {
   return process.env.BACKEND_FUNCTIONS_BASE_URL || process.env.FUNCTIONS_BASE_URL || 'http://localhost:7071';
 }
 
+function getFunctionsKeyHeaders(functionsBaseUrl: string): Record<string, string> {
+  const key = process.env.BACKEND_FUNCTIONS_KEY;
+  if (key) return { 'x-functions-key': key };
+  if (functionsBaseUrl.startsWith('http://localhost:') || functionsBaseUrl.startsWith('http://127.0.0.1:')) return {};
+  throw new Error('BACKEND_FUNCTIONS_KEY is required for non-local Functions calls');
+}
+
 /**
  * Simple HTTP client for calling backend APIs
  * Use this to make requests to BFF API routes (which forward to Azure Functions)
@@ -903,6 +911,7 @@ async function request<T>(
   queryParams?: Record<string, string>
 ): Promise<T> {
   const functionsBaseUrl = getFunctionsBaseUrl();
+  const keyHeaders = getFunctionsKeyHeaders(functionsBaseUrl);
   let url = \`\${functionsBaseUrl}\${endpoint}\`;
   if (queryParams) {
     const params = new URLSearchParams(queryParams);
@@ -914,6 +923,7 @@ async function request<T>(
       method,
       headers: {
         'Content-Type': 'application/json',
+        ...keyHeaders,
       },
       body: body ? JSON.stringify(body) : undefined,
     });
@@ -997,6 +1007,7 @@ export const api = {
   // 6. Create .env.example
   const envExample = `# Azure Functions Backend URL
 BACKEND_FUNCTIONS_BASE_URL=http://localhost:7071
+BACKEND_FUNCTIONS_KEY=
 
 # Azure Configuration
 AZURE_RESOURCE_GROUP=your-resource-group
@@ -1082,6 +1093,7 @@ export async function register() {
   const envLocalContent = [
     '# Azure Functions Backend URL (Local)',
     'BACKEND_FUNCTIONS_BASE_URL=http://localhost:7071',
+    'BACKEND_FUNCTIONS_KEY=',
     ''
   ].join('\n');
   fs.writeFileSync(path.join(projectDir, '.env.local'), envLocalContent);
@@ -1378,7 +1390,7 @@ export async function greet(request: HttpRequest, context: InvocationContext): P
 
 app.http('greet', {
   methods: ['GET', 'POST'],
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: greet
 });
 `);
@@ -1410,7 +1422,7 @@ public sealed class GreetFunction
 {
     [Function("greet")]
     public async Task<HttpResponseData> Run(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = "greet")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = "greet")] HttpRequestData request)
     {
         var query = request.Url.Query.TrimStart('?').Split('&', StringSplitOptions.RemoveEmptyEntries);
         var name = "SwallowKit";
@@ -1478,7 +1490,7 @@ def greet(req: func.HttpRequest) -> func.HttpResponse:
 
 from blueprints.greet import bp as greet_bp
 
-app = func.FunctionApp(http_auth_level=func.AuthLevel.ANONYMOUS)
+app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION)
 
 app.register_blueprint(greet_bp)
 # SwallowKit scaffold registrations
@@ -2109,7 +2121,7 @@ const containerName = 'Models'; // PascalCase + 's'
 app.http('{model}-get-all', {
   methods: ['GET'],
   route: '{model}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [{ type: 'cosmosDB', name: 'cosmosInput', containerName, ... }],
   handler: async (request, context) => {
     const documents = context.extraInputs.get('cosmosInput');
@@ -2400,7 +2412,7 @@ import { ModelSchema } from '@${projectName}/shared';
 app.http('{model}-get-all', {
   methods: ['GET'],
   route: '{model}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [cosmosInput],
   handler: async (request, context) => {
     const documents = context.extraInputs.get(cosmosInput);
@@ -2431,6 +2443,43 @@ app.http('{model}-get-all', {
   console.log('');
 }
 
+export function buildFunctionsHostKeyBicepExpression(): string {
+  return "listKeys('${functionsFlex.outputs.id}/host/default', '2023-12-01').functionKeys.default";
+}
+
+export function buildStaticWebAppConfigBicepSource(): string {
+  return `@description('Static Web App name')
+param staticWebAppName string
+
+@description('Functions App default hostname for backend API calls')
+param functionsDefaultHostname string
+
+@secure()
+@description('Functions host key used only by the server-side BFF')
+param functionsHostKey string
+
+@description('Application Insights connection string for SWA')
+param appInsightsConnectionString string
+
+resource staticWebApp 'Microsoft.Web/staticSites@2023-01-01' existing = {
+  name: staticWebAppName
+}
+
+resource staticWebAppConfig 'Microsoft.Web/staticSites/config@2023-01-01' = {
+  parent: staticWebApp
+  name: 'appsettings'
+  properties: {
+    APPLICATIONINSIGHTS_CONNECTION_STRING: appInsightsConnectionString
+    ApplicationInsightsAgent_EXTENSION_VERSION: '~3'
+    BACKEND_FUNCTIONS_BASE_URL: 'https://\${functionsDefaultHostname}'
+    BACKEND_FUNCTIONS_KEY: functionsHostKey
+  }
+}
+
+output configName string = staticWebAppConfig.name
+`;
+}
+
 async function createInfrastructure(
   projectDir: string,
   projectName: string,
@@ -2605,6 +2654,7 @@ module staticWebAppConfig 'modules/staticwebapp-config.bicep' = {
   params: {
     staticWebAppName: staticWebApp.outputs.name
     functionsDefaultHostname: functionsFlex.outputs.defaultHostname
+    functionsHostKey: ${buildFunctionsHostKeyBicepExpression()}
     appInsightsConnectionString: appInsightsSwa.outputs.connectionString
   }
   dependsOn: [
@@ -2698,31 +2748,7 @@ output defaultHostname string = staticWebApp.properties.defaultHostname
   fs.writeFileSync(path.join(modulesDir, 'staticwebapp.bicep'), staticWebAppBicep);
 
   // modules/staticwebapp-config.bicep (for updating config after Functions deployment)
-  const staticWebAppConfigBicep = `@description('Static Web App name')
-param staticWebAppName string
-
-@description('Functions App default hostname for backend API calls')
-param functionsDefaultHostname string
-
-@description('Application Insights connection string for SWA')
-param appInsightsConnectionString string
-
-resource staticWebApp 'Microsoft.Web/staticSites@2023-01-01' existing = {
-  name: staticWebAppName
-}
-
-resource staticWebAppConfig 'Microsoft.Web/staticSites/config@2023-01-01' = {
-  parent: staticWebApp
-  name: 'appsettings'
-  properties: {
-    APPLICATIONINSIGHTS_CONNECTION_STRING: appInsightsConnectionString
-    ApplicationInsightsAgent_EXTENSION_VERSION: '~3'
-    BACKEND_FUNCTIONS_BASE_URL: 'https://\${functionsDefaultHostname}'
-  }
-}
-
-output configName string = staticWebAppConfig.name
-`;
+  const staticWebAppConfigBicep = buildStaticWebAppConfigBicepSource();
   fs.writeFileSync(path.join(modulesDir, 'staticwebapp-config.bicep'), staticWebAppConfigBicep);
   
   // modules/loganalytics.bicep (Shared Log Analytics Workspace)

package/src/cli/commands/scaffold.ts

@@ -6,7 +6,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import { spawnSync } from "child_process";
-import { getBackendLanguage, getConnectorDefinition, getAuthConfig, ensureSwallowKitProject } from "../../core/config";
+import { getBackendLanguage, getConnectorDefinition, getAuthConfig, getFullConfig, getNormalizedAuthConfig, ensureSwallowKitProject, normalizeAuthConfig, validateConfig } from "../../core/config";
 import { ModelInfo, parseModelFile, toKebabCase, toPascalCase, toCamelCase } from "../../core/scaffold/model-parser";
 import {
   generateCSharpAzureFunctionsCRUD,
@@ -42,6 +42,7 @@ import {
   AuthConfig,
 } from "../../types";
 import { syncProjectManifest } from "../../core/project/manifest";
+import { generateBFFCallFunctionWithAuth, generateBFFCallFunctionWithMultipleAuth, generateBFFCallFunctionWithSwaAuth, generateNamedAuthRouterCSharp, generateNamedAuthRouterPython, generateNamedAuthRouterTS } from "../../core/scaffold/auth-generator";
 
 interface ScaffoldOptions {
   model: string; // モデルファイルのパス（例: "lib/models/todo.ts" or "todo"）
@@ -74,6 +75,9 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
   // SwallowKit プロジェクトディレクトリかどうかを検証
   ensureSwallowKitProject("scaffold");
 
+  const configValidation = validateConfig(getFullConfig());
+  if (!configValidation.valid) throw new Error(`Invalid SwallowKit configuration:\n${configValidation.errors.map(error => `- ${error}`).join("\n")}`);
+
   console.log("🏗️  SwallowKit Scaffold: Generating CRUD operations...\n");
 
   try {
@@ -159,9 +163,12 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
       const uiAuthPolicy = resolveAuthPolicy(modelInfo, uiAuthConfig);
       const uiAuthOptions: UIAuthOptions | undefined =
         uiAuthPolicy && uiAuthConfig && uiAuthConfig.provider !== 'none'
-          ? { authPolicy: uiAuthPolicy }
+          ? createUIAuthOptions(uiAuthPolicy, uiAuthConfig)
           : undefined;
       await generateUIComponents(modelInfo, sharedPackageName, uiAuthOptions);
+      if (uiAuthOptions?.authenticatedFetchImport) {
+        applyExternalTokenFetchToGeneratedUi(modelInfo, uiAuthOptions.authenticatedFetchImport);
+      }
       await updateNavigationMenu(modelInfo);
     }
 
@@ -190,15 +197,44 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
   }
 }
 
+function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo, importPath = '@/lib/auth/authenticated-fetch'): void {
+  const uiRoot = path.join(process.cwd(), 'app', toKebabCase(modelInfo.name));
+  if (!fs.existsSync(uiRoot)) return;
+  const visit = (dir: string): void => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const target = path.join(dir, entry.name);
+      if (entry.isDirectory()) { visit(target); continue; }
+      if (!entry.name.endsWith('.tsx')) continue;
+      let content = fs.readFileSync(target, 'utf-8');
+      if (!content.includes('fetch(')) continue;
+      content = content.replace(/\bfetch\(/g, 'authenticatedFetch(');
+      content = content.replace(
+        /(if \(!res\.ok\) throw new Error\([^\n]+\);)/g,
+        `if (res.status === 401) throw new Error('Authentication required');\n        $1`
+      );
+      if (!content.includes(importPath)) {
+        const directive = content.match(/^'use client';\s*\r?\n/)?.[0] ?? '';
+        content = `${directive}import { authenticatedFetch } from '${importPath}';\n${content.slice(directive.length)}`;
+      }
+      fs.writeFileSync(target, content, 'utf-8');
+    }
+  };
+  visit(uiRoot);
+}
+
 /**
  * モデルの authPolicy と auth config から実効的な認可ポリシーを解決
  * - モデルに authPolicy があればそれを使用
  * - なければ auth.authorization.defaultPolicy に従う
  * - auth 設定がなければ undefined（ガードなし）
  */
-function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefined): ModelAuthPolicy | undefined {
+export function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefined): ModelAuthPolicy | undefined {
   // モデルに明示的な authPolicy がある場合はそれを使用
   if (modelInfo.authPolicy) {
+    const normalized = normalizeAuthConfig(authConfig);
+    for (const policyName of [modelInfo.authPolicy.policy, typeof modelInfo.authPolicy.read === 'string' ? modelInfo.authPolicy.read : undefined, typeof modelInfo.authPolicy.write === 'string' ? modelInfo.authPolicy.write : undefined].filter((value): value is string => Boolean(value))) {
+      if (!normalized?.authorization.policies[policyName]) throw new Error(`Model '${modelInfo.name}' references undefined auth policy '${policyName}'. Define auth.authorization.policies.${policyName}.`);
+    }
     return modelInfo.authPolicy;
   }
 
@@ -208,11 +244,13 @@ function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefi
   }
 
   // defaultPolicy が 'authenticated' なら認証のみ（ロール指定なし）のポリシーを返す
-  const defaultPolicy = authConfig.authorization?.defaultPolicy ?? 'authenticated';
+  const defaultPolicy = authConfig.authorization?.defaultPolicy === 'public' ? 'anonymous' : authConfig.authorization?.defaultPolicy ?? 'authenticated';
   if (defaultPolicy === 'authenticated') {
     return {}; // 空のポリシー = 認証のみ、ロール制限なし
   }
 
+  if (defaultPolicy !== 'anonymous') return { policy: defaultPolicy };
+
   // defaultPolicy が 'anonymous' なら認証不要
   return undefined;
 }
@@ -302,11 +340,14 @@ async function generateCallFunctionHelper(): Promise<void> {
 
   // auth 設定がある場合は Authorization ヘッダー転送版を生成
   const authConfig = getAuthConfig();
-  const hasAuth = authConfig && authConfig.provider !== 'none';
+  const normalizedAuth = normalizeAuthConfig(authConfig);
+  const hasAuth = Boolean(normalizedAuth && Object.keys(normalizedAuth.schemes).length > 0);
   let helperCode: string;
   if (hasAuth) {
-    const { generateBFFCallFunctionWithAuth } = await import("../../core/scaffold/auth-generator");
-    helperCode = generateBFFCallFunctionWithAuth();
+    const providers = new Set(Object.values(normalizedAuth!.schemes).map(scheme => scheme.provider));
+    helperCode = normalizedAuth!.schemes.default && Object.keys(normalizedAuth!.schemes).length === 1
+      ? authConfig?.provider === "swa" ? generateBFFCallFunctionWithSwaAuth() : generateBFFCallFunctionWithAuth()
+      : providers.has("swa") ? generateBFFCallFunctionWithMultipleAuth() : generateBFFCallFunctionWithAuth();
   } else {
     helperCode = generateBFFCallFunction();
   }
@@ -335,6 +376,12 @@ async function generateFunctionsCode(
 
   const modelKebab = toKebabCase(modelInfo.name);
   if (backendLanguage === "typescript") {
+    const normalizedAuth = getNormalizedAuthConfig();
+    if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+      const routerPath = path.join(process.cwd(), functionsDir, "src", "auth", "auth-router.ts");
+      fs.mkdirSync(path.dirname(routerPath), { recursive: true });
+      fs.writeFileSync(routerPath, generateNamedAuthRouterTS(normalizedAuth), "utf-8");
+    }
     const functionFilePath = path.join(
       process.cwd(),
       functionsDir,
@@ -347,13 +394,19 @@ async function generateFunctionsCode(
       fs.mkdirSync(functionDir, { recursive: true });
     }
 
-    const code = generateCompactAzureFunctionsCRUD(modelInfo, sharedPackageName, authPolicy);
+    const code = generateCompactAzureFunctionsCRUD(modelInfo, sharedPackageName, authPolicy, authConfig?.provider);
     fs.writeFileSync(functionFilePath, code, "utf-8");
     console.log(`✅ Created: ${functionFilePath}`);
     return;
   }
 
   if (backendLanguage === "csharp") {
+    const normalizedAuth = getNormalizedAuthConfig();
+    if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+      const routerPath = path.join(process.cwd(), functionsDir, "Auth", "AuthRouter.cs");
+      fs.mkdirSync(path.dirname(routerPath), { recursive: true });
+      fs.writeFileSync(routerPath, generateNamedAuthRouterCSharp(normalizedAuth), "utf-8");
+    }
     const crudDir = path.join(process.cwd(), functionsDir, "Crud");
     const functionFilePath = path.join(crudDir, `${modelInfo.name}CrudFunctions.cs`);
     fs.mkdirSync(crudDir, { recursive: true });
@@ -370,6 +423,13 @@ async function generateFunctionsCode(
     return;
   }
 
+  const normalizedAuth = getNormalizedAuthConfig();
+  if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+    const routerPath = path.join(process.cwd(), functionsDir, "auth", "auth_router.py");
+    fs.mkdirSync(path.dirname(routerPath), { recursive: true });
+    fs.writeFileSync(routerPath, generateNamedAuthRouterPython(normalizedAuth), "utf-8");
+  }
+
   const blueprintsDir = path.join(process.cwd(), functionsDir, "blueprints");
   const blueprintPath = path.join(blueprintsDir, `${modelKebab.replace(/-/g, "_")}.py`);
   fs.mkdirSync(blueprintsDir, { recursive: true });
@@ -380,6 +440,20 @@ async function generateFunctionsCode(
   console.log(`✅ Created: ${blueprintPath}`);
 }
 
+function createUIAuthOptions(policy: ModelAuthPolicy, authConfig: AuthConfig): UIAuthOptions {
+  const normalized = normalizeAuthConfig(authConfig);
+  const readPolicyName = typeof policy.read === 'string' ? policy.read : policy.policy;
+  const writePolicyName = typeof policy.write === 'string' ? policy.write : policy.policy;
+  const readNamed = readPolicyName ? normalized?.authorization.policies[readPolicyName] : undefined;
+  const named = writePolicyName ? normalized?.authorization.policies[writePolicyName] : undefined;
+  const writeRoles = named?.roles ?? (Array.isArray(policy.write) ? policy.write : policy.roles) ?? [];
+  const externalScheme = [...(readNamed?.schemes ?? []), ...(named?.schemes ?? [])].find(name => normalized?.schemes[name]?.provider === 'external-token');
+  const authScheme = readNamed?.schemes[0] ?? named?.schemes[0];
+  const authenticatedFetchImport = externalScheme ? `@/lib/auth/schemes/${toKebabCase(externalScheme)}/authenticated-fetch` : authConfig.provider === 'external-token' ? '@/lib/auth/authenticated-fetch' : undefined;
+  const authContextImport = authScheme ? `@/lib/auth/schemes/${toKebabCase(authScheme)}/auth-context` : '@/lib/auth/auth-context';
+  return { authPolicy: policy, writeRoles, authenticatedFetchImport, authContextImport };
+}
+
 /**
  * コネクタモデル用 Azure Functions コード生成
  */
@@ -425,14 +499,16 @@ async function generateConnectorFunctionsCode(
         modelInfo, sharedPackageName,
         connectorDef as RdbConnectorConfig,
         connectorConfig as RdbModelConnectorConfig,
-        authPolicy
+        authPolicy,
+        authConfig?.provider
       );
     } else {
       code = generateApiConnectorFunctionTS(
         modelInfo, sharedPackageName,
         connectorDef as ApiConnectorConfig,
         connectorConfig as ApiModelConnectorConfig,
-        authPolicy
+        authPolicy,
+        authConfig?.provider
       );
     }
 

package/src/cli/index.ts

@@ -26,6 +26,8 @@ const DEV_OPTION_ARITY = new Map<string, 0 | 1>([
   ["--verbose", 0],
   ["--no-functions", 0],
   ["--mock-connectors", 0],
+  ["--swa-port", 1],
+  ["--no-swa", 0],
 ]);
 
 function ensureUtf8ConsoleOnWindows(): void {
@@ -168,10 +170,12 @@ export function createProgram(devCommandOverride: Command = devCommand): Command
   program
     .command("add-auth")
     .description("Add authentication and authorization to the project")
-    .option("--provider <provider>", "Auth provider: custom-jwt | swa | swa-custom | none", "custom-jwt")
+    .option("--provider <provider>", "Auth provider: custom-jwt | swa | external-token | swa-custom | none", "custom-jwt")
+    .option("--scheme <name>", "Add a named authentication scheme")
     .action((options) => {
       addAuthCommand({
         provider: options.provider,
+        scheme: options.scheme,
       });
     });
 

package/src/core/config.ts

@@ -1,7 +1,7 @@
 import * as fs from "fs";
 import { createRequire } from "module";
 import * as path from "path";
-import { AuthConfig, BackendLanguage, ConnectorDefinition, SwallowKitConfig } from "../types";
+import { AuthConfig, AuthProvider, BackendLanguage, ConnectorDefinition, NormalizedAuthConfig, SwallowKitConfig } from "../types";
 import { detectFromProject, getCommands } from "../utils/package-manager";
 
 const requireFromHere = createRequire(__filename);
@@ -37,7 +37,7 @@ const DEFAULT_CONFIG: SwallowKitConfig = {
 /**
  * 設定ファイルを読み込み
  */
-export function loadConfig(configPath?: string): SwallowKitConfig {
+export function loadConfig(configPath?: string, throwOnError = false): SwallowKitConfig {
   const defaultPaths = [
     "swallowkit.config.json",
     "swallowkit.config.js",
@@ -63,6 +63,7 @@ export function loadConfig(configPath?: string): SwallowKitConfig {
           return mergeConfig(DEFAULT_CONFIG, unwrapConfigModule(loadedConfig));
         }
       } catch (error) {
+        if (throwOnError) throw error;
         console.warn(`⚠️ 設定ファイルの読み込みに失敗: ${filePath}`, error);
       }
     }
@@ -200,6 +201,40 @@ export function getAuthConfig(configPath?: string): AuthConfig | undefined {
   return config.auth;
 }
 
+/** Load configuration for mutating/generation commands and fail instead of silently falling back. */
+export function getValidatedFullConfig(configPath?: string): SwallowKitConfig {
+  const config = mergeConfig(loadConfig(configPath, true), loadConfigFromEnv());
+  const validation = validateConfig(config);
+  if (!validation.valid) throw new Error(`Invalid SwallowKit configuration:\n${validation.errors.map(error => `- ${error}`).join("\n")}`);
+  return config;
+}
+
+const VALID_AUTH_PROVIDERS: AuthProvider[] = ["custom-jwt", "swa", "external-token", "swa-custom", "none"];
+const AUTH_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/;
+
+/** Convert the legacy single-provider shape to the canonical named-scheme shape. */
+export function normalizeAuthConfig(auth?: AuthConfig): NormalizedAuthConfig | undefined {
+  if (!auth) return undefined;
+  const schemes = { ...(auth.schemes ?? {}) };
+  if (auth.provider && auth.provider !== "none" && !schemes.default) {
+    schemes.default = { provider: auth.provider, customJwt: auth.customJwt, swa: auth.swa };
+  }
+  const rawDefault = auth.authorization?.defaultPolicy ?? (Object.keys(schemes).length ? "authenticated" : "anonymous");
+  return {
+    ...auth,
+    schemes,
+    authorization: {
+      ...auth.authorization,
+      defaultPolicy: rawDefault === "public" ? "anonymous" : rawDefault,
+      policies: { ...(auth.authorization?.policies ?? {}) },
+    },
+  };
+}
+
+export function getNormalizedAuthConfig(configPath?: string): NormalizedAuthConfig | undefined {
+  return normalizeAuthConfig(getAuthConfig(configPath));
+}
+
 /**
  * 設定の検証
  */
@@ -214,6 +249,38 @@ function hasConfiguredDatabase(config: SwallowKitConfig): boolean {
 export function validateConfig(config: SwallowKitConfig): { valid: boolean; errors: string[] } {
   const errors: string[] = [];
 
+  const auth = normalizeAuthConfig(config.auth);
+  if (auth) {
+    for (const [name, scheme] of Object.entries(auth.schemes)) {
+      const base = `auth.schemes.${name}`;
+      if (!AUTH_NAME.test(name)) errors.push(`${base}: scheme name must match ${AUTH_NAME}; rename the scheme`);
+      if (!VALID_AUTH_PROVIDERS.includes(scheme.provider)) errors.push(`${base}.provider: unsupported provider '${scheme.provider}'; use ${VALID_AUTH_PROVIDERS.join(", ")}`);
+      if (scheme.provider === "none" || scheme.provider === "swa-custom") errors.push(`${base}.provider: '${scheme.provider}' cannot be used as a named scheme; use swa, external-token, or custom-jwt`);
+      if (scheme.provider === "custom-jwt") {
+        const jwt = scheme.customJwt ?? (name === "default" ? auth.customJwt : undefined);
+        for (const key of ["userConnector", "userTable", "loginIdColumn", "passwordHashColumn", "rolesColumn"] as const) {
+          if (!jwt?.[key]) errors.push(`${base}.customJwt.${key}: required for custom-jwt; configure this value`);
+        }
+      }
+    }
+    for (const [name, policy] of Object.entries(auth.authorization.policies)) {
+      const base = `auth.authorization.policies.${name}`;
+      if (!AUTH_NAME.test(name)) errors.push(`${base}: policy name must match ${AUTH_NAME}; rename the policy`);
+      if (!Array.isArray(policy.schemes) || policy.schemes.length === 0) errors.push(`${base}.schemes: provide at least one named scheme`);
+      for (const scheme of policy.schemes ?? []) if (!auth.schemes[scheme]) errors.push(`${base}.schemes: undefined scheme '${scheme}'; define auth.schemes.${scheme}`);
+      const sources = new Map<string, string>();
+      for (const schemeName of policy.schemes ?? []) {
+        const provider = auth.schemes[schemeName]?.provider;
+        const source = provider === "swa" ? "x-ms-client-principal" : provider === "custom-jwt" || provider === "external-token" ? "authorization-bearer" : provider;
+        if (source && sources.has(source)) errors.push(`${base}.schemes: '${sources.get(source)}' and '${schemeName}' both use ${source}; split the policy so credential selection is deterministic`);
+        else if (source) sources.set(source, schemeName);
+      }
+    }
+    const defaultPolicy = auth.authorization.defaultPolicy;
+    if (defaultPolicy === "authenticated" && !auth.schemes.default && Object.keys(auth.schemes).length !== 1) errors.push("auth.authorization.defaultPolicy: 'authenticated' requires auth.schemes.default (or exactly one scheme); set a default scheme or use a named policy");
+    else if (!["anonymous", "authenticated"].includes(defaultPolicy) && !auth.authorization.policies[defaultPolicy]) errors.push(`auth.authorization.defaultPolicy: undefined policy '${defaultPolicy}'; define auth.authorization.policies.${defaultPolicy}`);
+  }
+
   // データベース設定の検証
   if (hasConfiguredDatabase(config) && !config.database?.connectionString) {
     errors.push("Cosmos DB connection string is required");

package/src/core/mock/connector-mock-server.ts

@@ -503,9 +503,9 @@ export class ConnectorMockServer {
     if (!policy) return undefined; // defaultPolicy: authenticated → 認証のみ、ロールチェック不要
 
     if (isWrite) {
-      return policy.write || policy.roles;
+      return Array.isArray(policy.write) ? policy.write : policy.roles;
     }
-    return policy.read || policy.roles;
+    return Array.isArray(policy.read) ? policy.read : policy.roles;
   }
 
   private readBody(req: http.IncomingMessage, callback: (body: MockDocument) => void) {

package/src/core/project/manifest.ts

@@ -1,6 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
-import { getBackendLanguage, getFullConfig, validateConfig } from "../config";
+import { getBackendLanguage, getFullConfig, normalizeAuthConfig, validateConfig } from "../config";
 import { getAllModels, toCamelCase, toKebabCase } from "../scaffold/model-parser";
 import { AuthConfig, BackendLanguage, ConnectorDefinition, ModelAuthPolicy, ModelConnectorConfig } from "../../types";
 import { captureConsoleMessages, withWorkingDirectory } from "../operations/runtime";
@@ -340,7 +340,7 @@ export async function buildProjectManifest(projectRoot: string = process.cwd()):
       connectors: Object.entries(config.connectors || {})
         .map(([name, definition]) => ({ name, definition }))
         .sort((left, right) => left.name.localeCompare(right.name)),
-      auth: config.auth || null,
+      auth: normalizeAuthConfig(config.auth) || null,
       entities: entities.sort((left, right) => left.name.localeCompare(right.name)),
       routes,
       modules: buildModules(projectRoot),
@@ -356,7 +356,7 @@ export async function buildProjectManifest(projectRoot: string = process.cwd()):
         ],
         hasSharedWorkspace: fs.existsSync(path.join(projectRoot, "shared", "package.json")),
         hasConnectors: Object.keys(config.connectors || {}).length > 0,
-        hasAuth: Boolean(config.auth && config.auth.provider !== "none"),
+        hasAuth: Boolean(config.auth && (config.auth.provider !== "none" || Object.keys(config.auth.schemes ?? {}).length > 0)),
       },
     };
 

package/src/core/project/validation.ts

@@ -209,6 +209,22 @@ export async function validateProject(projectRoot: string = process.cwd()): Prom
     });
   }
 
+  const namedPolicies = loaded.manifest.auth?.authorization?.policies ?? {};
+  for (const entity of loaded.manifest.entities) {
+    const policy = entity.authPolicy;
+    if (!policy) continue;
+    const references = [policy.policy, typeof policy.read === "string" ? policy.read : undefined, typeof policy.write === "string" ? policy.write : undefined].filter((value): value is string => Boolean(value));
+    for (const name of references) {
+      if (!namedPolicies[name]) pushViolation(violations, {
+        code: "undefined-auth-policy",
+        severity: "error",
+        message: `Model '${entity.name}' references undefined authorization policy '${name}'.`,
+        location: { path: entity.filePath, entity: entity.name },
+        suggestedFix: `Define auth.authorization.policies.${name} or update the model authPolicy reference.`,
+      });
+    }
+  }
+
   for (const entity of loaded.manifest.entities) {
     validateSchemaNaming(entity, violations);
   }