swallowkit 1.0.0-beta.46 → 1.0.0-beta.48

package/src/core/scaffold/connector-functions-generator.ts

@@ -11,6 +11,7 @@ import {
   ApiModelConnectorConfig,
   ConnectorOperation,
   ModelAuthPolicy,
+  AuthProvider,
 } from "../../types";
 import { generateAuthImportTS, generateAuthGuardTS } from "./auth-generator";
 
@@ -24,7 +25,8 @@ export function generateRdbConnectorFunctionTS(
   sharedPackageName: string,
   connectorDef: RdbConnectorConfig,
   modelConnector: RdbModelConnectorConfig,
-  authPolicy?: ModelAuthPolicy
+  authPolicy?: ModelAuthPolicy,
+  authProvider?: AuthProvider
 ): string {
   const modelCamel = toCamelCase(model.name);
   const schemaName = model.schemaName;
@@ -122,8 +124,9 @@ export function generateRdbConnectorFunctionTS(
 
   // Auth guard setup
   const hasAuth = !!authPolicy;
-  const authImport = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
-  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read')}\n` : '';
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImport = hasAuth ? `\n${generateAuthImportTS(namedAuth)}\n` : '';
+  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read', authProvider)}\n` : '';
   const authCatchBlock = hasAuth
     ? `      const authErr = handleAuthError(error);
       if (authErr) return authErr;\n      `
@@ -143,7 +146,7 @@ ${getConnection}
 app.http('${modelCamel}-get-all', {
   methods: ['GET'],
   route: '${modelCamel}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${readGuard}
       ${queryAll}
@@ -162,7 +165,7 @@ app.http('${modelCamel}-get-all', {
 app.http('${modelCamel}-get-by-id', {
   methods: ['GET'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${readGuard}
       const id = request.params.id;
@@ -190,7 +193,8 @@ export function generateApiConnectorFunctionTS(
   sharedPackageName: string,
   connectorDef: ApiConnectorConfig,
   modelConnector: ApiModelConnectorConfig,
-  authPolicy?: ModelAuthPolicy
+  authPolicy?: ModelAuthPolicy,
+  authProvider?: AuthProvider
 ): string {
   const modelCamel = toCamelCase(model.name);
   const schemaName = model.schemaName;
@@ -202,9 +206,10 @@ export function generateApiConnectorFunctionTS(
 
   // Auth guard setup (user access control, separate from connector auth to external APIs)
   const hasAuth = !!authPolicy;
-  const authImportLine = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
-  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read')}\n` : '';
-  const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write')}\n` : '';
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImportLine = hasAuth ? `\n${generateAuthImportTS(namedAuth)}\n` : '';
+  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read', authProvider)}\n` : '';
+  const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write', authProvider)}\n` : '';
   const authCatchBlock = hasAuth
     ? `      const authErr = handleAuthError(error);
       if (authErr) return authErr;\n      `
@@ -229,7 +234,7 @@ ${authSetup.helperCode}
 app.http('${modelCamel}-get-all', {
   methods: ['GET'],
   route: '${modelCamel}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${readGuard}
       const url = getBaseUrl() + '${epPath}';
@@ -263,7 +268,7 @@ app.http('${modelCamel}-get-all', {
 app.http('${modelCamel}-get-by-id', {
   methods: ['GET'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${readGuard}
       const id = request.params.id;
@@ -303,7 +308,7 @@ app.http('${modelCamel}-get-by-id', {
 app.http('${modelCamel}-create', {
   methods: ['POST'],
   route: '${modelCamel}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${writeGuard}
       const body = await request.json();
@@ -341,7 +346,7 @@ app.http('${modelCamel}-create', {
 app.http('${modelCamel}-update', {
   methods: ['PUT'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${writeGuard}
       const id = request.params.id;
@@ -381,7 +386,7 @@ app.http('${modelCamel}-update', {
 app.http('${modelCamel}-delete', {
   methods: ['DELETE'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${writeGuard}
       const id = request.params.id;
@@ -496,7 +501,7 @@ export function generateRdbConnectorFunctionCSharp(
     methods += `
     [Function("${modelCamel}GetAll")]
     public async Task<HttpResponseData> GetAll(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "${modelCamel}")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "${modelCamel}")] HttpRequestData request)
     {
         try
         {
@@ -531,7 +536,7 @@ export function generateRdbConnectorFunctionCSharp(
     methods += `
     [Function("${modelCamel}GetById")]
     public async Task<HttpResponseData> GetById(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -618,7 +623,7 @@ export function generateApiConnectorFunctionCSharp(
     methods += `
     [Function("${modelCamel}GetAll")]
     public async Task<HttpResponseData> GetAll(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "${modelCamel}")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "${modelCamel}")] HttpRequestData request)
     {
         try
         {
@@ -651,7 +656,7 @@ export function generateApiConnectorFunctionCSharp(
     methods += `
     [Function("${modelCamel}GetById")]
     public async Task<HttpResponseData> GetById(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -689,7 +694,7 @@ export function generateApiConnectorFunctionCSharp(
     methods += `
     [Function("${modelCamel}Create")]
     public async Task<HttpResponseData> Create(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "${modelCamel}")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "post", Route = "${modelCamel}")] HttpRequestData request)
     {
         try
         {
@@ -725,7 +730,7 @@ export function generateApiConnectorFunctionCSharp(
     methods += `
     [Function("${modelCamel}Update")]
     public async Task<HttpResponseData> Update(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "put", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "put", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -759,7 +764,7 @@ export function generateApiConnectorFunctionCSharp(
     methods += `
     [Function("${modelCamel}Delete")]
     public async Task<HttpResponseData> Delete(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "delete", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "delete", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try

package/src/core/scaffold/functions-generator.ts

@@ -5,14 +5,14 @@
  */
 
 import { ModelInfo, toCamelCase, toKebabCase } from "./model-parser";
-import { ModelAuthPolicy } from "../../types";
+import { AuthProvider, ModelAuthPolicy } from "../../types";
 import { generateAuthImportTS, generateAuthGuardTS, generateAuthGuardCSharp, generateAuthGuardPython } from "./auth-generator";
 
 /**
  * Azure Functions エンティティファイルを生成（インラインハンドラー方式）
  * 各ハンドラーがベタ書きされており、ビジネスロジックの追加・変更が容易
  */
-export function generateCompactAzureFunctionsCRUD(model: ModelInfo, sharedPackageName: string, authPolicy?: ModelAuthPolicy): string {
+export function generateCompactAzureFunctionsCRUD(model: ModelInfo, sharedPackageName: string, authPolicy?: ModelAuthPolicy, authProvider?: AuthProvider): string {
   const modelName = model.name;
   const modelCamel = toCamelCase(modelName);
   const schemaName = model.schemaName;
@@ -22,9 +22,10 @@ export function generateCompactAzureFunctionsCRUD(model: ModelInfo, sharedPackag
   const isIdPartition = partitionKeyField === 'id';
 
   const hasAuth = !!authPolicy;
-  const authImport = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
-  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read')}\n` : '';
-  const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write')}\n` : '';
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImport = hasAuth ? `\n${generateAuthImportTS(namedAuth)}\n` : '';
+  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read', authProvider)}\n` : '';
+  const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write', authProvider)}\n` : '';
   const authCatchBlock = hasAuth
     ? `      const authErr = handleAuthError(error);
       if (authErr) return authErr;\n`
@@ -69,7 +70,7 @@ const containerName = '${modelName.endsWith('s') ? modelName : modelName + 's'}'
 app.http('${modelCamel}-get-all', {
   methods: ['GET'],
   route: '${modelCamel}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -105,7 +106,7 @@ ${getByIdHandler}
 app.http('${modelCamel}-create', {
   methods: ['POST'],
   route: '${modelCamel}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraOutputs: [
     {
       type: 'cosmosDB',
@@ -158,7 +159,7 @@ function generateGetByIdWithBinding(modelCamel: string, schemaName: string, read
 app.http('${modelCamel}-get-by-id', {
   methods: ['GET'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -193,7 +194,7 @@ function generateGetByIdWithSdk(modelCamel: string, schemaName: string, readGuar
 app.http('${modelCamel}-get-by-id', {
   methods: ['GET'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${readGuard}
       const id = request.params.id;
@@ -229,7 +230,7 @@ function generateUpdateWithBinding(modelCamel: string, schemaName: string, write
 app.http('${modelCamel}-update', {
   methods: ['PUT'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -294,7 +295,7 @@ function generateUpdateWithSdk(modelCamel: string, schemaName: string, partition
 app.http('${modelCamel}-update', {
   methods: ['PUT'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${writeGuard}
       const id = request.params.id;
@@ -349,7 +350,7 @@ function generateDeleteIdPartition(modelCamel: string, writeGuard: string, authC
 app.http('${modelCamel}-delete', {
   methods: ['DELETE'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${writeGuard}
       const id = request.params.id;
@@ -379,7 +380,7 @@ function generateDeleteCustomPartition(modelCamel: string, partitionKeyField: st
 app.http('${modelCamel}-delete', {
   methods: ['DELETE'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {${writeGuard}
       const id = request.params.id;
@@ -596,7 +597,7 @@ ${readItemMethod}
 
     [Function("${modelCamel}GetAll")]
     public async Task<HttpResponseData> GetAll(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "${modelCamel}")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "${modelCamel}")] HttpRequestData request)
     {
         try
         {${readGuard}
@@ -637,7 +638,7 @@ ${readItemMethod}
 
     [Function("${modelCamel}GetById")]
     public async Task<HttpResponseData> GetById(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -660,7 +661,7 @@ ${readItemMethod}
 
     [Function("${modelCamel}Create")]
     public async Task<HttpResponseData> Create(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "${modelCamel}")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "post", Route = "${modelCamel}")] HttpRequestData request)
     {
         try
         {${writeGuard}
@@ -695,7 +696,7 @@ ${readItemMethod}
 
     [Function("${modelCamel}Update")]
     public async Task<HttpResponseData> Update(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "put", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "put", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -740,7 +741,7 @@ ${readItemMethod}
 
     [Function("${modelCamel}Delete")]
     public async Task<HttpResponseData> Delete(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "delete", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "delete", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -779,7 +780,8 @@ export function generatePythonAzureFunctionsCRUD(model: ModelInfo, authPolicy?:
   const isIdPartition = partitionKeyField === 'id';
 
   const hasAuth = !!authPolicy;
-  const authImport = hasAuth ? '\nfrom auth.jwt_helper import require_auth, require_roles, handle_auth_error\n' : '';
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImport = hasAuth ? `\nfrom auth.${namedAuth ? 'auth_router' : 'jwt_helper'} import require_auth, require_roles, handle_auth_error\n` : '';
   // generateAuthGuardPython outputs at 4-space indent; inside try: we need 8-space
   const readGuardRaw = hasAuth ? generateAuthGuardPython(authPolicy!, 'read') : '';
   const writeGuardRaw = hasAuth ? generateAuthGuardPython(authPolicy!, 'write') : '';

package/src/core/scaffold/model-parser.ts

@@ -779,14 +779,20 @@ export function parseAuthPolicy(content: string): ModelAuthPolicy | undefined {
   const read = extractRoles('read');
   const write = extractRoles('write');
 
-  if (!roles && !read && !write) {
+  const extractName = (key: string): string | undefined => objectStr.match(new RegExp(`${key}\\s*:\\s*['"]([^'"]+)['"]`))?.[1];
+  const namedPolicy = extractName('policy');
+  const namedRead = extractName('read');
+  const namedWrite = extractName('write');
+
+  if (!roles && !read && !write && !namedPolicy && !namedRead && !namedWrite) {
     return undefined;
   }
 
   return {
     ...(roles ? { roles } : {}),
-    ...(read ? { read } : {}),
-    ...(write ? { write } : {}),
+    ...(namedRead ? { read: namedRead } : read ? { read } : {}),
+    ...(namedWrite ? { write: namedWrite } : write ? { write } : {}),
+    ...(namedPolicy ? { policy: namedPolicy } : {}),
   };
 }
 

package/src/core/scaffold/nextjs-generator.ts

@@ -32,6 +32,17 @@ function getFunctionsBaseUrl(): string {
   return process.env.BACKEND_FUNCTIONS_BASE_URL || process.env.FUNCTIONS_BASE_URL || 'http://localhost:7071';
 }
 
+function isLocalFunctionsUrl(url: string): boolean {
+  return url.startsWith('http://localhost:') || url.startsWith('http://127.0.0.1:');
+}
+
+function getFunctionsKeyHeaders(functionsBaseUrl: string): Record<string, string> {
+  const key = process.env.BACKEND_FUNCTIONS_KEY;
+  if (key) return { 'x-functions-key': key };
+  if (isLocalFunctionsUrl(functionsBaseUrl)) return {};
+  throw new Error('BACKEND_FUNCTIONS_KEY is required for non-local Functions calls');
+}
+
 interface CallFunctionConfig<TInput = any, TOutput = any> {
   /** HTTP メソッド */
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -70,11 +81,12 @@ export async function callFunction<TInput = any, TOutput = any>(
     // Azure Functions を呼び出し
     const functionsBaseUrl = getFunctionsBaseUrl();
     const url = functionsBaseUrl + path;
+    const keyHeaders = getFunctionsKeyHeaders(functionsBaseUrl);
     console.log(\`[BFF] \${method} \${url}\`);
 
     const response = await fetch(url, {
       method,
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...keyHeaders },
       body: validatedBody !== undefined ? JSON.stringify(validatedBody) : undefined,
     });
 

package/src/core/scaffold/ui-generator.ts

@@ -10,6 +10,9 @@ import { ModelAuthPolicy } from "../../types";
 export interface UIAuthOptions {
   /** モデル固有のロールポリシー */
   authPolicy: ModelAuthPolicy;
+  writeRoles?: string[];
+  authenticatedFetchImport?: string;
+  authContextImport?: string;
 }
 
 /**
@@ -21,7 +24,8 @@ export function generateListPage(model: ModelInfo, sharedPackageName: string, au
   const modelKebab = toKebabCase(modelName);
   
   const hasAuth = !!authOptions;
-  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const authContextImport = authOptions?.authContextImport ?? '@/lib/auth/auth-context';
+  const writeRoles = authOptions?.writeRoles ?? (Array.isArray(authOptions?.authPolicy?.write) ? authOptions.authPolicy.write : authOptions?.authPolicy?.roles);
   const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
   
   // フィールドから表示するカラムを抽出（id以外の最初の3つ）
@@ -71,7 +75,7 @@ import { useEffect, useState } from 'react';
 import Link from 'next/link';
 import { z } from 'zod/v4';
 ${schemaImportLine}
-${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
+${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
@@ -266,7 +270,8 @@ export function generateDetailPage(model: ModelInfo, sharedPackageName: string,
   const modelKebab = toKebabCase(modelName);
   
   const hasAuth = !!authOptions;
-  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const authContextImport = authOptions?.authContextImport ?? '@/lib/auth/auth-context';
+  const writeRoles = authOptions?.writeRoles ?? (Array.isArray(authOptions?.authPolicy?.write) ? authOptions.authPolicy.write : authOptions?.authPolicy?.roles);
   const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
   
   // 外部キーフィールドを検出
@@ -311,7 +316,7 @@ import { useParams, useRouter } from 'next/navigation';
 import Link from 'next/link';
 import { z } from 'zod/v4';
 ${schemaImportLine}
-${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
+${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
@@ -910,7 +915,8 @@ export function generateNewPage(model: ModelInfo, authOptions?: UIAuthOptions):
   const modelKebab = toKebabCase(modelName);
   
   const hasAuth = !!authOptions;
-  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const authContextImport = authOptions?.authContextImport ?? '@/lib/auth/auth-context';
+  const writeRoles = authOptions?.writeRoles ?? (Array.isArray(authOptions?.authPolicy?.write) ? authOptions.authPolicy.write : authOptions?.authPolicy?.roles);
   const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
   
   if (!hasAuth) {
@@ -936,7 +942,7 @@ export default function New${modelName}Page() {
 import { useEffect } from 'react';
 import { useRouter } from 'next/navigation';
 import ${modelName}Form from '../_components/${modelName}Form';
-import { useAuth } from '@/lib/auth/auth-context';
+import { useAuth } from '${authContextImport}';
 
 export default function New${modelName}Page() {
   const router = useRouter();
@@ -979,7 +985,8 @@ export function generateEditPage(model: ModelInfo, sharedPackageName: string, au
   const modelKebab = toKebabCase(modelName);
   
   const hasAuth = !!authOptions;
-  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const authContextImport = authOptions?.authContextImport ?? '@/lib/auth/auth-context';
+  const writeRoles = authOptions?.writeRoles ?? (Array.isArray(authOptions?.authPolicy?.write) ? authOptions.authPolicy.write : authOptions?.authPolicy?.roles);
   const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
   
   const schemaName = model.schemaName;
@@ -997,7 +1004,7 @@ import { useParams, useRouter } from 'next/navigation';
 import ${modelName}Form from '../../_components/${modelName}Form';
 import { z } from 'zod/v4';
 ${schemaImportLine}
-${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
+${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 

package/src/types/index.ts

@@ -73,7 +73,7 @@ export interface ApiModelConnectorConfig {
 export type ModelConnectorConfig = RdbModelConnectorConfig | ApiModelConnectorConfig;
 
 // 認証プロバイダー種別
-export type AuthProvider = "custom-jwt" | "swa" | "swa-custom" | "none";
+export type AuthProvider = "custom-jwt" | "swa" | "external-token" | "swa-custom" | "none";
 
 // custom-jwt プロバイダー設定
 export interface CustomJwtConfig {
@@ -95,12 +95,25 @@ export interface SwaAuthConfig {
 
 // 認可設定
 export interface AuthorizationConfig {
-  defaultPolicy?: "authenticated" | "anonymous";
+  defaultPolicy?: "authenticated" | "anonymous" | "public" | string;
+  policies?: Record<string, AuthorizationPolicy>;
+}
+
+export interface AuthorizationPolicy {
+  schemes: string[];
+  roles?: string[];
+}
+
+export interface AuthSchemeConfig {
+  provider: AuthProvider;
+  customJwt?: CustomJwtConfig;
+  swa?: SwaAuthConfig;
 }
 
 // 認証設定
 export interface AuthConfig {
-  provider: AuthProvider;
+  provider?: AuthProvider;
+  schemes?: Record<string, AuthSchemeConfig>;
   customJwt?: CustomJwtConfig;
   swa?: SwaAuthConfig;
   authorization?: AuthorizationConfig;
@@ -109,8 +122,26 @@ export interface AuthConfig {
 // モデルに付与する認可ポリシー
 export interface ModelAuthPolicy {
   roles?: string[];
-  read?: string[];
-  write?: string[];
+  read?: string[] | string;
+  write?: string[] | string;
+  policy?: string;
+}
+
+export interface NormalizedAuthConfig extends Omit<AuthConfig, "schemes" | "authorization"> {
+  schemes: Record<string, AuthSchemeConfig>;
+  authorization: AuthorizationConfig & { defaultPolicy: string; policies: Record<string, AuthorizationPolicy> };
+}
+
+export interface AuthPrincipal {
+  subject: string;
+  scheme: string;
+  issuer: string;
+  roles: string[];
+  claims: Record<string, unknown>;
+  /** @deprecated Use subject. */
+  userId?: string;
+  /** @deprecated Read provider data from claims. */
+  userDetails?: string;
 }
 
 // CLI設定の型

package/src/utils/package-manager.ts

@@ -178,6 +178,7 @@ export function getCiSetupStep(pm: PackageManager): string {
 }
 
 export function getCiInstallCommand(ciPm: PackageManager, projectPm: PackageManager = ciPm): string {
+  void projectPm; // Reserved for package-manager-specific CI bridging.
   if (ciPm === "pnpm") {
     return getCommands(ciPm).ci;
   }