swallowkit 1.0.0-beta.46 → 1.0.0-beta.48

package/src/__tests__/__snapshots__/functions-generator.test.ts.snap

@@ -130,7 +130,7 @@ public sealed class TodoCrudFunctions
 
     [Function("todoGetAll")]
     public async Task<HttpResponseData> GetAll(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "todo")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "todo")] HttpRequestData request)
     {
         try
         {
@@ -171,7 +171,7 @@ public sealed class TodoCrudFunctions
 
     [Function("todoGetById")]
     public async Task<HttpResponseData> GetById(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "todo/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "todo/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -194,7 +194,7 @@ public sealed class TodoCrudFunctions
 
     [Function("todoCreate")]
     public async Task<HttpResponseData> Create(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "todo")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "post", Route = "todo")] HttpRequestData request)
     {
         try
         {
@@ -229,7 +229,7 @@ public sealed class TodoCrudFunctions
 
     [Function("todoUpdate")]
     public async Task<HttpResponseData> Update(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "put", Route = "todo/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "put", Route = "todo/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -274,7 +274,7 @@ public sealed class TodoCrudFunctions
 
     [Function("todoDelete")]
     public async Task<HttpResponseData> Delete(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "delete", Route = "todo/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "delete", Route = "todo/{id}")] HttpRequestData request,
         string id)
     {
         try
@@ -466,7 +466,7 @@ const containerName = 'Todos';
 app.http('todo-get-all', {
   methods: ['GET'],
   route: 'todo',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -500,7 +500,7 @@ app.http('todo-get-all', {
 app.http('todo-get-by-id', {
   methods: ['GET'],
   route: 'todo/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {
       const id = request.params.id;
@@ -542,7 +542,7 @@ app.http('todo-get-by-id', {
 app.http('todo-create', {
   methods: ['POST'],
   route: 'todo',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraOutputs: [
     {
       type: 'cosmosDB',
@@ -586,7 +586,7 @@ app.http('todo-create', {
 app.http('todo-update', {
   methods: ['PUT'],
   route: 'todo/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {
       const id = request.params.id;
@@ -647,7 +647,7 @@ app.http('todo-update', {
 app.http('todo-delete', {
   methods: ['DELETE'],
   route: 'todo/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {
       const id = request.params.id;
@@ -706,7 +706,7 @@ const containerName = 'Todos';
 app.http('todo-get-all', {
   methods: ['GET'],
   route: 'todo',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -740,7 +740,7 @@ app.http('todo-get-all', {
 app.http('todo-get-by-id', {
   methods: ['GET'],
   route: 'todo/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -773,7 +773,7 @@ app.http('todo-get-by-id', {
 app.http('todo-create', {
   methods: ['POST'],
   route: 'todo',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraOutputs: [
     {
       type: 'cosmosDB',
@@ -817,7 +817,7 @@ app.http('todo-create', {
 app.http('todo-update', {
   methods: ['PUT'],
   route: 'todo/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -880,7 +880,7 @@ app.http('todo-update', {
 app.http('todo-delete', {
   methods: ['DELETE'],
   route: 'todo/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {
       const id = request.params.id;
@@ -928,7 +928,7 @@ const containerName = 'Issues';
 app.http('issue-get-all', {
   methods: ['GET'],
   route: 'issue',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -962,7 +962,7 @@ app.http('issue-get-all', {
 app.http('issue-get-by-id', {
   methods: ['GET'],
   route: 'issue/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -995,7 +995,7 @@ app.http('issue-get-by-id', {
 app.http('issue-create', {
   methods: ['POST'],
   route: 'issue',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraOutputs: [
     {
       type: 'cosmosDB',
@@ -1039,7 +1039,7 @@ app.http('issue-create', {
 app.http('issue-update', {
   methods: ['PUT'],
   route: 'issue/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -1102,7 +1102,7 @@ app.http('issue-update', {
 app.http('issue-delete', {
   methods: ['DELETE'],
   route: 'issue/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
     try {
       const id = request.params.id;

package/src/__tests__/__snapshots__/nextjs-generator.test.ts.snap

@@ -23,6 +23,17 @@ function getFunctionsBaseUrl(): string {
   return process.env.BACKEND_FUNCTIONS_BASE_URL || process.env.FUNCTIONS_BASE_URL || 'http://localhost:7071';
 }
 
+function isLocalFunctionsUrl(url: string): boolean {
+  return url.startsWith('http://localhost:') || url.startsWith('http://127.0.0.1:');
+}
+
+function getFunctionsKeyHeaders(functionsBaseUrl: string): Record<string, string> {
+  const key = process.env.BACKEND_FUNCTIONS_KEY;
+  if (key) return { 'x-functions-key': key };
+  if (isLocalFunctionsUrl(functionsBaseUrl)) return {};
+  throw new Error('BACKEND_FUNCTIONS_KEY is required for non-local Functions calls');
+}
+
 interface CallFunctionConfig<TInput = any, TOutput = any> {
   /** HTTP メソッド */
   method: 'GET' | 'POST' | 'PUT' | 'DELETE';
@@ -61,11 +72,12 @@ export async function callFunction<TInput = any, TOutput = any>(
     // Azure Functions を呼び出し
     const functionsBaseUrl = getFunctionsBaseUrl();
     const url = functionsBaseUrl + path;
+    const keyHeaders = getFunctionsKeyHeaders(functionsBaseUrl);
     console.log(\`[BFF] \${method} \${url}\`);
 
     const response = await fetch(url, {
       method,
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...keyHeaders },
       body: validatedBody !== undefined ? JSON.stringify(validatedBody) : undefined,
     });
 

package/src/__tests__/auth.test.ts

@@ -13,6 +13,17 @@ import {
   generateLoginPage,
   generateAuthContext,
   generateBFFCallFunctionWithAuth,
+  generateBFFCallFunctionWithSwaAuth,
+  generateSwaAuthHelperTS,
+  generateSwaAuthHelperCSharp,
+  generateSwaAuthHelperPython,
+  generateExternalTokenAdapter,
+  generateAuthenticatedFetch,
+  generateExternalTokenAuthContext,
+  generateExternalTokenVerifierTS,
+  generateExternalTokenHelperTS,
+  generateExternalTokenVerifierCSharp,
+  generateExternalTokenVerifierPython,
   generateAuthImportTS,
   generateAuthGuardTS,
   generateAuthGuardCSharp,
@@ -22,6 +33,7 @@ import { generateCompactAzureFunctionsCRUD } from "../core/scaffold/functions-ge
 import { parseAuthPolicy } from "../core/scaffold/model-parser";
 import { createBasicModelInfo } from "./fixtures";
 import { ModelAuthPolicy, CustomJwtConfig } from "../types";
+import { addAuthProviderToRootLayout, generateSwaAuthContext } from "../cli/commands/add-auth";
 
 const defaultJwtConfig: CustomJwtConfig = {
   userConnector: "mysql",
@@ -325,6 +337,97 @@ describe("generateBFFCallFunctionWithAuth", () => {
     const code = generateBFFCallFunctionWithAuth();
     expect(code).toContain("catch");
   });
+
+  it("also attaches the Functions host key", () => {
+    const code = generateBFFCallFunctionWithAuth();
+    expect(code).toContain("BACKEND_FUNCTIONS_KEY");
+    expect(code).toContain("'x-functions-key'");
+  });
+});
+
+describe("SWA built-in auth generators", () => {
+  it("wraps the root layout with AuthProvider exactly once", () => {
+    const layout = `import './globals.css';\nexport default function RootLayout({ children }: { children: React.ReactNode }) {\n  return <html><body>{children}</body></html>;\n}\n`;
+    const once = addAuthProviderToRootLayout(layout);
+    const twice = addAuthProviderToRootLayout(once);
+
+    expect(twice).toBe(once);
+    expect(once.match(/import \{ AuthProvider \}/g)).toHaveLength(1);
+    expect(once.match(/<AuthProvider>/g)).toHaveLength(1);
+    expect(once).toContain("<AuthProvider>{children}</AuthProvider>");
+  });
+
+  it("preserves a React directive before the generated import", () => {
+    const layout = `'use client';\nimport { useAuth } from '@/lib/auth/auth-context';\nexport default function RootLayout({ children }: { children: React.ReactNode }) { return <body>{children}</body>; }`;
+    const updated = addAuthProviderToRootLayout(layout);
+
+    expect(updated).toMatch(/^'use client';\nimport \{ AuthProvider \}/);
+    expect(updated.match(/AuthProvider \} from/g)).toHaveLength(1);
+  });
+
+  it("treats unavailable or invalid /.auth/me responses as anonymous", () => {
+    const code = generateSwaAuthContext();
+    expect(code).toContain("if (!response.ok)");
+    expect(code).toContain("typeof body !== 'object'");
+    expect(code).toContain(".catch(() => setUser(null))");
+    expect(code).toContain(".finally(() => setLoading(false))");
+  });
+
+  it("normalizes a valid SWA principal and its string roles", () => {
+    const code = generateSwaAuthContext();
+    expect(code).toContain("typeof value.userId !== 'string'");
+    expect(code).toContain("value.userRoles.filter");
+    expect(code).toContain("satisfies AuthUser");
+  });
+
+  it("forwards a normalized platform principal with /.auth/me fallback", () => {
+    const code = generateBFFCallFunctionWithSwaAuth();
+    expect(code).toContain("x-ms-client-principal");
+    expect(code).toContain("/.auth/me");
+    expect(code).toContain("BACKEND_FUNCTIONS_KEY");
+    expect(code).not.toContain("fetchHeaders['Authorization']");
+  });
+
+  it.each([
+    ["typescript", generateSwaAuthHelperTS()],
+    ["csharp", generateSwaAuthHelperCSharp()],
+    ["python", generateSwaAuthHelperPython()],
+  ])("generates %s principal validation and role checks", (_language, code) => {
+    expect(code).toContain("x-ms-client-principal");
+    expect(code).toContain("authenticated");
+    expect(code.toLowerCase()).toContain("role");
+    expect(code).not.toContain("JWT_SECRET");
+  });
+});
+
+describe("external token auth generators", () => {
+  it("generates a fail-closed frontend adapter and authenticated fetch", () => {
+    expect(generateExternalTokenAdapter()).toContain("return null");
+    const fetchCode = generateAuthenticatedFetch();
+    expect(fetchCode).toContain("Authorization");
+    expect(fetchCode).toContain("Bearer");
+    expect(fetchCode).toContain("status: 401");
+  });
+
+  it("handles non-JSON auth/me responses without parsing them", () => {
+    const code = generateExternalTokenAuthContext();
+    expect(code).toContain("content-type");
+    expect(code).toContain(".catch(() => setUser(null))");
+  });
+
+  it.each([
+    ["typescript", generateExternalTokenVerifierTS()],
+    ["csharp", generateExternalTokenVerifierCSharp()],
+    ["python", generateExternalTokenVerifierPython()],
+  ])("generates a fail-closed %s verifier", (_language, code) => {
+    expect(code).toContain("External token verifier is not configured");
+    expect(code).not.toContain("JWT_SECRET");
+  });
+
+  it("awaits external token verification in TypeScript guards", () => {
+    expect(generateAuthGuardTS({}, "read", "external-token")).toContain("await requireAuth(request)");
+    expect(generateExternalTokenHelperTS()).toContain("await verifyExternalToken");
+  });
 });
 
 // ============================================================
@@ -340,6 +443,10 @@ describe("generateAuthImportTS", () => {
 });
 
 describe("generateAuthGuardTS", () => {
+  it("generates a named read/write policy guard", () => {
+    expect(generateAuthGuardTS({ read: "adminOnly", write: "lineUserOnly" }, "read")).toContain("requireAuth(request, \"adminOnly\")");
+    expect(generateAuthGuardTS({ policy: "adminOnly" }, "write")).toContain("requireAuth(request, \"adminOnly\")");
+  });
   it("generates authentication-only guard for empty policy", () => {
     const policy: ModelAuthPolicy = {};
     const readGuard = generateAuthGuardTS(policy, "read");

package/src/__tests__/config.test.ts

@@ -1,7 +1,28 @@
-import { validateConfig, loadConfigFromEnv } from "../core/config";
+import { validateConfig, loadConfigFromEnv, normalizeAuthConfig } from "../core/config";
 import { SwallowKitConfig } from "../types";
 
 describe("validateConfig", () => {
+  it("normalizes a legacy provider as the default scheme", () => {
+    const auth = normalizeAuthConfig({ provider: "external-token", authorization: { defaultPolicy: "authenticated" } });
+    expect(auth?.schemes.default.provider).toBe("external-token");
+    expect(auth?.authorization.defaultPolicy).toBe("authenticated");
+  });
+
+  it("accepts SWA and external token named schemes", () => {
+    const result = validateConfig({ auth: { schemes: { admin: { provider: "swa" }, lineUser: { provider: "external-token" } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] }, lineUserOnly: { schemes: ["lineUser"] } } } } });
+    expect(result).toEqual({ valid: true, errors: [] });
+  });
+
+  it("rejects undefined scheme references and ambiguous bearer schemes", () => {
+    const missing = validateConfig({ auth: { schemes: { admin: { provider: "swa" } }, authorization: { defaultPolicy: "anonymous", policies: { bad: { schemes: ["missing"] } } } } });
+    expect(missing.errors.join("\n")).toContain("auth.authorization.policies.bad.schemes");
+    const ambiguous = validateConfig({ auth: { schemes: { a: { provider: "external-token" }, b: { provider: "external-token" } }, authorization: { defaultPolicy: "anonymous", policies: { bad: { schemes: ["a", "b"] } } } } });
+    expect(ambiguous.errors.join("\n")).toContain("deterministic");
+  });
+
+  it("normalizes public to anonymous", () => {
+    expect(normalizeAuthConfig({ provider: "none", authorization: { defaultPolicy: "public" } })?.authorization.defaultPolicy).toBe("anonymous");
+  });
   it("returns valid for a complete config", () => {
     const config: SwallowKitConfig = {
       database: { connectionString: "AccountEndpoint=https://..." },

package/src/__tests__/dev.test.ts

@@ -6,6 +6,7 @@ import {
   buildFunctionsStartArgs,
   buildFunctionsCoreToolsCommand,
   buildNextDevArgs,
+  buildSwaStartArgs,
   buildDevCommand,
   buildPythonFunctionsEnv,
   compareVersionNumbers,
@@ -13,6 +14,7 @@ import {
   getFunctionsReadinessTimeoutMs,
   getCSharpFunctionsBuildArtifactPaths,
   getPythonVirtualEnvPaths,
+  getSwaCliInstallCommand,
   parseCoreToolsVersion,
   waitForHttpServerReady,
 } from "../cli/commands/dev";
@@ -70,6 +72,23 @@ describe("dev command helpers", () => {
     expect(buildFunctionsBaseUrl("127.0.0.1", "7072")).toBe("http://127.0.0.1:7072");
   });
 
+  it("builds SWA CLI arguments without bypassing the Next.js BFF", () => {
+    expect(buildSwaStartArgs(undefined, "3000", "4280")).toEqual([
+      "start",
+      "http://localhost:3000",
+      "--swa-config-location",
+      ".",
+      "--port",
+      "4280",
+    ]);
+    expect(buildSwaStartArgs(undefined, "3000", "4280")).not.toContain("--api-devserver-url");
+  });
+
+  it("provides a project-local SWA CLI install command", () => {
+    expect(getSwaCliInstallCommand("pnpm")).toBe("pnpm add -Dw @azure/static-web-apps-cli");
+    expect(getSwaCliInstallCommand("npm")).toBe("npm install -D @azure/static-web-apps-cli");
+  });
+
   it("gives C# more startup time before reporting readiness timeout", () => {
     expect(getFunctionsReadinessTimeoutMs("csharp")).toBeGreaterThan(getFunctionsReadinessTimeoutMs("typescript"));
     expect(getFunctionsReadinessTimeoutMs("csharp")).toBeGreaterThan(getFunctionsReadinessTimeoutMs("python"));
@@ -197,6 +216,8 @@ describe("dev CLI parser", () => {
       noFunctions: true,
       seedEnv: "local",
       mockConnectors: true,
+      swaPort: "4290",
+      noSwa: true,
     };
 
     const optionsAfterCommand = await parseDevOptions([
@@ -215,6 +236,9 @@ describe("dev CLI parser", () => {
       "--seed-env",
       "local",
       "--mock-connectors",
+      "--swa-port",
+      "4290",
+      "--no-swa",
     ]);
 
     const optionsBeforeCommand = await parseDevOptions([
@@ -226,6 +250,9 @@ describe("dev CLI parser", () => {
       "--seed-env",
       "local",
       "--mock-connectors",
+      "--swa-port",
+      "4290",
+      "--no-swa",
       "--no-functions",
       "--port",
       "3001",

package/src/__tests__/init.test.ts

@@ -17,6 +17,8 @@ import {
   injectSwallowKitNextConfig,
   parseIgnoredBuilds,
   buildCosmosDbFreeTierBicepSource,
+  buildFunctionsHostKeyBicepExpression,
+  buildStaticWebAppConfigBicepSource,
   withNpmLockfileSafeManifests,
 } from "../cli/commands/init";
 
@@ -100,6 +102,7 @@ module.exports = nextConfig;
     expect(dependencies).toEqual({
       "@azure/cosmos": "^4.0.0",
       applicationinsights: "^3.3.0",
+      zod: "^4.0.0",
       "@sample-app/shared": "workspace:*",
     });
     expect(dependencies).not.toHaveProperty("swallowkit");
@@ -212,6 +215,22 @@ describe("buildCosmosDbFreeTierBicepSource", () => {
   });
 });
 
+describe("Functions host key infrastructure", () => {
+  it("reads the generated default host key without exposing a literal value", () => {
+    const expression = buildFunctionsHostKeyBicepExpression();
+    expect(expression).toContain("listKeys(");
+    expect(expression).toContain("functionKeys.default");
+  });
+
+  it("passes the key to SWA through a secure module parameter", () => {
+    const source = buildStaticWebAppConfigBicepSource();
+    expect(source).toContain("@secure()");
+    expect(source).toContain("param functionsHostKey string");
+    expect(source).toContain("BACKEND_FUNCTIONS_KEY: functionsHostKey");
+    expect(source).not.toContain("output functionsHostKey");
+  });
+});
+
 describe("GitHub Actions workflow generation", () => {
   it("uses npm ci for the SWA workflow when the project was initialized with pnpm", () => {
     const workflow = buildGitHubSwaWorkflow("npm", "pnpm");

package/src/__tests__/mcp.test.ts

@@ -9,7 +9,7 @@ const itWhenBuiltEntrypointExists = fs.existsSync(builtMcpEntrypoint) ? it : it.
 
 describe("SwallowKit MCP tool definitions", () => {
   it("delegates inspect_project to the machine CLI", async () => {
-    const runner = jest.fn(async (_args: Parameters<MachineCliRunner>[0]) => ({
+    const runner = jest.fn(async () => ({
       stdout: JSON.stringify({
         ok: true,
         command: "inspect-project",
@@ -48,7 +48,7 @@ describe("SwallowKit MCP tool definitions", () => {
   });
 
   it("delegates scaffold_model with explicit args", async () => {
-    const runner = jest.fn(async (_args: Parameters<MachineCliRunner>[0]) => ({
+    const runner = jest.fn(async () => ({
       stdout: JSON.stringify({
         ok: true,
         command: "generate-scaffold",

package/src/__tests__/multi-auth.test.ts

@@ -0,0 +1,133 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { addAuthCommand } from "../cli/commands/add-auth";
+import {
+  generateBFFCallFunctionWithMultipleAuth,
+  generateNamedAuthRouterCSharp,
+  generateNamedAuthRouterPython,
+  generateNamedAuthRouterTS,
+} from "../core/scaffold/auth-generator";
+import { normalizeAuthConfig } from "../core/config";
+import { parseAuthPolicy } from "../core/scaffold/model-parser";
+import { createBasicModelInfo } from "./fixtures";
+import { generateCSharpAzureFunctionsCRUD, generateCompactAzureFunctionsCRUD, generatePythonAzureFunctionsCRUD } from "../core/scaffold/functions-generator";
+
+const auth = normalizeAuthConfig({
+  schemes: {
+    admin: { provider: "swa" },
+    lineUser: { provider: "external-token" },
+  },
+  authorization: {
+    defaultPolicy: "anonymous",
+    policies: {
+      adminOnly: { schemes: ["admin"], roles: ["authenticated"] },
+      lineUserOnly: { schemes: ["lineUser"], roles: ["authenticated"] },
+    },
+  },
+})!;
+
+describe("named authentication routers", () => {
+  it("generates deterministic TypeScript policy routing and normalized principals", () => {
+    const code = generateNamedAuthRouterTS(auth);
+    expect(code).toContain("policy.schemes.filter");
+    expect(code).toContain("candidates.length !== 1");
+    expect(code).toContain("subject: value.userId");
+    expect(code).toContain("scheme + ':' + principal.subject");
+    expect(code).toContain("new AuthError(403");
+    expect(code).toContain("new AuthError(503");
+    expect(code).not.toContain("JWT_SECRET");
+  });
+
+  it("generates equivalent C# and Python named guards", () => {
+    const csharp = generateNamedAuthRouterCSharp(auth);
+    const python = generateNamedAuthRouterPython(auth);
+    expect(csharp).toContain("record AuthPrincipal(string Subject, string Scheme, string Issuer");
+    expect(csharp).toContain("candidates.Length != 1");
+    expect(csharp).toContain("HttpStatusCode.Forbidden");
+    expect(python).toContain('principal["scheme"] + ":" + principal["subject"]');
+    expect(python).toContain("len(candidates) != 1");
+    expect(python).toContain("AuthError(503");
+  });
+
+  it("generates valid branch structure for an SWA-only Python router", () => {
+    const swaOnly = normalizeAuthConfig({ schemes: { admin: { provider: "swa", swa: { allowedProviders: ["github"] } } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } } })!;
+    const python = generateNamedAuthRouterPython(swaOnly);
+    expect(python).toContain('        if PROVIDERS[scheme] == "swa":');
+    expect(python).not.toContain('        elif PROVIDERS[scheme] == "swa":');
+    expect(python).toContain("ALLOWED_PROVIDERS");
+    expect(generateNamedAuthRouterCSharp(swaOnly)).toContain("AllowedProviders[scheme]");
+  });
+
+  it("scaffolds named read/write guards for all Functions languages", () => {
+    const policy = { read: "adminOnly", write: "lineUserOnly" };
+    const model = createBasicModelInfo();
+    const ts = generateCompactAzureFunctionsCRUD(model, "@fixture/shared", policy);
+    const cs = generateCSharpAzureFunctionsCRUD(model, policy);
+    const py = generatePythonAzureFunctionsCRUD(model, policy).blueprint;
+    expect(ts).toContain("./auth/auth-router");
+    expect(ts).toContain('requireAuth(request, "adminOnly")');
+    expect(ts).toContain('requireAuth(request, "lineUserOnly")');
+    expect(cs).toContain('AuthRouter.Authorize(request, "adminOnly")');
+    expect(cs).toContain('AuthRouter.Authorize(request, "lineUserOnly")');
+    expect(py).toContain("from auth.auth_router import");
+    expect(py).toContain('require_auth(req, "adminOnly")');
+    expect(py).toContain('require_auth(req, "lineUserOnly")');
+  });
+
+  it("forwards both credential sources and the Functions host key", () => {
+    const code = generateBFFCallFunctionWithMultipleAuth();
+    expect(code).toContain("fetchHeaders['Authorization']");
+    expect(code).toContain("fetchHeaders['x-ms-client-principal']");
+    expect(code).toContain("'x-functions-key'");
+    expect(code).not.toMatch(/console\.log\([^\n]*(authorization|principal|cookie)/i);
+  });
+
+  it("parses model-wide and operation-specific named policies", () => {
+    expect(parseAuthPolicy("export const authPolicy = { policy: 'adminOnly' };"))
+      .toEqual({ policy: "adminOnly" });
+    expect(parseAuthPolicy("export const authPolicy = { read: 'adminOnly', write: 'lineUserOnly' };"))
+      .toEqual({ read: "adminOnly", write: "lineUserOnly" });
+  });
+});
+
+describe("add-auth named scheme CLI", () => {
+  const originalCwd = process.cwd();
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-multi-auth-"));
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ name: "fixture" }));
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" }, auth: { schemes: {}, authorization: { defaultPolicy: "anonymous", policies: {} } } }, null, 2));
+    process.chdir(root);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("adds two schemes without overwriting the first verifier", async () => {
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    await addAuthCommand({ scheme: "lineUser", provider: "external-token" });
+    const verifier = path.join(root, "functions", "src", "auth", "schemes", "line-user", "verifier.ts");
+    fs.writeFileSync(verifier, "// user verifier\n", "utf-8");
+    const config = JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8"));
+    expect(config.auth.schemes.admin.provider).toBe("swa");
+    expect(config.auth.schemes.lineUser.provider).toBe("external-token");
+    await expect(addAuthCommand({ scheme: "lineUser", provider: "external-token" })).rejects.toThrow("already exists");
+    expect(fs.readFileSync(verifier, "utf-8")).toBe("// user verifier\n");
+    expect(fs.readFileSync(path.join(root, "lib", "api", "call-function.ts"), "utf-8")).toContain("x-functions-key");
+  });
+
+  it("updates a JavaScript config that already has a trailing comma", async () => {
+    fs.rmSync(path.join(root, "swallowkit.config.json"));
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {\n  backend: { language: 'typescript' },\n  api: { endpoint: '/api/test' },\n};\n");
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    const content = fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8");
+    expect(content).not.toContain(",,");
+    const configModule = { exports: {} as Record<string, unknown> };
+    new Function("module", content)(configModule);
+    expect((configModule.exports as { auth: { schemes: { admin: { provider: string } } } }).auth.schemes.admin.provider).toBe("swa");
+  });
+});

package/src/__tests__/nextjs-generator.test.ts

@@ -21,6 +21,14 @@ describe("generateBFFCallFunction", () => {
     expect(code).toContain("export async function callFunction");
   });
 
+  it("uses a server-side Functions key and fails closed outside localhost", () => {
+    const code = generateBFFCallFunction();
+    expect(code).toContain("BACKEND_FUNCTIONS_KEY");
+    expect(code).toContain("'x-functions-key'");
+    expect(code).toContain("required for non-local Functions calls");
+    expect(code).not.toContain("?code=");
+  });
+
   it("includes z.ZodSchema typings", () => {
     const code = generateBFFCallFunction();
     expect(code).toContain("z.ZodSchema");