swallowkit 1.0.0-beta.46 → 1.0.0-beta.48

package/src/cli/commands/add-auth.ts

@@ -5,7 +5,7 @@
 
 import * as fs from "fs";
 import * as path from "path";
-import { ensureSwallowKitProject, getBackendLanguage, getConnectorDefinition, getFullConfig } from "../../core/config";
+import { ensureSwallowKitProject, getBackendLanguage, getConnectorDefinition, getValidatedFullConfig } from "../../core/config";
 import { AuthProvider, BackendLanguage, CustomJwtConfig, RdbConnectorConfig } from "../../types";
 import {
   generateAuthModels,
@@ -22,12 +22,213 @@ import {
   generateLoginPage,
   generateAuthContext,
   generateBFFCallFunctionWithAuth,
+  generateBFFCallFunctionWithSwaAuth,
+  generateBFFCallFunctionWithMultipleAuth,
+  generateSwaAuthHelperTS,
+  generateSwaAuthHelperCSharp,
+  generateSwaAuthHelperPython,
+  generateExternalTokenAdapter,
+  generateAuthenticatedFetch,
+  generateExternalTokenBFFMeRoute,
+  generateExternalTokenAuthContext,
+  generateExternalTokenVerifierTS,
+  generateExternalTokenHelperTS,
+  generateExternalAuthMeTS,
+  generateExternalTokenVerifierCSharp,
+  generateExternalTokenHelperCSharp,
+  generateExternalAuthMeCSharp,
+  generateExternalTokenVerifierPython,
+  generateExternalTokenHelperPython,
+  generateExternalAuthMePython,
+  generateNamedExternalTokenVerifierCSharp,
+  generateNamedExternalTokenVerifierPython,
 } from "../../core/scaffold/auth-generator";
 import { syncProjectManifest } from "../../core/project/manifest";
 import { buildSharedTsConfig } from "./init";
 
 interface AddAuthOptions {
   provider?: string;
+  scheme?: string;
+}
+
+function writeIfMissing(filePath: string, content: string): void {
+  if (fs.existsSync(filePath)) return;
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content, "utf-8");
+}
+
+function defaultCustomJwtConfig(): CustomJwtConfig {
+  return {
+    userConnector: "mysql",
+    userTable: "users",
+    loginIdColumn: "login_id",
+    passwordHashColumn: "password_hash",
+    rolesColumn: "roles",
+    jwtSecretEnv: "JWT_SECRET",
+    tokenExpiry: "24h",
+  };
+}
+
+function setupSwaAuth(cwd: string, backendLanguage: BackendLanguage): void {
+  const helperPath = backendLanguage === "typescript"
+    ? path.join(cwd, "functions", "src", "auth", "jwt-helper.ts")
+    : backendLanguage === "csharp"
+      ? path.join(cwd, "functions", "Auth", "JwtHelper.cs")
+      : path.join(cwd, "functions", "auth", "jwt_helper.py");
+  fs.mkdirSync(path.dirname(helperPath), { recursive: true });
+  const helper = backendLanguage === "typescript"
+    ? generateSwaAuthHelperTS()
+    : backendLanguage === "csharp"
+      ? generateSwaAuthHelperCSharp()
+      : generateSwaAuthHelperPython();
+  fs.writeFileSync(helperPath, helper, "utf-8");
+
+  const callFnPath = path.join(cwd, "lib", "api", "call-function.ts");
+  fs.mkdirSync(path.dirname(callFnPath), { recursive: true });
+  fs.writeFileSync(callFnPath, generateBFFCallFunctionWithSwaAuth(), "utf-8");
+
+  const authDir = path.join(cwd, "lib", "auth");
+  fs.mkdirSync(authDir, { recursive: true });
+  fs.writeFileSync(path.join(authDir, "auth-context.tsx"), generateSwaAuthContext(), "utf-8");
+  updateRootLayoutWithAuthProvider(cwd);
+  const loginDir = path.join(cwd, "app", "login");
+  fs.mkdirSync(loginDir, { recursive: true });
+  fs.writeFileSync(path.join(loginDir, "page.tsx"), generateSwaLoginPage(), "utf-8");
+  updateSwaRouteConfig(cwd);
+}
+
+function setupExternalTokenAuth(cwd: string, backendLanguage: BackendLanguage): void {
+  const authDir = path.join(cwd, "lib", "auth");
+  fs.mkdirSync(authDir, { recursive: true });
+  writeIfMissing(path.join(authDir, "external-token-adapter.ts"), generateExternalTokenAdapter());
+  fs.writeFileSync(path.join(authDir, "authenticated-fetch.ts"), generateAuthenticatedFetch(), "utf-8");
+  fs.writeFileSync(path.join(authDir, "auth-context.tsx"), generateExternalTokenAuthContext(), "utf-8");
+  fs.writeFileSync(path.join(cwd, "lib", "api", "call-function.ts"), generateBFFCallFunctionWithAuth(), "utf-8");
+  const meDir = path.join(cwd, "app", "api", "auth", "me");
+  fs.mkdirSync(meDir, { recursive: true });
+  fs.writeFileSync(path.join(meDir, "route.ts"), generateExternalTokenBFFMeRoute(), "utf-8");
+  updateRootLayoutWithAuthProvider(cwd);
+
+  if (backendLanguage === "typescript") {
+    const verifier = path.join(cwd, "functions", "src", "auth", "external-token-verifier.ts");
+    writeIfMissing(verifier, generateExternalTokenVerifierTS());
+    fs.writeFileSync(path.join(cwd, "functions", "src", "auth", "jwt-helper.ts"), generateExternalTokenHelperTS(), "utf-8");
+    fs.writeFileSync(path.join(cwd, "functions", "src", "auth-me.ts"), generateExternalAuthMeTS(), "utf-8");
+  } else if (backendLanguage === "csharp") {
+    const verifier = path.join(cwd, "functions", "Auth", "ExternalTokenVerifier.cs");
+    writeIfMissing(verifier, generateExternalTokenVerifierCSharp());
+    fs.writeFileSync(path.join(cwd, "functions", "Auth", "JwtHelper.cs"), generateExternalTokenHelperCSharp(), "utf-8");
+    fs.writeFileSync(path.join(cwd, "functions", "Auth", "ExternalAuthMe.cs"), generateExternalAuthMeCSharp(), "utf-8");
+  } else {
+    const verifier = path.join(cwd, "functions", "auth", "external_token_verifier.py");
+    writeIfMissing(verifier, generateExternalTokenVerifierPython());
+    fs.writeFileSync(path.join(cwd, "functions", "auth", "jwt_helper.py"), generateExternalTokenHelperPython(), "utf-8");
+    const authMePath = path.join(cwd, "functions", "blueprints", "auth_me.py");
+    fs.mkdirSync(path.dirname(authMePath), { recursive: true });
+    fs.writeFileSync(authMePath, generateExternalAuthMePython(), "utf-8");
+    updatePythonAuthMeRegistration(cwd);
+  }
+}
+
+function updatePythonAuthMeRegistration(cwd: string): void {
+  const appPath = path.join(cwd, "functions", "function_app.py");
+  if (!fs.existsSync(appPath)) return;
+  const importLine = "from blueprints.auth_me import bp as external_auth_me_bp";
+  const registerLine = "app.register_blueprint(external_auth_me_bp)";
+  let content = fs.readFileSync(appPath, "utf-8");
+  if (content.includes(importLine)) return;
+  const marker = "# SwallowKit scaffold registrations";
+  content = content.includes(marker)
+    ? content.replace(marker, `${importLine}\n${registerLine}\n${marker}`)
+    : `${content.trimEnd()}\n${importLine}\n${registerLine}\n`;
+  fs.writeFileSync(appPath, content, "utf-8");
+}
+
+function generateSwaLoginPage(): string {
+  return `'use client';
+export default function LoginPage() {
+  return <main><h1>Sign in</h1><a href="/.auth/login/aad?post_login_redirect_uri=/">Sign in with Microsoft</a></main>;
+}
+`;
+}
+
+export function generateSwaAuthContext(): string {
+  return `'use client';
+import { createContext, useContext, useEffect, useState, type ReactNode } from 'react';
+
+export interface AuthUser { id: string; loginId: string; name: string; email: string; roles: string[]; }
+interface AuthContextValue { user: AuthUser | null; loading: boolean; login: () => void; logout: () => void; hasRole: (role: string) => boolean; hasAnyRole: (roles: string[]) => boolean; }
+const AuthContext = createContext<AuthContextValue | null>(null);
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [user, setUser] = useState<AuthUser | null>(null);
+  const [loading, setLoading] = useState(true);
+  useEffect(() => {
+    fetch('/.auth/me')
+      .then(async response => {
+        if (!response.ok) throw new Error('SWA authentication is unavailable');
+        const body: unknown = await response.json();
+        if (!body || typeof body !== 'object' || !('clientPrincipal' in body)) return null;
+        const principal = body.clientPrincipal;
+        if (!principal || typeof principal !== 'object') return null;
+        const value = principal as Record<string, unknown>;
+        if (typeof value.userId !== 'string') return null;
+        return {
+          id: value.userId,
+          loginId: typeof value.userDetails === 'string' ? value.userDetails : '',
+          name: typeof value.userDetails === 'string' ? value.userDetails : '',
+          email: typeof value.userDetails === 'string' ? value.userDetails : '',
+          roles: Array.isArray(value.userRoles) ? value.userRoles.filter((role): role is string => typeof role === 'string') : [],
+        } satisfies AuthUser;
+      })
+      .then(setUser)
+      .catch(() => setUser(null))
+      .finally(() => setLoading(false));
+  }, []);
+  const login = () => { window.location.href = '/.auth/login/aad?post_login_redirect_uri=/'; };
+  const logout = () => { window.location.href = '/.auth/logout?post_logout_redirect_uri=/'; };
+  const hasRole = (role: string) => user?.roles.includes(role) ?? false;
+  return <AuthContext.Provider value={{ user, loading, login, logout, hasRole, hasAnyRole: roles => roles.some(hasRole) }}>{children}</AuthContext.Provider>;
+}
+export function useAuth() { const value = useContext(AuthContext); if (!value) throw new Error('useAuth must be used within an AuthProvider'); return value; }
+`;
+}
+
+export function addAuthProviderToRootLayout(layout: string): string {
+  let updated = layout;
+  if (!/import\s*\{[^}]*\bAuthProvider\b[^}]*\}\s*from\s*['"]@\/lib\/auth\/auth-context['"]/.test(updated)) {
+    const directive = updated.match(/^(?:\s*['"]use (?:client|server)['"];?\s*\r?\n)/)?.[0] ?? "";
+    updated = `${directive}import { AuthProvider } from '@/lib/auth/auth-context';\n${updated.slice(directive.length)}`;
+  }
+  if (!/<AuthProvider(?:\s|>)/.test(updated)) {
+    const childrenIndex = updated.lastIndexOf("{children}");
+    if (childrenIndex === -1) {
+      throw new Error("Could not find {children} in app/layout.tsx");
+    }
+    updated = `${updated.slice(0, childrenIndex)}<AuthProvider>{children}</AuthProvider>${updated.slice(childrenIndex + "{children}".length)}`;
+  }
+  return updated;
+}
+
+function updateRootLayoutWithAuthProvider(cwd: string): void {
+  const layoutPath = path.join(cwd, "app", "layout.tsx");
+  if (!fs.existsSync(layoutPath)) {
+    throw new Error("app/layout.tsx was not found; cannot install AuthProvider");
+  }
+  const layout = fs.readFileSync(layoutPath, "utf-8");
+  const updated = addAuthProviderToRootLayout(layout);
+  if (updated !== layout) fs.writeFileSync(layoutPath, updated, "utf-8");
+}
+
+function updateSwaRouteConfig(cwd: string): void {
+  const configPath = path.join(cwd, "staticwebapp.config.json");
+  const config = fs.existsSync(configPath) ? JSON.parse(fs.readFileSync(configPath, "utf-8")) : {};
+  config.routes = Array.isArray(config.routes)
+    ? config.routes.filter((route: { route?: string }) => route.route !== "/api/*")
+    : [];
+  config.routes.unshift({ route: "/api/*", allowedRoles: ["authenticated"] });
+  config.responseOverrides = { ...(config.responseOverrides || {}), "401": { statusCode: 302, redirect: "/.auth/login/aad?post_login_redirect_uri=.referrer" } };
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
 }
 
 export async function addAuthCommand(options: AddAuthOptions) {
@@ -36,15 +237,49 @@ export async function addAuthCommand(options: AddAuthOptions) {
   console.log(" SwallowKit Add-Auth: Setting up authentication...\n");
 
   const provider = (options.provider || "custom-jwt") as AuthProvider;
-  if (!["custom-jwt", "swa", "swa-custom", "none"].includes(provider)) {
-    console.error(` Unknown provider: ${provider}. Use: custom-jwt | swa | swa-custom | none`);
+  if (!["custom-jwt", "swa", "external-token", "swa-custom", "none"].includes(provider)) {
+    console.error(` Unknown provider: ${provider}. Use: custom-jwt | swa | external-token | swa-custom | none`);
     process.exit(1);
   }
 
   const backendLanguage = getBackendLanguage();
-  const config = getFullConfig();
+  const config = getValidatedFullConfig();
   const cwd = process.cwd();
 
+  if (options.scheme) {
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(options.scheme)) throw new Error("--scheme must start with a letter and contain only letters, digits, '_' or '-'");
+    if (provider === "none" || provider === "swa-custom") throw new Error(`Provider '${provider}' cannot be added as a named scheme`);
+    addNamedScheme(cwd, options.scheme, provider, backendLanguage);
+    await syncProjectManifest();
+    console.log(`\n Named authentication scheme '${options.scheme}' added.`);
+    return;
+  }
+
+  if (provider === "swa-custom") {
+    throw new Error("The swa-custom provider is not implemented. Use --provider swa or --provider custom-jwt.");
+  }
+  if (provider === "none") {
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig());
+    await syncProjectManifest();
+    console.log(" Authentication disabled in swallowkit.config.js");
+    return;
+  }
+  if (provider === "swa") {
+    setupSwaAuth(cwd, backendLanguage);
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig());
+    await syncProjectManifest();
+    console.log("\n SWA built-in authentication setup complete!");
+    return;
+  }
+  if (provider === "external-token") {
+    setupExternalTokenAuth(cwd, backendLanguage);
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig());
+    await syncProjectManifest();
+    console.log("\n External token authentication setup complete!");
+    console.log(" Implement the generated frontend adapter and backend verifier before use.");
+    return;
+  }
+
   // Read project name from package.json
   const pkgPath = path.join(cwd, "package.json");
   const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
@@ -59,15 +294,9 @@ export async function addAuthCommand(options: AddAuthOptions) {
   }
 
   // Default custom-jwt config
-  const customJwtConfig: CustomJwtConfig = config.auth?.customJwt || {
-    userConnector: "mysql",
-    userTable: "users",
-    loginIdColumn: "login_id",
-    passwordHashColumn: "password_hash",
-    rolesColumn: "roles",
-    jwtSecretEnv: "JWT_SECRET",
-    tokenExpiry: "24h",
-  };
+  const customJwtConfig: CustomJwtConfig = config.auth?.customJwt || defaultCustomJwtConfig();
+
+  // custom-jwt setup continues below.
 
   // 1. Generate shared/models/auth.ts
   console.log(" Generating auth models...");
@@ -148,6 +377,103 @@ export async function addAuthCommand(options: AddAuthOptions) {
   console.log(`  5. Run scaffold to regenerate functions with auth guards`);
 }
 
+function findObjectEnd(content: string, open: number): number {
+  let depth = 0, quote = "";
+  for (let i = open; i < content.length; i++) {
+    const ch = content[i];
+    if (quote) { if (ch === quote && content[i - 1] !== "\\") quote = ""; continue; }
+    if (ch === "'" || ch === '"' || ch === "`") { quote = ch; continue; }
+    if (ch === "{") depth++;
+    if (ch === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
+
+function updateConfigWithNamedScheme(cwd: string, scheme: string, provider: AuthProvider): void {
+  const jsPath = path.join(cwd, "swallowkit.config.js");
+  const jsonPath = path.join(cwd, "swallowkit.config.json");
+  const configPath = fs.existsSync(jsPath) ? jsPath : jsonPath;
+  if (!fs.existsSync(configPath)) throw new Error("swallowkit.config.js or swallowkit.config.json is required");
+  if (configPath.endsWith(".json")) {
+    const value = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    value.auth ??= {};
+    value.auth.schemes ??= {};
+    if (value.auth.schemes[scheme]) throw new Error(`auth.schemes.${scheme} already exists; no files were changed`);
+    value.auth.schemes[scheme] = provider === "custom-jwt" ? { provider, customJwt: defaultCustomJwtConfig() } : { provider };
+    value.auth.authorization ??= { defaultPolicy: "anonymous", policies: {} };
+    fs.writeFileSync(configPath, JSON.stringify(value, null, 2) + "\n", "utf-8");
+    return;
+  }
+  let content = fs.readFileSync(configPath, "utf-8");
+  const authMatch = /\bauth\s*:\s*\{/.exec(content);
+  const customJwt = defaultCustomJwtConfig();
+  const entry = provider === "custom-jwt"
+    ? `\n      ${scheme}: { provider: 'custom-jwt', customJwt: ${JSON.stringify(customJwt)} },`
+    : `\n      ${scheme}: { provider: '${provider}' },`;
+  if (!authMatch) {
+    const rootEnd = content.lastIndexOf("}");
+    const beforeRootEnd = content.slice(0, rootEnd).trimEnd();
+    const separator = beforeRootEnd.endsWith(",") || beforeRootEnd.endsWith("{") ? "" : ",";
+    content = `${beforeRootEnd}${separator}\n  auth: {\n    schemes: {${entry}\n    },\n    authorization: { defaultPolicy: 'anonymous', policies: {} },\n  },\n${content.slice(rootEnd)}`;
+  } else {
+    const authOpen = content.indexOf("{", authMatch.index);
+    const authEnd = findObjectEnd(content, authOpen);
+    const authBody = content.slice(authOpen + 1, authEnd);
+    const schemesMatch = /\bschemes\s*:\s*\{/.exec(authBody);
+    if (schemesMatch) {
+      const schemesOpen = authOpen + 1 + authBody.indexOf("{", schemesMatch.index);
+      const schemesEnd = findObjectEnd(content, schemesOpen);
+      const existing = content.slice(schemesOpen + 1, schemesEnd);
+      if (new RegExp(`(^|[,\\s])${scheme}\\s*:`).test(existing)) throw new Error(`auth.schemes.${scheme} already exists; no files were changed`);
+      content = content.slice(0, schemesEnd) + entry + "\n    " + content.slice(schemesEnd);
+    } else {
+      content = content.slice(0, authOpen + 1) + `\n    schemes: {${entry}\n    },` + content.slice(authOpen + 1);
+    }
+  }
+  fs.writeFileSync(configPath, content, "utf-8");
+}
+
+function addNamedScheme(cwd: string, scheme: string, provider: AuthProvider, language: BackendLanguage): void {
+  // Validate/update config before creating files, so duplicate names stop safely.
+  updateConfigWithNamedScheme(cwd, scheme, provider);
+  const slug = scheme.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+  if (language === "typescript") {
+    const dir = path.join(cwd, "functions", "src", "auth", "schemes", slug);
+    if (provider === "external-token") writeIfMissing(path.join(dir, "verifier.ts"), generateExternalTokenVerifierTS());
+    else if (provider === "swa") writeIfMissing(path.join(dir, "adapter.ts"), generateSwaAuthHelperTS());
+    else writeIfMissing(path.join(dir, "jwt-helper.ts"), generateJwtHelperTS());
+  } else if (language === "csharp") {
+    const dir = path.join(cwd, "functions", "Auth", "Schemes", slug);
+    if (provider === "external-token") writeIfMissing(path.join(dir, "ExternalTokenVerifier.cs"), generateNamedExternalTokenVerifierCSharp(scheme));
+    else if (provider === "swa") writeIfMissing(path.join(dir, "SwaAdapter.cs"), generateSwaAuthHelperCSharp());
+    else writeIfMissing(path.join(dir, "JwtHelper.cs"), generateJwtHelperCSharp());
+  } else {
+    const dir = path.join(cwd, "functions", "auth", "schemes", slug.replace(/-/g, "_"));
+    if (provider === "external-token") writeIfMissing(path.join(dir, "verifier.py"), generateNamedExternalTokenVerifierPython(scheme));
+    else if (provider === "swa") writeIfMissing(path.join(dir, "adapter.py"), generateSwaAuthHelperPython());
+    else writeIfMissing(path.join(dir, "jwt_helper.py"), generateJwtHelperPython());
+  }
+  const clientDir = path.join(cwd, "lib", "auth", "schemes", slug);
+  if (provider === "external-token") {
+    writeIfMissing(path.join(clientDir, "token-adapter.ts"), generateExternalTokenAdapter());
+    writeIfMissing(path.join(clientDir, "authenticated-fetch.ts"), generateAuthenticatedFetch().replace("'./external-token-adapter'", "'./token-adapter'"));
+    writeIfMissing(path.join(clientDir, "auth-context.tsx"), generateExternalTokenAuthContext().replace(/external-token-adapter/g, "token-adapter"));
+  } else if (provider === "swa") {
+    writeIfMissing(path.join(clientDir, "auth-context.tsx"), generateSwaAuthContext());
+  } else if (provider === "custom-jwt") {
+    writeIfMissing(path.join(clientDir, "auth-context.tsx"), generateAuthContext());
+  }
+  const callFunctionPath = path.join(cwd, "lib", "api", "call-function.ts");
+  if (!fs.existsSync(callFunctionPath)) writeIfMissing(callFunctionPath, generateBFFCallFunctionWithMultipleAuth());
+  else {
+    const current = fs.readFileSync(callFunctionPath, "utf-8");
+    if (!current.includes("x-ms-client-principal") || !current.includes("fetchHeaders['Authorization']")) {
+      if (current.includes("SwallowKit BFF Call Function Helper")) fs.writeFileSync(callFunctionPath, generateBFFCallFunctionWithMultipleAuth(), "utf-8");
+      else console.warn(" Existing customized lib/api/call-function.ts was preserved. Ensure it forwards Bearer and SWA credentials without logging them.");
+    }
+  }
+}
+
 /**
  * Ensure the shared package has proper build infrastructure
  * (tsconfig.json, build script, typescript devDependency).
@@ -359,10 +685,7 @@ function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: Custo
   const beforeClosing = content.substring(0, closingBraceIdx).trimEnd();
   const needsComma = !beforeClosing.endsWith(",") && !beforeClosing.endsWith("{");
 
-  const authBlock = `${needsComma ? "," : ""}
-  // 認証認可設定
-  auth: {
-    provider: '${provider}',
+  const providerSettings = provider === "custom-jwt" ? `
     customJwt: {
       userConnector: '${config.userConnector}',
       userTable: '${config.userTable}',
@@ -371,7 +694,17 @@ function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: Custo
       rolesColumn: '${config.rolesColumn}',
       jwtSecretEnv: '${config.jwtSecretEnv || "JWT_SECRET"}',
       tokenExpiry: '${config.tokenExpiry || "24h"}',
-    },
+    },` : provider === "swa" ? `
+    swa: {
+      allowedProviders: ['aad'],
+      roleSource: 'swa-roles',
+    },` : "";
+
+  const authBlock = `${needsComma ? "," : ""}
+  // 認証認可設定
+  auth: {
+    provider: '${provider}',
+${providerSettings}
     authorization: {
       defaultPolicy: 'authenticated',
     },

package/src/cli/commands/dev.ts

@@ -7,7 +7,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as net from 'net';
 import { CosmosClient, PartitionKeyKind } from '@azure/cosmos';
-import { ensureSwallowKitProject, getBackendLanguage, getAuthConfig } from '../../core/config';
+import { ensureSwallowKitProject, getBackendLanguage, getAuthConfig, normalizeAuthConfig } from '../../core/config';
 import { ModelInfo } from '../../core/scaffold/model-parser';
 import {
   applyDevSeedEnvironment,
@@ -38,10 +38,13 @@ export interface DevOptions {
   noFunctions?: boolean;
   seedEnv?: string;
   mockConnectors?: boolean;
+  swaPort?: string;
+  noSwa?: boolean;
 }
 
 type ParsedDevActionOptions = DevOptions & {
   functions?: boolean;
+  swa?: boolean;
 };
 
 interface FunctionsCoreToolsCommand {
@@ -57,6 +60,7 @@ function normalizeParsedDevOptions(options: ParsedDevActionOptions): DevOptions
   return {
     ...options,
     noFunctions: options.noFunctions ?? options.functions === false,
+    noSwa: options.noSwa ?? options.swa === false,
   };
 }
 
@@ -121,6 +125,23 @@ export function buildFunctionsBaseUrl(host: string | undefined, functionsPort: s
   return `http://${host || 'localhost'}:${functionsPort}`;
 }
 
+export function buildSwaStartArgs(host: string | undefined, nextPort: string, swaPort: string): string[] {
+  return [
+    'start',
+    `http://${host || 'localhost'}:${nextPort}`,
+    '--swa-config-location',
+    '.',
+    '--port',
+    swaPort,
+  ];
+}
+
+export function getSwaCliInstallCommand(pm: string): string {
+  return pm === 'pnpm'
+    ? 'pnpm add -Dw @azure/static-web-apps-cli'
+    : 'npm install -D @azure/static-web-apps-cli';
+}
+
 export function getFunctionsReadinessTimeoutMs(backendLanguage: BackendLanguage): number {
   return backendLanguage === 'csharp' ? 90_000 : 30_000;
 }
@@ -506,6 +527,8 @@ export function buildDevCommand(
     .option('--no-functions', 'Skip Azure Functions startup')
     .option('--seed-env <environment>', 'Replace Cosmos DB Emulator data from dev-seeds/<environment> before startup')
     .option('--mock-connectors', 'Start mock server for connector models (serves Zod-generated data)', false)
+    .option('--swa-port <port>', 'SWA authentication emulator port', '4280')
+    .option('--no-swa', 'Skip the SWA authentication emulator')
     .action(async (options: ParsedDevActionOptions) => {
       const normalizedOptions = normalizeParsedDevOptions(options);
 
@@ -618,11 +641,25 @@ async function initializeCosmosDB(databaseName: string): Promise<CosmosInitializ
 async function startDevEnvironment(options: DevOptions) {
   const port = options.port || '3000';
   const functionsPort = options.functionsPort || '7071';
+  const swaPort = options.swaPort || '4280';
   
   // Detect package manager from project lockfile
   const pm = detectFromProject();
   const pmCmd = getCommands(pm);
   const backendLanguage = getBackendLanguage();
+  const authConfig = getAuthConfig();
+  const normalizedAuth = normalizeAuthConfig(authConfig);
+  const useSwaEmulator = Boolean(normalizedAuth && Object.values(normalizedAuth.schemes).some(scheme => scheme.provider === 'swa')) && !options.noSwa;
+  const swaCommand = useSwaEmulator ? await resolveSwaCliCommand(process.cwd()) : null;
+
+  if (useSwaEmulator && !swaCommand) {
+    const installCommand = getSwaCliInstallCommand(pm);
+    console.error('❌ SWA authentication requires Azure Static Web Apps CLI for local development.');
+    console.error('   Install it in this project and retry:');
+    console.error(`\n   ${installCommand}\n`);
+    process.exitCode = 1;
+    return;
+  }
   
   // プロセスを管理する配列
   const processes: ChildProcess[] = [];
@@ -925,7 +962,6 @@ async function startDevEnvironment(options: DevOptions) {
       const connectorModels = allModels.filter((m) => m.connectorConfig);
 
       // Resolve auth config — auth functions use RDB connectors, mocked alongside other models
-      const authConfig = getAuthConfig();
       let mockAuthConfig: { jwtSecret: string; tokenExpiry?: string; customJwt?: { userTable: string; loginIdColumn: string; passwordHashColumn: string; rolesColumn: string }; defaultPolicy?: "authenticated" | "anonymous" } | undefined;
       if (authConfig?.provider === 'custom-jwt' && authConfig.customJwt) {
         // Read JWT_SECRET from functions/local.settings.json if available
@@ -946,7 +982,9 @@ async function startDevEnvironment(options: DevOptions) {
             passwordHashColumn: authConfig.customJwt.passwordHashColumn,
             rolesColumn: authConfig.customJwt.rolesColumn,
           },
-          defaultPolicy: authConfig.authorization?.defaultPolicy,
+          defaultPolicy: authConfig.authorization?.defaultPolicy === "public" ? "anonymous" :
+            authConfig.authorization?.defaultPolicy === "authenticated" || authConfig.authorization?.defaultPolicy === "anonymous"
+              ? authConfig.authorization.defaultPolicy : undefined,
         };
       }
 
@@ -985,18 +1023,6 @@ async function startDevEnvironment(options: DevOptions) {
     // 5. Start Next.js development server
     const nextArgs = buildNextDevArgs(pm, port);
     
-    if (options.open) {
-      // Next.js 14+ deprecated --open option, so we open browser manually
-      setTimeout(() => {
-        const url = `http://${options.host || 'localhost'}:${port}`;
-        console.log(`\n🌐 Opening browser: ${url}`);
-        
-        const start = process.platform === 'darwin' ? 'open' :
-                      process.platform === 'win32' ? 'start' : 'xdg-open';
-        spawn(start, [url], { shell: true });
-      }, 3000);
-    }
-
     // Ensure .env.local points to bffTargetPort so Next.js reads the correct backend URL.
     // When --mock-connectors is active, bffTargetPort = mock port (7072); otherwise = Functions port (7071).
     // Next.js may load .env.local values that override spawn env vars, so we must keep them in sync.
@@ -1063,10 +1089,52 @@ async function startDevEnvironment(options: DevOptions) {
       }
     }
 
+    let swaReady = false;
+    if (useSwaEmulator && swaCommand) {
+      const nextUrl = `http://${options.host || 'localhost'}:${port}`;
+      console.log(`⏳ Waiting for Next.js before starting the SWA emulator at ${nextUrl}...`);
+      const nextReady = await waitForHttpServerReady(nextUrl);
+      if (!nextReady) {
+        throw new Error(`Next.js did not become ready at ${nextUrl}`);
+      }
+
+      console.log(`🔐 Starting SWA authentication emulator (port: ${swaPort})...`);
+      const swaProcess = spawn(swaCommand, buildSwaStartArgs(options.host, port, swaPort), {
+        cwd: process.cwd(),
+        shell: true,
+        stdio: 'inherit',
+        env: process.env,
+      });
+      processes.push(swaProcess);
+      swaProcess.on('error', (error) => {
+        console.error('❌ SWA CLI startup error:', error.message);
+      });
+
+      const swaUrl = `http://${options.host || 'localhost'}:${swaPort}`;
+      swaReady = await waitForHttpServerReady(swaUrl);
+      if (!swaReady) {
+        throw new Error(`SWA authentication emulator did not become ready at ${swaUrl}`);
+      }
+    }
+
     console.log('');
     console.log('✅ SwallowKit development environment is running!');
     console.log('');
-    console.log(`📱 Next.js: http://${options.host || 'localhost'}:${port}`);
+    if (useSwaEmulator) {
+      const swaUrl = `http://${options.host || 'localhost'}:${swaPort}`;
+      console.log('🔐 SWA authenticated app:');
+      console.log(`   ${swaUrl}`);
+      console.log('');
+      console.log('🔑 Local sign-in:');
+      console.log(`   ${swaUrl}/.auth/login/aad`);
+      console.log('   Enter any username and select Login.');
+      console.log('   The "authenticated" role is added automatically.');
+      console.log('');
+      console.log('📱 Next.js direct access (authentication is not emulated):');
+      console.log(`   http://${options.host || 'localhost'}:${port}`);
+    } else {
+      console.log(`📱 Next.js: http://${options.host || 'localhost'}:${port}`);
+    }
     if (hasFunctions && !options.noFunctions) {
       console.log(`${functionsReady ? '⚡ Azure Functions' : '⏳ Azure Functions (starting)'}: ${functionsBaseUrl}`);
     }
@@ -1082,7 +1150,22 @@ async function startDevEnvironment(options: DevOptions) {
     if (mockServer) {
       console.log('💡 Connector models served from mock server (Zod-generated data)');
     }
+    if (swaReady) {
+      console.log('💡 Open the app through the SWA port when testing authenticated pages and CRUD APIs.');
+    }
     console.log('');
+
+    if (options.open) {
+      const url = useSwaEmulator
+        ? `http://${options.host || 'localhost'}:${swaPort}`
+        : `http://${options.host || 'localhost'}:${port}`;
+      console.log(`🌐 Opening browser: ${url}`);
+      const start = process.platform === 'darwin' ? 'open' :
+                    process.platform === 'win32' ? 'start' : 'xdg-open';
+      spawn(start, [url], { shell: true });
+      console.log('');
+    }
+
     console.log('🛑 Press Ctrl+C to stop');
     console.log('');
 
@@ -1097,6 +1180,23 @@ async function startDevEnvironment(options: DevOptions) {
   }
 }
 
+async function resolveSwaCliCommand(projectRoot: string): Promise<string | null> {
+  const binaryName = process.platform === 'win32' ? 'swa.cmd' : 'swa';
+  const localCommand = path.join(projectRoot, 'node_modules', '.bin', binaryName);
+  if (fs.existsSync(localCommand) && await checkCommand(localCommand, ['--version'], {
+    cwd: projectRoot,
+    shell: process.platform === 'win32',
+  })) {
+    return localCommand;
+  }
+
+  if (await checkCommand('swa', ['--version'], { cwd: projectRoot })) {
+    return 'swa';
+  }
+
+  return null;
+}
+
 async function runCommand(
   command: string,
   args: string[],