swallowkit 1.0.0-beta.47 → 1.0.0-beta.48

package/src/core/config.ts

@@ -1,7 +1,7 @@
 import * as fs from "fs";
 import { createRequire } from "module";
 import * as path from "path";
-import { AuthConfig, BackendLanguage, ConnectorDefinition, SwallowKitConfig } from "../types";
+import { AuthConfig, AuthProvider, BackendLanguage, ConnectorDefinition, NormalizedAuthConfig, SwallowKitConfig } from "../types";
 import { detectFromProject, getCommands } from "../utils/package-manager";
 
 const requireFromHere = createRequire(__filename);
@@ -37,7 +37,7 @@ const DEFAULT_CONFIG: SwallowKitConfig = {
 /**
  * 設定ファイルを読み込み
  */
-export function loadConfig(configPath?: string): SwallowKitConfig {
+export function loadConfig(configPath?: string, throwOnError = false): SwallowKitConfig {
   const defaultPaths = [
     "swallowkit.config.json",
     "swallowkit.config.js",
@@ -63,6 +63,7 @@ export function loadConfig(configPath?: string): SwallowKitConfig {
           return mergeConfig(DEFAULT_CONFIG, unwrapConfigModule(loadedConfig));
         }
       } catch (error) {
+        if (throwOnError) throw error;
         console.warn(`⚠️ 設定ファイルの読み込みに失敗: ${filePath}`, error);
       }
     }
@@ -200,6 +201,40 @@ export function getAuthConfig(configPath?: string): AuthConfig | undefined {
   return config.auth;
 }
 
+/** Load configuration for mutating/generation commands and fail instead of silently falling back. */
+export function getValidatedFullConfig(configPath?: string): SwallowKitConfig {
+  const config = mergeConfig(loadConfig(configPath, true), loadConfigFromEnv());
+  const validation = validateConfig(config);
+  if (!validation.valid) throw new Error(`Invalid SwallowKit configuration:\n${validation.errors.map(error => `- ${error}`).join("\n")}`);
+  return config;
+}
+
+const VALID_AUTH_PROVIDERS: AuthProvider[] = ["custom-jwt", "swa", "external-token", "swa-custom", "none"];
+const AUTH_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/;
+
+/** Convert the legacy single-provider shape to the canonical named-scheme shape. */
+export function normalizeAuthConfig(auth?: AuthConfig): NormalizedAuthConfig | undefined {
+  if (!auth) return undefined;
+  const schemes = { ...(auth.schemes ?? {}) };
+  if (auth.provider && auth.provider !== "none" && !schemes.default) {
+    schemes.default = { provider: auth.provider, customJwt: auth.customJwt, swa: auth.swa };
+  }
+  const rawDefault = auth.authorization?.defaultPolicy ?? (Object.keys(schemes).length ? "authenticated" : "anonymous");
+  return {
+    ...auth,
+    schemes,
+    authorization: {
+      ...auth.authorization,
+      defaultPolicy: rawDefault === "public" ? "anonymous" : rawDefault,
+      policies: { ...(auth.authorization?.policies ?? {}) },
+    },
+  };
+}
+
+export function getNormalizedAuthConfig(configPath?: string): NormalizedAuthConfig | undefined {
+  return normalizeAuthConfig(getAuthConfig(configPath));
+}
+
 /**
  * 設定の検証
  */
@@ -214,6 +249,38 @@ function hasConfiguredDatabase(config: SwallowKitConfig): boolean {
 export function validateConfig(config: SwallowKitConfig): { valid: boolean; errors: string[] } {
   const errors: string[] = [];
 
+  const auth = normalizeAuthConfig(config.auth);
+  if (auth) {
+    for (const [name, scheme] of Object.entries(auth.schemes)) {
+      const base = `auth.schemes.${name}`;
+      if (!AUTH_NAME.test(name)) errors.push(`${base}: scheme name must match ${AUTH_NAME}; rename the scheme`);
+      if (!VALID_AUTH_PROVIDERS.includes(scheme.provider)) errors.push(`${base}.provider: unsupported provider '${scheme.provider}'; use ${VALID_AUTH_PROVIDERS.join(", ")}`);
+      if (scheme.provider === "none" || scheme.provider === "swa-custom") errors.push(`${base}.provider: '${scheme.provider}' cannot be used as a named scheme; use swa, external-token, or custom-jwt`);
+      if (scheme.provider === "custom-jwt") {
+        const jwt = scheme.customJwt ?? (name === "default" ? auth.customJwt : undefined);
+        for (const key of ["userConnector", "userTable", "loginIdColumn", "passwordHashColumn", "rolesColumn"] as const) {
+          if (!jwt?.[key]) errors.push(`${base}.customJwt.${key}: required for custom-jwt; configure this value`);
+        }
+      }
+    }
+    for (const [name, policy] of Object.entries(auth.authorization.policies)) {
+      const base = `auth.authorization.policies.${name}`;
+      if (!AUTH_NAME.test(name)) errors.push(`${base}: policy name must match ${AUTH_NAME}; rename the policy`);
+      if (!Array.isArray(policy.schemes) || policy.schemes.length === 0) errors.push(`${base}.schemes: provide at least one named scheme`);
+      for (const scheme of policy.schemes ?? []) if (!auth.schemes[scheme]) errors.push(`${base}.schemes: undefined scheme '${scheme}'; define auth.schemes.${scheme}`);
+      const sources = new Map<string, string>();
+      for (const schemeName of policy.schemes ?? []) {
+        const provider = auth.schemes[schemeName]?.provider;
+        const source = provider === "swa" ? "x-ms-client-principal" : provider === "custom-jwt" || provider === "external-token" ? "authorization-bearer" : provider;
+        if (source && sources.has(source)) errors.push(`${base}.schemes: '${sources.get(source)}' and '${schemeName}' both use ${source}; split the policy so credential selection is deterministic`);
+        else if (source) sources.set(source, schemeName);
+      }
+    }
+    const defaultPolicy = auth.authorization.defaultPolicy;
+    if (defaultPolicy === "authenticated" && !auth.schemes.default && Object.keys(auth.schemes).length !== 1) errors.push("auth.authorization.defaultPolicy: 'authenticated' requires auth.schemes.default (or exactly one scheme); set a default scheme or use a named policy");
+    else if (!["anonymous", "authenticated"].includes(defaultPolicy) && !auth.authorization.policies[defaultPolicy]) errors.push(`auth.authorization.defaultPolicy: undefined policy '${defaultPolicy}'; define auth.authorization.policies.${defaultPolicy}`);
+  }
+
   // データベース設定の検証
   if (hasConfiguredDatabase(config) && !config.database?.connectionString) {
     errors.push("Cosmos DB connection string is required");

package/src/core/mock/connector-mock-server.ts

@@ -503,9 +503,9 @@ export class ConnectorMockServer {
     if (!policy) return undefined; // defaultPolicy: authenticated → 認証のみ、ロールチェック不要
 
     if (isWrite) {
-      return policy.write || policy.roles;
+      return Array.isArray(policy.write) ? policy.write : policy.roles;
     }
-    return policy.read || policy.roles;
+    return Array.isArray(policy.read) ? policy.read : policy.roles;
   }
 
   private readBody(req: http.IncomingMessage, callback: (body: MockDocument) => void) {

package/src/core/project/manifest.ts

@@ -1,6 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
-import { getBackendLanguage, getFullConfig, validateConfig } from "../config";
+import { getBackendLanguage, getFullConfig, normalizeAuthConfig, validateConfig } from "../config";
 import { getAllModels, toCamelCase, toKebabCase } from "../scaffold/model-parser";
 import { AuthConfig, BackendLanguage, ConnectorDefinition, ModelAuthPolicy, ModelConnectorConfig } from "../../types";
 import { captureConsoleMessages, withWorkingDirectory } from "../operations/runtime";
@@ -340,7 +340,7 @@ export async function buildProjectManifest(projectRoot: string = process.cwd()):
       connectors: Object.entries(config.connectors || {})
         .map(([name, definition]) => ({ name, definition }))
         .sort((left, right) => left.name.localeCompare(right.name)),
-      auth: config.auth || null,
+      auth: normalizeAuthConfig(config.auth) || null,
       entities: entities.sort((left, right) => left.name.localeCompare(right.name)),
       routes,
       modules: buildModules(projectRoot),
@@ -356,7 +356,7 @@ export async function buildProjectManifest(projectRoot: string = process.cwd()):
         ],
         hasSharedWorkspace: fs.existsSync(path.join(projectRoot, "shared", "package.json")),
         hasConnectors: Object.keys(config.connectors || {}).length > 0,
-        hasAuth: Boolean(config.auth && config.auth.provider !== "none"),
+        hasAuth: Boolean(config.auth && (config.auth.provider !== "none" || Object.keys(config.auth.schemes ?? {}).length > 0)),
       },
     };
 

package/src/core/project/validation.ts

@@ -209,6 +209,22 @@ export async function validateProject(projectRoot: string = process.cwd()): Prom
     });
   }
 
+  const namedPolicies = loaded.manifest.auth?.authorization?.policies ?? {};
+  for (const entity of loaded.manifest.entities) {
+    const policy = entity.authPolicy;
+    if (!policy) continue;
+    const references = [policy.policy, typeof policy.read === "string" ? policy.read : undefined, typeof policy.write === "string" ? policy.write : undefined].filter((value): value is string => Boolean(value));
+    for (const name of references) {
+      if (!namedPolicies[name]) pushViolation(violations, {
+        code: "undefined-auth-policy",
+        severity: "error",
+        message: `Model '${entity.name}' references undefined authorization policy '${name}'.`,
+        location: { path: entity.filePath, entity: entity.name },
+        suggestedFix: `Define auth.authorization.policies.${name} or update the model authPolicy reference.`,
+      });
+    }
+  }
+
   for (const entity of loaded.manifest.entities) {
     validateSchemaNaming(entity, violations);
   }

package/src/core/scaffold/auth-generator.ts

@@ -3,10 +3,212 @@
  * add-auth コマンドおよび scaffold ロールガード挿入で使用するテンプレート群
  */
 
-import { AuthProvider, CustomJwtConfig, ModelAuthPolicy, RdbConnectorConfig } from "../../types";
+import { AuthProvider, CustomJwtConfig, ModelAuthPolicy, NormalizedAuthConfig, RdbConnectorConfig } from "../../types";
 
 type RdbProvider = RdbConnectorConfig["provider"]; // "mysql" | "postgres" | "sqlserver"
 
+export function generateNamedAuthRouterTS(config: NormalizedAuthConfig): string {
+  const external = Object.entries(config.schemes).filter(([, s]) => s.provider === "external-token");
+  const custom = Object.entries(config.schemes).filter(([, s]) => s.provider === "custom-jwt");
+  const imports = external.map(([name]) => {
+    const slug = name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+    const id = safeIdentifier(name);
+    return `import { verifyExternalToken as verify_${id}, ExternalTokenVerificationError as Error_${id} } from './schemes/${slug}/verifier';`;
+  }).concat(custom.map(([name]) => {
+    const slug = name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+    return `import { requireAuth as verify_${safeIdentifier(name)} } from './schemes/${slug}/jwt-helper';`;
+  })).join("\n");
+  const verifiers = external.map(([name]) => { const id = safeIdentifier(name); return `${JSON.stringify(name)}: async (token: string) => { try { return await verify_${id}(token); } catch (e) { if (e instanceof Error_${id}) throw new AuthError(e.status, e.message); throw e; } }`; }).join(",\n  ");
+  return `import type { HttpRequest, HttpResponseInit } from '@azure/functions';
+${imports}
+export type AuthPrincipal = { subject: string; scheme: string; issuer: string; roles: string[]; claims: Record<string, unknown>; /** @deprecated */ userId?: string; /** @deprecated */ userDetails?: string };
+export class AuthError extends Error { constructor(public status: 401 | 403 | 503, message: string) { super(message); } }
+const schemes = ${JSON.stringify(Object.fromEntries(Object.entries(config.schemes).map(([n,s]) => [n,{provider:s.provider,allowedProviders:s.swa?.allowedProviders??[]}])))} as const;
+const policies = ${JSON.stringify(config.authorization.policies)} as Record<string, { schemes: string[]; roles?: string[] }>;
+const externalVerifiers: Record<string, (token: string) => Promise<any>> = { ${verifiers} };
+const customVerifiers: Record<string, (request: HttpRequest) => any> = { ${custom.map(([name]) => `${JSON.stringify(name)}: verify_${safeIdentifier(name)}`).join(", ")} };
+function swa(request: HttpRequest, scheme: string): AuthPrincipal {
+  const encoded = request.headers.get('x-ms-client-principal');
+  if (!encoded) throw new AuthError(401, 'Authentication required');
+  try { const value = JSON.parse(Buffer.from(encoded, 'base64').toString('utf8')) as Record<string, unknown>;
+    const roles = Array.isArray(value.userRoles) ? value.userRoles.filter((r): r is string => typeof r === 'string') : [];
+    if (typeof value.userId !== 'string' || !value.userId || !roles.includes('authenticated')) throw new Error();
+    const allowed = (schemes as any)[scheme]?.allowedProviders as string[] | undefined;
+    if (allowed?.length && (typeof value.identityProvider !== 'string' || !allowed.includes(value.identityProvider))) throw new Error();
+    return { subject: value.userId, scheme, issuer: typeof value.identityProvider === 'string' ? 'swa:' + value.identityProvider : 'swa', roles, claims: value, userId: value.userId, userDetails: typeof value.userDetails === 'string' ? value.userDetails : undefined };
+  } catch (e) { if (e instanceof AuthError) throw e; throw new AuthError(401, 'Invalid SWA client principal'); }
+}
+export async function requireAuth(request: HttpRequest, policyName: string): Promise<AuthPrincipal> {
+  const policy = policies[policyName]; if (!policy) throw new AuthError(401, 'Undefined authorization policy');
+  const bearer = request.headers.get('authorization'); const hasSwa = Boolean(request.headers.get('x-ms-client-principal'));
+  const candidates = policy.schemes.filter(name => { const p=(schemes as any)[name]?.provider; return p === 'swa' ? hasSwa : (p === 'external-token' || p === 'custom-jwt') ? Boolean(bearer?.startsWith('Bearer ')) : false; });
+  if (candidates.length !== 1) throw new AuthError(401, candidates.length ? 'Ambiguous credentials' : 'Authentication required');
+  const scheme = candidates[0]; const provider = (schemes as any)[scheme]?.provider; let principal: AuthPrincipal;
+  if (provider === 'swa') principal = swa(request, scheme);
+  else if (provider === 'external-token') { const token=bearer!.slice(7); try { const p=await externalVerifiers[scheme](token); const subject=p?.subject ?? p?.userId; if (typeof subject !== 'string' || !subject || !Array.isArray(p.roles)) throw new AuthError(401,'Invalid external principal'); principal={subject,scheme,issuer:typeof p.issuer==='string'?p.issuer:scheme,roles:p.roles,claims:p.claims && typeof p.claims==='object'?p.claims:p,userId:subject,userDetails:p.userDetails}; } catch(e) { if(e instanceof AuthError) throw e; throw new AuthError(503,'Identity provider unavailable'); } }
+  else if (provider === 'custom-jwt') { try { const p=customVerifiers[scheme](request); const subject=p?.sub ?? p?.userId; if(typeof subject !== 'string' || !subject || !Array.isArray(p.roles)) throw new Error(); principal={subject,scheme,issuer:scheme,roles:p.roles,claims:p,userId:subject,userDetails:p.loginId}; } catch { throw new AuthError(401,'Invalid or expired token'); } }
+  else throw new AuthError(401, 'Authentication adapter is not configured');
+  requireRoles(principal, policy.roles || []); return principal;
+}
+export function requireRoles(principal: AuthPrincipal, roles: string[]): void { if (roles.length && !roles.some(r => principal.roles.includes(r))) throw new AuthError(403, 'Insufficient permissions'); }
+export function identityKey(principal: AuthPrincipal): string { return principal.scheme + ':' + principal.subject; }
+export function handleAuthError(error: unknown): HttpResponseInit | null { return error instanceof AuthError ? { status:error.status, jsonBody:{error:error.message} } : null; }
+`;
+}
+
+function safeIdentifier(name: string): string {
+  return name.replace(/[^A-Za-z0-9_]/g, "_");
+}
+
+function schemeSlug(name: string): string {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+}
+
+export function generateNamedExternalTokenVerifierCSharp(scheme: string): string {
+  const id = safeIdentifier(scheme);
+  return `namespace Functions.Auth.Schemes;
+public record ExternalPrincipal_${id}(string Subject, string Issuer, string[] Roles, IReadOnlyDictionary<string, object?> Claims);
+public sealed class ExternalTokenVerificationException_${id} : Exception
+{
+    public bool IsIdentityProviderUnavailable { get; }
+    public ExternalTokenVerificationException_${id}(string message, bool unavailable = false) : base(message) => IsIdentityProviderUnavailable = unavailable;
+}
+public static class ExternalTokenVerifier_${id}
+{
+    // Validate signature, issuer, audience and expiry. This stub deliberately fails closed.
+    public static Task<ExternalPrincipal_${id}> VerifyAsync(string token) => throw new InvalidOperationException("External token verifier for ${scheme} is not configured");
+}
+`;
+}
+
+export function generateNamedExternalTokenVerifierPython(scheme: string): string {
+  return `class ExternalTokenVerificationError(Exception):
+    def __init__(self, message: str, identity_provider_unavailable: bool = False):
+        super().__init__(message)
+        self.identity_provider_unavailable = identity_provider_unavailable
+
+def verify_external_token(token: str) -> dict:
+    # Validate signature, issuer, audience and expiry. This stub deliberately fails closed.
+    raise RuntimeError("External token verifier for ${scheme} is not configured")
+`;
+}
+
+export function generateNamedAuthRouterCSharp(config: NormalizedAuthConfig): string {
+  const externalCases = Object.entries(config.schemes).filter(([,s]) => s.provider === "external-token").map(([name]) => {
+    const id = safeIdentifier(name);
+    return `            case "${name}":
+                try
+                {
+                    var external = await ExternalTokenVerifier_${id}.VerifyAsync(bearer!);
+                    principal = new AuthPrincipal(external.Subject, "${name}", external.Issuer, external.Roles, external.Claims);
+                }
+                catch (ExternalTokenVerificationException_${id} ex) when (ex.IsIdentityProviderUnavailable) { return (null, await Error(request, HttpStatusCode.ServiceUnavailable, "Identity provider unavailable")); }
+                catch (ExternalTokenVerificationException_${id}) { return (null, await Error(request, HttpStatusCode.Unauthorized, "Invalid token")); }
+                catch { return (null, await Error(request, HttpStatusCode.ServiceUnavailable, "External token verifier unavailable")); }
+                break;`;
+  }).join("\n");
+  return `using System.Net;
+using System.Text;
+using System.Text.Json;
+using Microsoft.Azure.Functions.Worker.Http;
+using Functions.Auth.Schemes;
+namespace Functions.Auth;
+public record AuthPrincipal(string Subject, string Scheme, string Issuer, string[] Roles, IReadOnlyDictionary<string, object?> Claims)
+{
+    [Obsolete("Use Subject")] public string UserId => Subject;
+    public string IdentityKey => $"{Scheme}:{Subject}";
+}
+public static class AuthRouter
+{
+    private static readonly Dictionary<string, (string[] Schemes, string[] Roles)> Policies = new()
+    {
+${Object.entries(config.authorization.policies).map(([n,p]) => `        ["${n}"] = (new[] { ${p.schemes.map(s=>`"${s}"`).join(", ")} }, new[] { ${(p.roles??[]).map(r=>`"${r}"`).join(", ")} }),`).join("\n")}
+    };
+    private static readonly Dictionary<string,string> Providers = new() { ${Object.entries(config.schemes).map(([n,s])=>`["${n}"]="${s.provider}"`).join(", ")} };
+    private static readonly Dictionary<string,string[]> AllowedProviders = new() { ${Object.entries(config.schemes).map(([n,s])=>`["${n}"]=new[] { ${(s.swa?.allowedProviders??[]).map(p=>`"${p}"`).join(", ")} }`).join(", ")} };
+    public static async Task<(AuthPrincipal? Principal, HttpResponseData? ErrorResponse)> Authorize(HttpRequestData request, string policyName)
+    {
+        if (!Policies.TryGetValue(policyName, out var policy)) return (null, await Error(request, HttpStatusCode.Unauthorized, "Undefined authorization policy"));
+        var bearerHeader = request.Headers.TryGetValues("Authorization", out var authValues) ? authValues.FirstOrDefault() : null;
+        var bearer = bearerHeader?.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase) == true ? bearerHeader[7..] : null;
+        var swa = request.Headers.TryGetValues("x-ms-client-principal", out var swaValues) ? swaValues.FirstOrDefault() : null;
+        var candidates = policy.Schemes.Where(s => Providers[s] == "swa" ? swa != null : Providers[s] is "external-token" or "custom-jwt" ? bearer != null : false).ToArray();
+        if (candidates.Length != 1) return (null, await Error(request, HttpStatusCode.Unauthorized, candidates.Length == 0 ? "Authentication required" : "Ambiguous credentials"));
+        var scheme = candidates[0]; AuthPrincipal principal;
+        switch (scheme)
+        {
+${externalCases}
+            default:
+                if (Providers[scheme] != "swa") return (null, await Error(request, HttpStatusCode.Unauthorized, "Authentication adapter is not configured"));
+                try
+                {
+                    using var doc = JsonDocument.Parse(Encoding.UTF8.GetString(Convert.FromBase64String(swa!)));
+                    var root = doc.RootElement; var subject = root.GetProperty("userId").GetString();
+                    var roles = root.TryGetProperty("userRoles", out var rv) ? rv.EnumerateArray().Where(v=>v.ValueKind==JsonValueKind.String).Select(v=>v.GetString()!).ToArray() : Array.Empty<string>();
+                    if (string.IsNullOrEmpty(subject) || !roles.Contains("authenticated")) throw new InvalidOperationException();
+                    var identityProvider = root.TryGetProperty("identityProvider", out var iv) ? iv.GetString() : null;
+                    if (AllowedProviders[scheme].Length > 0 && (identityProvider == null || !AllowedProviders[scheme].Contains(identityProvider))) throw new InvalidOperationException();
+                    var issuer = identityProvider == null ? "swa" : "swa:" + identityProvider;
+                    principal = new AuthPrincipal(subject!, scheme, issuer, roles, new Dictionary<string,object?> { ["clientPrincipal"] = root.Clone() });
+                }
+                catch { return (null, await Error(request, HttpStatusCode.Unauthorized, "Invalid SWA client principal")); }
+                break;
+        }
+        if (policy.Roles.Length > 0 && !policy.Roles.Any(principal.Roles.Contains)) return (null, await Error(request, HttpStatusCode.Forbidden, "Insufficient permissions"));
+        return (principal, null);
+    }
+    private static async Task<HttpResponseData> Error(HttpRequestData request, HttpStatusCode status, string message) { var response=request.CreateResponse(status); await response.WriteAsJsonAsync(new { error=message }); return response; }
+}
+`;
+}
+
+export function generateNamedAuthRouterPython(config: NormalizedAuthConfig): string {
+  const external = Object.entries(config.schemes).filter(([,s])=>s.provider === "external-token");
+  const imports = external.map(([n])=>`from auth.schemes.${schemeSlug(n).replace(/-/g,"_")}.verifier import verify_external_token as verify_${safeIdentifier(n)}, ExternalTokenVerificationError as Error_${safeIdentifier(n)}`).join("\n");
+  const cases = external.map(([n], index)=>`        ${index === 0 ? "if" : "elif"} scheme == ${JSON.stringify(n)}:
+            try:
+                value = verify_${safeIdentifier(n)}(bearer)
+            except Error_${safeIdentifier(n)} as exc:
+                raise AuthError(503 if exc.identity_provider_unavailable else 401, "Identity provider unavailable" if exc.identity_provider_unavailable else "Invalid token")
+            except Exception:
+                raise AuthError(503, "External token verifier unavailable")
+            if not value.get("subject") or not isinstance(value.get("roles"), list): raise AuthError(401, "Invalid external principal")
+            principal = {"subject": value["subject"], "scheme": scheme, "issuer": value.get("issuer", scheme), "roles": value["roles"], "claims": value.get("claims", {}), "userId": value["subject"]}`).join("\n");
+  return `import base64
+import json
+import azure.functions as func
+${imports}
+POLICIES = ${JSON.stringify(config.authorization.policies)}
+PROVIDERS = ${JSON.stringify(Object.fromEntries(Object.entries(config.schemes).map(([n,s])=>[n,s.provider])))}
+ALLOWED_PROVIDERS = ${JSON.stringify(Object.fromEntries(Object.entries(config.schemes).map(([n,s])=>[n,s.swa?.allowedProviders??[]])))}
+class AuthError(Exception):
+    def __init__(self, status, message): self.status, self.message = status, message
+def require_auth(req: func.HttpRequest, policy_name: str):
+    policy = POLICIES.get(policy_name)
+    if not policy: raise AuthError(401, "Undefined authorization policy")
+    header = req.headers.get("authorization", "")
+    bearer = header[7:] if header.lower().startswith("bearer ") else None
+    swa = req.headers.get("x-ms-client-principal")
+    candidates = [s for s in policy["schemes"] if (PROVIDERS[s] == "swa" and swa) or (PROVIDERS[s] in ("external-token", "custom-jwt") and bearer)]
+    if len(candidates) != 1: raise AuthError(401, "Authentication required" if not candidates else "Ambiguous credentials")
+    scheme = candidates[0]
+${cases}
+        ${external.length ? "elif" : "if"} PROVIDERS[scheme] == "swa":
+            try:
+                value=json.loads(base64.b64decode(swa).decode("utf-8")); roles=[r for r in value.get("userRoles",[]) if isinstance(r,str)]
+                if not value.get("userId") or "authenticated" not in roles: raise ValueError()
+                if ALLOWED_PROVIDERS[scheme] and value.get("identityProvider") not in ALLOWED_PROVIDERS[scheme]: raise ValueError()
+                principal={"subject":value["userId"],"scheme":scheme,"issuer":"swa:"+value.get("identityProvider", "unknown"),"roles":roles,"claims":value,"userId":value["userId"]}
+            except Exception: raise AuthError(401,"Invalid SWA client principal")
+        else: raise AuthError(401,"Authentication adapter is not configured")
+    require_roles(principal, policy.get("roles", [])); return principal
+def require_roles(principal, roles):
+    if roles and not any(role in principal.get("roles",[]) for role in roles): raise AuthError(403,"Insufficient permissions")
+def identity_key(principal): return principal["scheme"] + ":" + principal["subject"]
+def handle_auth_error(error): return func.HttpResponse(json.dumps({"error":error.message}),status_code=error.status,mimetype="application/json") if isinstance(error,AuthError) else None
+`;
+}
+
 // ============================================================
 // 1. shared/models/auth.ts（Zod スキーマ）
 // ============================================================
@@ -1249,8 +1451,9 @@ export function generateBFFCallFunctionWithSwaAuth(): string {
       if (authorization) {
         fetchHeaders['Authorization'] = authorization;
       }`,
-      `      let principal = reqHeaders.get('x-ms-client-principal');
-      if (!principal) {
+      `      // Never forward a browser-supplied principal header. Resolve it from the SWA session endpoint.
+      let principal: string | null = null;
+      {
         const cookie = reqHeaders.get('cookie');
         const host = reqHeaders.get('host');
         if (cookie && host) {
@@ -1282,6 +1485,16 @@ export function generateBFFCallFunctionWithSwaAuth(): string {
     );
 }
 
+/** Combined transport for named schemes. Functions still performs all verification. */
+export function generateBFFCallFunctionWithMultipleAuth(): string {
+  return generateBFFCallFunctionWithSwaAuth().replace(
+    `      // Never forward a browser-supplied principal header. Resolve it from the SWA session endpoint.`,
+    `      const authorization = reqHeaders.get('authorization');
+      if (authorization?.startsWith('Bearer ')) fetchHeaders['Authorization'] = authorization;
+      // Never forward a browser-supplied principal header. Resolve it from the SWA session endpoint.`
+  );
+}
+
 export function generateSwaAuthHelperTS(): string {
   return `import { HttpRequest, HttpResponseInit } from '@azure/functions';
 
@@ -1485,17 +1698,20 @@ public static class JwtHelper
 /**
  * TypeScript Functions のハンドラーにロールガードを挿入するためのインポート文を生成
  */
-export function generateAuthImportTS(): string {
-  return `import { requireAuth, requireRoles, handleAuthError } from './auth/jwt-helper';`;
+export function generateAuthImportTS(namedPolicy = false): string {
+  return `import { requireAuth, requireRoles, handleAuthError } from './auth/${namedPolicy ? "auth-router" : "jwt-helper"}';`;
 }
 
 /**
  * TypeScript Functions のハンドラー先頭に挿入する認証チェックコードを生成
  */
 export function generateAuthGuardTS(policy: ModelAuthPolicy, operation: 'read' | 'write', provider?: AuthProvider): string {
-  const roles = operation === 'read'
-    ? (policy.read || policy.roles || [])
-    : (policy.write || policy.roles || []);
+  const selected = operation === 'read' ? policy.read : policy.write;
+  if (typeof selected === 'string' || policy.policy) {
+    const name = typeof selected === 'string' ? selected : policy.policy!;
+    return `      const authUser = await requireAuth(request, ${JSON.stringify(name)});`;
+  }
+  const roles = selected || policy.roles || [];
 
   if (roles.length > 0) {
     return `      const authUser = ${provider === 'external-token' ? 'await ' : ''}requireAuth(request);
@@ -1508,9 +1724,12 @@ export function generateAuthGuardTS(policy: ModelAuthPolicy, operation: 'read' |
  * C# Functions のハンドラーに挿入するロールガードコードを生成
  */
 export function generateAuthGuardCSharp(policy: ModelAuthPolicy, operation: 'read' | 'write'): string {
-  const roles = operation === 'read'
-    ? (policy.read || policy.roles || [])
-    : (policy.write || policy.roles || []);
+  const selected = operation === 'read' ? policy.read : policy.write;
+  if (typeof selected === 'string' || policy.policy) {
+    const name = typeof selected === 'string' ? selected : policy.policy!;
+    return `            var (principal, errorResponse) = await AuthRouter.Authorize(request, ${JSON.stringify(name)});\n            if (errorResponse != null) return errorResponse;`;
+  }
+  const roles = selected || policy.roles || [];
 
   if (roles.length > 0) {
     const rolesStr = roles.map(r => `"${r}"`).join(', ');
@@ -1525,9 +1744,12 @@ export function generateAuthGuardCSharp(policy: ModelAuthPolicy, operation: 'rea
  * Python Functions のハンドラーに挿入するロールガードコードを生成
  */
 export function generateAuthGuardPython(policy: ModelAuthPolicy, operation: 'read' | 'write'): string {
-  const roles = operation === 'read'
-    ? (policy.read || policy.roles || [])
-    : (policy.write || policy.roles || []);
+  const selected = operation === 'read' ? policy.read : policy.write;
+  if (typeof selected === 'string' || policy.policy) {
+    const name = typeof selected === 'string' ? selected : policy.policy!;
+    return `    user = require_auth(req, ${JSON.stringify(name)})`;
+  }
+  const roles = selected || policy.roles || [];
 
   if (roles.length > 0) {
     const rolesStr = roles.map(r => `"${r}"`).join(', ');

package/src/core/scaffold/connector-functions-generator.ts

@@ -124,7 +124,8 @@ export function generateRdbConnectorFunctionTS(
 
   // Auth guard setup
   const hasAuth = !!authPolicy;
-  const authImport = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImport = hasAuth ? `\n${generateAuthImportTS(namedAuth)}\n` : '';
   const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read', authProvider)}\n` : '';
   const authCatchBlock = hasAuth
     ? `      const authErr = handleAuthError(error);
@@ -205,7 +206,8 @@ export function generateApiConnectorFunctionTS(
 
   // Auth guard setup (user access control, separate from connector auth to external APIs)
   const hasAuth = !!authPolicy;
-  const authImportLine = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImportLine = hasAuth ? `\n${generateAuthImportTS(namedAuth)}\n` : '';
   const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read', authProvider)}\n` : '';
   const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write', authProvider)}\n` : '';
   const authCatchBlock = hasAuth

package/src/core/scaffold/functions-generator.ts

@@ -22,7 +22,8 @@ export function generateCompactAzureFunctionsCRUD(model: ModelInfo, sharedPackag
   const isIdPartition = partitionKeyField === 'id';
 
   const hasAuth = !!authPolicy;
-  const authImport = hasAuth ? `\n${generateAuthImportTS()}\n` : '';
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImport = hasAuth ? `\n${generateAuthImportTS(namedAuth)}\n` : '';
   const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read', authProvider)}\n` : '';
   const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write', authProvider)}\n` : '';
   const authCatchBlock = hasAuth
@@ -779,7 +780,8 @@ export function generatePythonAzureFunctionsCRUD(model: ModelInfo, authPolicy?:
   const isIdPartition = partitionKeyField === 'id';
 
   const hasAuth = !!authPolicy;
-  const authImport = hasAuth ? '\nfrom auth.jwt_helper import require_auth, require_roles, handle_auth_error\n' : '';
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImport = hasAuth ? `\nfrom auth.${namedAuth ? 'auth_router' : 'jwt_helper'} import require_auth, require_roles, handle_auth_error\n` : '';
   // generateAuthGuardPython outputs at 4-space indent; inside try: we need 8-space
   const readGuardRaw = hasAuth ? generateAuthGuardPython(authPolicy!, 'read') : '';
   const writeGuardRaw = hasAuth ? generateAuthGuardPython(authPolicy!, 'write') : '';

package/src/core/scaffold/model-parser.ts

@@ -779,14 +779,20 @@ export function parseAuthPolicy(content: string): ModelAuthPolicy | undefined {
   const read = extractRoles('read');
   const write = extractRoles('write');
 
-  if (!roles && !read && !write) {
+  const extractName = (key: string): string | undefined => objectStr.match(new RegExp(`${key}\\s*:\\s*['"]([^'"]+)['"]`))?.[1];
+  const namedPolicy = extractName('policy');
+  const namedRead = extractName('read');
+  const namedWrite = extractName('write');
+
+  if (!roles && !read && !write && !namedPolicy && !namedRead && !namedWrite) {
     return undefined;
   }
 
   return {
     ...(roles ? { roles } : {}),
-    ...(read ? { read } : {}),
-    ...(write ? { write } : {}),
+    ...(namedRead ? { read: namedRead } : read ? { read } : {}),
+    ...(namedWrite ? { write: namedWrite } : write ? { write } : {}),
+    ...(namedPolicy ? { policy: namedPolicy } : {}),
   };
 }
 

package/src/core/scaffold/ui-generator.ts

@@ -10,6 +10,9 @@ import { ModelAuthPolicy } from "../../types";
 export interface UIAuthOptions {
   /** モデル固有のロールポリシー */
   authPolicy: ModelAuthPolicy;
+  writeRoles?: string[];
+  authenticatedFetchImport?: string;
+  authContextImport?: string;
 }
 
 /**
@@ -21,7 +24,8 @@ export function generateListPage(model: ModelInfo, sharedPackageName: string, au
   const modelKebab = toKebabCase(modelName);
   
   const hasAuth = !!authOptions;
-  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const authContextImport = authOptions?.authContextImport ?? '@/lib/auth/auth-context';
+  const writeRoles = authOptions?.writeRoles ?? (Array.isArray(authOptions?.authPolicy?.write) ? authOptions.authPolicy.write : authOptions?.authPolicy?.roles);
   const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
   
   // フィールドから表示するカラムを抽出（id以外の最初の3つ）
@@ -71,7 +75,7 @@ import { useEffect, useState } from 'react';
 import Link from 'next/link';
 import { z } from 'zod/v4';
 ${schemaImportLine}
-${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
+${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
@@ -266,7 +270,8 @@ export function generateDetailPage(model: ModelInfo, sharedPackageName: string,
   const modelKebab = toKebabCase(modelName);
   
   const hasAuth = !!authOptions;
-  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const authContextImport = authOptions?.authContextImport ?? '@/lib/auth/auth-context';
+  const writeRoles = authOptions?.writeRoles ?? (Array.isArray(authOptions?.authPolicy?.write) ? authOptions.authPolicy.write : authOptions?.authPolicy?.roles);
   const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
   
   // 外部キーフィールドを検出
@@ -311,7 +316,7 @@ import { useParams, useRouter } from 'next/navigation';
 import Link from 'next/link';
 import { z } from 'zod/v4';
 ${schemaImportLine}
-${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
+${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;
 
@@ -910,7 +915,8 @@ export function generateNewPage(model: ModelInfo, authOptions?: UIAuthOptions):
   const modelKebab = toKebabCase(modelName);
   
   const hasAuth = !!authOptions;
-  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const authContextImport = authOptions?.authContextImport ?? '@/lib/auth/auth-context';
+  const writeRoles = authOptions?.writeRoles ?? (Array.isArray(authOptions?.authPolicy?.write) ? authOptions.authPolicy.write : authOptions?.authPolicy?.roles);
   const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
   
   if (!hasAuth) {
@@ -936,7 +942,7 @@ export default function New${modelName}Page() {
 import { useEffect } from 'react';
 import { useRouter } from 'next/navigation';
 import ${modelName}Form from '../_components/${modelName}Form';
-import { useAuth } from '@/lib/auth/auth-context';
+import { useAuth } from '${authContextImport}';
 
 export default function New${modelName}Page() {
   const router = useRouter();
@@ -979,7 +985,8 @@ export function generateEditPage(model: ModelInfo, sharedPackageName: string, au
   const modelKebab = toKebabCase(modelName);
   
   const hasAuth = !!authOptions;
-  const writeRoles = authOptions?.authPolicy?.write || authOptions?.authPolicy?.roles;
+  const authContextImport = authOptions?.authContextImport ?? '@/lib/auth/auth-context';
+  const writeRoles = authOptions?.writeRoles ?? (Array.isArray(authOptions?.authPolicy?.write) ? authOptions.authPolicy.write : authOptions?.authPolicy?.roles);
   const hasWriteRoles = hasAuth && writeRoles && writeRoles.length > 0;
   
   const schemaName = model.schemaName;
@@ -997,7 +1004,7 @@ import { useParams, useRouter } from 'next/navigation';
 import ${modelName}Form from '../../_components/${modelName}Form';
 import { z } from 'zod/v4';
 ${schemaImportLine}
-${hasAuth ? `import { useAuth } from '@/lib/auth/auth-context';` : ''}
+${hasAuth ? `import { useAuth } from '${authContextImport}';` : ''}
 
 type ${modelName} = z.infer<typeof ${localSchemaName}>;