swallowkit 1.0.0-beta.47 → 1.0.0-beta.49

package/src/__tests__/multi-auth.test.ts

@@ -0,0 +1,133 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { addAuthCommand } from "../cli/commands/add-auth";
+import {
+  generateBFFCallFunctionWithMultipleAuth,
+  generateNamedAuthRouterCSharp,
+  generateNamedAuthRouterPython,
+  generateNamedAuthRouterTS,
+} from "../core/scaffold/auth-generator";
+import { normalizeAuthConfig } from "../core/config";
+import { parseAuthPolicy } from "../core/scaffold/model-parser";
+import { createBasicModelInfo } from "./fixtures";
+import { generateCSharpAzureFunctionsCRUD, generateCompactAzureFunctionsCRUD, generatePythonAzureFunctionsCRUD } from "../core/scaffold/functions-generator";
+
+const auth = normalizeAuthConfig({
+  schemes: {
+    admin: { provider: "swa" },
+    lineUser: { provider: "external-token" },
+  },
+  authorization: {
+    defaultPolicy: "anonymous",
+    policies: {
+      adminOnly: { schemes: ["admin"], roles: ["authenticated"] },
+      lineUserOnly: { schemes: ["lineUser"], roles: ["authenticated"] },
+    },
+  },
+})!;
+
+describe("named authentication routers", () => {
+  it("generates deterministic TypeScript policy routing and normalized principals", () => {
+    const code = generateNamedAuthRouterTS(auth);
+    expect(code).toContain("policy.schemes.filter");
+    expect(code).toContain("candidates.length !== 1");
+    expect(code).toContain("subject: value.userId");
+    expect(code).toContain("scheme + ':' + principal.subject");
+    expect(code).toContain("new AuthError(403");
+    expect(code).toContain("new AuthError(503");
+    expect(code).not.toContain("JWT_SECRET");
+  });
+
+  it("generates equivalent C# and Python named guards", () => {
+    const csharp = generateNamedAuthRouterCSharp(auth);
+    const python = generateNamedAuthRouterPython(auth);
+    expect(csharp).toContain("record AuthPrincipal(string Subject, string Scheme, string Issuer");
+    expect(csharp).toContain("candidates.Length != 1");
+    expect(csharp).toContain("HttpStatusCode.Forbidden");
+    expect(python).toContain('principal["scheme"] + ":" + principal["subject"]');
+    expect(python).toContain("len(candidates) != 1");
+    expect(python).toContain("AuthError(503");
+  });
+
+  it("generates valid branch structure for an SWA-only Python router", () => {
+    const swaOnly = normalizeAuthConfig({ schemes: { admin: { provider: "swa", swa: { allowedProviders: ["github"] } } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } } })!;
+    const python = generateNamedAuthRouterPython(swaOnly);
+    expect(python).toContain('        if PROVIDERS[scheme] == "swa":');
+    expect(python).not.toContain('        elif PROVIDERS[scheme] == "swa":');
+    expect(python).toContain("ALLOWED_PROVIDERS");
+    expect(generateNamedAuthRouterCSharp(swaOnly)).toContain("AllowedProviders[scheme]");
+  });
+
+  it("scaffolds named read/write guards for all Functions languages", () => {
+    const policy = { read: "adminOnly", write: "lineUserOnly" };
+    const model = createBasicModelInfo();
+    const ts = generateCompactAzureFunctionsCRUD(model, "@fixture/shared", policy);
+    const cs = generateCSharpAzureFunctionsCRUD(model, policy);
+    const py = generatePythonAzureFunctionsCRUD(model, policy).blueprint;
+    expect(ts).toContain("./auth/auth-router");
+    expect(ts).toContain('requireAuth(request, "adminOnly")');
+    expect(ts).toContain('requireAuth(request, "lineUserOnly")');
+    expect(cs).toContain('AuthRouter.Authorize(request, "adminOnly")');
+    expect(cs).toContain('AuthRouter.Authorize(request, "lineUserOnly")');
+    expect(py).toContain("from auth.auth_router import");
+    expect(py).toContain('require_auth(req, "adminOnly")');
+    expect(py).toContain('require_auth(req, "lineUserOnly")');
+  });
+
+  it("forwards both credential sources and the Functions host key", () => {
+    const code = generateBFFCallFunctionWithMultipleAuth();
+    expect(code).toContain("fetchHeaders['Authorization']");
+    expect(code).toContain("fetchHeaders['x-ms-client-principal']");
+    expect(code).toContain("'x-functions-key'");
+    expect(code).not.toMatch(/console\.log\([^\n]*(authorization|principal|cookie)/i);
+  });
+
+  it("parses model-wide and operation-specific named policies", () => {
+    expect(parseAuthPolicy("export const authPolicy = { policy: 'adminOnly' };"))
+      .toEqual({ policy: "adminOnly" });
+    expect(parseAuthPolicy("export const authPolicy = { read: 'adminOnly', write: 'lineUserOnly' };"))
+      .toEqual({ read: "adminOnly", write: "lineUserOnly" });
+  });
+});
+
+describe("add-auth named scheme CLI", () => {
+  const originalCwd = process.cwd();
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-multi-auth-"));
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ name: "fixture" }));
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" }, auth: { schemes: {}, authorization: { defaultPolicy: "anonymous", policies: {} } } }, null, 2));
+    process.chdir(root);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it("adds two schemes without overwriting the first verifier", async () => {
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    await addAuthCommand({ scheme: "lineUser", provider: "external-token" });
+    const verifier = path.join(root, "functions", "src", "auth", "schemes", "line-user", "verifier.ts");
+    fs.writeFileSync(verifier, "// user verifier\n", "utf-8");
+    const config = JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8"));
+    expect(config.auth.schemes.admin.provider).toBe("swa");
+    expect(config.auth.schemes.lineUser.provider).toBe("external-token");
+    await expect(addAuthCommand({ scheme: "lineUser", provider: "external-token" })).rejects.toThrow("already exists");
+    expect(fs.readFileSync(verifier, "utf-8")).toBe("// user verifier\n");
+    expect(fs.readFileSync(path.join(root, "lib", "api", "call-function.ts"), "utf-8")).toContain("x-functions-key");
+  });
+
+  it("updates a JavaScript config that already has a trailing comma", async () => {
+    fs.rmSync(path.join(root, "swallowkit.config.json"));
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {\n  backend: { language: 'typescript' },\n  api: { endpoint: '/api/test' },\n};\n");
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    const content = fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8");
+    expect(content).not.toContain(",,");
+    const configModule = { exports: {} as Record<string, unknown> };
+    new Function("module", content)(configModule);
+    expect((configModule.exports as { auth: { schemes: { admin: { provider: string } } } }).auth.schemes.admin.provider).toBe("swa");
+  });
+});

package/src/cli/commands/add-auth.ts

@@ -5,7 +5,7 @@
 
 import * as fs from "fs";
 import * as path from "path";
-import { ensureSwallowKitProject, getBackendLanguage, getConnectorDefinition, getFullConfig } from "../../core/config";
+import { ensureSwallowKitProject, getBackendLanguage, getConnectorDefinition, getValidatedFullConfig } from "../../core/config";
 import { AuthProvider, BackendLanguage, CustomJwtConfig, RdbConnectorConfig } from "../../types";
 import {
   generateAuthModels,
@@ -23,6 +23,7 @@ import {
   generateAuthContext,
   generateBFFCallFunctionWithAuth,
   generateBFFCallFunctionWithSwaAuth,
+  generateBFFCallFunctionWithMultipleAuth,
   generateSwaAuthHelperTS,
   generateSwaAuthHelperCSharp,
   generateSwaAuthHelperPython,
@@ -39,12 +40,15 @@ import {
   generateExternalTokenVerifierPython,
   generateExternalTokenHelperPython,
   generateExternalAuthMePython,
+  generateNamedExternalTokenVerifierCSharp,
+  generateNamedExternalTokenVerifierPython,
 } from "../../core/scaffold/auth-generator";
 import { syncProjectManifest } from "../../core/project/manifest";
 import { buildSharedTsConfig } from "./init";
 
 interface AddAuthOptions {
   provider?: string;
+  scheme?: string;
 }
 
 function writeIfMissing(filePath: string, content: string): void {
@@ -239,9 +243,18 @@ export async function addAuthCommand(options: AddAuthOptions) {
   }
 
   const backendLanguage = getBackendLanguage();
-  const config = getFullConfig();
+  const config = getValidatedFullConfig();
   const cwd = process.cwd();
 
+  if (options.scheme) {
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(options.scheme)) throw new Error("--scheme must start with a letter and contain only letters, digits, '_' or '-'");
+    if (provider === "none" || provider === "swa-custom") throw new Error(`Provider '${provider}' cannot be added as a named scheme`);
+    addNamedScheme(cwd, options.scheme, provider, backendLanguage);
+    await syncProjectManifest();
+    console.log(`\n Named authentication scheme '${options.scheme}' added.`);
+    return;
+  }
+
   if (provider === "swa-custom") {
     throw new Error("The swa-custom provider is not implemented. Use --provider swa or --provider custom-jwt.");
   }
@@ -364,6 +377,103 @@ export async function addAuthCommand(options: AddAuthOptions) {
   console.log(`  5. Run scaffold to regenerate functions with auth guards`);
 }
 
+function findObjectEnd(content: string, open: number): number {
+  let depth = 0, quote = "";
+  for (let i = open; i < content.length; i++) {
+    const ch = content[i];
+    if (quote) { if (ch === quote && content[i - 1] !== "\\") quote = ""; continue; }
+    if (ch === "'" || ch === '"' || ch === "`") { quote = ch; continue; }
+    if (ch === "{") depth++;
+    if (ch === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
+
+function updateConfigWithNamedScheme(cwd: string, scheme: string, provider: AuthProvider): void {
+  const jsPath = path.join(cwd, "swallowkit.config.js");
+  const jsonPath = path.join(cwd, "swallowkit.config.json");
+  const configPath = fs.existsSync(jsPath) ? jsPath : jsonPath;
+  if (!fs.existsSync(configPath)) throw new Error("swallowkit.config.js or swallowkit.config.json is required");
+  if (configPath.endsWith(".json")) {
+    const value = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    value.auth ??= {};
+    value.auth.schemes ??= {};
+    if (value.auth.schemes[scheme]) throw new Error(`auth.schemes.${scheme} already exists; no files were changed`);
+    value.auth.schemes[scheme] = provider === "custom-jwt" ? { provider, customJwt: defaultCustomJwtConfig() } : { provider };
+    value.auth.authorization ??= { defaultPolicy: "anonymous", policies: {} };
+    fs.writeFileSync(configPath, JSON.stringify(value, null, 2) + "\n", "utf-8");
+    return;
+  }
+  let content = fs.readFileSync(configPath, "utf-8");
+  const authMatch = /\bauth\s*:\s*\{/.exec(content);
+  const customJwt = defaultCustomJwtConfig();
+  const entry = provider === "custom-jwt"
+    ? `\n      ${scheme}: { provider: 'custom-jwt', customJwt: ${JSON.stringify(customJwt)} },`
+    : `\n      ${scheme}: { provider: '${provider}' },`;
+  if (!authMatch) {
+    const rootEnd = content.lastIndexOf("}");
+    const beforeRootEnd = content.slice(0, rootEnd).trimEnd();
+    const separator = beforeRootEnd.endsWith(",") || beforeRootEnd.endsWith("{") ? "" : ",";
+    content = `${beforeRootEnd}${separator}\n  auth: {\n    schemes: {${entry}\n    },\n    authorization: { defaultPolicy: 'anonymous', policies: {} },\n  },\n${content.slice(rootEnd)}`;
+  } else {
+    const authOpen = content.indexOf("{", authMatch.index);
+    const authEnd = findObjectEnd(content, authOpen);
+    const authBody = content.slice(authOpen + 1, authEnd);
+    const schemesMatch = /\bschemes\s*:\s*\{/.exec(authBody);
+    if (schemesMatch) {
+      const schemesOpen = authOpen + 1 + authBody.indexOf("{", schemesMatch.index);
+      const schemesEnd = findObjectEnd(content, schemesOpen);
+      const existing = content.slice(schemesOpen + 1, schemesEnd);
+      if (new RegExp(`(^|[,\\s])${scheme}\\s*:`).test(existing)) throw new Error(`auth.schemes.${scheme} already exists; no files were changed`);
+      content = content.slice(0, schemesEnd) + entry + "\n    " + content.slice(schemesEnd);
+    } else {
+      content = content.slice(0, authOpen + 1) + `\n    schemes: {${entry}\n    },` + content.slice(authOpen + 1);
+    }
+  }
+  fs.writeFileSync(configPath, content, "utf-8");
+}
+
+function addNamedScheme(cwd: string, scheme: string, provider: AuthProvider, language: BackendLanguage): void {
+  // Validate/update config before creating files, so duplicate names stop safely.
+  updateConfigWithNamedScheme(cwd, scheme, provider);
+  const slug = scheme.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+  if (language === "typescript") {
+    const dir = path.join(cwd, "functions", "src", "auth", "schemes", slug);
+    if (provider === "external-token") writeIfMissing(path.join(dir, "verifier.ts"), generateExternalTokenVerifierTS());
+    else if (provider === "swa") writeIfMissing(path.join(dir, "adapter.ts"), generateSwaAuthHelperTS());
+    else writeIfMissing(path.join(dir, "jwt-helper.ts"), generateJwtHelperTS());
+  } else if (language === "csharp") {
+    const dir = path.join(cwd, "functions", "Auth", "Schemes", slug);
+    if (provider === "external-token") writeIfMissing(path.join(dir, "ExternalTokenVerifier.cs"), generateNamedExternalTokenVerifierCSharp(scheme));
+    else if (provider === "swa") writeIfMissing(path.join(dir, "SwaAdapter.cs"), generateSwaAuthHelperCSharp());
+    else writeIfMissing(path.join(dir, "JwtHelper.cs"), generateJwtHelperCSharp());
+  } else {
+    const dir = path.join(cwd, "functions", "auth", "schemes", slug.replace(/-/g, "_"));
+    if (provider === "external-token") writeIfMissing(path.join(dir, "verifier.py"), generateNamedExternalTokenVerifierPython(scheme));
+    else if (provider === "swa") writeIfMissing(path.join(dir, "adapter.py"), generateSwaAuthHelperPython());
+    else writeIfMissing(path.join(dir, "jwt_helper.py"), generateJwtHelperPython());
+  }
+  const clientDir = path.join(cwd, "lib", "auth", "schemes", slug);
+  if (provider === "external-token") {
+    writeIfMissing(path.join(clientDir, "token-adapter.ts"), generateExternalTokenAdapter());
+    writeIfMissing(path.join(clientDir, "authenticated-fetch.ts"), generateAuthenticatedFetch().replace("'./external-token-adapter'", "'./token-adapter'"));
+    writeIfMissing(path.join(clientDir, "auth-context.tsx"), generateExternalTokenAuthContext().replace(/external-token-adapter/g, "token-adapter"));
+  } else if (provider === "swa") {
+    writeIfMissing(path.join(clientDir, "auth-context.tsx"), generateSwaAuthContext());
+  } else if (provider === "custom-jwt") {
+    writeIfMissing(path.join(clientDir, "auth-context.tsx"), generateAuthContext());
+  }
+  const callFunctionPath = path.join(cwd, "lib", "api", "call-function.ts");
+  if (!fs.existsSync(callFunctionPath)) writeIfMissing(callFunctionPath, generateBFFCallFunctionWithMultipleAuth());
+  else {
+    const current = fs.readFileSync(callFunctionPath, "utf-8");
+    if (!current.includes("x-ms-client-principal") || !current.includes("fetchHeaders['Authorization']")) {
+      if (current.includes("SwallowKit BFF Call Function Helper")) fs.writeFileSync(callFunctionPath, generateBFFCallFunctionWithMultipleAuth(), "utf-8");
+      else console.warn(" Existing customized lib/api/call-function.ts was preserved. Ensure it forwards Bearer and SWA credentials without logging them.");
+    }
+  }
+}
+
 /**
  * Ensure the shared package has proper build infrastructure
  * (tsconfig.json, build script, typescript devDependency).

package/src/cli/commands/dev.ts

@@ -7,7 +7,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as net from 'net';
 import { CosmosClient, PartitionKeyKind } from '@azure/cosmos';
-import { ensureSwallowKitProject, getBackendLanguage, getAuthConfig } from '../../core/config';
+import { ensureSwallowKitProject, getBackendLanguage, getAuthConfig, normalizeAuthConfig } from '../../core/config';
 import { ModelInfo } from '../../core/scaffold/model-parser';
 import {
   applyDevSeedEnvironment,
@@ -648,7 +648,8 @@ async function startDevEnvironment(options: DevOptions) {
   const pmCmd = getCommands(pm);
   const backendLanguage = getBackendLanguage();
   const authConfig = getAuthConfig();
-  const useSwaEmulator = authConfig?.provider === 'swa' && !options.noSwa;
+  const normalizedAuth = normalizeAuthConfig(authConfig);
+  const useSwaEmulator = Boolean(normalizedAuth && Object.values(normalizedAuth.schemes).some(scheme => scheme.provider === 'swa')) && !options.noSwa;
   const swaCommand = useSwaEmulator ? await resolveSwaCliCommand(process.cwd()) : null;
 
   if (useSwaEmulator && !swaCommand) {
@@ -981,7 +982,9 @@ async function startDevEnvironment(options: DevOptions) {
             passwordHashColumn: authConfig.customJwt.passwordHashColumn,
             rolesColumn: authConfig.customJwt.rolesColumn,
           },
-          defaultPolicy: authConfig.authorization?.defaultPolicy,
+          defaultPolicy: authConfig.authorization?.defaultPolicy === "public" ? "anonymous" :
+            authConfig.authorization?.defaultPolicy === "authenticated" || authConfig.authorization?.defaultPolicy === "anonymous"
+              ? authConfig.authorization.defaultPolicy : undefined,
         };
       }
 

package/src/cli/commands/init.ts

@@ -31,15 +31,22 @@ interface InitOptions {
   backendLanguage?: BackendLanguage;
   cosmosDbMode?: CosmosDbMode;
   vnet?: VNetOption;
+  swaPlan?: StaticWebAppPlan;
 }
 
 type CiCdProvider = 'github' | 'azure' | 'skip';
 type CosmosDbMode = 'freetier' | 'serverless';
 type VNetOption = 'none' | 'outbound';
+type StaticWebAppPlan = 'free' | 'standard';
+
+export function getStaticWebAppSku(plan: StaticWebAppPlan): 'Free' | 'Standard' {
+  return plan === 'free' ? 'Free' : 'Standard';
+}
 
 interface AzureConfig {
   cosmosDbMode: CosmosDbMode;
   vnetOption: VNetOption;
+  swaPlan: StaticWebAppPlan;
 }
 
 const BACKEND_LANGUAGE_CHOICES: Array<{ title: string; value: BackendLanguage }> = [
@@ -186,32 +193,56 @@ async function promptCiCd(): Promise<CiCdProvider> {
   return response.cicd || 'skip';
 }
 
-async function promptAzureConfig(): Promise<AzureConfig> {
-  const cosmosResponse = await prompts({
-    type: 'select',
-    name: 'mode',
-    message: 'Cosmos DB mode (affects cost):',
-    choices: [
-      { title: 'Free Tier (1000 RU/s free, best for first project)', value: 'freetier' },
-      { title: 'Serverless (pay-per-use, flexible)', value: 'serverless' }
-    ],
-    initial: 0
-  });
-
-  const vnetResponse = await prompts({
-    type: 'select',
-    name: 'vnet',
-    message: 'Network security:',
-    choices: [
-      { title: 'VNet Integration (recommended) - Cosmos DB via Private Endpoint', value: 'outbound' },
-      { title: 'None - Public endpoints, simplest but least secure', value: 'none' }
-    ],
-    initial: 0
-  });
+async function promptAzureConfig(options: InitOptions): Promise<AzureConfig> {
+  let swaPlan = options.swaPlan;
+  if (!swaPlan) {
+    const response = await prompts({
+      type: 'select',
+      name: 'plan',
+      message: 'Azure Static Web Apps plan:',
+      choices: [
+        { title: 'Standard (production, SLA and advanced auth/networking features)', value: 'standard' },
+        { title: 'Free (personal projects, no SLA and lower quotas)', value: 'free' }
+      ],
+      initial: 0
+    });
+    swaPlan = response.plan || 'standard';
+  }
+
+  let cosmosDbMode = options.cosmosDbMode;
+  if (!cosmosDbMode) {
+    const response = await prompts({
+      type: 'select',
+      name: 'mode',
+      message: 'Cosmos DB mode (affects cost):',
+      choices: [
+        { title: 'Free Tier (1000 RU/s free, best for first project)', value: 'freetier' },
+        { title: 'Serverless (pay-per-use, flexible)', value: 'serverless' }
+      ],
+      initial: 0
+    });
+    cosmosDbMode = response.mode || 'freetier';
+  }
+
+  let vnetOption = options.vnet;
+  if (!vnetOption) {
+    const response = await prompts({
+      type: 'select',
+      name: 'vnet',
+      message: 'Network security:',
+      choices: [
+        { title: 'VNet Integration (recommended) - Cosmos DB via Private Endpoint', value: 'outbound' },
+        { title: 'None - Public endpoints, simplest but least secure', value: 'none' }
+      ],
+      initial: 0
+    });
+    vnetOption = response.vnet || 'outbound';
+  }
 
   return {
-    cosmosDbMode: cosmosResponse.mode || 'freetier',
-    vnetOption: vnetResponse.vnet || 'outbound'
+    cosmosDbMode: cosmosDbMode || 'freetier',
+    vnetOption: vnetOption || 'outbound',
+    swaPlan: swaPlan || 'standard'
   };
 }
 
@@ -219,6 +250,7 @@ const VALID_CICD: CiCdProvider[] = ['github', 'azure', 'skip'];
 const VALID_BACKEND_LANGUAGE: BackendLanguage[] = ['typescript', 'csharp', 'python'];
 const VALID_COSMOS_DB_MODE: CosmosDbMode[] = ['freetier', 'serverless'];
 const VALID_VNET: VNetOption[] = ['none', 'outbound'];
+const VALID_SWA_PLAN: StaticWebAppPlan[] = ['free', 'standard'];
 
 function validateInitFlags(options: InitOptions): void {
   if (options.cicd && !VALID_CICD.includes(options.cicd)) {
@@ -237,6 +269,10 @@ function validateInitFlags(options: InitOptions): void {
     console.error(`❌ Invalid --vnet value: "${options.vnet}". Must be: ${VALID_VNET.join(', ')}`);
     process.exit(1);
   }
+  if (options.swaPlan && !VALID_SWA_PLAN.includes(options.swaPlan)) {
+    console.error(`❌ Invalid --swa-plan value: "${options.swaPlan}". Must be: ${VALID_SWA_PLAN.join(', ')}`);
+    process.exit(1);
+  }
 }
 
 export async function initCommand(options: InitOptions) {
@@ -264,9 +300,7 @@ export async function initCommand(options: InitOptions) {
     const cicdProvider: CiCdProvider = options.cicd || await promptCiCd();
     const backendLanguage: BackendLanguage = options.backendLanguage || await promptBackendLanguage();
 
-    const azureConfig: AzureConfig = (options.cosmosDbMode && options.vnet)
-      ? { cosmosDbMode: options.cosmosDbMode, vnetOption: options.vnet }
-      : await promptAzureConfig();
+    const azureConfig = await promptAzureConfig(options);
 
     // Create Next.js project with create-next-app
     await createNextJsProject(options.name, pm);
@@ -2494,6 +2528,7 @@ async function createInfrastructure(
 
   const enableVNet = azureConfig.vnetOption !== 'none';
   const functionsRuntime = getFunctionsRuntimeConfig(backendLanguage);
+  const staticWebAppSku = getStaticWebAppSku(azureConfig.swaPlan);
 
   // main.bicep
   const mainBicep = `targetScope = 'resourceGroup'
@@ -2507,6 +2542,13 @@ param location string = resourceGroup().location
 @description('Location for Static Web App (must be explicitly provided)')
 param swaLocation string
 
+@description('Static Web Apps hosting plan')
+@allowed([
+  'Free'
+  'Standard'
+])
+param staticWebAppSku string = '${staticWebAppSku}'
+
 @description('Cosmos DB mode')
 @allowed(['freetier', 'serverless'])
 param cosmosDbMode string = '${azureConfig.cosmosDbMode}'
@@ -2549,7 +2591,7 @@ module staticWebApp 'modules/staticwebapp.bicep' = {
   params: {
     name: 'swa-\${projectName}'
     location: swaLocation
-    sku: 'Standard'
+    sku: staticWebAppSku
     appInsightsConnectionString: appInsightsSwa.outputs.connectionString
   }
 }
@@ -2692,6 +2734,9 @@ output vnetName string = enableVNet ? vnet.outputs.name : ''
     "cosmosDbMode": {
       "value": "${azureConfig.cosmosDbMode}"
     },
+    "staticWebAppSku": {
+      "value": "${staticWebAppSku}"
+    },
     "enableVNet": {
       "value": ${enableVNet}
     }