swallowkit 1.0.0-beta.47 → 1.0.0-beta.49

package/src/cli/commands/scaffold.ts

@@ -6,7 +6,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import { spawnSync } from "child_process";
-import { getBackendLanguage, getConnectorDefinition, getAuthConfig, ensureSwallowKitProject } from "../../core/config";
+import { getBackendLanguage, getConnectorDefinition, getAuthConfig, getFullConfig, getNormalizedAuthConfig, ensureSwallowKitProject, normalizeAuthConfig, validateConfig } from "../../core/config";
 import { ModelInfo, parseModelFile, toKebabCase, toPascalCase, toCamelCase } from "../../core/scaffold/model-parser";
 import {
   generateCSharpAzureFunctionsCRUD,
@@ -42,6 +42,7 @@ import {
   AuthConfig,
 } from "../../types";
 import { syncProjectManifest } from "../../core/project/manifest";
+import { generateBFFCallFunctionWithAuth, generateBFFCallFunctionWithMultipleAuth, generateBFFCallFunctionWithSwaAuth, generateNamedAuthRouterCSharp, generateNamedAuthRouterPython, generateNamedAuthRouterTS } from "../../core/scaffold/auth-generator";
 
 interface ScaffoldOptions {
   model: string; // モデルファイルのパス（例: "lib/models/todo.ts" or "todo"）
@@ -74,6 +75,9 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
   // SwallowKit プロジェクトディレクトリかどうかを検証
   ensureSwallowKitProject("scaffold");
 
+  const configValidation = validateConfig(getFullConfig());
+  if (!configValidation.valid) throw new Error(`Invalid SwallowKit configuration:\n${configValidation.errors.map(error => `- ${error}`).join("\n")}`);
+
   console.log("🏗️  SwallowKit Scaffold: Generating CRUD operations...\n");
 
   try {
@@ -159,11 +163,11 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
       const uiAuthPolicy = resolveAuthPolicy(modelInfo, uiAuthConfig);
       const uiAuthOptions: UIAuthOptions | undefined =
         uiAuthPolicy && uiAuthConfig && uiAuthConfig.provider !== 'none'
-          ? { authPolicy: uiAuthPolicy }
+          ? createUIAuthOptions(uiAuthPolicy, uiAuthConfig)
           : undefined;
       await generateUIComponents(modelInfo, sharedPackageName, uiAuthOptions);
-      if (uiAuthConfig?.provider === 'external-token') {
-        applyExternalTokenFetchToGeneratedUi(modelInfo);
+      if (uiAuthOptions?.authenticatedFetchImport) {
+        applyExternalTokenFetchToGeneratedUi(modelInfo, uiAuthOptions.authenticatedFetchImport);
       }
       await updateNavigationMenu(modelInfo);
     }
@@ -193,7 +197,7 @@ export async function scaffoldCommand(options: ScaffoldOptions) {
   }
 }
 
-function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo): void {
+function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo, importPath = '@/lib/auth/authenticated-fetch'): void {
   const uiRoot = path.join(process.cwd(), 'app', toKebabCase(modelInfo.name));
   if (!fs.existsSync(uiRoot)) return;
   const visit = (dir: string): void => {
@@ -208,9 +212,9 @@ function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo): void {
         /(if \(!res\.ok\) throw new Error\([^\n]+\);)/g,
         `if (res.status === 401) throw new Error('Authentication required');\n        $1`
       );
-      if (!content.includes("@/lib/auth/authenticated-fetch")) {
+      if (!content.includes(importPath)) {
         const directive = content.match(/^'use client';\s*\r?\n/)?.[0] ?? '';
-        content = `${directive}import { authenticatedFetch } from '@/lib/auth/authenticated-fetch';\n${content.slice(directive.length)}`;
+        content = `${directive}import { authenticatedFetch } from '${importPath}';\n${content.slice(directive.length)}`;
       }
       fs.writeFileSync(target, content, 'utf-8');
     }
@@ -224,9 +228,13 @@ function applyExternalTokenFetchToGeneratedUi(modelInfo: ModelInfo): void {
  * - なければ auth.authorization.defaultPolicy に従う
  * - auth 設定がなければ undefined（ガードなし）
  */
-function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefined): ModelAuthPolicy | undefined {
+export function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefined): ModelAuthPolicy | undefined {
   // モデルに明示的な authPolicy がある場合はそれを使用
   if (modelInfo.authPolicy) {
+    const normalized = normalizeAuthConfig(authConfig);
+    for (const policyName of [modelInfo.authPolicy.policy, typeof modelInfo.authPolicy.read === 'string' ? modelInfo.authPolicy.read : undefined, typeof modelInfo.authPolicy.write === 'string' ? modelInfo.authPolicy.write : undefined].filter((value): value is string => Boolean(value))) {
+      if (!normalized?.authorization.policies[policyName]) throw new Error(`Model '${modelInfo.name}' references undefined auth policy '${policyName}'. Define auth.authorization.policies.${policyName}.`);
+    }
     return modelInfo.authPolicy;
   }
 
@@ -236,11 +244,13 @@ function resolveAuthPolicy(modelInfo: ModelInfo, authConfig: AuthConfig | undefi
   }
 
   // defaultPolicy が 'authenticated' なら認証のみ（ロール指定なし）のポリシーを返す
-  const defaultPolicy = authConfig.authorization?.defaultPolicy ?? 'authenticated';
+  const defaultPolicy = authConfig.authorization?.defaultPolicy === 'public' ? 'anonymous' : authConfig.authorization?.defaultPolicy ?? 'authenticated';
   if (defaultPolicy === 'authenticated') {
     return {}; // 空のポリシー = 認証のみ、ロール制限なし
   }
 
+  if (defaultPolicy !== 'anonymous') return { policy: defaultPolicy };
+
   // defaultPolicy が 'anonymous' なら認証不要
   return undefined;
 }
@@ -330,13 +340,14 @@ async function generateCallFunctionHelper(): Promise<void> {
 
   // auth 設定がある場合は Authorization ヘッダー転送版を生成
   const authConfig = getAuthConfig();
-  const hasAuth = authConfig && authConfig.provider !== 'none';
+  const normalizedAuth = normalizeAuthConfig(authConfig);
+  const hasAuth = Boolean(normalizedAuth && Object.keys(normalizedAuth.schemes).length > 0);
   let helperCode: string;
   if (hasAuth) {
-    const { generateBFFCallFunctionWithAuth, generateBFFCallFunctionWithSwaAuth } = await import("../../core/scaffold/auth-generator");
-    helperCode = authConfig?.provider === "swa"
-      ? generateBFFCallFunctionWithSwaAuth()
-      : generateBFFCallFunctionWithAuth();
+    const providers = new Set(Object.values(normalizedAuth!.schemes).map(scheme => scheme.provider));
+    helperCode = normalizedAuth!.schemes.default && Object.keys(normalizedAuth!.schemes).length === 1
+      ? authConfig?.provider === "swa" ? generateBFFCallFunctionWithSwaAuth() : generateBFFCallFunctionWithAuth()
+      : providers.has("swa") ? generateBFFCallFunctionWithMultipleAuth() : generateBFFCallFunctionWithAuth();
   } else {
     helperCode = generateBFFCallFunction();
   }
@@ -365,6 +376,12 @@ async function generateFunctionsCode(
 
   const modelKebab = toKebabCase(modelInfo.name);
   if (backendLanguage === "typescript") {
+    const normalizedAuth = getNormalizedAuthConfig();
+    if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+      const routerPath = path.join(process.cwd(), functionsDir, "src", "auth", "auth-router.ts");
+      fs.mkdirSync(path.dirname(routerPath), { recursive: true });
+      fs.writeFileSync(routerPath, generateNamedAuthRouterTS(normalizedAuth), "utf-8");
+    }
     const functionFilePath = path.join(
       process.cwd(),
       functionsDir,
@@ -384,6 +401,12 @@ async function generateFunctionsCode(
   }
 
   if (backendLanguage === "csharp") {
+    const normalizedAuth = getNormalizedAuthConfig();
+    if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+      const routerPath = path.join(process.cwd(), functionsDir, "Auth", "AuthRouter.cs");
+      fs.mkdirSync(path.dirname(routerPath), { recursive: true });
+      fs.writeFileSync(routerPath, generateNamedAuthRouterCSharp(normalizedAuth), "utf-8");
+    }
     const crudDir = path.join(process.cwd(), functionsDir, "Crud");
     const functionFilePath = path.join(crudDir, `${modelInfo.name}CrudFunctions.cs`);
     fs.mkdirSync(crudDir, { recursive: true });
@@ -400,6 +423,13 @@ async function generateFunctionsCode(
     return;
   }
 
+  const normalizedAuth = getNormalizedAuthConfig();
+  if (normalizedAuth && Object.keys(normalizedAuth.schemes).some(name => name !== "default")) {
+    const routerPath = path.join(process.cwd(), functionsDir, "auth", "auth_router.py");
+    fs.mkdirSync(path.dirname(routerPath), { recursive: true });
+    fs.writeFileSync(routerPath, generateNamedAuthRouterPython(normalizedAuth), "utf-8");
+  }
+
   const blueprintsDir = path.join(process.cwd(), functionsDir, "blueprints");
   const blueprintPath = path.join(blueprintsDir, `${modelKebab.replace(/-/g, "_")}.py`);
   fs.mkdirSync(blueprintsDir, { recursive: true });
@@ -410,6 +440,20 @@ async function generateFunctionsCode(
   console.log(`✅ Created: ${blueprintPath}`);
 }
 
+function createUIAuthOptions(policy: ModelAuthPolicy, authConfig: AuthConfig): UIAuthOptions {
+  const normalized = normalizeAuthConfig(authConfig);
+  const readPolicyName = typeof policy.read === 'string' ? policy.read : policy.policy;
+  const writePolicyName = typeof policy.write === 'string' ? policy.write : policy.policy;
+  const readNamed = readPolicyName ? normalized?.authorization.policies[readPolicyName] : undefined;
+  const named = writePolicyName ? normalized?.authorization.policies[writePolicyName] : undefined;
+  const writeRoles = named?.roles ?? (Array.isArray(policy.write) ? policy.write : policy.roles) ?? [];
+  const externalScheme = [...(readNamed?.schemes ?? []), ...(named?.schemes ?? [])].find(name => normalized?.schemes[name]?.provider === 'external-token');
+  const authScheme = readNamed?.schemes[0] ?? named?.schemes[0];
+  const authenticatedFetchImport = externalScheme ? `@/lib/auth/schemes/${toKebabCase(externalScheme)}/authenticated-fetch` : authConfig.provider === 'external-token' ? '@/lib/auth/authenticated-fetch' : undefined;
+  const authContextImport = authScheme ? `@/lib/auth/schemes/${toKebabCase(authScheme)}/auth-context` : '@/lib/auth/auth-context';
+  return { authPolicy: policy, writeRoles, authenticatedFetchImport, authContextImport };
+}
+
 /**
  * コネクタモデル用 Azure Functions コード生成
  */

package/src/cli/index.ts

@@ -109,6 +109,7 @@ export function createProgram(devCommandOverride: Command = devCommand): Command
     .option("--backend-language <language>", "Azure Functions backend language: typescript | csharp | python")
     .option("--cosmos-db-mode <mode>", "Cosmos DB mode: freetier | serverless")
     .option("--vnet <option>", "Network security: outbound | none")
+    .option("--swa-plan <plan>", "Azure Static Web Apps plan: free | standard")
     .action((projectName, options) => {
       initCommand({
         name: projectName || "swallowkit-app",
@@ -118,6 +119,7 @@ export function createProgram(devCommandOverride: Command = devCommand): Command
         backendLanguage: options.backendLanguage,
         cosmosDbMode: options.cosmosDbMode,
         vnet: options.vnet,
+        swaPlan: options.swaPlan,
       });
     });
 
@@ -171,9 +173,11 @@ export function createProgram(devCommandOverride: Command = devCommand): Command
     .command("add-auth")
     .description("Add authentication and authorization to the project")
     .option("--provider <provider>", "Auth provider: custom-jwt | swa | external-token | swa-custom | none", "custom-jwt")
+    .option("--scheme <name>", "Add a named authentication scheme")
     .action((options) => {
       addAuthCommand({
         provider: options.provider,
+        scheme: options.scheme,
       });
     });
 

package/src/core/config.ts

@@ -1,7 +1,7 @@
 import * as fs from "fs";
 import { createRequire } from "module";
 import * as path from "path";
-import { AuthConfig, BackendLanguage, ConnectorDefinition, SwallowKitConfig } from "../types";
+import { AuthConfig, AuthProvider, BackendLanguage, ConnectorDefinition, NormalizedAuthConfig, SwallowKitConfig } from "../types";
 import { detectFromProject, getCommands } from "../utils/package-manager";
 
 const requireFromHere = createRequire(__filename);
@@ -37,7 +37,7 @@ const DEFAULT_CONFIG: SwallowKitConfig = {
 /**
  * 設定ファイルを読み込み
  */
-export function loadConfig(configPath?: string): SwallowKitConfig {
+export function loadConfig(configPath?: string, throwOnError = false): SwallowKitConfig {
   const defaultPaths = [
     "swallowkit.config.json",
     "swallowkit.config.js",
@@ -63,6 +63,7 @@ export function loadConfig(configPath?: string): SwallowKitConfig {
           return mergeConfig(DEFAULT_CONFIG, unwrapConfigModule(loadedConfig));
         }
       } catch (error) {
+        if (throwOnError) throw error;
         console.warn(`⚠️ 設定ファイルの読み込みに失敗: ${filePath}`, error);
       }
     }
@@ -200,6 +201,40 @@ export function getAuthConfig(configPath?: string): AuthConfig | undefined {
   return config.auth;
 }
 
+/** Load configuration for mutating/generation commands and fail instead of silently falling back. */
+export function getValidatedFullConfig(configPath?: string): SwallowKitConfig {
+  const config = mergeConfig(loadConfig(configPath, true), loadConfigFromEnv());
+  const validation = validateConfig(config);
+  if (!validation.valid) throw new Error(`Invalid SwallowKit configuration:\n${validation.errors.map(error => `- ${error}`).join("\n")}`);
+  return config;
+}
+
+const VALID_AUTH_PROVIDERS: AuthProvider[] = ["custom-jwt", "swa", "external-token", "swa-custom", "none"];
+const AUTH_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/;
+
+/** Convert the legacy single-provider shape to the canonical named-scheme shape. */
+export function normalizeAuthConfig(auth?: AuthConfig): NormalizedAuthConfig | undefined {
+  if (!auth) return undefined;
+  const schemes = { ...(auth.schemes ?? {}) };
+  if (auth.provider && auth.provider !== "none" && !schemes.default) {
+    schemes.default = { provider: auth.provider, customJwt: auth.customJwt, swa: auth.swa };
+  }
+  const rawDefault = auth.authorization?.defaultPolicy ?? (Object.keys(schemes).length ? "authenticated" : "anonymous");
+  return {
+    ...auth,
+    schemes,
+    authorization: {
+      ...auth.authorization,
+      defaultPolicy: rawDefault === "public" ? "anonymous" : rawDefault,
+      policies: { ...(auth.authorization?.policies ?? {}) },
+    },
+  };
+}
+
+export function getNormalizedAuthConfig(configPath?: string): NormalizedAuthConfig | undefined {
+  return normalizeAuthConfig(getAuthConfig(configPath));
+}
+
 /**
  * 設定の検証
  */
@@ -214,6 +249,38 @@ function hasConfiguredDatabase(config: SwallowKitConfig): boolean {
 export function validateConfig(config: SwallowKitConfig): { valid: boolean; errors: string[] } {
   const errors: string[] = [];
 
+  const auth = normalizeAuthConfig(config.auth);
+  if (auth) {
+    for (const [name, scheme] of Object.entries(auth.schemes)) {
+      const base = `auth.schemes.${name}`;
+      if (!AUTH_NAME.test(name)) errors.push(`${base}: scheme name must match ${AUTH_NAME}; rename the scheme`);
+      if (!VALID_AUTH_PROVIDERS.includes(scheme.provider)) errors.push(`${base}.provider: unsupported provider '${scheme.provider}'; use ${VALID_AUTH_PROVIDERS.join(", ")}`);
+      if (scheme.provider === "none" || scheme.provider === "swa-custom") errors.push(`${base}.provider: '${scheme.provider}' cannot be used as a named scheme; use swa, external-token, or custom-jwt`);
+      if (scheme.provider === "custom-jwt") {
+        const jwt = scheme.customJwt ?? (name === "default" ? auth.customJwt : undefined);
+        for (const key of ["userConnector", "userTable", "loginIdColumn", "passwordHashColumn", "rolesColumn"] as const) {
+          if (!jwt?.[key]) errors.push(`${base}.customJwt.${key}: required for custom-jwt; configure this value`);
+        }
+      }
+    }
+    for (const [name, policy] of Object.entries(auth.authorization.policies)) {
+      const base = `auth.authorization.policies.${name}`;
+      if (!AUTH_NAME.test(name)) errors.push(`${base}: policy name must match ${AUTH_NAME}; rename the policy`);
+      if (!Array.isArray(policy.schemes) || policy.schemes.length === 0) errors.push(`${base}.schemes: provide at least one named scheme`);
+      for (const scheme of policy.schemes ?? []) if (!auth.schemes[scheme]) errors.push(`${base}.schemes: undefined scheme '${scheme}'; define auth.schemes.${scheme}`);
+      const sources = new Map<string, string>();
+      for (const schemeName of policy.schemes ?? []) {
+        const provider = auth.schemes[schemeName]?.provider;
+        const source = provider === "swa" ? "x-ms-client-principal" : provider === "custom-jwt" || provider === "external-token" ? "authorization-bearer" : provider;
+        if (source && sources.has(source)) errors.push(`${base}.schemes: '${sources.get(source)}' and '${schemeName}' both use ${source}; split the policy so credential selection is deterministic`);
+        else if (source) sources.set(source, schemeName);
+      }
+    }
+    const defaultPolicy = auth.authorization.defaultPolicy;
+    if (defaultPolicy === "authenticated" && !auth.schemes.default && Object.keys(auth.schemes).length !== 1) errors.push("auth.authorization.defaultPolicy: 'authenticated' requires auth.schemes.default (or exactly one scheme); set a default scheme or use a named policy");
+    else if (!["anonymous", "authenticated"].includes(defaultPolicy) && !auth.authorization.policies[defaultPolicy]) errors.push(`auth.authorization.defaultPolicy: undefined policy '${defaultPolicy}'; define auth.authorization.policies.${defaultPolicy}`);
+  }
+
   // データベース設定の検証
   if (hasConfiguredDatabase(config) && !config.database?.connectionString) {
     errors.push("Cosmos DB connection string is required");

package/src/core/mock/connector-mock-server.ts

@@ -503,9 +503,9 @@ export class ConnectorMockServer {
     if (!policy) return undefined; // defaultPolicy: authenticated → 認証のみ、ロールチェック不要
 
     if (isWrite) {
-      return policy.write || policy.roles;
+      return Array.isArray(policy.write) ? policy.write : policy.roles;
     }
-    return policy.read || policy.roles;
+    return Array.isArray(policy.read) ? policy.read : policy.roles;
   }
 
   private readBody(req: http.IncomingMessage, callback: (body: MockDocument) => void) {

package/src/core/project/manifest.ts

@@ -1,6 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
-import { getBackendLanguage, getFullConfig, validateConfig } from "../config";
+import { getBackendLanguage, getFullConfig, normalizeAuthConfig, validateConfig } from "../config";
 import { getAllModels, toCamelCase, toKebabCase } from "../scaffold/model-parser";
 import { AuthConfig, BackendLanguage, ConnectorDefinition, ModelAuthPolicy, ModelConnectorConfig } from "../../types";
 import { captureConsoleMessages, withWorkingDirectory } from "../operations/runtime";
@@ -340,7 +340,7 @@ export async function buildProjectManifest(projectRoot: string = process.cwd()):
       connectors: Object.entries(config.connectors || {})
         .map(([name, definition]) => ({ name, definition }))
         .sort((left, right) => left.name.localeCompare(right.name)),
-      auth: config.auth || null,
+      auth: normalizeAuthConfig(config.auth) || null,
       entities: entities.sort((left, right) => left.name.localeCompare(right.name)),
       routes,
       modules: buildModules(projectRoot),
@@ -356,7 +356,7 @@ export async function buildProjectManifest(projectRoot: string = process.cwd()):
         ],
         hasSharedWorkspace: fs.existsSync(path.join(projectRoot, "shared", "package.json")),
         hasConnectors: Object.keys(config.connectors || {}).length > 0,
-        hasAuth: Boolean(config.auth && config.auth.provider !== "none"),
+        hasAuth: Boolean(config.auth && (config.auth.provider !== "none" || Object.keys(config.auth.schemes ?? {}).length > 0)),
       },
     };
 

package/src/core/project/validation.ts

@@ -209,6 +209,22 @@ export async function validateProject(projectRoot: string = process.cwd()): Prom
     });
   }
 
+  const namedPolicies = loaded.manifest.auth?.authorization?.policies ?? {};
+  for (const entity of loaded.manifest.entities) {
+    const policy = entity.authPolicy;
+    if (!policy) continue;
+    const references = [policy.policy, typeof policy.read === "string" ? policy.read : undefined, typeof policy.write === "string" ? policy.write : undefined].filter((value): value is string => Boolean(value));
+    for (const name of references) {
+      if (!namedPolicies[name]) pushViolation(violations, {
+        code: "undefined-auth-policy",
+        severity: "error",
+        message: `Model '${entity.name}' references undefined authorization policy '${name}'.`,
+        location: { path: entity.filePath, entity: entity.name },
+        suggestedFix: `Define auth.authorization.policies.${name} or update the model authPolicy reference.`,
+      });
+    }
+  }
+
   for (const entity of loaded.manifest.entities) {
     validateSchemaNaming(entity, violations);
   }