swallowkit 1.0.0-beta.53 → 1.0.0-beta.55

package/src/__tests__/bff-swa-auth.test.ts

@@ -0,0 +1,275 @@
+import ts from "typescript";
+import {
+  generateBFFCallFunctionWithMultipleAuth,
+  generateBFFCallFunctionWithSwaAuth,
+} from "../core/scaffold/auth-generator";
+
+type GeneratedModule = {
+  callFunction(config: { method: "GET"; path: string }): Promise<unknown>;
+};
+
+type FetchCall = {
+  url: string;
+  init: RequestInit | undefined;
+};
+
+const originalFetch = global.fetch;
+const originalBaseUrl = process.env.BACKEND_FUNCTIONS_BASE_URL;
+const originalFunctionsKey = process.env.BACKEND_FUNCTIONS_KEY;
+
+function encodePrincipal(value: unknown): string {
+  return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
+}
+
+function decodeForwardedPrincipal(call: FetchCall): Record<string, unknown> | undefined {
+  const value = (call.init?.headers as Record<string, string>)["x-ms-client-principal"];
+  return value
+    ? JSON.parse(Buffer.from(value, "base64").toString("utf8"))
+    : undefined;
+}
+
+function loadGeneratedModule(
+  code: string,
+  requestHeaders: Record<string, string>,
+): GeneratedModule {
+  const output = ts.transpileModule(code, {
+    compilerOptions: {
+      esModuleInterop: true,
+      module: ts.ModuleKind.CommonJS,
+      target: ts.ScriptTarget.ES2020,
+    },
+    reportDiagnostics: true,
+  });
+  expect(output.diagnostics).toEqual([]);
+
+  class MockNextResponse {
+    static json(body: unknown, init?: { status?: number }) {
+      return { body, status: init?.status ?? 200 };
+    }
+
+    constructor(
+      public body: unknown,
+      public init?: { status?: number },
+    ) {}
+  }
+
+  const generatedModule = { exports: {} as GeneratedModule };
+  const mockRequire = (id: string): unknown => {
+    if (id === "next/server") return { NextResponse: MockNextResponse };
+    if (id === "next/headers") {
+      return { headers: async () => new Headers(requestHeaders) };
+    }
+    if (id === "zod/v4") return require("zod/v4");
+    throw new Error(`Unexpected generated import: ${id}`);
+  };
+
+  new Function("require", "module", "exports", output.outputText)(
+    mockRequire,
+    generatedModule,
+    generatedModule.exports,
+  );
+  return generatedModule.exports;
+}
+
+async function runGeneratedCall(options: {
+  code: string;
+  requestHeaders: Record<string, string>;
+  mePrincipal?: unknown;
+  functionsBaseUrl?: string;
+}): Promise<FetchCall[]> {
+  process.env.BACKEND_FUNCTIONS_BASE_URL =
+    options.functionsBaseUrl ?? "https://functions.example.test";
+  process.env.BACKEND_FUNCTIONS_KEY = "functions-key-secret";
+
+  const calls: FetchCall[] = [];
+  global.fetch = jest.fn(async (input: string | URL | Request, init?: RequestInit) => {
+    const url = input.toString();
+    calls.push({ url, init });
+    if (url.endsWith("/.auth/me")) {
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({ clientPrincipal: options.mePrincipal }),
+      } as Response;
+    }
+    return {
+      ok: true,
+      status: 200,
+      json: async () => ({ ok: true }),
+      text: async () => "",
+    } as Response;
+  }) as typeof fetch;
+
+  const generated = loadGeneratedModule(options.code, options.requestHeaders);
+  await generated.callFunction({ method: "GET", path: "/api/resource" });
+  return calls;
+}
+
+function functionsCall(calls: FetchCall[]): FetchCall {
+  const call = calls.find(({ url }) => url.endsWith("/api/resource"));
+  expect(call).toBeDefined();
+  return call!;
+}
+
+afterEach(() => {
+  global.fetch = originalFetch;
+  if (originalBaseUrl === undefined) delete process.env.BACKEND_FUNCTIONS_BASE_URL;
+  else process.env.BACKEND_FUNCTIONS_BASE_URL = originalBaseUrl;
+  if (originalFunctionsKey === undefined) delete process.env.BACKEND_FUNCTIONS_KEY;
+  else process.env.BACKEND_FUNCTIONS_KEY = originalFunctionsKey;
+  jest.restoreAllMocks();
+});
+
+describe("generated BFF SWA credential forwarding", () => {
+  const validPrincipal = {
+    identityProvider: "github",
+    userId: "user-123",
+    userDetails: "octocat",
+    userRoles: ["anonymous", "authenticated", 123],
+    untrustedExtra: "must-not-be-forwarded",
+  };
+
+  it("normalizes an incoming principal and does not call /.auth/me", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=cookie-secret",
+        host: "app.example.test",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+
+    expect(calls.map(({ url }) => url)).not.toContain("https://app.example.test/.auth/me");
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toEqual({
+      identityProvider: "github",
+      userId: "user-123",
+      userDetails: "octocat",
+      userRoles: ["anonymous", "authenticated"],
+    });
+    expect(
+      (functionsCall(calls).init?.headers as Record<string, string>)[
+        "x-functions-key"
+      ],
+    ).toBe("functions-key-secret");
+  });
+
+  it("uses x-forwarded-host for the /.auth/me fallback", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=valid",
+        host: "internal.example.test",
+        "x-forwarded-host": "public.example.test",
+      },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("https://public.example.test/.auth/me");
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toEqual({
+      identityProvider: "github",
+      userId: "user-123",
+      userDetails: "octocat",
+      userRoles: ["anonymous", "authenticated"],
+    });
+  });
+
+  it("falls back to host when x-forwarded-host is absent", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { cookie: "session=valid", host: "app.example.test" },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("https://app.example.test/.auth/me");
+  });
+
+  it("uses the first comma-separated forwarded host and protocol", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=valid",
+        host: "internal.example.test",
+        "x-forwarded-host": "public.example.test, proxy.example.test",
+        "x-forwarded-proto": "http, https",
+      },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("http://public.example.test/.auth/me");
+  });
+
+  it.each([
+    ["a missing userId", { ...validPrincipal, userId: undefined }],
+    ["a missing authenticated role", { ...validPrincipal, userRoles: ["anonymous"] }],
+    ["a missing identityProvider", { ...validPrincipal, identityProvider: "" }],
+  ])("does not forward a principal with %s", async (_case, principal) => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { "x-ms-client-principal": encodePrincipal(principal) },
+    });
+
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toBeUndefined();
+  });
+
+  it.each([
+    "not-base64!",
+    `${encodePrincipal(validPrincipal)}!`,
+    Buffer.from("not-json", "utf8").toString("base64"),
+  ])(
+    "fails closed without logging credentials for malformed principal %s",
+    async (principal) => {
+      const error = jest.spyOn(console, "error").mockImplementation(() => undefined);
+      const cookie = "session=highly-sensitive-cookie";
+      const calls = await runGeneratedCall({
+        code: generateBFFCallFunctionWithSwaAuth(),
+        requestHeaders: { cookie, "x-ms-client-principal": principal },
+      });
+
+      expect(decodeForwardedPrincipal(functionsCall(calls))).toBeUndefined();
+      const logged = JSON.stringify(error.mock.calls);
+      expect(logged).not.toContain(cookie);
+      expect(logged).not.toContain(principal);
+    },
+  );
+
+  it("preserves Bearer and applies the same SWA rules for multiple auth", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithMultipleAuth(),
+      requestHeaders: {
+        authorization: "Bearer line-token-secret",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+    const headers = functionsCall(calls).init?.headers as Record<string, string>;
+
+    expect(headers.Authorization).toBe("Bearer line-token-secret");
+    expect(decodeForwardedPrincipal(functionsCall(calls))?.userId).toBe("user-123");
+  });
+
+  it("does not add Bearer forwarding to the SWA-only variant", async () => {
+    const code = generateBFFCallFunctionWithSwaAuth();
+    const calls = await runGeneratedCall({
+      code,
+      requestHeaders: {
+        authorization: "Bearer must-not-be-forwarded",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+    const headers = functionsCall(calls).init?.headers as Record<string, string>;
+
+    expect(headers.Authorization).toBeUndefined();
+    expect(code).not.toContain("reqHeaders.get('authorization')");
+    expect(decodeForwardedPrincipal(functionsCall(calls))?.userId).toBe("user-123");
+  });
+
+  it("defaults /.auth/me to http for local Functions development", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { cookie: "session=valid", host: "localhost:3000" },
+      mePrincipal: validPrincipal,
+      functionsBaseUrl: "http://localhost:7071",
+    });
+
+    expect(calls[0].url).toBe("http://localhost:3000/.auth/me");
+  });
+});

package/src/__tests__/multi-auth.test.ts

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import { addAuthCommand } from "../cli/commands/add-auth";
+import { createUIAuthOptions } from "../cli/commands/scaffold";
 import {
   generateBFFCallFunctionWithMultipleAuth,
   generateNamedAuthRouterCSharp,
@@ -12,8 +13,10 @@ import { normalizeAuthConfig } from "../core/config";
 import { parseAuthPolicy } from "../core/scaffold/model-parser";
 import { createBasicModelInfo } from "./fixtures";
 import { generateCSharpAzureFunctionsCRUD, generateCompactAzureFunctionsCRUD, generatePythonAzureFunctionsCRUD } from "../core/scaffold/functions-generator";
+import { generateAuthLayout, generateNewPage } from "../core/scaffold/ui-generator";
+import { AuthConfig } from "../types";
 
-const auth = normalizeAuthConfig({
+const namedAuthConfig: AuthConfig = {
   schemes: {
     admin: { provider: "swa" },
     lineUser: { provider: "external-token" },
@@ -25,7 +28,8 @@ const auth = normalizeAuthConfig({
       lineUserOnly: { schemes: ["lineUser"], roles: ["authenticated"] },
     },
   },
-})!;
+};
+const auth = normalizeAuthConfig(namedAuthConfig)!;
 
 describe("named authentication routers", () => {
   it("generates deterministic TypeScript policy routing and normalized principals", () => {
@@ -77,7 +81,7 @@ describe("named authentication routers", () => {
 
   it("forwards both credential sources and the Functions host key", () => {
     const code = generateBFFCallFunctionWithMultipleAuth();
-    expect(code).toContain("fetchHeaders['Authorization']");
+    expect(code).toContain("fetchHeaders.Authorization");
     expect(code).toContain("fetchHeaders['x-ms-client-principal']");
     expect(code).toContain("'x-functions-key'");
     expect(code).not.toMatch(/console\.log\([^\n]*(authorization|principal|cookie)/i);
@@ -89,6 +93,17 @@ describe("named authentication routers", () => {
     expect(parseAuthPolicy("export const authPolicy = { read: 'adminOnly', write: 'lineUserOnly' };"))
       .toEqual({ read: "adminOnly", write: "lineUserOnly" });
   });
+
+  it("resolves the same named auth context for the model layout and CRUD pages", () => {
+    const model = createBasicModelInfo({ name: "Product", authPolicy: { policy: "adminOnly" } });
+    const options = createUIAuthOptions(model.authPolicy!, namedAuthConfig);
+    const layout = generateAuthLayout(model, options);
+    const page = generateNewPage(model, options);
+
+    expect(options.authContextImport).toBe("@/lib/auth/schemes/admin/auth-context");
+    expect(layout).toContain("AuthProvider } from '@/lib/auth/schemes/admin/auth-context'");
+    expect(page).toContain("useAuth } from '@/lib/auth/schemes/admin/auth-context'");
+  });
 });
 
 describe("add-auth named scheme CLI", () => {

package/src/__tests__/scaffold.test.ts

@@ -3,7 +3,7 @@ import * as fs from "fs";
 import * as os from "os";
 import { EventEmitter } from "events";
 import * as childProcess from "child_process";
-import { generateCosmosContainer } from "../cli/commands/scaffold";
+import { generateCosmosContainer, generateUIComponents } from "../cli/commands/scaffold";
 import {
   NSWAG_CONSOLECORE_VERSION,
   buildCSharpCodegenToolManifestSource,
@@ -17,6 +17,117 @@ import {
 } from "../core/scaffold/native-schema-generator";
 import { createBasicModelInfo } from "./fixtures";
 
+describe("authenticated UI scaffold layouts", () => {
+  const originalCwd = process.cwd();
+  let tempDir: string;
+  const authOptions = {
+    authPolicy: { policy: "staffOnly" },
+    writeRoles: ["authenticated"],
+    authContextImport: "@/lib/auth/schemes/staff/auth-context",
+  };
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(originalCwd, ".tmp-auth-layout-"));
+    process.chdir(tempDir);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("writes a model-scoped provider layout and regenerates it stably", async () => {
+    const model = createBasicModelInfo({ name: "Product", schemaName: "productSchema" });
+
+    await generateUIComponents(model, "@fixture/shared", authOptions);
+    const layoutPath = path.join(tempDir, "app", "product", "layout.tsx");
+    const first = fs.readFileSync(layoutPath, "utf-8");
+    await generateUIComponents(model, "@fixture/shared", authOptions);
+    const second = fs.readFileSync(layoutPath, "utf-8");
+
+    expect(second).toBe(first);
+    expect(second).toContain("from '@/lib/auth/schemes/staff/auth-context'");
+    expect(second.match(/import \{ AuthProvider \}/g)).toHaveLength(1);
+    expect(second.match(/<AuthProvider>/g)).toHaveLength(1);
+    expect(fs.readFileSync(path.join(tempDir, "app", "product", "page.tsx"), "utf-8"))
+      .toContain("from '@/lib/auth/schemes/staff/auth-context'");
+  });
+
+  it("does not create an auth layout for an unauthenticated model or affect another route", async () => {
+    await generateUIComponents(createBasicModelInfo({ name: "Product", schemaName: "productSchema" }), "@fixture/shared");
+    await generateUIComponents(createBasicModelInfo({ name: "Line", schemaName: "lineSchema" }), "@fixture/shared");
+
+    expect(fs.existsSync(path.join(tempDir, "app", "product", "layout.tsx"))).toBe(false);
+    expect(fs.existsSync(path.join(tempDir, "app", "line", "layout.tsx"))).toBe(false);
+    expect(fs.readFileSync(path.join(tempDir, "app", "line", "page.tsx"), "utf-8"))
+      .not.toContain("schemes/staff/auth-context");
+  });
+
+  it("builds the generated authenticated CRUD routes with Next.js", async () => {
+    const model = createBasicModelInfo({ name: "Product", schemaName: "productSchema" });
+    await generateUIComponents(model, "@fixture/shared", authOptions);
+
+    writeFile(path.join(tempDir, "app", "layout.tsx"), `export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return <html><body>{children}</body></html>;
+}
+`);
+    writeFile(path.join(tempDir, "lib", "auth", "schemes", "staff", "auth-context.tsx"), `'use client';
+import { createContext, useContext } from 'react';
+const AuthContext = createContext<{ user: { id: string }; loading: boolean; hasAnyRole: (roles: string[]) => boolean } | null>(null);
+export function AuthProvider({ children }: { children: React.ReactNode }) {
+  return <AuthContext.Provider value={{ user: { id: 'test' }, loading: false, hasAnyRole: () => true }}>{children}</AuthContext.Provider>;
+}
+export function useAuth() {
+  const value = useContext(AuthContext);
+  if (!value) throw new Error('useAuth must be used within an AuthProvider');
+  return value;
+}
+`);
+    writeFile(path.join(tempDir, "shared.ts"), `import { z } from 'zod/v4';
+export const productSchema = z.object({
+  id: z.string(),
+  title: z.string(),
+  description: z.string().optional(),
+  completed: z.boolean(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+});
+`);
+    writeFile(path.join(tempDir, "package.json"), JSON.stringify({
+      private: true,
+      scripts: { build: "next build" },
+    }, null, 2));
+    writeFile(path.join(tempDir, "tsconfig.json"), JSON.stringify({
+      compilerOptions: {
+        target: "ES2020",
+        lib: ["dom", "dom.iterable", "esnext"],
+        strict: true,
+        noEmit: true,
+        esModuleInterop: true,
+        module: "esnext",
+        moduleResolution: "bundler",
+        resolveJsonModule: true,
+        isolatedModules: true,
+        jsx: "preserve",
+        baseUrl: ".",
+        paths: { "@/*": ["./*"], "@fixture/shared": ["./shared.ts"] },
+      },
+      include: ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+      exclude: ["node_modules"],
+    }, null, 2));
+
+    const npmCommand = process.platform === "win32"
+      ? { file: process.env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", "npm run build"] }
+      : { file: "npm", args: ["run", "build"] };
+    expect(() => childProcess.execFileSync(npmCommand.file, npmCommand.args, {
+      cwd: tempDir,
+      env: { ...process.env, NEXT_TELEMETRY_DISABLED: "1" },
+      stdio: "pipe",
+      timeout: 120_000,
+    })).not.toThrow();
+  }, 150_000);
+});
+
 jest.mock("child_process", () => {
   const actual = jest.requireActual<typeof import("child_process")>("child_process");
   return {

package/src/__tests__/ui-generator.test.ts

@@ -7,6 +7,7 @@ import {
   generateFormComponent,
   generateNewPage,
   generateEditPage,
+  generateAuthLayout,
 } from "../core/scaffold/ui-generator";
 import {
   createBasicModelInfo,
@@ -15,6 +16,41 @@ import {
   createModelInfoWithEnum,
 } from "./fixtures";
 
+const namedAuthOptions = {
+  authPolicy: { policy: "staffOnly" },
+  writeRoles: ["authenticated"],
+  authContextImport: "@/lib/auth/schemes/staff/auth-context",
+};
+
+describe("generateAuthLayout", () => {
+  it("uses the same resolved auth context as authenticated CRUD pages", () => {
+    const model = createBasicModelInfo({ name: "Product" });
+    const layout = generateAuthLayout(model, namedAuthOptions);
+    const listPage = generateListPage(model, "@myapp/shared", namedAuthOptions);
+    const newPage = generateNewPage(model, namedAuthOptions);
+
+    expect(layout).toContain("import { AuthProvider } from '@/lib/auth/schemes/staff/auth-context';");
+    expect(layout).toContain("<AuthProvider>{children}</AuthProvider>");
+    expect(layout).toContain("function ProductLayout");
+    expect(listPage).toContain("import { useAuth } from '@/lib/auth/schemes/staff/auth-context';");
+    expect(newPage).toContain("import { useAuth } from '@/lib/auth/schemes/staff/auth-context';");
+  });
+
+  it("does not generate an auth layout without auth options", () => {
+    expect(generateAuthLayout(createBasicModelInfo({ name: "Product" }))).toBeUndefined();
+  });
+
+  it("is deterministic and does not duplicate providers or imports", () => {
+    const model = createBasicModelInfo({ name: "Product" });
+    const first = generateAuthLayout(model, namedAuthOptions);
+    const second = generateAuthLayout(model, namedAuthOptions);
+
+    expect(second).toBe(first);
+    expect(first?.match(/import \{ AuthProvider \}/g)).toHaveLength(1);
+    expect(first?.match(/<AuthProvider>/g)).toHaveLength(1);
+  });
+});
+
 describe("generateListPage", () => {
   it("generates list page for basic model (snapshot)", () => {
     const model = createBasicModelInfo();

package/src/cli/commands/scaffold.ts

@@ -28,6 +28,7 @@ import {
   generateFormComponent,
   generateNewPage,
   generateEditPage,
+  generateAuthLayout,
   UIAuthOptions,
 } from "../../core/scaffold/ui-generator";
 import { generateLanguageSchemaArtifacts } from "../../core/scaffold/native-schema-generator";
@@ -440,7 +441,7 @@ async function generateFunctionsCode(
   console.log(`✅ Created: ${blueprintPath}`);
 }
 
-function createUIAuthOptions(policy: ModelAuthPolicy, authConfig: AuthConfig): UIAuthOptions {
+export function createUIAuthOptions(policy: ModelAuthPolicy, authConfig: AuthConfig): UIAuthOptions {
   const normalized = normalizeAuthConfig(authConfig);
   const readPolicyName = typeof policy.read === 'string' ? policy.read : policy.policy;
   const writePolicyName = typeof policy.write === 'string' ? policy.write : policy.policy;
@@ -956,7 +957,7 @@ module ${containerModuleName} 'containers/${modelKebab}-container.bicep' = {
 /**
  * Generate UI components (list, detail, form, create, edit pages)
  */
-async function generateUIComponents(modelInfo: any, sharedPackageName: string, authOptions?: UIAuthOptions): Promise<void> {
+export async function generateUIComponents(modelInfo: ModelInfo, sharedPackageName: string, authOptions?: UIAuthOptions): Promise<void> {
   console.log("\n🎨 Generating UI components...");
 
   const modelKebab = toKebabCase(modelInfo.name);
@@ -983,18 +984,25 @@ async function generateUIComponents(modelInfo: any, sharedPackageName: string, a
   const formComponent = generateFormComponent(modelInfo, sharedPackageName);
   const newPage = generateNewPage(modelInfo, authOptions);
   const editPage = generateEditPage(modelInfo, sharedPackageName, authOptions);
+  const authLayout = generateAuthLayout(modelInfo, authOptions);
 
   fs.writeFileSync(path.join(modelDir, "page.tsx"), listPage, "utf-8");
   fs.writeFileSync(path.join(idDir, "page.tsx"), detailPage, "utf-8");
   fs.writeFileSync(path.join(componentsDir, `${modelName}Form.tsx`), formComponent, "utf-8");
   fs.writeFileSync(path.join(newDir, "page.tsx"), newPage, "utf-8");
   fs.writeFileSync(path.join(editDir, "page.tsx"), editPage, "utf-8");
+  if (authLayout) {
+    fs.writeFileSync(path.join(modelDir, "layout.tsx"), authLayout, "utf-8");
+  }
 
   console.log(`✅ Created: ${path.join(modelDir, "page.tsx")}`);
   console.log(`✅ Created: ${path.join(idDir, "page.tsx")}`);
   console.log(`✅ Created: ${path.join(componentsDir, `${modelName}Form.tsx`)}`);
   console.log(`✅ Created: ${path.join(newDir, "page.tsx")}`);
   console.log(`✅ Created: ${path.join(editDir, "page.tsx")}`);
+  if (authLayout) {
+    console.log(`✅ Created: ${path.join(modelDir, "layout.tsx")}`);
+  }
 }
 
 /**