swallowkit 1.0.0-beta.8 → 1.0.0

package/src/cli/commands/add-auth.ts

@@ -0,0 +1,853 @@
+/**
+ * SwallowKit Add-Auth コマンド
+ * 認証認可基盤ファイルを生成する
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import { ensureSwallowKitProject, getBackendLanguage, getConnectorDefinition, getValidatedFullConfig } from "../../core/config";
+import { AuthProvider, BackendLanguage, CustomJwtConfig, RdbConnectorConfig } from "../../types";
+import {
+  generateAuthModels,
+  generateAuthFunctionsTS,
+  generateJwtHelperTS,
+  generateAuthFunctionsCSharp,
+  generateJwtHelperCSharp,
+  generateAuthFunctionsPython,
+  generateJwtHelperPython,
+  generateBFFAuthLoginRoute,
+  generateBFFAuthLogoutRoute,
+  generateBFFAuthMeRoute,
+  generateProxy,
+  generateLoginPage,
+  generateAuthContext,
+  generateBFFCallFunctionWithAuth,
+  generateBFFCallFunctionWithSwaAuth,
+  generateBFFCallFunctionWithMultipleAuth,
+  generateSwaAuthHelperTS,
+  generateSwaAuthHelperCSharp,
+  generateSwaAuthHelperPython,
+  generateExternalTokenAdapter,
+  generateAuthenticatedFetch,
+  generateExternalTokenBFFMeRoute,
+  generateExternalTokenAuthContext,
+  generateExternalTokenVerifierTS,
+  generateExternalTokenHelperTS,
+  generateExternalAuthMeTS,
+  generateExternalTokenVerifierCSharp,
+  generateExternalTokenHelperCSharp,
+  generateExternalAuthMeCSharp,
+  generateExternalTokenVerifierPython,
+  generateExternalTokenHelperPython,
+  generateExternalAuthMePython,
+  generateNamedExternalTokenVerifierCSharp,
+  generateNamedExternalTokenVerifierPython,
+} from "../../core/scaffold/auth-generator";
+import { syncProjectManifest } from "../../core/project/manifest";
+import { FileOperationSession, getActiveFileSession } from "../../core/operations/file-session";
+import { recordSessionOperations } from "../../core/project/artifacts";
+import { buildSharedTsConfig } from "./init";
+
+interface AddAuthOptions {
+  provider?: string;
+  scheme?: string;
+  /** SWA の許可する identity provider (例: ['github'])。未指定時は ['aad']。 */
+  allowedProviders?: string[];
+}
+
+const SWA_PROVIDER_LABELS: Record<string, string> = {
+  aad: "Microsoft",
+  github: "GitHub",
+  google: "Google",
+  twitter: "X",
+  apple: "Apple",
+  facebook: "Facebook",
+};
+
+function swaProviderLabel(provider: string): string {
+  return SWA_PROVIDER_LABELS[provider] ?? provider.charAt(0).toUpperCase() + provider.slice(1);
+}
+
+function normalizeSwaProviders(allowedProviders?: string[]): string[] {
+  const providers = (allowedProviders ?? []).map((p) => p.trim().toLowerCase()).filter(Boolean);
+  for (const provider of providers) {
+    if (!/^[a-z0-9-]+$/.test(provider)) throw new Error(`Invalid SWA identity provider name: ${provider}`);
+  }
+  return providers.length > 0 ? providers : ["aad"];
+}
+
+const AUTH_GENERATOR = "add-auth";
+const managedMeta = { ownership: "managed" as const, generator: AUTH_GENERATOR };
+const extensionMeta = { ownership: "extension-point" as const, generator: AUTH_GENERATOR };
+const onceMeta = { ownership: "generated-once" as const, generator: AUTH_GENERATOR };
+
+function writeIfMissing(session: FileOperationSession, filePath: string, content: string): void {
+  if (session.fileExists(filePath)) return;
+  session.writeFile(filePath, content, onceMeta);
+}
+
+function defaultCustomJwtConfig(): CustomJwtConfig {
+  return {
+    userConnector: "mysql",
+    userTable: "users",
+    loginIdColumn: "login_id",
+    passwordHashColumn: "password_hash",
+    rolesColumn: "roles",
+    jwtSecretEnv: "JWT_SECRET",
+    tokenExpiry: "24h",
+  };
+}
+
+function setupSwaAuth(cwd: string, backendLanguage: BackendLanguage, session: FileOperationSession, allowedProviders?: string[]): void {
+  const providers = normalizeSwaProviders(allowedProviders);
+  const helperPath = backendLanguage === "typescript"
+    ? path.join(cwd, "functions", "src", "auth", "jwt-helper.ts")
+    : backendLanguage === "csharp"
+      ? path.join(cwd, "functions", "Auth", "JwtHelper.cs")
+      : path.join(cwd, "functions", "auth", "jwt_helper.py");
+  const helper = backendLanguage === "typescript"
+    ? generateSwaAuthHelperTS()
+    : backendLanguage === "csharp"
+      ? generateSwaAuthHelperCSharp()
+      : generateSwaAuthHelperPython();
+  session.writeFile(helperPath, helper, managedMeta);
+
+  const callFnPath = path.join(cwd, "lib", "api", "call-function.ts");
+  session.writeFile(callFnPath, generateBFFCallFunctionWithSwaAuth(), managedMeta);
+
+  const authDir = path.join(cwd, "lib", "auth");
+  session.writeFile(path.join(authDir, "auth-context.tsx"), generateSwaAuthContext(providers), managedMeta);
+  updateRootLayoutWithAuthProvider(cwd, session);
+  const loginDir = path.join(cwd, "app", "login");
+  session.writeFile(path.join(loginDir, "page.tsx"), generateSwaLoginPage(providers), managedMeta);
+  updateSwaRouteConfig(cwd, session, providers);
+}
+
+function setupExternalTokenAuth(cwd: string, backendLanguage: BackendLanguage, session: FileOperationSession): void {
+  const authDir = path.join(cwd, "lib", "auth");
+  writeIfMissing(session, path.join(authDir, "external-token-adapter.ts"), generateExternalTokenAdapter());
+  session.writeFile(path.join(authDir, "authenticated-fetch.ts"), generateAuthenticatedFetch(), managedMeta);
+  session.writeFile(path.join(authDir, "auth-context.tsx"), generateExternalTokenAuthContext(), managedMeta);
+  session.writeFile(path.join(cwd, "lib", "api", "call-function.ts"), generateBFFCallFunctionWithAuth(), managedMeta);
+  const meDir = path.join(cwd, "app", "api", "auth", "me");
+  session.writeFile(path.join(meDir, "route.ts"), generateExternalTokenBFFMeRoute(), managedMeta);
+  updateRootLayoutWithAuthProvider(cwd, session);
+
+  if (backendLanguage === "typescript") {
+    const verifier = path.join(cwd, "functions", "src", "auth", "external-token-verifier.ts");
+    writeIfMissing(session, verifier, generateExternalTokenVerifierTS());
+    session.writeFile(path.join(cwd, "functions", "src", "auth", "jwt-helper.ts"), generateExternalTokenHelperTS(), managedMeta);
+    session.writeFile(path.join(cwd, "functions", "src", "auth-me.ts"), generateExternalAuthMeTS(), managedMeta);
+  } else if (backendLanguage === "csharp") {
+    const verifier = path.join(cwd, "functions", "Auth", "ExternalTokenVerifier.cs");
+    writeIfMissing(session, verifier, generateExternalTokenVerifierCSharp());
+    session.writeFile(path.join(cwd, "functions", "Auth", "JwtHelper.cs"), generateExternalTokenHelperCSharp(), managedMeta);
+    session.writeFile(path.join(cwd, "functions", "Auth", "ExternalAuthMe.cs"), generateExternalAuthMeCSharp(), managedMeta);
+  } else {
+    const verifier = path.join(cwd, "functions", "auth", "external_token_verifier.py");
+    writeIfMissing(session, verifier, generateExternalTokenVerifierPython());
+    session.writeFile(path.join(cwd, "functions", "auth", "jwt_helper.py"), generateExternalTokenHelperPython(), managedMeta);
+    const authMePath = path.join(cwd, "functions", "blueprints", "auth_me.py");
+    session.writeFile(authMePath, generateExternalAuthMePython(), managedMeta);
+    updatePythonAuthMeRegistration(cwd, session);
+  }
+}
+
+function updatePythonAuthMeRegistration(cwd: string, session: FileOperationSession): void {
+  const appPath = path.join(cwd, "functions", "function_app.py");
+  if (!session.fileExists(appPath)) return;
+  const importLine = "from blueprints.auth_me import bp as external_auth_me_bp";
+  const registerLine = "app.register_blueprint(external_auth_me_bp)";
+  let content = session.readFile(appPath);
+  if (content.includes(importLine)) return;
+  const marker = "# SwallowKit scaffold registrations";
+  content = content.includes(marker)
+    ? content.replace(marker, `${importLine}\n${registerLine}\n${marker}`)
+    : `${content.trimEnd()}\n${importLine}\n${registerLine}\n`;
+  session.writeFile(appPath, content, extensionMeta);
+}
+
+function generateSwaLoginPage(allowedProviders?: string[]): string {
+  const providers = normalizeSwaProviders(allowedProviders);
+  const links = providers
+    .map((provider) => `<a href="/.auth/login/${provider}?post_login_redirect_uri=/">Sign in with ${swaProviderLabel(provider)}</a>`)
+    .join("");
+  return `'use client';
+export default function LoginPage() {
+  return <main><h1>Sign in</h1>${links}</main>;
+}
+`;
+}
+
+export function generateSwaAuthContext(allowedProviders?: string[]): string {
+  const providers = normalizeSwaProviders(allowedProviders);
+  const primaryProvider = providers[0];
+  return `'use client';
+import { createContext, useContext, useEffect, useState, type ReactNode } from 'react';
+
+export interface AuthUser { id: string; loginId: string; name: string; email: string; roles: string[]; }
+interface AuthContextValue { user: AuthUser | null; loading: boolean; login: () => void; logout: () => void; hasRole: (role: string) => boolean; hasAnyRole: (roles: string[]) => boolean; }
+const AuthContext = createContext<AuthContextValue | null>(null);
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [user, setUser] = useState<AuthUser | null>(null);
+  const [loading, setLoading] = useState(true);
+  useEffect(() => {
+    fetch('/.auth/me')
+      .then(async response => {
+        if (!response.ok) throw new Error('SWA authentication is unavailable');
+        const body: unknown = await response.json();
+        if (!body || typeof body !== 'object' || !('clientPrincipal' in body)) return null;
+        const principal = body.clientPrincipal;
+        if (!principal || typeof principal !== 'object') return null;
+        const value = principal as Record<string, unknown>;
+        if (typeof value.userId !== 'string') return null;
+        return {
+          id: value.userId,
+          loginId: typeof value.userDetails === 'string' ? value.userDetails : '',
+          name: typeof value.userDetails === 'string' ? value.userDetails : '',
+          email: typeof value.userDetails === 'string' ? value.userDetails : '',
+          roles: Array.isArray(value.userRoles) ? value.userRoles.filter((role): role is string => typeof role === 'string') : [],
+        } satisfies AuthUser;
+      })
+      .then(setUser)
+      .catch(() => setUser(null))
+      .finally(() => setLoading(false));
+  }, []);
+  const login = () => { window.location.href = '/.auth/login/${primaryProvider}?post_login_redirect_uri=/'; };
+  const logout = () => { window.location.href = '/.auth/logout?post_logout_redirect_uri=/'; };
+  const hasRole = (role: string) => user?.roles.includes(role) ?? false;
+  return <AuthContext.Provider value={{ user, loading, login, logout, hasRole, hasAnyRole: roles => roles.some(hasRole) }}>{children}</AuthContext.Provider>;
+}
+export function useAuth() { const value = useContext(AuthContext); if (!value) throw new Error('useAuth must be used within an AuthProvider'); return value; }
+`;
+}
+
+export function addAuthProviderToRootLayout(layout: string): string {
+  let updated = layout;
+  if (!/import\s*\{[^}]*\bAuthProvider\b[^}]*\}\s*from\s*['"]@\/lib\/auth\/auth-context['"]/.test(updated)) {
+    const directive = updated.match(/^(?:\s*['"]use (?:client|server)['"];?\s*\r?\n)/)?.[0] ?? "";
+    updated = `${directive}import { AuthProvider } from '@/lib/auth/auth-context';\n${updated.slice(directive.length)}`;
+  }
+  if (!/<AuthProvider(?:\s|>)/.test(updated)) {
+    const childrenIndex = updated.lastIndexOf("{children}");
+    if (childrenIndex === -1) {
+      throw new Error("Could not find {children} in app/layout.tsx");
+    }
+    updated = `${updated.slice(0, childrenIndex)}<AuthProvider>{children}</AuthProvider>${updated.slice(childrenIndex + "{children}".length)}`;
+  }
+  return updated;
+}
+
+function updateRootLayoutWithAuthProvider(cwd: string, session: FileOperationSession): void {
+  const layoutPath = path.join(cwd, "app", "layout.tsx");
+  if (!session.fileExists(layoutPath)) {
+    throw new Error("app/layout.tsx was not found; cannot install AuthProvider");
+  }
+  const layout = session.readFile(layoutPath);
+  const updated = addAuthProviderToRootLayout(layout);
+  if (updated !== layout) session.writeFile(layoutPath, updated, extensionMeta);
+}
+
+function updateSwaRouteConfig(cwd: string, session: FileOperationSession, allowedProviders?: string[]): void {
+  const primaryProvider = normalizeSwaProviders(allowedProviders)[0];
+  const configPath = path.join(cwd, "staticwebapp.config.json");
+  const config = session.fileExists(configPath) ? JSON.parse(session.readFile(configPath)) : {};
+  config.routes = Array.isArray(config.routes)
+    ? config.routes.filter((route: { route?: string }) => route.route !== "/api/*")
+    : [];
+  config.routes.unshift({ route: "/api/*", allowedRoles: ["authenticated"] });
+  config.responseOverrides = { ...(config.responseOverrides || {}), "401": { statusCode: 302, redirect: `/.auth/login/${primaryProvider}?post_login_redirect_uri=.referrer` } };
+  session.writeFile(configPath, JSON.stringify(config, null, 2), extensionMeta);
+}
+
+export async function addAuthCommand(options: AddAuthOptions) {
+  ensureSwallowKitProject("add-auth");
+
+  console.log(" SwallowKit Add-Auth: Setting up authentication...\n");
+
+  const provider = (options.provider || "custom-jwt") as AuthProvider;
+  if (!["custom-jwt", "swa", "external-token", "swa-custom", "none"].includes(provider)) {
+    console.error(` Unknown provider: ${provider}. Use: custom-jwt | swa | external-token | swa-custom | none`);
+    process.exit(1);
+  }
+
+  const backendLanguage = getBackendLanguage();
+  const config = getValidatedFullConfig();
+  const cwd = process.cwd();
+
+  // Plan(dry-run) や Apply からセッションが供給される。単体実行時は commit セッションを生成。
+  const session = getActiveFileSession() ?? new FileOperationSession("commit");
+  const finalize = async () => {
+    if (session.mode === "commit") {
+      recordSessionOperations(session.operations);
+      await syncProjectManifest();
+    }
+  };
+
+  if (options.scheme) {
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(options.scheme)) throw new Error("--scheme must start with a letter and contain only letters, digits, '_' or '-'");
+    if (provider === "none" || provider === "swa-custom") throw new Error(`Provider '${provider}' cannot be added as a named scheme`);
+    addNamedScheme(cwd, options.scheme, provider, backendLanguage, session, options.allowedProviders);
+    await finalize();
+    console.log(`\n Named authentication scheme '${options.scheme}' added.`);
+    return;
+  }
+
+  if (provider === "swa-custom") {
+    throw new Error("The swa-custom provider is not implemented. Use --provider swa or --provider custom-jwt.");
+  }
+  if (provider === "none") {
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig(), session);
+    await finalize();
+    console.log(" Authentication disabled in swallowkit.config.js");
+    return;
+  }
+  if (provider === "swa") {
+    setupSwaAuth(cwd, backendLanguage, session, options.allowedProviders);
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig(), session, options.allowedProviders);
+    await finalize();
+    console.log("\n SWA built-in authentication setup complete!");
+    return;
+  }
+  if (provider === "external-token") {
+    setupExternalTokenAuth(cwd, backendLanguage, session);
+    updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig(), session);
+    await finalize();
+    console.log("\n External token authentication setup complete!");
+    console.log(" Implement the generated frontend adapter and backend verifier before use.");
+    return;
+  }
+
+  // Read project name from package.json
+  const pkgPath = path.join(cwd, "package.json");
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+  const projectName = pkg.name || "app";
+
+  // Read shared package name
+  const sharedPkgPath = path.join(cwd, "shared", "package.json");
+  let sharedPackageName = `@${projectName}/shared`;
+  if (fs.existsSync(sharedPkgPath)) {
+    const sharedPkg = JSON.parse(fs.readFileSync(sharedPkgPath, "utf-8"));
+    sharedPackageName = sharedPkg.name || sharedPackageName;
+  }
+
+  // Default custom-jwt config
+  const customJwtConfig: CustomJwtConfig = config.auth?.customJwt || defaultCustomJwtConfig();
+
+  // custom-jwt setup continues below.
+
+  // 1. Generate shared/models/auth.ts
+  console.log(" Generating auth models...");
+  const modelsDir = path.join(cwd, "shared", "models");
+  const authModelPath = path.join(modelsDir, "auth.ts");
+  session.writeFile(authModelPath, generateAuthModels(), managedMeta);
+  console.log(` Created: shared/models/auth.ts`);
+
+  // Ensure shared package has build infrastructure (tsconfig, build script)
+  ensureSharedBuildInfrastructure(cwd, session);
+
+  // Update shared/index.ts to re-export auth
+  updateSharedIndex(cwd, session);
+
+  // Resolve RDB provider for dependency installation
+  const connDef = getConnectorDefinition(customJwtConfig.userConnector);
+  const rdbProvider = (connDef as RdbConnectorConfig | undefined)?.provider ?? "mysql";
+
+  // 2. Generate Functions auth code
+  console.log("\n Generating auth functions...");
+  generateFunctionsAuth(cwd, backendLanguage, sharedPackageName, customJwtConfig, session);
+
+  // 3. Generate BFF auth routes
+  console.log("\n Generating BFF auth routes...");
+  generateBFFAuth(cwd, projectName, sharedPackageName, session);
+
+  // 4. Generate proxy
+  console.log("\n  Generating proxy...");
+  const proxyPath = path.join(cwd, "proxy.ts");
+  session.writeFile(proxyPath, generateProxy(projectName), managedMeta);
+  console.log(` Created: proxy.ts`);
+
+  // 5. Generate login page
+  console.log("\n Generating login page...");
+  const loginDir = path.join(cwd, "app", "login");
+  session.writeFile(path.join(loginDir, "page.tsx"), generateLoginPage(), managedMeta);
+  console.log(` Created: app/login/page.tsx`);
+
+  // 6. Generate auth context
+  console.log("\n Generating auth context...");
+  const authLibDir = path.join(cwd, "lib", "auth");
+  session.writeFile(path.join(authLibDir, "auth-context.tsx"), generateAuthContext(), managedMeta);
+  console.log(`✅ Created: lib/auth/auth-context.tsx`);
+
+  // 7. Update callFunction with auth support
+  console.log("\n Updating callFunction with auth support...");
+  const callFnPath = path.join(cwd, "lib", "api", "call-function.ts");
+  session.writeFile(callFnPath, generateBFFCallFunctionWithAuth(), managedMeta);
+  console.log(` Updated: lib/api/call-function.ts`);
+
+  // 8. Update swallowkit.config.js
+  console.log("\n Updating configuration...");
+  updateConfigWithAuth(cwd, provider, customJwtConfig, session);
+
+  // 9. Update environment files
+  console.log("\n Updating environment files...");
+  updateEnvironmentFiles(cwd, session);
+
+  // 10. Install dependencies
+  console.log("\n Installing auth dependencies...");
+  await installAuthDependencies(cwd, backendLanguage, rdbProvider, session);
+  await finalize();
+
+  console.log("\n Authentication setup complete!");
+  console.log("\n Next steps:");
+  console.log("  1. Review the generated files");
+  console.log("  2. Set JWT_SECRET in functions/local.settings.json");
+  if (provider === "custom-jwt") {
+    console.log("  3. Ensure your user database table matches the config");
+    console.log("  4. Add authPolicy to your models for role-based access control:");
+    console.log("     export const authPolicy = { roles: ['admin'] };");
+  }
+  console.log(`  5. Run scaffold to regenerate functions with auth guards`);
+}
+
+function findObjectEnd(content: string, open: number): number {
+  let depth = 0, quote = "";
+  for (let i = open; i < content.length; i++) {
+    const ch = content[i];
+    if (quote) { if (ch === quote && content[i - 1] !== "\\") quote = ""; continue; }
+    if (ch === "'" || ch === '"' || ch === "`") { quote = ch; continue; }
+    if (ch === "{") depth++;
+    if (ch === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
+
+function updateConfigWithNamedScheme(cwd: string, scheme: string, provider: AuthProvider, session: FileOperationSession, allowedProviders?: string[]): void {
+  const jsPath = path.join(cwd, "swallowkit.config.js");
+  const jsonPath = path.join(cwd, "swallowkit.config.json");
+  const configPath = session.fileExists(jsPath) ? jsPath : jsonPath;
+  if (!session.fileExists(configPath)) throw new Error("swallowkit.config.js or swallowkit.config.json is required");
+  const swaProviders = provider === "swa" ? normalizeSwaProviders(allowedProviders) : undefined;
+  if (configPath.endsWith(".json")) {
+    const value = JSON.parse(session.readFile(configPath));
+    value.auth ??= {};
+    value.auth.schemes ??= {};
+    if (value.auth.schemes[scheme]) throw new Error(`auth.schemes.${scheme} already exists; no files were changed`);
+    value.auth.schemes[scheme] = provider === "custom-jwt"
+      ? { provider, customJwt: defaultCustomJwtConfig() }
+      : swaProviders
+        ? { provider, swa: { allowedProviders: swaProviders } }
+        : { provider };
+    value.auth.authorization ??= { defaultPolicy: "anonymous", policies: {} };
+    session.writeFile(configPath, JSON.stringify(value, null, 2) + "\n", extensionMeta);
+    return;
+  }
+  let content = session.readFile(configPath);
+  const authMatch = /\bauth\s*:\s*\{/.exec(content);
+  const customJwt = defaultCustomJwtConfig();
+  const entry = provider === "custom-jwt"
+    ? `\n      ${scheme}: { provider: 'custom-jwt', customJwt: ${JSON.stringify(customJwt)} },`
+    : swaProviders
+      ? `\n      ${scheme}: { provider: '${provider}', swa: { allowedProviders: [${swaProviders.map((p) => `'${p}'`).join(", ")}] } },`
+      : `\n      ${scheme}: { provider: '${provider}' },`;
+  if (!authMatch) {
+    const rootEnd = content.lastIndexOf("}");
+    const beforeRootEnd = content.slice(0, rootEnd).trimEnd();
+    const separator = beforeRootEnd.endsWith(",") || beforeRootEnd.endsWith("{") ? "" : ",";
+    content = `${beforeRootEnd}${separator}\n  auth: {\n    schemes: {${entry}\n    },\n    authorization: { defaultPolicy: 'anonymous', policies: {} },\n  },\n${content.slice(rootEnd)}`;
+  } else {
+    const authOpen = content.indexOf("{", authMatch.index);
+    const authEnd = findObjectEnd(content, authOpen);
+    const authBody = content.slice(authOpen + 1, authEnd);
+    const schemesMatch = /\bschemes\s*:\s*\{/.exec(authBody);
+    if (schemesMatch) {
+      const schemesOpen = authOpen + 1 + authBody.indexOf("{", schemesMatch.index);
+      const schemesEnd = findObjectEnd(content, schemesOpen);
+      const existing = content.slice(schemesOpen + 1, schemesEnd);
+      if (new RegExp(`(^|[,\\s])${scheme}\\s*:`).test(existing)) throw new Error(`auth.schemes.${scheme} already exists; no files were changed`);
+      content = content.slice(0, schemesEnd) + entry + "\n    " + content.slice(schemesEnd);
+    } else {
+      content = content.slice(0, authOpen + 1) + `\n    schemes: {${entry}\n    },` + content.slice(authOpen + 1);
+    }
+  }
+  session.writeFile(configPath, content, extensionMeta);
+}
+
+function addNamedScheme(cwd: string, scheme: string, provider: AuthProvider, language: BackendLanguage, session: FileOperationSession, allowedProviders?: string[]): void {
+  // Validate/update config before creating files, so duplicate names stop safely.
+  updateConfigWithNamedScheme(cwd, scheme, provider, session, allowedProviders);
+  const slug = scheme.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+  if (language === "typescript") {
+    const dir = path.join(cwd, "functions", "src", "auth", "schemes", slug);
+    if (provider === "external-token") writeIfMissing(session, path.join(dir, "verifier.ts"), generateExternalTokenVerifierTS());
+    else if (provider === "swa") writeIfMissing(session, path.join(dir, "adapter.ts"), generateSwaAuthHelperTS());
+    else writeIfMissing(session, path.join(dir, "jwt-helper.ts"), generateJwtHelperTS());
+  } else if (language === "csharp") {
+    const dir = path.join(cwd, "functions", "Auth", "Schemes", slug);
+    if (provider === "external-token") writeIfMissing(session, path.join(dir, "ExternalTokenVerifier.cs"), generateNamedExternalTokenVerifierCSharp(scheme));
+    else if (provider === "swa") writeIfMissing(session, path.join(dir, "SwaAdapter.cs"), generateSwaAuthHelperCSharp());
+    else writeIfMissing(session, path.join(dir, "JwtHelper.cs"), generateJwtHelperCSharp());
+  } else {
+    const dir = path.join(cwd, "functions", "auth", "schemes", slug.replace(/-/g, "_"));
+    if (provider === "external-token") writeIfMissing(session, path.join(dir, "verifier.py"), generateNamedExternalTokenVerifierPython(scheme));
+    else if (provider === "swa") writeIfMissing(session, path.join(dir, "adapter.py"), generateSwaAuthHelperPython());
+    else writeIfMissing(session, path.join(dir, "jwt_helper.py"), generateJwtHelperPython());
+  }
+  const clientDir = path.join(cwd, "lib", "auth", "schemes", slug);
+  if (provider === "external-token") {
+    writeIfMissing(session, path.join(clientDir, "token-adapter.ts"), generateExternalTokenAdapter());
+    writeIfMissing(session, path.join(clientDir, "authenticated-fetch.ts"), generateAuthenticatedFetch().replace("'./external-token-adapter'", "'./token-adapter'"));
+    writeIfMissing(session, path.join(clientDir, "auth-context.tsx"), generateExternalTokenAuthContext().replace(/external-token-adapter/g, "token-adapter"));
+  } else if (provider === "swa") {
+    writeIfMissing(session, path.join(clientDir, "auth-context.tsx"), generateSwaAuthContext(allowedProviders));
+  } else if (provider === "custom-jwt") {
+    writeIfMissing(session, path.join(clientDir, "auth-context.tsx"), generateAuthContext());
+  }
+  const callFunctionPath = path.join(cwd, "lib", "api", "call-function.ts");
+  if (!session.fileExists(callFunctionPath)) writeIfMissing(session, callFunctionPath, generateBFFCallFunctionWithMultipleAuth());
+  else {
+    const current = session.readFile(callFunctionPath);
+    if (!current.includes("x-ms-client-principal") || !current.includes("fetchHeaders['Authorization']")) {
+      if (current.includes("SwallowKit BFF Call Function Helper")) session.writeFile(callFunctionPath, generateBFFCallFunctionWithMultipleAuth(), managedMeta);
+      else console.warn(" Existing customized lib/api/call-function.ts was preserved. Ensure it forwards Bearer and SWA credentials without logging them.");
+    }
+  }
+}
+
+/**
+ * Ensure the shared package has proper build infrastructure
+ * (tsconfig.json, build script, typescript devDependency).
+ * Required for `dev` command which runs `npm run --workspace=shared build`.
+ */
+function ensureSharedBuildInfrastructure(cwd: string, session: FileOperationSession): void {
+  const sharedDir = path.join(cwd, "shared");
+  const pkgPath = path.join(sharedDir, "package.json");
+  if (!session.fileExists(pkgPath)) return;
+
+  const pkg = JSON.parse(session.readFile(pkgPath));
+  let updated = false;
+
+  // Ensure scripts.build exists
+  if (!pkg.scripts?.build) {
+    if (!pkg.scripts) pkg.scripts = {};
+    pkg.scripts.build = "tsc";
+    pkg.scripts.watch = "tsc --watch";
+    updated = true;
+  }
+
+  // Ensure main points to compiled output
+  if (!pkg.main || pkg.main === "index.ts") {
+    pkg.main = "dist/index.js";
+    pkg.types = "dist/index.d.ts";
+    updated = true;
+  }
+
+  // Ensure typescript devDependency
+  if (!pkg.devDependencies?.typescript) {
+    if (!pkg.devDependencies) pkg.devDependencies = {};
+    pkg.devDependencies.typescript = "^5.0.0";
+    updated = true;
+  }
+
+  if (updated) {
+    session.writeFile(pkgPath, JSON.stringify(pkg, null, 2), extensionMeta);
+    console.log(` Updated: shared/package.json (added build infrastructure)`);
+  }
+
+  // Ensure tsconfig.json exists
+  const tsconfigPath = path.join(sharedDir, "tsconfig.json");
+  if (!session.fileExists(tsconfigPath)) {
+    session.writeFile(tsconfigPath, JSON.stringify(buildSharedTsConfig(), null, 2), onceMeta);
+    console.log(` Created: shared/tsconfig.json`);
+  }
+}
+
+function updateSharedIndex(cwd: string, session: FileOperationSession): void {
+  const indexPath = path.join(cwd, "shared", "index.ts");
+  if (session.fileExists(indexPath)) {
+    let content = session.readFile(indexPath);
+    if (!content.includes("./models/auth")) {
+      content += `\nexport { LoginRequest, AuthUser, LoginResponse } from './models/auth';\n`;
+      session.writeFile(indexPath, content, extensionMeta);
+      console.log(` Updated: shared/index.ts`);
+    }
+  } else {
+    session.writeFile(indexPath, `export { LoginRequest, AuthUser, LoginResponse } from './models/auth';\n`, extensionMeta);
+    console.log(` Created: shared/index.ts`);
+  }
+}
+
+function generateFunctionsAuth(
+  cwd: string,
+  backendLanguage: BackendLanguage,
+  sharedPackageName: string,
+  config: CustomJwtConfig,
+  session: FileOperationSession,
+): void {
+  const functionsDir = path.join(cwd, "functions");
+
+  // Resolve the RDB provider from the connector definition
+  const connDef = getConnectorDefinition(config.userConnector);
+  const provider = (connDef as RdbConnectorConfig | undefined)?.provider ?? "mysql";
+
+  if (backendLanguage === "typescript") {
+    // Auth functions
+    const srcDir = path.join(functionsDir, "src");
+    session.writeFile(
+      path.join(srcDir, "auth.ts"),
+      generateAuthFunctionsTS(sharedPackageName, config, provider),
+      managedMeta
+    );
+    console.log(` Created: functions/src/auth.ts`);
+
+    // JWT helper
+    const authDir = path.join(srcDir, "auth");
+    session.writeFile(
+      path.join(authDir, "jwt-helper.ts"),
+      generateJwtHelperTS(),
+      managedMeta
+    );
+    console.log(` Created: functions/src/auth/jwt-helper.ts`);
+  } else if (backendLanguage === "csharp") {
+    const authDir = path.join(functionsDir, "Auth");
+    session.writeFile(
+      path.join(authDir, "AuthFunctions.cs"),
+      generateAuthFunctionsCSharp(config, provider),
+      managedMeta
+    );
+    console.log(` Created: functions/Auth/AuthFunctions.cs`);
+    session.writeFile(
+      path.join(authDir, "JwtHelper.cs"),
+      generateJwtHelperCSharp(),
+      managedMeta
+    );
+    console.log(` Created: functions/Auth/JwtHelper.cs`);
+  } else if (backendLanguage === "python") {
+    const blueprintsDir = path.join(functionsDir, "blueprints");
+    session.writeFile(
+      path.join(blueprintsDir, "auth.py"),
+      generateAuthFunctionsPython(config, provider),
+      managedMeta
+    );
+    console.log(` Created: functions/blueprints/auth.py`);
+
+    const authDir = path.join(functionsDir, "auth");
+    session.writeFile(
+      path.join(authDir, "jwt_helper.py"),
+      generateJwtHelperPython(),
+      managedMeta
+    );
+    console.log(` Created: functions/auth/jwt_helper.py`);
+
+    // __init__.py
+    if (!session.fileExists(path.join(authDir, "__init__.py"))) {
+      session.writeFile(path.join(authDir, "__init__.py"), "", onceMeta);
+    }
+
+    // Register auth blueprint in function_app.py
+    const functionAppPath = path.join(functionsDir, "function_app.py");
+    if (session.fileExists(functionAppPath)) {
+      const content = session.readFile(functionAppPath);
+      const authImport = "from blueprints.auth import bp as auth_bp";
+      const authRegister = "app.register_blueprint(auth_bp)";
+      if (!content.includes(authImport)) {
+        const marker = "# SwallowKit scaffold registrations";
+        if (content.includes(marker)) {
+          const updated = content.replace(
+            marker,
+            `${authImport}\n${authRegister}\n${marker}`
+          );
+          session.writeFile(functionAppPath, updated, extensionMeta);
+          console.log(` Updated: functions/function_app.py (registered auth blueprint)`);
+        }
+      }
+    }
+  }
+}
+
+function generateBFFAuth(cwd: string, projectName: string, sharedPackageName: string, session: FileOperationSession): void {
+  const authApiDir = path.join(cwd, "app", "api", "auth");
+
+  // Login route
+  const loginDir = path.join(authApiDir, "login");
+  session.writeFile(
+    path.join(loginDir, "route.ts"),
+    generateBFFAuthLoginRoute(projectName, sharedPackageName),
+    managedMeta
+  );
+  console.log(` Created: app/api/auth/login/route.ts`);
+
+  // Logout route
+  const logoutDir = path.join(authApiDir, "logout");
+  session.writeFile(
+    path.join(logoutDir, "route.ts"),
+    generateBFFAuthLogoutRoute(projectName),
+    managedMeta
+  );
+  console.log(` Created: app/api/auth/logout/route.ts`);
+
+  // Me route
+  const meDir = path.join(authApiDir, "me");
+  session.writeFile(
+    path.join(meDir, "route.ts"),
+    generateBFFAuthMeRoute(),
+    managedMeta
+  );
+  console.log(` Created: app/api/auth/me/route.ts`);
+}
+
+function updateConfigWithAuth(cwd: string, provider: AuthProvider, config: CustomJwtConfig, session: FileOperationSession, allowedProviders?: string[]): void {
+  const configPath = path.join(cwd, "swallowkit.config.js");
+  if (!session.fileExists(configPath)) {
+    console.warn("  swallowkit.config.js not found. Please add auth config manually.");
+    return;
+  }
+
+  const content = session.readFile(configPath);
+
+  if (content.includes("auth:") || content.includes("auth :")) {
+    console.log("  'auth' section already exists in swallowkit.config.js");
+    return;
+  }
+
+  // Find the last property before the closing of module.exports
+  const closingBraceIdx = content.lastIndexOf("}");
+  if (closingBraceIdx === -1) {
+    console.error(" Could not parse config file structure.");
+    return;
+  }
+
+  const beforeClosing = content.substring(0, closingBraceIdx).trimEnd();
+  const needsComma = !beforeClosing.endsWith(",") && !beforeClosing.endsWith("{");
+
+  const providerSettings = provider === "custom-jwt" ? `
+    customJwt: {
+      userConnector: '${config.userConnector}',
+      userTable: '${config.userTable}',
+      loginIdColumn: '${config.loginIdColumn}',
+      passwordHashColumn: '${config.passwordHashColumn}',
+      rolesColumn: '${config.rolesColumn}',
+      jwtSecretEnv: '${config.jwtSecretEnv || "JWT_SECRET"}',
+      tokenExpiry: '${config.tokenExpiry || "24h"}',
+    },` : provider === "swa" ? `
+    swa: {
+      allowedProviders: [${normalizeSwaProviders(allowedProviders).map((p) => `'${p}'`).join(", ")}],
+      roleSource: 'swa-roles',
+    },` : "";
+
+  const authBlock = `${needsComma ? "," : ""}
+  // 認証認可設定
+  auth: {
+    provider: '${provider}',
+${providerSettings}
+    authorization: {
+      defaultPolicy: 'authenticated',
+    },
+  },
+`;
+
+  const newContent = content.substring(0, closingBraceIdx) + authBlock + content.substring(closingBraceIdx);
+  session.writeFile(configPath, newContent, extensionMeta);
+  console.log(` Updated: swallowkit.config.js`);
+}
+
+function updateEnvironmentFiles(cwd: string, session: FileOperationSession): void {
+  // Update functions/local.settings.json
+  const localSettingsPath = path.join(cwd, "functions", "local.settings.json");
+  if (session.fileExists(localSettingsPath)) {
+    const settings = JSON.parse(session.readFile(localSettingsPath));
+    if (!settings.Values) settings.Values = {};
+    if (!settings.Values.JWT_SECRET) {
+      settings.Values.JWT_SECRET = "dev-jwt-secret-change-in-production-min-32-chars!!";
+    }
+    session.writeFile(localSettingsPath, JSON.stringify(settings, null, 2), extensionMeta);
+    console.log(` Updated: functions/local.settings.json`);
+  }
+
+  // Update .env.example
+  const envExamplePath = path.join(cwd, ".env.example");
+  if (session.fileExists(envExamplePath)) {
+    let content = session.readFile(envExamplePath);
+    if (!content.includes("JWT_SECRET")) {
+      content += "\n# Authentication\nJWT_SECRET=your-jwt-secret-key-at-least-32-chars\n";
+      session.writeFile(envExamplePath, content, extensionMeta);
+      console.log(` Updated: .env.example`);
+    }
+  }
+}
+
+async function installAuthDependencies(cwd: string, backendLanguage: BackendLanguage, provider: "mysql" | "postgres" | "sqlserver" = "mysql", session: FileOperationSession): Promise<void> {
+  if (backendLanguage === "typescript") {
+    const funcPkgPath = path.join(cwd, "functions", "package.json");
+    if (session.fileExists(funcPkgPath)) {
+      const funcPkg = JSON.parse(session.readFile(funcPkgPath));
+      if (!funcPkg.dependencies) funcPkg.dependencies = {};
+      funcPkg.dependencies["jsonwebtoken"] = "^9.0.0";
+      funcPkg.dependencies["bcryptjs"] = "^2.4.3";
+      // RDB driver based on provider
+      if (provider === "mysql") funcPkg.dependencies["mysql2"] = "^3.11.0";
+      else if (provider === "postgres") funcPkg.dependencies["pg"] = "^8.13.0";
+      else funcPkg.dependencies["mssql"] = "^11.0.0";
+      if (!funcPkg.devDependencies) funcPkg.devDependencies = {};
+      funcPkg.devDependencies["@types/jsonwebtoken"] = "^9.0.0";
+      funcPkg.devDependencies["@types/bcryptjs"] = "^2.4.0";
+      if (provider === "postgres") funcPkg.devDependencies["@types/pg"] = "^8.11.0";
+      session.writeFile(funcPkgPath, JSON.stringify(funcPkg, null, 2), extensionMeta);
+      console.log(` Updated: functions/package.json with auth dependencies (${provider})`);
+    }
+  } else if (backendLanguage === "csharp") {
+    // Add NuGet package references to .csproj
+    const functionsDir = path.join(cwd, "functions");
+    const csprojFiles = fs.existsSync(functionsDir)
+      ? fs.readdirSync(functionsDir).filter((f: string) => f.endsWith(".csproj"))
+      : [];
+    if (csprojFiles.length > 0) {
+      const csprojPath = path.join(functionsDir, csprojFiles[0]);
+      let csprojContent = session.readFile(csprojPath);
+      const nugetPackages: { name: string; version: string }[] = [
+        { name: "System.IdentityModel.Tokens.Jwt", version: "7.0.0" },
+        { name: "Microsoft.IdentityModel.Tokens", version: "7.0.0" },
+        { name: "BCrypt.Net-Next", version: "4.0.3" },
+      ];
+      // RDB driver based on provider
+      if (provider === "mysql") nugetPackages.push({ name: "MySqlConnector", version: "2.3.0" });
+      else if (provider === "postgres") nugetPackages.push({ name: "Npgsql", version: "8.0.0" });
+      else nugetPackages.push({ name: "Microsoft.Data.SqlClient", version: "5.2.0" });
+      for (const pkg of nugetPackages) {
+        if (!csprojContent.includes(`"${pkg.name}"`)) {
+          const insertPoint = csprojContent.lastIndexOf("</ItemGroup>");
+          if (insertPoint >= 0) {
+            csprojContent =
+              csprojContent.slice(0, insertPoint) +
+              `  <PackageReference Include="${pkg.name}" Version="${pkg.version}" />\n  ` +
+              csprojContent.slice(insertPoint);
+          }
+        }
+      }
+      session.writeFile(csprojPath, csprojContent, extensionMeta);
+      console.log(` Updated: ${csprojFiles[0]} with auth NuGet packages (${provider})`);
+    }
+  } else if (backendLanguage === "python") {
+    // Add Python dependencies to requirements.txt
+    const requirementsPath = path.join(cwd, "functions", "requirements.txt");
+    const baseDeps = ["PyJWT>=2.8.0", "bcrypt>=4.1.0"];
+    // RDB driver based on provider
+    if (provider === "mysql") baseDeps.push("mysql-connector-python>=8.3.0");
+    else if (provider === "postgres") baseDeps.push("psycopg2-binary>=2.9.0");
+    else baseDeps.push("pymssql>=2.2.0");
+    if (session.fileExists(requirementsPath)) {
+      let content = session.readFile(requirementsPath);
+      for (const dep of baseDeps) {
+        const pkgName = dep.split(">=")[0].split("==")[0];
+        if (!content.includes(pkgName)) {
+          content += `${dep}\n`;
+        }
+      }
+      session.writeFile(requirementsPath, content, extensionMeta);
+    } else {
+      session.writeFile(requirementsPath, baseDeps.join("\n") + "\n", extensionMeta);
+    }
+    console.log(` Updated: functions/requirements.txt with auth dependencies`);
+  }
+}