swallowkit 1.0.0-beta.9 → 1.0.0

package/src/core/scaffold/functions-generator.ts

@@ -5,29 +5,72 @@
  */
 
 import { ModelInfo, toCamelCase, toKebabCase } from "./model-parser";
+import { AuthProvider, ModelAuthPolicy } from "../../types";
+import { generateAuthImportTS, generateAuthGuardTS, generateAuthGuardCSharp, generateAuthGuardPython } from "./auth-generator";
 
 /**
  * Azure Functions エンティティファイルを生成（インラインハンドラー方式）
  * 各ハンドラーがベタ書きされており、ビジネスロジックの追加・変更が容易
  */
-export function generateCompactAzureFunctionsCRUD(model: ModelInfo, sharedPackageName: string): string {
+export function generateCompactAzureFunctionsCRUD(model: ModelInfo, sharedPackageName: string, authPolicy?: ModelAuthPolicy, authProvider?: AuthProvider): string {
   const modelName = model.name;
   const modelCamel = toCamelCase(modelName);
-  const modelKebab = toKebabCase(modelName);
   const schemaName = model.schemaName;
 
+  const partitionKeyPath = model.partitionKey; // e.g. "/tenantId"
+  const partitionKeyField = partitionKeyPath.slice(1); // e.g. "tenantId"
+  const isIdPartition = partitionKeyField === 'id';
+
+  const hasAuth = !!authPolicy;
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImport = hasAuth ? `\n${generateAuthImportTS(namedAuth)}\n` : '';
+  const readGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'read', authProvider)}\n` : '';
+  const writeGuard = hasAuth ? `\n${generateAuthGuardTS(authPolicy!, 'write', authProvider)}\n` : '';
+  const authCatchBlock = hasAuth
+    ? `      const authErr = handleAuthError(error);
+      if (authErr) return authErr;\n`
+    : '';
+
+  // SDK クライアント初期化ヘルパー（PK≠/id の場合、および delete で使用）
+  const sdkClientInit = `const { CosmosClient } = await import('@azure/cosmos');
+      const endpoint = process.env.CosmosDBConnection__accountEndpoint;
+      let client: InstanceType<typeof CosmosClient>;
+      if (endpoint) {
+        const { DefaultAzureCredential } = await import('@azure/identity');
+        client = new CosmosClient({ endpoint, aadCredentials: new DefaultAzureCredential() });
+      } else {
+        client = new CosmosClient(process.env.CosmosDBConnection!);
+      }
+      const database = client.database(process.env.COSMOS_DB_DATABASE_NAME || 'AppDatabase');
+      const container = database.container(containerName);`;
+
+  // getById ハンドラー: PK=/id の場合は input binding、それ以外は SDK
+  const getByIdHandler = isIdPartition
+    ? generateGetByIdWithBinding(modelCamel, schemaName, readGuard, authCatchBlock)
+    : generateGetByIdWithSdk(modelCamel, schemaName, readGuard, authCatchBlock, sdkClientInit);
+
+  // update ハンドラー: PK=/id の場合は input binding、それ以外は SDK
+  const updateHandler = isIdPartition
+    ? generateUpdateWithBinding(modelCamel, schemaName, writeGuard, authCatchBlock)
+    : generateUpdateWithSdk(modelCamel, schemaName, partitionKeyField, writeGuard, authCatchBlock, sdkClientInit);
+
+  // delete ハンドラー: 常に SDK（既存パターン）、PK に応じて分岐
+  const deleteHandler = isIdPartition
+    ? generateDeleteIdPartition(modelCamel, writeGuard, authCatchBlock, sdkClientInit)
+    : generateDeleteCustomPartition(modelCamel, partitionKeyField, writeGuard, authCatchBlock, sdkClientInit);
+
   return `import { app, HttpRequest, HttpResponseInit, InvocationContext } from '@azure/functions';
 import { z } from 'zod/v4';
 import crypto from 'crypto';
-import { ${schemaName} } from '${sharedPackageName}';
+import { ${schemaName} } from '${sharedPackageName}';${authImport}
 
-const containerName = '${modelName}s';
+const containerName = '${modelName.endsWith('s') ? modelName : modelName + 's'}';
 
 // GET /api/${modelCamel} - 全件取得
 app.http('${modelCamel}-get-all', {
   methods: ['GET'],
   route: '${modelCamel}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -39,8 +82,8 @@ app.http('${modelCamel}-get-all', {
     },
   ],
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
-      const documents = context.extraInputs.get('cosmosInput') as any[];
+    try {${readGuard}
+      const documents = context.extraInputs.get('cosmosInput') as unknown[];
 
       if (!documents || !Array.isArray(documents)) {
         return { status: 200, jsonBody: [] };
@@ -51,50 +94,19 @@ app.http('${modelCamel}-get-all', {
 
       return { status: 200, jsonBody: validated };
     } catch (error) {
-      context.error(\`Error fetching from \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error fetching from \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to fetch items' } };
     }
   },
 });
 
-// GET /api/${modelCamel}/{id} - ID指定取得
-app.http('${modelCamel}-get-by-id', {
-  methods: ['GET'],
-  route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
-  extraInputs: [
-    {
-      type: 'cosmosDB',
-      name: 'cosmosInput',
-      databaseName: process.env.COSMOS_DB_DATABASE_NAME || 'AppDatabase',
-      containerName,
-      connection: 'CosmosDBConnection',
-      id: '{id}',
-      partitionKey: '{id}',
-    },
-  ],
-  handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
-      const document = context.extraInputs.get('cosmosInput');
-
-      if (!document) {
-        return { status: 404, jsonBody: { error: 'Item not found' } };
-      }
-
-      const validated = ${schemaName}.parse(document);
-      return { status: 200, jsonBody: validated };
-    } catch (error) {
-      context.error(\`Error fetching item from \${containerName}:\`, error);
-      return { status: 500, jsonBody: { error: 'Failed to fetch item' } };
-    }
-  },
-});
+${getByIdHandler}
 
 // POST /api/${modelCamel} - 新規作成
 app.http('${modelCamel}-create', {
   methods: ['POST'],
   route: '${modelCamel}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraOutputs: [
     {
       type: 'cosmosDB',
@@ -106,8 +118,8 @@ app.http('${modelCamel}-create', {
     },
   ],
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
-      const body = await request.json() as any;
+    try {${writeGuard}
+      const body = await request.json() as Record<string, unknown>;
 
       const { id, createdAt, updatedAt, ...userData } = body;
       const now = new Date().toISOString();
@@ -128,17 +140,97 @@ app.http('${modelCamel}-create', {
       context.extraOutputs.set('cosmosOutput', result.data);
       return { status: 201, jsonBody: result.data };
     } catch (error) {
-      context.error(\`Error creating item in \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error creating item in \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to create item' } };
     }
   },
 });
 
-// PUT /api/${modelCamel}/{id} - 更新
+${updateHandler}
+
+${deleteHandler}
+`;
+}
+
+// --- TS getById ハンドラー生成ヘルパー ---
+
+function generateGetByIdWithBinding(modelCamel: string, schemaName: string, readGuard: string, authCatchBlock: string): string {
+  return `// GET /api/${modelCamel}/{id} - ID指定取得
+app.http('${modelCamel}-get-by-id', {
+  methods: ['GET'],
+  route: '${modelCamel}/{id}',
+  authLevel: 'function',
+  extraInputs: [
+    {
+      type: 'cosmosDB',
+      name: 'cosmosInput',
+      databaseName: process.env.COSMOS_DB_DATABASE_NAME || 'AppDatabase',
+      containerName,
+      connection: 'CosmosDBConnection',
+      id: '{id}',
+      partitionKey: '{id}',
+    },
+  ],
+  handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
+    try {${readGuard}
+      const document = context.extraInputs.get('cosmosInput');
+
+      if (!document) {
+        return { status: 404, jsonBody: { error: 'Item not found' } };
+      }
+
+      const validated = ${schemaName}.parse(document);
+      return { status: 200, jsonBody: validated };
+    } catch (error) {
+${authCatchBlock}      context.error(\`Error fetching item from \${containerName}:\`, error);
+      return { status: 500, jsonBody: { error: 'Failed to fetch item' } };
+    }
+  },
+});`;
+}
+
+function generateGetByIdWithSdk(modelCamel: string, schemaName: string, readGuard: string, authCatchBlock: string, sdkClientInit: string): string {
+  return `// GET /api/${modelCamel}/{id} - ID指定取得 (custom partition key)
+app.http('${modelCamel}-get-by-id', {
+  methods: ['GET'],
+  route: '${modelCamel}/{id}',
+  authLevel: 'function',
+  handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
+    try {${readGuard}
+      const id = request.params.id;
+      if (!id) {
+        return { status: 400, jsonBody: { error: 'ID is required' } };
+      }
+
+      ${sdkClientInit}
+
+      const { resources } = await container.items.query({
+        query: 'SELECT * FROM c WHERE c.id = @id',
+        parameters: [{ name: '@id', value: id }],
+      }).fetchAll();
+
+      if (!resources || resources.length === 0) {
+        return { status: 404, jsonBody: { error: 'Item not found' } };
+      }
+
+      const validated = ${schemaName}.parse(resources[0]);
+      return { status: 200, jsonBody: validated };
+    } catch (error) {
+${authCatchBlock}      context.error(\`Error fetching item from \${containerName}:\`, error);
+      return { status: 500, jsonBody: { error: 'Failed to fetch item' } };
+    }
+  },
+});`;
+}
+
+// --- TS update ハンドラー生成ヘルパー ---
+
+function generateUpdateWithBinding(modelCamel: string, schemaName: string, writeGuard: string, authCatchBlock: string): string {
+  return `// PUT /api/${modelCamel}/{id} - 更新
 app.http('${modelCamel}-update', {
   methods: ['PUT'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   extraInputs: [
     {
       type: 'cosmosDB',
@@ -160,18 +252,18 @@ app.http('${modelCamel}-update', {
     },
   ],
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${writeGuard}
       const id = request.params.id;
       if (!id) {
         return { status: 400, jsonBody: { error: 'ID is required' } };
       }
 
-      const existingDocument = context.extraInputs.get('cosmosInput') as any;
+      const existingDocument = context.extraInputs.get('cosmosInput') as Record<string, unknown> | undefined;
       if (!existingDocument) {
         return { status: 404, jsonBody: { error: 'Item not found' } };
       }
 
-      const body = await request.json() as any;
+      const body = await request.json() as Record<string, unknown>;
       const { createdAt, updatedAt, ...userData } = body;
 
       const dataWithManagedFields = {
@@ -191,57 +283,216 @@ app.http('${modelCamel}-update', {
       context.extraOutputs.set('cosmosOutput', result.data);
       return { status: 200, jsonBody: result.data };
     } catch (error) {
-      context.error(\`Error updating item in \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error updating item in \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to update item' } };
     }
   },
-});
+});`;
+}
+
+function generateUpdateWithSdk(modelCamel: string, schemaName: string, partitionKeyField: string, writeGuard: string, authCatchBlock: string, sdkClientInit: string): string {
+  return `// PUT /api/${modelCamel}/{id} - 更新 (custom partition key)
+app.http('${modelCamel}-update', {
+  methods: ['PUT'],
+  route: '${modelCamel}/{id}',
+  authLevel: 'function',
+  handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
+    try {${writeGuard}
+      const id = request.params.id;
+      if (!id) {
+        return { status: 400, jsonBody: { error: 'ID is required' } };
+      }
+
+      ${sdkClientInit}
+
+      const { resources } = await container.items.query({
+        query: 'SELECT * FROM c WHERE c.id = @id',
+        parameters: [{ name: '@id', value: id }],
+      }).fetchAll();
+
+      if (!resources || resources.length === 0) {
+        return { status: 404, jsonBody: { error: 'Item not found' } };
+      }
+
+      const existingDocument = resources[0];
+      const body = await request.json() as Record<string, unknown>;
+      const { createdAt, updatedAt, ...userData } = body;
+
+      const dataWithManagedFields = {
+        ...userData,
+        id,
+        createdAt: existingDocument.createdAt,
+        updatedAt: new Date().toISOString(),
+      };
+
+      const result = ${schemaName}.safeParse(dataWithManagedFields);
+
+      if (!result.success) {
+        context.error('Validation failed:', result.error.issues);
+        return { status: 400, jsonBody: { error: 'Validation failed', details: result.error.issues } };
+      }
+
+      const pkValue = result.data.${partitionKeyField};
+      await container.items.upsert(result.data);
+      return { status: 200, jsonBody: result.data };
+    } catch (error) {
+${authCatchBlock}      context.error(\`Error updating item in \${containerName}:\`, error);
+      return { status: 500, jsonBody: { error: 'Failed to update item' } };
+    }
+  },
+});`;
+}
+
+// --- TS delete ハンドラー生成ヘルパー ---
 
-// DELETE /api/${modelCamel}/{id} - 削除
+function generateDeleteIdPartition(modelCamel: string, writeGuard: string, authCatchBlock: string, sdkClientInit: string): string {
+  return `// DELETE /api/${modelCamel}/{id} - 削除
 app.http('${modelCamel}-delete', {
   methods: ['DELETE'],
   route: '${modelCamel}/{id}',
-  authLevel: 'anonymous',
+  authLevel: 'function',
   handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
-    try {
+    try {${writeGuard}
       const id = request.params.id;
       if (!id) {
         return { status: 400, jsonBody: { error: 'ID is required' } };
       }
 
-      const { CosmosClient } = await import('@azure/cosmos');
-      const endpoint = process.env.CosmosDBConnection__accountEndpoint;
-      let client: InstanceType<typeof CosmosClient>;
-      if (endpoint) {
-        const { DefaultAzureCredential } = await import('@azure/identity');
-        client = new CosmosClient({ endpoint, aadCredentials: new DefaultAzureCredential() });
-      } else {
-        client = new CosmosClient(process.env.CosmosDBConnection!);
-      }
-      const database = client.database(process.env.COSMOS_DB_DATABASE_NAME || 'AppDatabase');
-      const container = database.container(containerName);
+      ${sdkClientInit}
 
       await container.item(id, id).delete();
       context.log(\`Deleted item \${id} from \${containerName}\`);
 
       return { status: 204 };
-    } catch (error: any) {
-      if (error.code === 404) {
+    } catch (error) {
+      if ((error as { code?: number }).code === 404) {
         return { status: 404, jsonBody: { error: 'Item not found' } };
       }
-      context.error(\`Error deleting item from \${containerName}:\`, error);
+${authCatchBlock}      context.error(\`Error deleting item from \${containerName}:\`, error);
       return { status: 500, jsonBody: { error: 'Failed to delete item' } };
     }
   },
-});
-`;
+});`;
 }
 
-export function generateCSharpAzureFunctionsCRUD(model: ModelInfo): string {
+function generateDeleteCustomPartition(modelCamel: string, partitionKeyField: string, writeGuard: string, authCatchBlock: string, sdkClientInit: string): string {
+  return `// DELETE /api/${modelCamel}/{id} - 削除 (custom partition key)
+app.http('${modelCamel}-delete', {
+  methods: ['DELETE'],
+  route: '${modelCamel}/{id}',
+  authLevel: 'function',
+  handler: async (request: HttpRequest, context: InvocationContext): Promise<HttpResponseInit> => {
+    try {${writeGuard}
+      const id = request.params.id;
+      if (!id) {
+        return { status: 400, jsonBody: { error: 'ID is required' } };
+      }
+
+      ${sdkClientInit}
+
+      // パーティションキー値を取得するためにドキュメントを読み取り
+      const { resources } = await container.items.query({
+        query: 'SELECT * FROM c WHERE c.id = @id',
+        parameters: [{ name: '@id', value: id }],
+      }).fetchAll();
+
+      if (!resources || resources.length === 0) {
+        return { status: 404, jsonBody: { error: 'Item not found' } };
+      }
+
+      const pkValue = resources[0].${partitionKeyField};
+      await container.item(id, pkValue).delete();
+      context.log(\`Deleted item \${id} from \${containerName}\`);
+
+      return { status: 204 };
+    } catch (error) {
+      if ((error as { code?: number }).code === 404) {
+        return { status: 404, jsonBody: { error: 'Item not found' } };
+      }
+${authCatchBlock}      context.error(\`Error deleting item from \${containerName}:\`, error);
+      return { status: 500, jsonBody: { error: 'Failed to delete item' } };
+    }
+  },
+});`;
+}
+
+export function generateCSharpAzureFunctionsCRUD(model: ModelInfo, authPolicy?: ModelAuthPolicy): string {
   const modelName = model.name;
   const modelCamel = toCamelCase(modelName);
-  const className = `${modelName}Functions`;
-  const containerName = `${modelName}s`;
+  const className = `${modelName}CrudFunctions`;
+  const containerName = modelName.endsWith('s') ? modelName : `${modelName}s`;
+
+  const partitionKeyPath = model.partitionKey;
+  const partitionKeyField = partitionKeyPath.slice(1);
+  const isIdPartition = partitionKeyField === 'id';
+
+  const hasAuth = !!authPolicy;
+  const authUsing = hasAuth ? 'using Functions.Auth;\n' : '';
+  const readGuard = hasAuth ? `\n${generateAuthGuardCSharp(authPolicy!, 'read')}\n` : '';
+  const writeGuard = hasAuth ? `\n${generateAuthGuardCSharp(authPolicy!, 'write')}\n` : '';
+
+  // PK値の取得ロジック（create 用）
+  const createPkExpr = isIdPartition
+    ? 'id'
+    : `payload["${partitionKeyField}"]?.GetValue<string>() ?? throw new InvalidOperationException("Partition key field '${partitionKeyField}' is required.")`;
+
+  // ReadCosmosItemAsync: PK=/id の場合は直接読み取り、それ以外はクエリ
+  const readItemMethod = isIdPartition
+    ? `    private static async Task<JsonObject> ReadCosmosItemAsync(Container container, string id)
+    {
+        var response = await container.ReadItemStreamAsync(id, new PartitionKey(id));
+        if (response.StatusCode == HttpStatusCode.NotFound)
+        {
+            throw new CosmosException("Item not found", HttpStatusCode.NotFound, 0, response.Headers.ActivityId, response.Headers.RequestCharge);
+        }
+
+        if (!response.IsSuccessStatusCode)
+        {
+            throw new InvalidOperationException($"Cosmos read failed with status {(int)response.StatusCode}.");
+        }
+
+        using var document = await JsonDocument.ParseAsync(response.Content);
+        return JsonNode.Parse(document.RootElement.GetRawText())?.AsObject()
+            ?? throw new JsonException("Cosmos item payload must be a JSON object.");
+    }`
+    : `    private static async Task<JsonObject> ReadCosmosItemAsync(Container container, string id)
+    {
+        var query = new QueryDefinition("SELECT * FROM c WHERE c.id = @id")
+            .WithParameter("@id", id);
+        using var iterator = container.GetItemQueryStreamIterator(query);
+
+        while (iterator.HasMoreResults)
+        {
+            var page = await iterator.ReadNextAsync();
+            if (!page.IsSuccessStatusCode)
+            {
+                throw new InvalidOperationException($"Cosmos query failed with status {(int)page.StatusCode}.");
+            }
+
+            using var document = await JsonDocument.ParseAsync(page.Content);
+            if (document.RootElement.TryGetProperty("Documents", out var documents))
+            {
+                foreach (var item in documents.EnumerateArray())
+                {
+                    return JsonNode.Parse(item.GetRawText())?.AsObject()
+                        ?? throw new JsonException("Cosmos item payload must be a JSON object.");
+                }
+            }
+        }
+
+        throw new CosmosException("Item not found", HttpStatusCode.NotFound, 0, "", 0);
+    }`;
+
+  // Replace / Delete の PK 解決ロジック
+  const replacePkExpr = isIdPartition
+    ? 'new PartitionKey(id)'
+    : `new PartitionKey(payload["${partitionKeyField}"]?.GetValue<string>())`;
+
+  const deleteLogic = isIdPartition
+    ? `            await container.DeleteItemAsync<JsonObject>(id, new PartitionKey(id));`
+    : `            var existing = await ReadCosmosItemAsync(container, id);
+            var pkValue = existing["${partitionKeyField}"]?.GetValue<string>();
+            await container.DeleteItemAsync<JsonObject>(id, new PartitionKey(pkValue));`;
 
   return `using System.Net;
 using System.Text;
@@ -252,7 +503,7 @@ using Microsoft.Azure.Cosmos;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
 using Microsoft.Extensions.Logging;
-
+${authUsing}
 namespace SwallowKit.Functions;
 
 public sealed class ${className}
@@ -335,23 +586,7 @@ public sealed class ${className}
     private static Stream CreateJsonStream(JsonObject payload) =>
         new MemoryStream(Encoding.UTF8.GetBytes(payload.ToJsonString()));
 
-    private static async Task<JsonObject> ReadCosmosItemAsync(Container container, string id)
-    {
-        var response = await container.ReadItemStreamAsync(id, new PartitionKey(id));
-        if (response.StatusCode == HttpStatusCode.NotFound)
-        {
-            throw new CosmosException("Item not found", HttpStatusCode.NotFound, 0, response.Headers.ActivityId, response.Headers.RequestCharge);
-        }
-
-        if (!response.IsSuccessStatusCode)
-        {
-            throw new InvalidOperationException($"Cosmos read failed with status {(int)response.StatusCode}.");
-        }
-
-        using var document = await JsonDocument.ParseAsync(response.Content);
-        return JsonNode.Parse(document.RootElement.GetRawText())?.AsObject()
-            ?? throw new JsonException("Cosmos item payload must be a JSON object.");
-    }
+${readItemMethod}
 
     private static async Task<HttpResponseData> WriteJsonAsync(HttpRequestData request, HttpStatusCode status, object payload)
     {
@@ -362,10 +597,10 @@ public sealed class ${className}
 
     [Function("${modelCamel}GetAll")]
     public async Task<HttpResponseData> GetAll(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "${modelCamel}")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "${modelCamel}")] HttpRequestData request)
     {
         try
-        {
+        {${readGuard}
             using var client = CreateCosmosClient();
             var container = GetContainer(client);
             using var iterator = container.GetItemQueryStreamIterator("SELECT * FROM c");
@@ -403,11 +638,11 @@ public sealed class ${className}
 
     [Function("${modelCamel}GetById")]
     public async Task<HttpResponseData> GetById(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "get", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
-        {
+        {${readGuard}
             using var client = CreateCosmosClient();
             var container = GetContainer(client);
             var item = await ReadCosmosItemAsync(container, id);
@@ -426,10 +661,10 @@ public sealed class ${className}
 
     [Function("${modelCamel}Create")]
     public async Task<HttpResponseData> Create(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "${modelCamel}")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "post", Route = "${modelCamel}")] HttpRequestData request)
     {
         try
-        {
+        {${writeGuard}
             var body = await ReadRequestBodyAsync(request);
             var now = DateTimeOffset.UtcNow.ToString("O");
             var id = body["id"]?.GetValue<string>() ?? Guid.NewGuid().ToString();
@@ -438,7 +673,8 @@ public sealed class ${className}
             using var client = CreateCosmosClient();
             var container = GetContainer(client);
             using var stream = CreateJsonStream(payload);
-            var response = await container.CreateItemStreamAsync(stream, new PartitionKey(id));
+            var pkValue = ${createPkExpr};
+            var response = await container.CreateItemStreamAsync(stream, new PartitionKey(pkValue));
             if (!response.IsSuccessStatusCode)
             {
                 throw new InvalidOperationException($"Cosmos create failed with status {(int)response.StatusCode}.");
@@ -460,11 +696,11 @@ public sealed class ${className}
 
     [Function("${modelCamel}Update")]
     public async Task<HttpResponseData> Update(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "put", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "put", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
-        {
+        {${writeGuard}
             using var client = CreateCosmosClient();
             var container = GetContainer(client);
 
@@ -483,7 +719,7 @@ public sealed class ${className}
             var payload = BuildManagedDocument(body, id, createdAt, DateTimeOffset.UtcNow.ToString("O"));
 
             using var stream = CreateJsonStream(payload);
-            var response = await container.ReplaceItemStreamAsync(stream, id, new PartitionKey(id));
+            var response = await container.ReplaceItemStreamAsync(stream, id, ${replacePkExpr});
             if (!response.IsSuccessStatusCode)
             {
                 throw new InvalidOperationException($"Cosmos replace failed with status {(int)response.StatusCode}.");
@@ -505,14 +741,14 @@ public sealed class ${className}
 
     [Function("${modelCamel}Delete")]
     public async Task<HttpResponseData> Delete(
-        [HttpTrigger(AuthorizationLevel.Anonymous, "delete", Route = "${modelCamel}/{id}")] HttpRequestData request,
+        [HttpTrigger(AuthorizationLevel.Function, "delete", Route = "${modelCamel}/{id}")] HttpRequestData request,
         string id)
     {
         try
-        {
+        {${writeGuard}
             using var client = CreateCosmosClient();
             var container = GetContainer(client);
-            await container.DeleteItemAsync<JsonObject>(id, new PartitionKey(id));
+${deleteLogic}
 
             return request.CreateResponse(HttpStatusCode.NoContent);
         }
@@ -530,14 +766,90 @@ public sealed class ${className}
 `;
 }
 
-export function generatePythonAzureFunctionsCRUD(model: ModelInfo): {
+export function generatePythonAzureFunctionsCRUD(model: ModelInfo, authPolicy?: ModelAuthPolicy): {
   blueprint: string;
   registration: string;
 } {
   const modelName = model.name;
   const modelCamel = toCamelCase(modelName);
   const modelSnake = toKebabCase(modelName).replace(/-/g, "_");
-  const containerName = `${modelName}s`;
+  const containerName = modelName.endsWith('s') ? modelName : `${modelName}s`;
+
+  const partitionKeyPath = model.partitionKey;
+  const partitionKeyField = partitionKeyPath.slice(1);
+  const isIdPartition = partitionKeyField === 'id';
+
+  const hasAuth = !!authPolicy;
+  const namedAuth = Boolean(authPolicy && (authPolicy.policy || typeof authPolicy.read === 'string' || typeof authPolicy.write === 'string'));
+  const authImport = hasAuth ? `\nfrom auth.${namedAuth ? 'auth_router' : 'jwt_helper'} import require_auth, require_roles, handle_auth_error\n` : '';
+  // generateAuthGuardPython outputs at 4-space indent; inside try: we need 8-space
+  const readGuardRaw = hasAuth ? generateAuthGuardPython(authPolicy!, 'read') : '';
+  const writeGuardRaw = hasAuth ? generateAuthGuardPython(authPolicy!, 'write') : '';
+  const readGuard = hasAuth ? '\n' + readGuardRaw.split('\n').map(l => '    ' + l).join('\n') : '';
+  const writeGuard = hasAuth ? '\n' + writeGuardRaw.split('\n').map(l => '    ' + l).join('\n') : '';
+  const authCatch = hasAuth ? `\n        auth_err = handle_auth_error(exc)\n        if auth_err:\n            return auth_err` : '';
+
+  // getById / update の読み取りロジック
+  const getByIdBody = isIdPartition
+    ? `        container = _get_container()
+        item = container.read_item(item=item_id, partition_key=item_id)
+        return _json_response(item, 200)`
+    : `        container = _get_container()
+        items = list(container.query_items(
+            query="SELECT * FROM c WHERE c.id = @id",
+            parameters=[{"name": "@id", "value": item_id}],
+            enable_cross_partition_query=True,
+        ))
+        if not items:
+            return _json_response({"error": "${modelName} not found", "id": item_id}, 404)
+        return _json_response(items[0], 200)`;
+
+  const updateBody = isIdPartition
+    ? `        container = _get_container()
+        existing = container.read_item(item=item_id, partition_key=item_id)
+        body = req.get_json()
+        payload = _build_managed_document(
+            body,
+            item_id,
+            existing.get("createdAt") or datetime.now(timezone.utc).isoformat(),
+            datetime.now(timezone.utc).isoformat(),
+        )
+        container.replace_item(item=item_id, body=payload)
+        return _json_response(payload, 200)`
+    : `        container = _get_container()
+        items = list(container.query_items(
+            query="SELECT * FROM c WHERE c.id = @id",
+            parameters=[{"name": "@id", "value": item_id}],
+            enable_cross_partition_query=True,
+        ))
+        if not items:
+            return _json_response({"error": "${modelName} not found", "id": item_id}, 404)
+        existing = items[0]
+        body = req.get_json()
+        payload = _build_managed_document(
+            body,
+            item_id,
+            existing.get("createdAt") or datetime.now(timezone.utc).isoformat(),
+            datetime.now(timezone.utc).isoformat(),
+        )
+        container.replace_item(item=existing, body=payload)
+        return _json_response(payload, 200)`;
+
+  const deleteBody = isIdPartition
+    ? `        container = _get_container()
+        container.delete_item(item=item_id, partition_key=item_id)
+        return func.HttpResponse(status_code=204)`
+    : `        container = _get_container()
+        items = list(container.query_items(
+            query="SELECT * FROM c WHERE c.id = @id",
+            parameters=[{"name": "@id", "value": item_id}],
+            enable_cross_partition_query=True,
+        ))
+        if not items:
+            return _json_response({"error": "${modelName} not found", "id": item_id}, 404)
+        pk_value = items[0].get("${partitionKeyField}")
+        container.delete_item(item=item_id, partition_key=pk_value)
+        return func.HttpResponse(status_code=204)`;
 
   return {
     registration: `from blueprints.${modelSnake} import bp as ${modelSnake}_bp\napp.register_blueprint(${modelSnake}_bp)`,
@@ -550,7 +862,7 @@ import os
 import azure.functions as func
 from azure.cosmos import CosmosClient, exceptions
 from azure.identity import DefaultAzureCredential
-
+${authImport}
 bp = func.Blueprint()
 CONTAINER_NAME = "${containerName}"
 DATABASE_NAME = os.environ.get("COSMOS_DB_DATABASE_NAME", "AppDatabase")
@@ -592,7 +904,7 @@ def _build_managed_document(source: dict[str, Any], item_id: str, created_at: st
 
 @bp.route(route="${modelCamel}", methods=["GET"])
 def ${modelSnake}_get_all(req: func.HttpRequest) -> func.HttpResponse:
-    try:
+    try:${readGuard}
         container = _get_container()
         items = list(
             container.query_items(
@@ -601,26 +913,24 @@ def ${modelSnake}_get_all(req: func.HttpRequest) -> func.HttpResponse:
             )
         )
         return _json_response(items, 200)
-    except Exception as exc:
+    except Exception as exc:${authCatch}
         return _json_response({"error": "Failed to fetch items", "details": str(exc)}, 500)
 
 
 @bp.route(route="${modelCamel}/{id}", methods=["GET"])
 def ${modelSnake}_get_by_id(req: func.HttpRequest) -> func.HttpResponse:
     item_id = req.route_params.get("id")
-    try:
-        container = _get_container()
-        item = container.read_item(item=item_id, partition_key=item_id)
-        return _json_response(item, 200)
+    try:${readGuard}
+${getByIdBody}
     except exceptions.CosmosResourceNotFoundError:
         return _json_response({"error": "${modelName} not found", "id": item_id}, 404)
-    except Exception as exc:
+    except Exception as exc:${authCatch}
         return _json_response({"error": "Failed to fetch item", "id": item_id, "details": str(exc)}, 500)
 
 
 @bp.route(route="${modelCamel}", methods=["POST"])
 def ${modelSnake}_create(req: func.HttpRequest) -> func.HttpResponse:
-    try:
+    try:${writeGuard}
         body = req.get_json()
         now = datetime.now(timezone.utc).isoformat()
         item_id = body.get("id") or str(uuid4())
@@ -631,43 +941,31 @@ def ${modelSnake}_create(req: func.HttpRequest) -> func.HttpResponse:
         return _json_response(payload, 201)
     except ValueError:
         return _json_response({"error": "Request body must be a JSON object."}, 400)
-    except Exception as exc:
+    except Exception as exc:${authCatch}
         return _json_response({"error": "Failed to create item", "details": str(exc)}, 500)
 
 
 @bp.route(route="${modelCamel}/{id}", methods=["PUT"])
 def ${modelSnake}_update(req: func.HttpRequest) -> func.HttpResponse:
     item_id = req.route_params.get("id")
-    try:
-        container = _get_container()
-        existing = container.read_item(item=item_id, partition_key=item_id)
-        body = req.get_json()
-        payload = _build_managed_document(
-            body,
-            item_id,
-            existing.get("createdAt") or datetime.now(timezone.utc).isoformat(),
-            datetime.now(timezone.utc).isoformat(),
-        )
-        container.replace_item(item=item_id, body=payload)
-        return _json_response(payload, 200)
+    try:${writeGuard}
+${updateBody}
     except exceptions.CosmosResourceNotFoundError:
         return _json_response({"error": "${modelName} not found", "id": item_id}, 404)
     except ValueError:
         return _json_response({"error": "Request body must be a JSON object.", "id": item_id}, 400)
-    except Exception as exc:
+    except Exception as exc:${authCatch}
         return _json_response({"error": "Failed to update item", "id": item_id, "details": str(exc)}, 500)
 
 
 @bp.route(route="${modelCamel}/{id}", methods=["DELETE"])
 def ${modelSnake}_delete(req: func.HttpRequest) -> func.HttpResponse:
     item_id = req.route_params.get("id")
-    try:
-        container = _get_container()
-        container.delete_item(item=item_id, partition_key=item_id)
-        return func.HttpResponse(status_code=204)
+    try:${writeGuard}
+${deleteBody}
     except exceptions.CosmosResourceNotFoundError:
         return _json_response({"error": "${modelName} not found", "id": item_id}, 404)
-    except Exception as exc:
+    except Exception as exc:${authCatch}
         return _json_response({"error": "Failed to delete item", "id": item_id, "details": str(exc)}, 500)
 `,
   };