swallowkit 1.0.0-beta.9 → 1.0.1

package/dist/cli/commands/add-auth.js

@@ -0,0 +1,790 @@
+"use strict";
+/**
+ * SwallowKit Add-Auth コマンド
+ * 認証認可基盤ファイルを生成する
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSwaAuthContext = generateSwaAuthContext;
+exports.addAuthProviderToRootLayout = addAuthProviderToRootLayout;
+exports.addAuthCommand = addAuthCommand;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../../core/config");
+const auth_generator_1 = require("../../core/scaffold/auth-generator");
+const manifest_1 = require("../../core/project/manifest");
+const file_session_1 = require("../../core/operations/file-session");
+const artifacts_1 = require("../../core/project/artifacts");
+const init_1 = require("./init");
+const SWA_PROVIDER_LABELS = {
+    aad: "Microsoft",
+    github: "GitHub",
+    google: "Google",
+    twitter: "X",
+    apple: "Apple",
+    facebook: "Facebook",
+};
+function swaProviderLabel(provider) {
+    return SWA_PROVIDER_LABELS[provider] ?? provider.charAt(0).toUpperCase() + provider.slice(1);
+}
+function normalizeSwaProviders(allowedProviders) {
+    const providers = (allowedProviders ?? []).map((p) => p.trim().toLowerCase()).filter(Boolean);
+    for (const provider of providers) {
+        if (!/^[a-z0-9-]+$/.test(provider))
+            throw new Error(`Invalid SWA identity provider name: ${provider}`);
+    }
+    return providers.length > 0 ? providers : ["aad"];
+}
+const AUTH_GENERATOR = "add-auth";
+const managedMeta = { ownership: "managed", generator: AUTH_GENERATOR };
+const extensionMeta = { ownership: "extension-point", generator: AUTH_GENERATOR };
+const onceMeta = { ownership: "generated-once", generator: AUTH_GENERATOR };
+function writeIfMissing(session, filePath, content) {
+    if (session.fileExists(filePath))
+        return;
+    session.writeFile(filePath, content, onceMeta);
+}
+function defaultCustomJwtConfig() {
+    return {
+        userConnector: "mysql",
+        userTable: "users",
+        loginIdColumn: "login_id",
+        passwordHashColumn: "password_hash",
+        rolesColumn: "roles",
+        jwtSecretEnv: "JWT_SECRET",
+        tokenExpiry: "24h",
+    };
+}
+function setupSwaAuth(cwd, backendLanguage, session, allowedProviders) {
+    const providers = normalizeSwaProviders(allowedProviders);
+    const helperPath = backendLanguage === "typescript"
+        ? path.join(cwd, "functions", "src", "auth", "jwt-helper.ts")
+        : backendLanguage === "csharp"
+            ? path.join(cwd, "functions", "Auth", "JwtHelper.cs")
+            : path.join(cwd, "functions", "auth", "jwt_helper.py");
+    const helper = backendLanguage === "typescript"
+        ? (0, auth_generator_1.generateSwaAuthHelperTS)()
+        : backendLanguage === "csharp"
+            ? (0, auth_generator_1.generateSwaAuthHelperCSharp)()
+            : (0, auth_generator_1.generateSwaAuthHelperPython)();
+    session.writeFile(helperPath, helper, managedMeta);
+    const callFnPath = path.join(cwd, "lib", "api", "call-function.ts");
+    session.writeFile(callFnPath, (0, auth_generator_1.generateBFFCallFunctionWithSwaAuth)(), managedMeta);
+    const authDir = path.join(cwd, "lib", "auth");
+    session.writeFile(path.join(authDir, "auth-context.tsx"), generateSwaAuthContext(providers), managedMeta);
+    updateRootLayoutWithAuthProvider(cwd, session);
+    const loginDir = path.join(cwd, "app", "login");
+    session.writeFile(path.join(loginDir, "page.tsx"), generateSwaLoginPage(providers), managedMeta);
+    updateSwaRouteConfig(cwd, session, providers);
+}
+function setupExternalTokenAuth(cwd, backendLanguage, session) {
+    const authDir = path.join(cwd, "lib", "auth");
+    writeIfMissing(session, path.join(authDir, "external-token-adapter.ts"), (0, auth_generator_1.generateExternalTokenAdapter)());
+    session.writeFile(path.join(authDir, "authenticated-fetch.ts"), (0, auth_generator_1.generateAuthenticatedFetch)(), managedMeta);
+    session.writeFile(path.join(authDir, "auth-context.tsx"), (0, auth_generator_1.generateExternalTokenAuthContext)(), managedMeta);
+    session.writeFile(path.join(cwd, "lib", "api", "call-function.ts"), (0, auth_generator_1.generateBFFCallFunctionWithAuth)(), managedMeta);
+    const meDir = path.join(cwd, "app", "api", "auth", "me");
+    session.writeFile(path.join(meDir, "route.ts"), (0, auth_generator_1.generateExternalTokenBFFMeRoute)(), managedMeta);
+    updateRootLayoutWithAuthProvider(cwd, session);
+    if (backendLanguage === "typescript") {
+        const verifier = path.join(cwd, "functions", "src", "auth", "external-token-verifier.ts");
+        writeIfMissing(session, verifier, (0, auth_generator_1.generateExternalTokenVerifierTS)());
+        session.writeFile(path.join(cwd, "functions", "src", "auth", "jwt-helper.ts"), (0, auth_generator_1.generateExternalTokenHelperTS)(), managedMeta);
+        session.writeFile(path.join(cwd, "functions", "src", "auth-me.ts"), (0, auth_generator_1.generateExternalAuthMeTS)(), managedMeta);
+    }
+    else if (backendLanguage === "csharp") {
+        const verifier = path.join(cwd, "functions", "Auth", "ExternalTokenVerifier.cs");
+        writeIfMissing(session, verifier, (0, auth_generator_1.generateExternalTokenVerifierCSharp)());
+        session.writeFile(path.join(cwd, "functions", "Auth", "JwtHelper.cs"), (0, auth_generator_1.generateExternalTokenHelperCSharp)(), managedMeta);
+        session.writeFile(path.join(cwd, "functions", "Auth", "ExternalAuthMe.cs"), (0, auth_generator_1.generateExternalAuthMeCSharp)(), managedMeta);
+    }
+    else {
+        const verifier = path.join(cwd, "functions", "auth", "external_token_verifier.py");
+        writeIfMissing(session, verifier, (0, auth_generator_1.generateExternalTokenVerifierPython)());
+        session.writeFile(path.join(cwd, "functions", "auth", "jwt_helper.py"), (0, auth_generator_1.generateExternalTokenHelperPython)(), managedMeta);
+        const authMePath = path.join(cwd, "functions", "blueprints", "auth_me.py");
+        session.writeFile(authMePath, (0, auth_generator_1.generateExternalAuthMePython)(), managedMeta);
+        updatePythonAuthMeRegistration(cwd, session);
+    }
+}
+function updatePythonAuthMeRegistration(cwd, session) {
+    const appPath = path.join(cwd, "functions", "function_app.py");
+    if (!session.fileExists(appPath))
+        return;
+    const importLine = "from blueprints.auth_me import bp as external_auth_me_bp";
+    const registerLine = "app.register_blueprint(external_auth_me_bp)";
+    let content = session.readFile(appPath);
+    if (content.includes(importLine))
+        return;
+    const marker = "# SwallowKit scaffold registrations";
+    content = content.includes(marker)
+        ? content.replace(marker, `${importLine}\n${registerLine}\n${marker}`)
+        : `${content.trimEnd()}\n${importLine}\n${registerLine}\n`;
+    session.writeFile(appPath, content, extensionMeta);
+}
+function generateSwaLoginPage(allowedProviders) {
+    const providers = normalizeSwaProviders(allowedProviders);
+    const links = providers
+        .map((provider) => `<a href="/.auth/login/${provider}?post_login_redirect_uri=/">Sign in with ${swaProviderLabel(provider)}</a>`)
+        .join("");
+    return `'use client';
+export default function LoginPage() {
+  return <main><h1>Sign in</h1>${links}</main>;
+}
+`;
+}
+function generateSwaAuthContext(allowedProviders) {
+    const providers = normalizeSwaProviders(allowedProviders);
+    const primaryProvider = providers[0];
+    return `'use client';
+import { createContext, useContext, useEffect, useState, type ReactNode } from 'react';
+
+export interface AuthUser { id: string; loginId: string; name: string; email: string; roles: string[]; }
+interface AuthContextValue { user: AuthUser | null; loading: boolean; login: () => void; logout: () => void; hasRole: (role: string) => boolean; hasAnyRole: (roles: string[]) => boolean; }
+const AuthContext = createContext<AuthContextValue | null>(null);
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [user, setUser] = useState<AuthUser | null>(null);
+  const [loading, setLoading] = useState(true);
+  useEffect(() => {
+    fetch('/.auth/me')
+      .then(async response => {
+        if (!response.ok) throw new Error('SWA authentication is unavailable');
+        const body: unknown = await response.json();
+        if (!body || typeof body !== 'object' || !('clientPrincipal' in body)) return null;
+        const principal = body.clientPrincipal;
+        if (!principal || typeof principal !== 'object') return null;
+        const value = principal as Record<string, unknown>;
+        if (typeof value.userId !== 'string') return null;
+        return {
+          id: value.userId,
+          loginId: typeof value.userDetails === 'string' ? value.userDetails : '',
+          name: typeof value.userDetails === 'string' ? value.userDetails : '',
+          email: typeof value.userDetails === 'string' ? value.userDetails : '',
+          roles: Array.isArray(value.userRoles) ? value.userRoles.filter((role): role is string => typeof role === 'string') : [],
+        } satisfies AuthUser;
+      })
+      .then(setUser)
+      .catch(() => setUser(null))
+      .finally(() => setLoading(false));
+  }, []);
+  const login = () => { window.location.href = '/.auth/login/${primaryProvider}?post_login_redirect_uri=/'; };
+  const logout = () => { window.location.href = '/.auth/logout?post_logout_redirect_uri=/'; };
+  const hasRole = (role: string) => user?.roles.includes(role) ?? false;
+  return <AuthContext.Provider value={{ user, loading, login, logout, hasRole, hasAnyRole: roles => roles.some(hasRole) }}>{children}</AuthContext.Provider>;
+}
+export function useAuth() { const value = useContext(AuthContext); if (!value) throw new Error('useAuth must be used within an AuthProvider'); return value; }
+`;
+}
+function addAuthProviderToRootLayout(layout) {
+    let updated = layout;
+    if (!/import\s*\{[^}]*\bAuthProvider\b[^}]*\}\s*from\s*['"]@\/lib\/auth\/auth-context['"]/.test(updated)) {
+        const directive = updated.match(/^(?:\s*['"]use (?:client|server)['"];?\s*\r?\n)/)?.[0] ?? "";
+        updated = `${directive}import { AuthProvider } from '@/lib/auth/auth-context';\n${updated.slice(directive.length)}`;
+    }
+    if (!/<AuthProvider(?:\s|>)/.test(updated)) {
+        const childrenIndex = updated.lastIndexOf("{children}");
+        if (childrenIndex === -1) {
+            throw new Error("Could not find {children} in app/layout.tsx");
+        }
+        updated = `${updated.slice(0, childrenIndex)}<AuthProvider>{children}</AuthProvider>${updated.slice(childrenIndex + "{children}".length)}`;
+    }
+    return updated;
+}
+function updateRootLayoutWithAuthProvider(cwd, session) {
+    const layoutPath = path.join(cwd, "app", "layout.tsx");
+    if (!session.fileExists(layoutPath)) {
+        throw new Error("app/layout.tsx was not found; cannot install AuthProvider");
+    }
+    const layout = session.readFile(layoutPath);
+    const updated = addAuthProviderToRootLayout(layout);
+    if (updated !== layout)
+        session.writeFile(layoutPath, updated, extensionMeta);
+}
+function updateSwaRouteConfig(cwd, session, allowedProviders) {
+    const primaryProvider = normalizeSwaProviders(allowedProviders)[0];
+    const configPath = path.join(cwd, "staticwebapp.config.json");
+    const config = session.fileExists(configPath) ? JSON.parse(session.readFile(configPath)) : {};
+    config.routes = Array.isArray(config.routes)
+        ? config.routes.filter((route) => route.route !== "/api/*")
+        : [];
+    config.routes.unshift({ route: "/api/*", allowedRoles: ["authenticated"] });
+    config.responseOverrides = { ...(config.responseOverrides || {}), "401": { statusCode: 302, redirect: `/.auth/login/${primaryProvider}?post_login_redirect_uri=.referrer` } };
+    session.writeFile(configPath, JSON.stringify(config, null, 2), extensionMeta);
+}
+async function addAuthCommand(options) {
+    (0, config_1.ensureSwallowKitProject)("add-auth");
+    console.log(" SwallowKit Add-Auth: Setting up authentication...\n");
+    const provider = (options.provider || "custom-jwt");
+    if (!["custom-jwt", "swa", "external-token", "swa-custom", "none"].includes(provider)) {
+        console.error(` Unknown provider: ${provider}. Use: custom-jwt | swa | external-token | swa-custom | none`);
+        process.exit(1);
+    }
+    const backendLanguage = (0, config_1.getBackendLanguage)();
+    const config = (0, config_1.getValidatedFullConfig)();
+    const cwd = process.cwd();
+    // Plan(dry-run) や Apply からセッションが供給される。単体実行時は commit セッションを生成。
+    const session = (0, file_session_1.getActiveFileSession)() ?? new file_session_1.FileOperationSession("commit");
+    const finalize = async () => {
+        if (session.mode === "commit") {
+            (0, artifacts_1.recordSessionOperations)(session.operations);
+            await (0, manifest_1.syncProjectManifest)();
+        }
+    };
+    if (options.scheme) {
+        if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(options.scheme))
+            throw new Error("--scheme must start with a letter and contain only letters, digits, '_' or '-'");
+        if (provider === "none" || provider === "swa-custom")
+            throw new Error(`Provider '${provider}' cannot be added as a named scheme`);
+        addNamedScheme(cwd, options.scheme, provider, backendLanguage, session, options.allowedProviders);
+        await finalize();
+        console.log(`\n Named authentication scheme '${options.scheme}' added.`);
+        return;
+    }
+    if (provider === "swa-custom") {
+        throw new Error("The swa-custom provider is not implemented. Use --provider swa or --provider custom-jwt.");
+    }
+    if (provider === "none") {
+        updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig(), session);
+        await finalize();
+        console.log(" Authentication disabled in swallowkit.config.js");
+        return;
+    }
+    if (provider === "swa") {
+        setupSwaAuth(cwd, backendLanguage, session, options.allowedProviders);
+        updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig(), session, options.allowedProviders);
+        await finalize();
+        console.log("\n SWA built-in authentication setup complete!");
+        return;
+    }
+    if (provider === "external-token") {
+        setupExternalTokenAuth(cwd, backendLanguage, session);
+        updateConfigWithAuth(cwd, provider, config.auth?.customJwt || defaultCustomJwtConfig(), session);
+        await finalize();
+        console.log("\n External token authentication setup complete!");
+        console.log(" Implement the generated frontend adapter and backend verifier before use.");
+        return;
+    }
+    // Read project name from package.json
+    const pkgPath = path.join(cwd, "package.json");
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    const projectName = pkg.name || "app";
+    // Read shared package name
+    const sharedPkgPath = path.join(cwd, "shared", "package.json");
+    let sharedPackageName = `@${projectName}/shared`;
+    if (fs.existsSync(sharedPkgPath)) {
+        const sharedPkg = JSON.parse(fs.readFileSync(sharedPkgPath, "utf-8"));
+        sharedPackageName = sharedPkg.name || sharedPackageName;
+    }
+    // Default custom-jwt config
+    const customJwtConfig = config.auth?.customJwt || defaultCustomJwtConfig();
+    // custom-jwt setup continues below.
+    // 1. Generate shared/models/auth.ts
+    console.log(" Generating auth models...");
+    const modelsDir = path.join(cwd, "shared", "models");
+    const authModelPath = path.join(modelsDir, "auth.ts");
+    session.writeFile(authModelPath, (0, auth_generator_1.generateAuthModels)(), managedMeta);
+    console.log(` Created: shared/models/auth.ts`);
+    // Ensure shared package has build infrastructure (tsconfig, build script)
+    ensureSharedBuildInfrastructure(cwd, session);
+    // Update shared/index.ts to re-export auth
+    updateSharedIndex(cwd, session);
+    // Resolve RDB provider for dependency installation
+    const connDef = (0, config_1.getConnectorDefinition)(customJwtConfig.userConnector);
+    const rdbProvider = connDef?.provider ?? "mysql";
+    // 2. Generate Functions auth code
+    console.log("\n Generating auth functions...");
+    generateFunctionsAuth(cwd, backendLanguage, sharedPackageName, customJwtConfig, session);
+    // 3. Generate BFF auth routes
+    console.log("\n Generating BFF auth routes...");
+    generateBFFAuth(cwd, projectName, sharedPackageName, session);
+    // 4. Generate proxy
+    console.log("\n  Generating proxy...");
+    const proxyPath = path.join(cwd, "proxy.ts");
+    session.writeFile(proxyPath, (0, auth_generator_1.generateProxy)(projectName), managedMeta);
+    console.log(` Created: proxy.ts`);
+    // 5. Generate login page
+    console.log("\n Generating login page...");
+    const loginDir = path.join(cwd, "app", "login");
+    session.writeFile(path.join(loginDir, "page.tsx"), (0, auth_generator_1.generateLoginPage)(), managedMeta);
+    console.log(` Created: app/login/page.tsx`);
+    // 6. Generate auth context
+    console.log("\n Generating auth context...");
+    const authLibDir = path.join(cwd, "lib", "auth");
+    session.writeFile(path.join(authLibDir, "auth-context.tsx"), (0, auth_generator_1.generateAuthContext)(), managedMeta);
+    console.log(`✅ Created: lib/auth/auth-context.tsx`);
+    // 7. Update callFunction with auth support
+    console.log("\n Updating callFunction with auth support...");
+    const callFnPath = path.join(cwd, "lib", "api", "call-function.ts");
+    session.writeFile(callFnPath, (0, auth_generator_1.generateBFFCallFunctionWithAuth)(), managedMeta);
+    console.log(` Updated: lib/api/call-function.ts`);
+    // 8. Update swallowkit.config.js
+    console.log("\n Updating configuration...");
+    updateConfigWithAuth(cwd, provider, customJwtConfig, session);
+    // 9. Update environment files
+    console.log("\n Updating environment files...");
+    updateEnvironmentFiles(cwd, session);
+    // 10. Install dependencies
+    console.log("\n Installing auth dependencies...");
+    await installAuthDependencies(cwd, backendLanguage, rdbProvider, session);
+    await finalize();
+    console.log("\n Authentication setup complete!");
+    console.log("\n Next steps:");
+    console.log("  1. Review the generated files");
+    console.log("  2. Set JWT_SECRET in functions/local.settings.json");
+    if (provider === "custom-jwt") {
+        console.log("  3. Ensure your user database table matches the config");
+        console.log("  4. Add authPolicy to your models for role-based access control:");
+        console.log("     export const authPolicy = { roles: ['admin'] };");
+    }
+    console.log(`  5. Run scaffold to regenerate functions with auth guards`);
+}
+function findObjectEnd(content, open) {
+    let depth = 0, quote = "";
+    for (let i = open; i < content.length; i++) {
+        const ch = content[i];
+        if (quote) {
+            if (ch === quote && content[i - 1] !== "\\")
+                quote = "";
+            continue;
+        }
+        if (ch === "'" || ch === '"' || ch === "`") {
+            quote = ch;
+            continue;
+        }
+        if (ch === "{")
+            depth++;
+        if (ch === "}" && --depth === 0)
+            return i;
+    }
+    return -1;
+}
+function updateConfigWithNamedScheme(cwd, scheme, provider, session, allowedProviders) {
+    var _a, _b;
+    const jsPath = path.join(cwd, "swallowkit.config.js");
+    const jsonPath = path.join(cwd, "swallowkit.config.json");
+    const configPath = session.fileExists(jsPath) ? jsPath : jsonPath;
+    if (!session.fileExists(configPath))
+        throw new Error("swallowkit.config.js or swallowkit.config.json is required");
+    const swaProviders = provider === "swa" ? normalizeSwaProviders(allowedProviders) : undefined;
+    if (configPath.endsWith(".json")) {
+        const value = JSON.parse(session.readFile(configPath));
+        value.auth ?? (value.auth = {});
+        (_a = value.auth).schemes ?? (_a.schemes = {});
+        if (value.auth.schemes[scheme])
+            throw new Error(`auth.schemes.${scheme} already exists; no files were changed`);
+        value.auth.schemes[scheme] = provider === "custom-jwt"
+            ? { provider, customJwt: defaultCustomJwtConfig() }
+            : swaProviders
+                ? { provider, swa: { allowedProviders: swaProviders } }
+                : { provider };
+        (_b = value.auth).authorization ?? (_b.authorization = { defaultPolicy: "anonymous", policies: {} });
+        session.writeFile(configPath, JSON.stringify(value, null, 2) + "\n", extensionMeta);
+        return;
+    }
+    let content = session.readFile(configPath);
+    const authMatch = /\bauth\s*:\s*\{/.exec(content);
+    const customJwt = defaultCustomJwtConfig();
+    const entry = provider === "custom-jwt"
+        ? `\n      ${scheme}: { provider: 'custom-jwt', customJwt: ${JSON.stringify(customJwt)} },`
+        : swaProviders
+            ? `\n      ${scheme}: { provider: '${provider}', swa: { allowedProviders: [${swaProviders.map((p) => `'${p}'`).join(", ")}] } },`
+            : `\n      ${scheme}: { provider: '${provider}' },`;
+    if (!authMatch) {
+        const rootEnd = content.lastIndexOf("}");
+        const beforeRootEnd = content.slice(0, rootEnd).trimEnd();
+        const separator = beforeRootEnd.endsWith(",") || beforeRootEnd.endsWith("{") ? "" : ",";
+        content = `${beforeRootEnd}${separator}\n  auth: {\n    schemes: {${entry}\n    },\n    authorization: { defaultPolicy: 'anonymous', policies: {} },\n  },\n${content.slice(rootEnd)}`;
+    }
+    else {
+        const authOpen = content.indexOf("{", authMatch.index);
+        const authEnd = findObjectEnd(content, authOpen);
+        const authBody = content.slice(authOpen + 1, authEnd);
+        const schemesMatch = /\bschemes\s*:\s*\{/.exec(authBody);
+        if (schemesMatch) {
+            const schemesOpen = authOpen + 1 + authBody.indexOf("{", schemesMatch.index);
+            const schemesEnd = findObjectEnd(content, schemesOpen);
+            const existing = content.slice(schemesOpen + 1, schemesEnd);
+            if (new RegExp(`(^|[,\\s])${scheme}\\s*:`).test(existing))
+                throw new Error(`auth.schemes.${scheme} already exists; no files were changed`);
+            content = content.slice(0, schemesEnd) + entry + "\n    " + content.slice(schemesEnd);
+        }
+        else {
+            content = content.slice(0, authOpen + 1) + `\n    schemes: {${entry}\n    },` + content.slice(authOpen + 1);
+        }
+    }
+    session.writeFile(configPath, content, extensionMeta);
+}
+function addNamedScheme(cwd, scheme, provider, language, session, allowedProviders) {
+    // Validate/update config before creating files, so duplicate names stop safely.
+    updateConfigWithNamedScheme(cwd, scheme, provider, session, allowedProviders);
+    const slug = scheme.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
+    if (language === "typescript") {
+        const dir = path.join(cwd, "functions", "src", "auth", "schemes", slug);
+        if (provider === "external-token")
+            writeIfMissing(session, path.join(dir, "verifier.ts"), (0, auth_generator_1.generateExternalTokenVerifierTS)());
+        else if (provider === "swa")
+            writeIfMissing(session, path.join(dir, "adapter.ts"), (0, auth_generator_1.generateSwaAuthHelperTS)());
+        else
+            writeIfMissing(session, path.join(dir, "jwt-helper.ts"), (0, auth_generator_1.generateJwtHelperTS)());
+    }
+    else if (language === "csharp") {
+        const dir = path.join(cwd, "functions", "Auth", "Schemes", slug);
+        if (provider === "external-token")
+            writeIfMissing(session, path.join(dir, "ExternalTokenVerifier.cs"), (0, auth_generator_1.generateNamedExternalTokenVerifierCSharp)(scheme));
+        else if (provider === "swa")
+            writeIfMissing(session, path.join(dir, "SwaAdapter.cs"), (0, auth_generator_1.generateSwaAuthHelperCSharp)());
+        else
+            writeIfMissing(session, path.join(dir, "JwtHelper.cs"), (0, auth_generator_1.generateJwtHelperCSharp)());
+    }
+    else {
+        const dir = path.join(cwd, "functions", "auth", "schemes", slug.replace(/-/g, "_"));
+        if (provider === "external-token")
+            writeIfMissing(session, path.join(dir, "verifier.py"), (0, auth_generator_1.generateNamedExternalTokenVerifierPython)(scheme));
+        else if (provider === "swa")
+            writeIfMissing(session, path.join(dir, "adapter.py"), (0, auth_generator_1.generateSwaAuthHelperPython)());
+        else
+            writeIfMissing(session, path.join(dir, "jwt_helper.py"), (0, auth_generator_1.generateJwtHelperPython)());
+    }
+    const clientDir = path.join(cwd, "lib", "auth", "schemes", slug);
+    if (provider === "external-token") {
+        writeIfMissing(session, path.join(clientDir, "token-adapter.ts"), (0, auth_generator_1.generateExternalTokenAdapter)());
+        writeIfMissing(session, path.join(clientDir, "authenticated-fetch.ts"), (0, auth_generator_1.generateAuthenticatedFetch)().replace("'./external-token-adapter'", "'./token-adapter'"));
+        writeIfMissing(session, path.join(clientDir, "auth-context.tsx"), (0, auth_generator_1.generateExternalTokenAuthContext)().replace(/external-token-adapter/g, "token-adapter"));
+    }
+    else if (provider === "swa") {
+        writeIfMissing(session, path.join(clientDir, "auth-context.tsx"), generateSwaAuthContext(allowedProviders));
+    }
+    else if (provider === "custom-jwt") {
+        writeIfMissing(session, path.join(clientDir, "auth-context.tsx"), (0, auth_generator_1.generateAuthContext)());
+    }
+    const callFunctionPath = path.join(cwd, "lib", "api", "call-function.ts");
+    if (!session.fileExists(callFunctionPath))
+        writeIfMissing(session, callFunctionPath, (0, auth_generator_1.generateBFFCallFunctionWithMultipleAuth)());
+    else {
+        const current = session.readFile(callFunctionPath);
+        if (!current.includes("x-ms-client-principal") || !current.includes("fetchHeaders['Authorization']")) {
+            if (current.includes("SwallowKit BFF Call Function Helper"))
+                session.writeFile(callFunctionPath, (0, auth_generator_1.generateBFFCallFunctionWithMultipleAuth)(), managedMeta);
+            else
+                console.warn(" Existing customized lib/api/call-function.ts was preserved. Ensure it forwards Bearer and SWA credentials without logging them.");
+        }
+    }
+}
+/**
+ * Ensure the shared package has proper build infrastructure
+ * (tsconfig.json, build script, typescript devDependency).
+ * Required for `dev` command which runs `npm run --workspace=shared build`.
+ */
+function ensureSharedBuildInfrastructure(cwd, session) {
+    const sharedDir = path.join(cwd, "shared");
+    const pkgPath = path.join(sharedDir, "package.json");
+    if (!session.fileExists(pkgPath))
+        return;
+    const pkg = JSON.parse(session.readFile(pkgPath));
+    let updated = false;
+    // Ensure scripts.build exists
+    if (!pkg.scripts?.build) {
+        if (!pkg.scripts)
+            pkg.scripts = {};
+        pkg.scripts.build = "tsc";
+        pkg.scripts.watch = "tsc --watch";
+        updated = true;
+    }
+    // Ensure main points to compiled output
+    if (!pkg.main || pkg.main === "index.ts") {
+        pkg.main = "dist/index.js";
+        pkg.types = "dist/index.d.ts";
+        updated = true;
+    }
+    // Ensure typescript devDependency
+    if (!pkg.devDependencies?.typescript) {
+        if (!pkg.devDependencies)
+            pkg.devDependencies = {};
+        pkg.devDependencies.typescript = "^5.0.0";
+        updated = true;
+    }
+    if (updated) {
+        session.writeFile(pkgPath, JSON.stringify(pkg, null, 2), extensionMeta);
+        console.log(` Updated: shared/package.json (added build infrastructure)`);
+    }
+    // Ensure tsconfig.json exists
+    const tsconfigPath = path.join(sharedDir, "tsconfig.json");
+    if (!session.fileExists(tsconfigPath)) {
+        session.writeFile(tsconfigPath, JSON.stringify((0, init_1.buildSharedTsConfig)(), null, 2), onceMeta);
+        console.log(` Created: shared/tsconfig.json`);
+    }
+}
+function updateSharedIndex(cwd, session) {
+    const indexPath = path.join(cwd, "shared", "index.ts");
+    if (session.fileExists(indexPath)) {
+        let content = session.readFile(indexPath);
+        if (!content.includes("./models/auth")) {
+            content += `\nexport { LoginRequest, AuthUser, LoginResponse } from './models/auth';\n`;
+            session.writeFile(indexPath, content, extensionMeta);
+            console.log(` Updated: shared/index.ts`);
+        }
+    }
+    else {
+        session.writeFile(indexPath, `export { LoginRequest, AuthUser, LoginResponse } from './models/auth';\n`, extensionMeta);
+        console.log(` Created: shared/index.ts`);
+    }
+}
+function generateFunctionsAuth(cwd, backendLanguage, sharedPackageName, config, session) {
+    const functionsDir = path.join(cwd, "functions");
+    // Resolve the RDB provider from the connector definition
+    const connDef = (0, config_1.getConnectorDefinition)(config.userConnector);
+    const provider = connDef?.provider ?? "mysql";
+    if (backendLanguage === "typescript") {
+        // Auth functions
+        const srcDir = path.join(functionsDir, "src");
+        session.writeFile(path.join(srcDir, "auth.ts"), (0, auth_generator_1.generateAuthFunctionsTS)(sharedPackageName, config, provider), managedMeta);
+        console.log(` Created: functions/src/auth.ts`);
+        // JWT helper
+        const authDir = path.join(srcDir, "auth");
+        session.writeFile(path.join(authDir, "jwt-helper.ts"), (0, auth_generator_1.generateJwtHelperTS)(), managedMeta);
+        console.log(` Created: functions/src/auth/jwt-helper.ts`);
+    }
+    else if (backendLanguage === "csharp") {
+        const authDir = path.join(functionsDir, "Auth");
+        session.writeFile(path.join(authDir, "AuthFunctions.cs"), (0, auth_generator_1.generateAuthFunctionsCSharp)(config, provider), managedMeta);
+        console.log(` Created: functions/Auth/AuthFunctions.cs`);
+        session.writeFile(path.join(authDir, "JwtHelper.cs"), (0, auth_generator_1.generateJwtHelperCSharp)(), managedMeta);
+        console.log(` Created: functions/Auth/JwtHelper.cs`);
+    }
+    else if (backendLanguage === "python") {
+        const blueprintsDir = path.join(functionsDir, "blueprints");
+        session.writeFile(path.join(blueprintsDir, "auth.py"), (0, auth_generator_1.generateAuthFunctionsPython)(config, provider), managedMeta);
+        console.log(` Created: functions/blueprints/auth.py`);
+        const authDir = path.join(functionsDir, "auth");
+        session.writeFile(path.join(authDir, "jwt_helper.py"), (0, auth_generator_1.generateJwtHelperPython)(), managedMeta);
+        console.log(` Created: functions/auth/jwt_helper.py`);
+        // __init__.py
+        if (!session.fileExists(path.join(authDir, "__init__.py"))) {
+            session.writeFile(path.join(authDir, "__init__.py"), "", onceMeta);
+        }
+        // Register auth blueprint in function_app.py
+        const functionAppPath = path.join(functionsDir, "function_app.py");
+        if (session.fileExists(functionAppPath)) {
+            const content = session.readFile(functionAppPath);
+            const authImport = "from blueprints.auth import bp as auth_bp";
+            const authRegister = "app.register_blueprint(auth_bp)";
+            if (!content.includes(authImport)) {
+                const marker = "# SwallowKit scaffold registrations";
+                if (content.includes(marker)) {
+                    const updated = content.replace(marker, `${authImport}\n${authRegister}\n${marker}`);
+                    session.writeFile(functionAppPath, updated, extensionMeta);
+                    console.log(` Updated: functions/function_app.py (registered auth blueprint)`);
+                }
+            }
+        }
+    }
+}
+function generateBFFAuth(cwd, projectName, sharedPackageName, session) {
+    const authApiDir = path.join(cwd, "app", "api", "auth");
+    // Login route
+    const loginDir = path.join(authApiDir, "login");
+    session.writeFile(path.join(loginDir, "route.ts"), (0, auth_generator_1.generateBFFAuthLoginRoute)(projectName, sharedPackageName), managedMeta);
+    console.log(` Created: app/api/auth/login/route.ts`);
+    // Logout route
+    const logoutDir = path.join(authApiDir, "logout");
+    session.writeFile(path.join(logoutDir, "route.ts"), (0, auth_generator_1.generateBFFAuthLogoutRoute)(projectName), managedMeta);
+    console.log(` Created: app/api/auth/logout/route.ts`);
+    // Me route
+    const meDir = path.join(authApiDir, "me");
+    session.writeFile(path.join(meDir, "route.ts"), (0, auth_generator_1.generateBFFAuthMeRoute)(), managedMeta);
+    console.log(` Created: app/api/auth/me/route.ts`);
+}
+function updateConfigWithAuth(cwd, provider, config, session, allowedProviders) {
+    const configPath = path.join(cwd, "swallowkit.config.js");
+    if (!session.fileExists(configPath)) {
+        console.warn("  swallowkit.config.js not found. Please add auth config manually.");
+        return;
+    }
+    const content = session.readFile(configPath);
+    if (content.includes("auth:") || content.includes("auth :")) {
+        console.log("  'auth' section already exists in swallowkit.config.js");
+        return;
+    }
+    // Find the last property before the closing of module.exports
+    const closingBraceIdx = content.lastIndexOf("}");
+    if (closingBraceIdx === -1) {
+        console.error(" Could not parse config file structure.");
+        return;
+    }
+    const beforeClosing = content.substring(0, closingBraceIdx).trimEnd();
+    const needsComma = !beforeClosing.endsWith(",") && !beforeClosing.endsWith("{");
+    const providerSettings = provider === "custom-jwt" ? `
+    customJwt: {
+      userConnector: '${config.userConnector}',
+      userTable: '${config.userTable}',
+      loginIdColumn: '${config.loginIdColumn}',
+      passwordHashColumn: '${config.passwordHashColumn}',
+      rolesColumn: '${config.rolesColumn}',
+      jwtSecretEnv: '${config.jwtSecretEnv || "JWT_SECRET"}',
+      tokenExpiry: '${config.tokenExpiry || "24h"}',
+    },` : provider === "swa" ? `
+    swa: {
+      allowedProviders: [${normalizeSwaProviders(allowedProviders).map((p) => `'${p}'`).join(", ")}],
+      roleSource: 'swa-roles',
+    },` : "";
+    const authBlock = `${needsComma ? "," : ""}
+  // 認証認可設定
+  auth: {
+    provider: '${provider}',
+${providerSettings}
+    authorization: {
+      defaultPolicy: 'authenticated',
+    },
+  },
+`;
+    const newContent = content.substring(0, closingBraceIdx) + authBlock + content.substring(closingBraceIdx);
+    session.writeFile(configPath, newContent, extensionMeta);
+    console.log(` Updated: swallowkit.config.js`);
+}
+function updateEnvironmentFiles(cwd, session) {
+    // Update functions/local.settings.json
+    const localSettingsPath = path.join(cwd, "functions", "local.settings.json");
+    if (session.fileExists(localSettingsPath)) {
+        const settings = JSON.parse(session.readFile(localSettingsPath));
+        if (!settings.Values)
+            settings.Values = {};
+        if (!settings.Values.JWT_SECRET) {
+            settings.Values.JWT_SECRET = "dev-jwt-secret-change-in-production-min-32-chars!!";
+        }
+        session.writeFile(localSettingsPath, JSON.stringify(settings, null, 2), extensionMeta);
+        console.log(` Updated: functions/local.settings.json`);
+    }
+    // Update .env.example
+    const envExamplePath = path.join(cwd, ".env.example");
+    if (session.fileExists(envExamplePath)) {
+        let content = session.readFile(envExamplePath);
+        if (!content.includes("JWT_SECRET")) {
+            content += "\n# Authentication\nJWT_SECRET=your-jwt-secret-key-at-least-32-chars\n";
+            session.writeFile(envExamplePath, content, extensionMeta);
+            console.log(` Updated: .env.example`);
+        }
+    }
+}
+async function installAuthDependencies(cwd, backendLanguage, provider = "mysql", session) {
+    if (backendLanguage === "typescript") {
+        const funcPkgPath = path.join(cwd, "functions", "package.json");
+        if (session.fileExists(funcPkgPath)) {
+            const funcPkg = JSON.parse(session.readFile(funcPkgPath));
+            if (!funcPkg.dependencies)
+                funcPkg.dependencies = {};
+            funcPkg.dependencies["jsonwebtoken"] = "^9.0.0";
+            funcPkg.dependencies["bcryptjs"] = "^2.4.3";
+            // RDB driver based on provider
+            if (provider === "mysql")
+                funcPkg.dependencies["mysql2"] = "^3.11.0";
+            else if (provider === "postgres")
+                funcPkg.dependencies["pg"] = "^8.13.0";
+            else
+                funcPkg.dependencies["mssql"] = "^11.0.0";
+            if (!funcPkg.devDependencies)
+                funcPkg.devDependencies = {};
+            funcPkg.devDependencies["@types/jsonwebtoken"] = "^9.0.0";
+            funcPkg.devDependencies["@types/bcryptjs"] = "^2.4.0";
+            if (provider === "postgres")
+                funcPkg.devDependencies["@types/pg"] = "^8.11.0";
+            session.writeFile(funcPkgPath, JSON.stringify(funcPkg, null, 2), extensionMeta);
+            console.log(` Updated: functions/package.json with auth dependencies (${provider})`);
+        }
+    }
+    else if (backendLanguage === "csharp") {
+        // Add NuGet package references to .csproj
+        const functionsDir = path.join(cwd, "functions");
+        const csprojFiles = fs.existsSync(functionsDir)
+            ? fs.readdirSync(functionsDir).filter((f) => f.endsWith(".csproj"))
+            : [];
+        if (csprojFiles.length > 0) {
+            const csprojPath = path.join(functionsDir, csprojFiles[0]);
+            let csprojContent = session.readFile(csprojPath);
+            const nugetPackages = [
+                { name: "System.IdentityModel.Tokens.Jwt", version: "7.0.0" },
+                { name: "Microsoft.IdentityModel.Tokens", version: "7.0.0" },
+                { name: "BCrypt.Net-Next", version: "4.0.3" },
+            ];
+            // RDB driver based on provider
+            if (provider === "mysql")
+                nugetPackages.push({ name: "MySqlConnector", version: "2.3.0" });
+            else if (provider === "postgres")
+                nugetPackages.push({ name: "Npgsql", version: "8.0.0" });
+            else
+                nugetPackages.push({ name: "Microsoft.Data.SqlClient", version: "5.2.0" });
+            for (const pkg of nugetPackages) {
+                if (!csprojContent.includes(`"${pkg.name}"`)) {
+                    const insertPoint = csprojContent.lastIndexOf("</ItemGroup>");
+                    if (insertPoint >= 0) {
+                        csprojContent =
+                            csprojContent.slice(0, insertPoint) +
+                                `  <PackageReference Include="${pkg.name}" Version="${pkg.version}" />\n  ` +
+                                csprojContent.slice(insertPoint);
+                    }
+                }
+            }
+            session.writeFile(csprojPath, csprojContent, extensionMeta);
+            console.log(` Updated: ${csprojFiles[0]} with auth NuGet packages (${provider})`);
+        }
+    }
+    else if (backendLanguage === "python") {
+        // Add Python dependencies to requirements.txt
+        const requirementsPath = path.join(cwd, "functions", "requirements.txt");
+        const baseDeps = ["PyJWT>=2.8.0", "bcrypt>=4.1.0"];
+        // RDB driver based on provider
+        if (provider === "mysql")
+            baseDeps.push("mysql-connector-python>=8.3.0");
+        else if (provider === "postgres")
+            baseDeps.push("psycopg2-binary>=2.9.0");
+        else
+            baseDeps.push("pymssql>=2.2.0");
+        if (session.fileExists(requirementsPath)) {
+            let content = session.readFile(requirementsPath);
+            for (const dep of baseDeps) {
+                const pkgName = dep.split(">=")[0].split("==")[0];
+                if (!content.includes(pkgName)) {
+                    content += `${dep}\n`;
+                }
+            }
+            session.writeFile(requirementsPath, content, extensionMeta);
+        }
+        else {
+            session.writeFile(requirementsPath, baseDeps.join("\n") + "\n", extensionMeta);
+        }
+        console.log(` Updated: functions/requirements.txt with auth dependencies`);
+    }
+}
+//# sourceMappingURL=add-auth.js.map