swallowkit 2.0.0-alpha.4 → 2.0.0-alpha.6

package/src/__tests__/mcp.test.ts

@@ -8,6 +8,77 @@ const builtMcpEntrypoint = path.resolve(__dirname, "..", "..", "dist", "mcp", "i
 const itWhenBuiltEntrypointExists = fs.existsSync(builtMcpEntrypoint) ? it : it.skip;
 
 describe("SwallowKit MCP tool definitions", () => {
+  it.each([
+    { status: "in-progress", outcome: "in-progress", state: "Running" },
+    { status: "blocked", outcome: "partial", state: "Succeeded" },
+  ])("does not promote $outcome provisioning to complete", async ({ status, outcome, state }) => {
+    const nextActions = [{ command: "swallowkit machine inspect provision --plan 123456789abc", description: "Read original state." }];
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({ ok: true, command: "apply-provision", status, nextActions, data: { outcome, deployment: { state } } }),
+      stderr: "", exitCode: 0,
+    }));
+    const tool = buildSwallowKitToolDefinitions(runner).find(candidate => candidate.name === "swallowkit_apply_provision")!;
+    const result = await tool.handler({ planId: "123456789abc", approve: true, waitSeconds: 0 });
+    expect(runner).toHaveBeenCalledWith(["apply", "provision", "--plan", "123456789abc", "--approve", "--wait-seconds", "0"]);
+    expect(JSON.parse(result.content[0].text)).toMatchObject({ status, outcome, deployment: { state }, nextActions });
+  });
+
+  it.each([
+    { status: "requires-human", code: "approval-required" },
+    { status: "failed", code: "azure-deployment-failed" },
+  ])("preserves $code and recovery actions", async ({ status, code }) => {
+    const nextActions = [{ command: "swallowkit machine apply provision --plan 123456789abc --approve", description: "Obtain human approval." }];
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({ ok: false, command: "apply-provision", status, error: { code, message: "Fixture error." }, nextActions }),
+      stderr: "", exitCode: 1,
+    }));
+    const tool = buildSwallowKitToolDefinitions(runner).find(candidate => candidate.name === "swallowkit_apply_provision")!;
+    const result = await tool.handler({ planId: "123456789abc" });
+    expect(runner).toHaveBeenCalledWith(["apply", "provision", "--plan", "123456789abc"]);
+    expect(result.isError).toBe(true);
+    expect(JSON.parse(result.content[0].text)).toMatchObject({ status, error: { code }, nextActions });
+  });
+
+  it.each(["swallowkit_apply_provision", "swallowkit_inspect_provision"])("forwards cancellation and preserves an unknown outcome for %s", async name => {
+    const controller = new AbortController();
+    const runner = jest.fn(async (_args: string[], signal?: AbortSignal) => {
+      expect(signal).toBe(controller.signal);
+      controller.abort();
+      return { stdout: "", stderr: "", exitCode: 143 };
+    });
+    const tool = buildSwallowKitToolDefinitions(runner).find(candidate => candidate.name === name)!;
+    const result = await tool.handler({ planId: "123456789abc", approve: true }, controller.signal);
+    expect(result.isError).toBe(true);
+    expect(JSON.parse(result.content[0].text)).toMatchObject({
+      status: "blocked", error: { code: "provision-interrupted", details: { outcome: "unknown", localFailure: "cancelled" } },
+      nextActions: expect.arrayContaining([expect.objectContaining({ command: "swallowkit machine inspect provision --plan 123456789abc" })]),
+    });
+  });
+
+  it("does not launch provision after the MCP request was already cancelled", async () => {
+    const controller = new AbortController();
+    controller.abort();
+    const runner = jest.fn(async () => ({ stdout: "", stderr: "", exitCode: 1 }));
+    const tool = buildSwallowKitToolDefinitions(runner).find(candidate => candidate.name === "swallowkit_apply_provision")!;
+    expect((await tool.handler({ planId: "123456789abc", approve: true }, controller.signal)).isError).toBe(true);
+    expect(runner).not.toHaveBeenCalled();
+  });
+
+  it("preserves blocked auth prerequisites and nextActions as structured MCP errors", async () => {
+    const nextActions = [{ command: "swallowkit machine plan auth --provider swa", description: "Configure auth first." }];
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({ ok: false, command: "plan-scaffold", status: "blocked",
+        error: { code: "auth-policy-without-auth", message: "Authentication is not configured." }, nextActions }),
+      stderr: "", exitCode: 1,
+    }));
+    const tool = buildSwallowKitToolDefinitions(runner).find(candidate => candidate.name === "swallowkit_plan_scaffold")!;
+    const result = await tool.handler({ model: "probe-item" });
+    expect(result.isError).toBe(true);
+    expect(JSON.parse(result.content[0].text)).toMatchObject({
+      status: "blocked", error: { code: "auth-policy-without-auth" }, nextActions,
+      metadata: { swallowkitVersion: expect.any(String) },
+    });
+  });
   it("delegates inspect_project to the machine CLI", async () => {
     const runner = jest.fn(async () => ({
       stdout: JSON.stringify({

package/src/__tests__/multi-auth.test.ts

@@ -1,6 +1,7 @@
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
+import { spawnSync } from "child_process";
 import { addAuthCommand } from "../cli/commands/add-auth";
 import { createUIAuthOptions } from "../cli/commands/scaffold";
 import {
@@ -9,12 +10,12 @@ import {
   generateNamedAuthRouterPython,
   generateNamedAuthRouterTS,
 } from "../core/scaffold/auth-generator";
-import { normalizeAuthConfig } from "../core/config";
+import { normalizeAuthConfig, validateConfig } from "../core/config";
 import { parseAuthPolicy } from "../core/scaffold/model-parser";
 import { createBasicModelInfo } from "./fixtures";
 import { generateCSharpAzureFunctionsCRUD, generateCompactAzureFunctionsCRUD, generatePythonAzureFunctionsCRUD } from "../core/scaffold/functions-generator";
 import { generateAuthLayout, generateNewPage } from "../core/scaffold/ui-generator";
-import { AuthConfig } from "../types";
+import { AuthConfig, SwallowKitConfig } from "../types";
 
 const namedAuthConfig: AuthConfig = {
   schemes: {
@@ -57,10 +58,24 @@ describe("named authentication routers", () => {
   it("generates valid branch structure for an SWA-only Python router", () => {
     const swaOnly = normalizeAuthConfig({ schemes: { admin: { provider: "swa", swa: { allowedProviders: ["github"] } } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } } })!;
     const python = generateNamedAuthRouterPython(swaOnly);
-    expect(python).toContain('        if PROVIDERS[scheme] == "swa":');
-    expect(python).not.toContain('        elif PROVIDERS[scheme] == "swa":');
+    expect(python).toContain('\n    if PROVIDERS[scheme] == "swa":');
+    expect(python).not.toContain('\n    elif PROVIDERS[scheme] == "swa":');
     expect(python).toContain("ALLOWED_PROVIDERS");
     expect(generateNamedAuthRouterCSharp(swaOnly)).toContain("AllowedProviders[scheme]");
+    expect(generateNamedAuthRouterCSharp(swaOnly)).not.toContain("using Functions.Auth.Schemes;");
+  });
+
+  const pythonCommand = ["python3", "python"].find(command => spawnSync(command, ["--version"], { encoding: "utf-8" }).status === 0);
+  (pythonCommand ? it : it.skip).each([false, true])("compiles named Python auth router syntax (external schemes: %s)", (external) => {
+    const config = external ? auth : normalizeAuthConfig({
+      schemes: { admin: { provider: "swa" } },
+      authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] } } },
+    })!;
+    const result = spawnSync(pythonCommand!, ["-c", "import ast,sys; ast.parse(sys.stdin.read())"], {
+      encoding: "utf-8", input: generateNamedAuthRouterPython(config),
+    });
+    expect(result.stderr).toBe("");
+    expect(result.status).toBe(0);
   });
 
   it("emits Array.Empty<string>() instead of untyped new[] { } for empty C# arrays (CS0826)", () => {
@@ -157,4 +172,100 @@ describe("add-auth named scheme CLI", () => {
     new Function("module", content)(configModule);
     expect((configModule.exports as { auth: { schemes: { admin: { provider: string } } } }).auth.schemes.admin.provider).toBe("swa");
   });
+
+  it("writes named schemes to swallowkit.config.json when both config files exist (loadConfig precedence)", async () => {
+    const js = "module.exports = { backend: { language: 'typescript' } };\n";
+    fs.writeFileSync(path.join(root, "swallowkit.config.js"), js);
+    await addAuthCommand({ scheme: "admin", provider: "swa" });
+    expect(JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8")).auth.schemes.admin.provider).toBe("swa");
+    expect(fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8")).toBe(js);
+  });
+
+  it.each(["json", "js"] as const)("disables auth in a %s config with an anonymous default that passes validation", async (format) => {
+    fs.rmSync(path.join(root, "swallowkit.config.json"));
+    if (format === "json") fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" } }));
+    else fs.writeFileSync(path.join(root, "swallowkit.config.js"), "module.exports = {\n  backend: { language: 'typescript' },\n}\n");
+    await addAuthCommand({ provider: "none" });
+    let config: SwallowKitConfig;
+    if (format === "json") {
+      config = JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8"));
+    } else {
+      const configModule = { exports: {} as SwallowKitConfig };
+      new Function("module", fs.readFileSync(path.join(root, "swallowkit.config.js"), "utf-8"))(configModule);
+      config = configModule.exports;
+    }
+    expect(config.auth).toMatchObject({ provider: "none", authorization: { defaultPolicy: "anonymous" } });
+    expect(validateConfig(config)).toEqual({ valid: true, errors: [] });
+  });
+
+  it("records single-provider auth in swallowkit.config.json instead of silently skipping it", async () => {
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "typescript" } }));
+    fs.mkdirSync(path.join(root, "app"), { recursive: true });
+    fs.writeFileSync(path.join(root, "app", "layout.tsx"), "export default function L({ children }: any) { return <html><body>{children}</body></html>; }\n");
+    await addAuthCommand({ provider: "swa", allowedProviders: ["github"] });
+    expect(JSON.parse(fs.readFileSync(path.join(root, "swallowkit.config.json"), "utf-8")).auth).toEqual({
+      provider: "swa",
+      swa: { allowedProviders: ["github"], roleSource: "swa-roles" },
+      authorization: { defaultPolicy: "authenticated" },
+    });
+  });
+
+  it.each(["typescript", "csharp", "python"] as const)("declares %s backend dependencies for a named custom-jwt scheme", async (language) => {
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language } }));
+    fs.mkdirSync(path.join(root, "functions"), { recursive: true });
+    if (language === "typescript") fs.writeFileSync(path.join(root, "functions", "package.json"), JSON.stringify({ name: "functions", dependencies: {} }));
+    if (language === "csharp") fs.writeFileSync(path.join(root, "functions", "App.Functions.csproj"), "<Project>\n  <ItemGroup>\n  </ItemGroup>\n</Project>\n");
+    if (language === "python") fs.writeFileSync(path.join(root, "functions", "requirements.txt"), "azure-functions\n");
+    await addAuthCommand({ scheme: "staff", provider: "custom-jwt" });
+    if (language === "typescript") {
+      expect(JSON.parse(fs.readFileSync(path.join(root, "functions", "package.json"), "utf-8")).dependencies).toEqual(expect.objectContaining({ jsonwebtoken: expect.any(String), bcryptjs: expect.any(String) }));
+    } else if (language === "csharp") {
+      const csproj = fs.readFileSync(path.join(root, "functions", "App.Functions.csproj"), "utf-8");
+      expect(csproj).toContain('Include="System.IdentityModel.Tokens.Jwt"');
+      expect(csproj).toContain('Include="BCrypt.Net-Next"');
+    } else {
+      expect(fs.readFileSync(path.join(root, "functions", "requirements.txt"), "utf-8")).toMatch(/PyJWT[\s\S]*bcrypt/);
+    }
+  });
+});
+
+describe("Python custom-jwt blueprint registration", () => {
+  const originalCwd = process.cwd();
+  let root: string;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-py-auth-"));
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ name: "fixture" }));
+    fs.writeFileSync(path.join(root, "swallowkit.config.json"), JSON.stringify({ backend: { language: "python" } }));
+    fs.mkdirSync(path.join(root, "shared"), { recursive: true });
+    fs.writeFileSync(path.join(root, "shared", "package.json"), JSON.stringify({ name: "@fixture/shared" }));
+    fs.mkdirSync(path.join(root, "functions"), { recursive: true });
+    fs.mkdirSync(path.join(root, "app"), { recursive: true });
+    fs.writeFileSync(path.join(root, "app", "layout.tsx"), "export default function L({ children }: any) { return <html><body>{children}</body></html>; }\n");
+    process.chdir(root);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  const register = (body: string) => fs.writeFileSync(path.join(root, "functions", "function_app.py"), body);
+
+  it("imports the blueprint object the generated module actually defines", async () => {
+    register("import azure.functions as func\napp = func.FunctionApp()\n# SwallowKit scaffold registrations\n");
+    await addAuthCommand({ provider: "custom-jwt" });
+    const blueprint = fs.readFileSync(path.join(root, "functions", "blueprints", "auth.py"), "utf-8");
+    const app = fs.readFileSync(path.join(root, "functions", "function_app.py"), "utf-8");
+    expect(blueprint).toMatch(/^auth_bp = func\.Blueprint\(\)$/m);
+    expect(app).toContain("from blueprints.auth import auth_bp\napp.register_blueprint(auth_bp)");
+  });
+
+  it("repairs the broken import written by earlier releases without duplicating the registration", async () => {
+    register("import azure.functions as func\napp = func.FunctionApp()\nfrom blueprints.auth import bp as auth_bp\napp.register_blueprint(auth_bp)\n# SwallowKit scaffold registrations\n");
+    await addAuthCommand({ provider: "custom-jwt" });
+    const app = fs.readFileSync(path.join(root, "functions", "function_app.py"), "utf-8");
+    expect(app).not.toContain("import bp as auth_bp");
+    expect(app.match(/app\.register_blueprint\(auth_bp\)/g)).toHaveLength(1);
+  });
 });

package/src/__tests__/plan-apply.test.ts

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import * as childProcess from "child_process";
+import * as ts from "typescript";
 import { EventEmitter } from "events";
 import { runMachineCli } from "../machine";
 import { getCSharpSchemaModelPath } from "../core/scaffold/native-schema-generator";
@@ -212,6 +213,7 @@ describe("plan / apply / drift / verify machine commands", () => {
       }),
       warnings: [],
     });
+
     expect(response.data.diagnostics).toEqual([]);
     expect(response.data.operations).toEqual(
       expect.arrayContaining([
@@ -230,6 +232,115 @@ describe("plan / apply / drift / verify machine commands", () => {
     ).toBe(true);
   });
 
+  it.each(["typescript", "csharp", "python"] as const)(
+    "blocks %s scaffold with an explicit authPolicy until authentication is configured",
+    async (language) => {
+      if (language === "typescript") createProjectFixture(tempDir);
+      else createNativeBackendFixture(tempDir, language);
+      fs.appendFileSync(path.join(tempDir, "shared", "models", "todo.ts"), "\nexport const authPolicy = { roles: ['admin'] };\n");
+      const reset = mockSuccessfulNativeCodegen();
+      try {
+        const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+        expect(plan.response).toMatchObject({
+          ok: false, status: "blocked", error: { code: "auth-policy-without-auth" },
+          nextActions: [expect.objectContaining({ command: expect.stringContaining("plan auth") })],
+        });
+        expect(fs.existsSync(path.join(tempDir, ".swallowkit", "state", "plans"))).toBe(false);
+        const generate = await runMachine(machineArgs("generate", "scaffold", "todo", "--api-only", "--skip-infra"));
+        expect(generate.response).toMatchObject({ ok: false, status: "blocked", error: { code: "auth-policy-without-auth" } });
+        expect(fs.existsSync(path.join(tempDir, "functions", "Crud"))).toBe(false);
+        expect(fs.readFileSync(path.join(tempDir, "shared", "index.ts"), "utf-8")).toBe("export {};\n");
+      } finally {
+        reset();
+      }
+    }
+  );
+
+  it("blocks an explicit role policy when the provider is none", async () => {
+    createProjectFixture(tempDir);
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    writeFile(path.join(tempDir, "swallowkit.config.json"), JSON.stringify({ auth: { provider: "none" } }));
+    fs.appendFileSync(path.join(tempDir, "shared", "models", "todo.ts"), "\nexport const authPolicy = { roles: ['admin'] };\n");
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-without-auth" } });
+  });
+
+  it("appends a manually authored model export during plan/apply scaffold without duplicating it", async () => {
+    createProjectFixture(tempDir);
+    const indexPath = path.join(tempDir, "shared", "index.ts");
+    const originalIndex = "// Custom exports are preserved.\nexport {};\n";
+    fs.writeFileSync(indexPath, originalIndex);
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response.data.operations).toContainEqual(expect.objectContaining({
+      path: "shared/index.ts", action: "append", ownership: "extension-point", conflict: false,
+    }));
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(originalIndex);
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.response.ok).toBe(true);
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(`${originalIndex}export { Todo } from './models/todo';\n`);
+    const repeat = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(repeat.response.data.operations.filter((op: { path: string; action: string }) =>
+      op.path === "shared/index.ts" && op.action !== "skip")).toEqual([]);
+  });
+
+  it.each<["typescript" | "csharp" | "python", "nextjs" | "react"]>([
+    ["typescript", "nextjs"], ["csharp", "react"], ["python", "react"],
+  ])("validates auth prerequisites in %s/%s before plan and apply", async (language, frontend) => {
+    if (language === "typescript") createProjectFixture(tempDir);
+    else createNativeBackendFixture(tempDir, language);
+    fs.unlinkSync(path.join(tempDir, "swallowkit.config.js"));
+    const configPath = path.join(tempDir, "swallowkit.config.json");
+    const config = { backend: { language }, frontend: { framework: frontend },
+      auth: { schemes: { admin: { provider: "swa" } }, authorization: {
+        defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"], roles: ["admin"] } },
+      } },
+    };
+    writeFile(configPath, JSON.stringify(config));
+    const modelPath = path.join(tempDir, "shared", "models", "todo.ts");
+    writeFile(modelPath, `${createModelSource("Todo")}\nexport const authPolicy = { roles: ['admin'] };`);
+    const reset = mockSuccessfulNativeCodegen();
+    try {
+      const invalid = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(invalid.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-requires-named-policy" } });
+      writeFile(modelPath, `${createModelSource("Todo")}\nexport const authPolicy = { policy: 'adminOnly' };`);
+      const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(plan.response.status).toBe("complete");
+      writeFile(configPath, JSON.stringify({ ...config, auth: undefined }));
+      const stale = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+      expect(stale.response).toMatchObject({ status: "blocked", error: { code: "stale-plan" } });
+      const direct = await runMachine(machineArgs("apply", "scaffold", "todo", "--api-only", "--skip-infra"));
+      expect(direct.response).toMatchObject({ status: "blocked", error: { code: "auth-policy-without-auth" } });
+      expect(fs.readFileSync(path.join(tempDir, "shared", "index.ts"), "utf-8")).toBe("export {};\n");
+    } finally { reset(); }
+  });
+
+  it.each([
+    ['export { Todo } from "./models/todo";\n', false],
+    ["export * from './models/todo';\n", false],
+    ["export type { Todo } from './models/todo';\n", true],
+    ["export type { Todo, displayName } from './models/todo';\n", true],
+    ["export { type Todo } from './models/todo';\n", true],
+    ["export { Todo as MyTodo } from './models/todo';", true],
+  ])("preserves existing exports and handles syntax variations: %s", async (content, append) => {
+    createProjectFixture(tempDir);
+    const indexPath = path.join(tempDir, "shared", "index.ts");
+    fs.writeFileSync(indexPath, content);
+    const plan = await runMachine(machineArgs("plan", "scaffold", "todo", "--api-only", "--skip-infra"));
+    expect(plan.response.data.operations.some((op: { path: string; action: string }) =>
+      op.path === "shared/index.ts" && op.action === "append")).toBe(append);
+    expect(fs.readFileSync(indexPath, "utf-8")).toBe(content);
+
+    const apply = await runMachine(machineArgs("apply", "scaffold", "--plan", plan.response.data.planId));
+    expect(apply.response.ok).toBe(true);
+    // The shared package must still compile: no duplicate Todo binding, and Todo is usable as a value.
+    writeFile(path.join(tempDir, "shared", "consumer.ts"), "import { Todo } from './index';\nexport const parsed: Todo = Todo.parse({ id: '1', name: 'x' });\n");
+    const program = ts.createProgram([indexPath, path.join(tempDir, "shared", "consumer.ts")], {
+      strict: true, noEmit: true, skipLibCheck: true, module: ts.ModuleKind.ESNext, target: ts.ScriptTarget.ES2020,
+      moduleResolution: ts.ModuleResolutionKind.Bundler,
+    });
+    expect(ts.getPreEmitDiagnostics(program).map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"))).toEqual([]);
+  });
+
   it("updates a ledger-unregistered legacy manifest without approval and preserves baseline identity", async () => {
     createProjectFixture(tempDir);
     createInfrastructureFixture(tempDir);