BlobSasPermissions needs List support for directory-scoped SAS tokens

[sanderbollen-clockworks]

Is your feature request related to a problem? Please describe.
Version 12.30.0 introduced the ability to created directory- and prefix-scoped SAS tokens, through setting is_directory=True on generate_blob_sas.

The REST documentation clearly mentions that list is supported for directory-scoped SAS tokens.

However, BlobSasPermissions does not expose List parameter. This means the only way to grant list permissions on a directory- or prefix-scoped SAS token is to use a raw string.

Describe the solution you'd like
Expose a List option on BlobSasPermissions that works for directory- or prefix-scoped SAS tokens.

Describe alternatives you've considered
Raw string works, but it's not pretty

Additional context
#35899 was closed because list permissions don't make sense for individual Blobs. But this issue predates the addition of directory- and prefix-scoped SAS tokens.

[github-actions]

Thank you for your feedback. Tagging and routing to the team member(s) best able to assist.

//cc: @jalauzon-msft @vincenttran-msft

[github-actions]

🎯 Agentic Issue Triage

Summary: The BlobSasPermissions class is missing a List permission option needed for directory- and prefix-scoped SAS tokens introduced in v12.30.0 via generate_blob_sas(is_directory=True). The REST API supports list for these scopes, but the SDK only allows setting it via raw strings.

📋 Issue Details

Package: azure-storage-blob (≥ 12.30.0)
Affected API: BlobSasPermissions, generate_blob_sas
Scenarios:

• Generating a directory-scoped SAS token that grants list permissions requires using a raw permission string instead of the BlobSasPermissions class
• Prefix-scoped SAS tokens similarly cannot use BlobSasPermissions to express list access

Root ask: Add a List option to BlobSasPermissions that is valid for directory- and prefix-scoped SAS tokens, aligning the SDK with the REST API's documented support for list permission on directories.

🔎 Debugging / Reproduction Notes

The REST API documentation for [Create User Delegation SAS – Permissions for directory/container/blob]((learn.microsoft.com/redacted) explicitly lists l (list) as a supported permission for directory-scoped tokens. The BlobSasPermissions class currently lacks this field, forcing workarounds via raw strings.

Suggested investigation steps:

1. Verify BlobSasPermissions definition in azure/storage/blob/_models.py to confirm absence of a list field.
2. Cross-check ContainerSasPermissions which already exposes list — use it as a reference implementation.
3. Add a list attribute to BlobSasPermissions that is only valid when the SAS is directory- or prefix-scoped, with appropriate validation or documentation guard.
4. Reference issue BlobSasPermissions needs to support List  #35899 (previously closed because list didn't apply to individual blobs) to ensure the new list attribute is scoped correctly.

🏷️ Label Confidence

• Category: Client — This is a data-plane SDK issue (azure-storage-blob, not a management library).
• Service: Storage — Directly involves azure-storage-blob, which lives under /sdk/storage/.
• Confidence: High — Package and service are unambiguously identified; a closely matching reference issue (Support Multiple Ip address in generate_blob_sas function in Azure store SDK #31957, same package, Client + Storage) confirms the label pair.

👥 Owner Routing

• Matched CODEOWNERS entry: # ServiceLabel: %Storage (line 758) — service label "Storage" matches directly.
• AzureSdkOwners: none listed
• ServiceOwners: @jalauzon-msft, @vincenttran-msft
• Routing action: Added Service Attention and needs-team-attention labels; @mentioned ServiceOwners via routing comment.
• Scan notes: Scanned bottom-to-top from end of CODEOWNERS file; the Storage entry at line 758 was the first match for the "Storage" service label.

Generated by Agentic Triage for issue #48022 · 26.6 AIC · ⌖ 7.01 AIC · ⊞ 9.6K · ◷