[Storage] Relocated SAS generation

sdk/storage/azure-storage-blob/HISTORY.md

@@ -9,6 +9,8 @@
 - Removed types that were accidentally exposed from two modules. Only `BlobServiceClient`, `ContainerClient`, 
 `BlobClient` and `LeaseClient` should be imported from azure.storage.blob.aio
 - `Logging` has been renamed to `BlobAnalyticsLogging`.
+- The `generate_shared_access_signature` methods on each of `BlobServiceClient`, `ContainerClient` and `BlobClient` have been replaced by module level functions `generate_account_sas`, `generate_container_sas` and `generate_blob_sas`.
+
 
 **New features**
 

sdk/storage/azure-storage-blob/azure/storage/blob/__init__.py

@@ -13,6 +13,7 @@
 from .blob_service_client import BlobServiceClient
 from .lease import LeaseClient
 from .download import StorageStreamDownloader
+from ._shared_access_signature import generate_account_sas, generate_container_sas, generate_blob_sas
 from ._shared.policies import ExponentialRetry, LinearRetry
 from ._shared.models import(
     LocationMode,
@@ -89,7 +90,10 @@
     'AccountSasPermissions',
     'StorageStreamDownloader',
     'CustomerProvidedEncryptionKey',
-    'RehydratePriority'
+    'RehydratePriority',
+    'generate_account_sas',
+    'generate_container_sas',
+    'generate_blob_sas'
 ]
 
 

sdk/storage/azure-storage-blob/azure/storage/blob/_shared/base_client.py

@@ -64,7 +64,7 @@
 }
 
 
-class StorageAccountHostsMixin(object):
+class StorageAccountHostsMixin(object):  # pylint: disable=too-many-instance-attributes
     def __init__(
         self,
         parsed_url,  # type: Any
@@ -80,11 +80,14 @@ def __init__(
         if service not in ["blob", "queue", "file"]:
             raise ValueError("Invalid service: {}".format(service))
         account = parsed_url.netloc.split(".{}.core.".format(service))
+        self.account_name = account[0]
         secondary_hostname = None
+
         self.credential = format_shared_key_credential(account, credential)
         if self.scheme.lower() != "https" and hasattr(self.credential, "get_token"):
             raise ValueError("Token credential is only supported with HTTPS.")
         if hasattr(self.credential, "account_name"):
+            self.account_name = self.credential.account_name
             secondary_hostname = "{}-secondary.{}.{}".format(self.credential.account_name, service, SERVICE_HOST_BASE)
 
         if not self._hosts:

sdk/storage/azure-storage-blob/azure/storage/blob/_shared/models.py

@@ -261,8 +261,8 @@ def from_string(cls, string):
 
 class AccountSasPermissions(object):
     """
-    :class:`~ResourceTypes` class to be used with generate_shared_access_signature
-    method and for the AccessPolicies used with set_*_acl. There are two types of
+    :class:`~ResourceTypes` class to be used with generate_account_sas
+    function and for the AccessPolicies used with set_*_acl. There are two types of
     SAS which may be used to grant resource access. One is to grant access to a
     specific resource (resource-specific). Another is to grant access to the
     entire service for a specific account and allow certain operations based on

sdk/storage/azure-storage-blob/azure/storage/blob/_shared/request_handlers.py

@@ -17,7 +17,6 @@
 
 from azure.core.configuration import Configuration
 from azure.core.exceptions import raise_with_traceback
-from azure.core.pipeline import Pipeline
 
 
 _LOGGER = logging.getLogger(__name__)

sdk/storage/azure-storage-blob/azure/storage/blob/_shared/uploads.py

@@ -395,7 +395,7 @@ def flush(self):
         pass
 
     def read(self, size=None):
-        if self.closed:
+        if self.closed:  # pylint: disable=using-constant-test
             raise ValueError("Stream is closed.")
 
         if size is None:

sdk/storage/azure-storage-blob/azure/storage/blob/_shared_access_signature.py

@@ -6,6 +6,7 @@
 
 from azure.storage.blob._shared import sign_string, url_quote
 from azure.storage.blob._shared.constants import X_MS_VERSION
+from azure.storage.blob._shared.models import Services
 from azure.storage.blob._shared.shared_access_signature import SharedAccessSignature, _SharedAccessHelper, \
     QueryStringConstants
 
@@ -260,3 +261,298 @@ def get_token(self):
         exclude = [BlobQueryStringConstants.SIGNED_TIMESTAMP]
         return '&'.join(['{0}={1}'.format(n, url_quote(v))
                          for n, v in self.query_dict.items() if v is not None and n not in exclude])
+
+
+def generate_account_sas(
+        account_name,  # type: str
+        account_key,  # type: str
+        resource_types,  # type: Union[ResourceTypes, str]
+        permission,  # type: Union[AccountSasPermissions, str]
+        expiry,  # type: Optional[Union[datetime, str]]
+        start=None,  # type: Optional[Union[datetime, str]]
+        ip=None,  # type: Optional[str]
+        **kwargs # type: Any
+    ):  # type: (...) -> str
+    """Generates a shared access signature for the blob service.
+
+    Use the returned signature with the credential parameter of any BlobServiceClient,
+    ContainerClient or BlobClient.
+
+    :param str account_name:
+        The storage account name used to generate the shared access signature.
+    :param str account_key:
+        The access key to generate the shared access signature.
+    :param resource_types:
+        Specifies the resource types that are accessible with the account SAS.
+    :type resource_types: str or ~azure.storage.blob.ResourceTypes
+    :param permission:
+        The permissions associated with the shared access signature. The
+        user is restricted to operations allowed by the permissions.
+        Required unless an id is given referencing a stored access policy
+        which contains this field. This field must be omitted if it has been
+        specified in an associated stored access policy.
+    :type permission: str or ~azure.storage.blob.AccountSasPermissions
+    :param expiry:
+        The time at which the shared access signature becomes invalid.
+        Required unless an id is given referencing a stored access policy
+        which contains this field. This field must be omitted if it has
+        been specified in an associated stored access policy. Azure will always
+        convert values to UTC. If a date is passed in without timezone info, it
+        is assumed to be UTC.
+    :type expiry: ~datetime.datetime or str
+    :param start:
+        The time at which the shared access signature becomes valid. If
+        omitted, start time for this call is assumed to be the time when the
+        storage service receives the request. Azure will always convert values
+        to UTC. If a date is passed in without timezone info, it is assumed to
+        be UTC.
+    :type start: ~datetime.datetime or str
+    :param str ip:
+        Specifies an IP address or a range of IP addresses from which to accept requests.
+        If the IP address from which the request originates does not match the IP address
+        or address range specified on the SAS token, the request is not authenticated.
+        For example, specifying ip=168.1.5.65 or ip=168.1.5.60-168.1.5.70 on the SAS
+        restricts the request to those IP addresses.
+    :keyword str protocol:
+        Specifies the protocol permitted for a request made. The default value is https.
+    :return: A Shared Access Signature (sas) token.
+    :rtype: str
+
+    .. admonition:: Example:
+
+        .. literalinclude:: ../tests/test_blob_samples_authentication.py
+            :start-after: [START create_sas_token]
+            :end-before: [END create_sas_token]
+            :language: python
+            :dedent: 8
+            :caption: Generating a shared access signature.
+    """
+    sas = SharedAccessSignature(account_name, account_key)
+    return sas.generate_account(
+        services=Services(blob=True),
+        resource_types=resource_types,
+        permission=permission,
+        expiry=expiry,
+        start=start,
+        ip=ip,
+        **kwargs
+    ) # type: ignore
+
+
+def generate_container_sas(
+        account_name,  # type: str
+        container_name,  # type: str
+        account_key=None,  # type: Optional[str]
+        user_delegation_key=None,  # type: Optional[UserDelegationKey]
+        permission=None,  # type: Optional[Union[ContainerSasPermissions, str]]
+        expiry=None,  # type: Optional[Union[datetime, str]]
+        start=None,  # type: Optional[Union[datetime, str]]
+        policy_id=None,  # type: Optional[str]
+        ip=None,  # type: Optional[str]
+        **kwargs # type: Any
+    ):
+    # type: (...) -> Any
+    """Generates a shared access signature for a container.
+
+    Use the returned signature with the credential parameter of any BlobServiceClient,
+    ContainerClient or BlobClient.
+
+    :param str account_name:
+        The storage account name used to generate the shared access signature.
+    :param str container_name:
+        The name of the container.
+    :param str account_key:
+        The access key to generate the shared access signature. Either `account_key` or
+        `user_delegation_key` must be specified.
+    :param ~azure.storage.blob.UserDelegationKey user_delegation_key:
+        Instead of an account key, the user could pass in a user delegation key.
+        A user delegation key can be obtained from the service by authenticating with an AAD identity;
+        this can be accomplished by calling :func:`~azure.storage.blob.BlobServiceClient.get_user_delegation_key`.
+        When present, the SAS is signed with the user delegation key instead.
+    :param permission:
+        The permissions associated with the shared access signature. The
+        user is restricted to operations allowed by the permissions.
+        Permissions must be ordered read, write, delete, list.
+        Required unless an id is given referencing a stored access policy
+        which contains this field. This field must be omitted if it has been
+        specified in an associated stored access policy.
+    :type permission: str or ~azure.storage.blob.ContainerSasPermissions
+    :param expiry:
+        The time at which the shared access signature becomes invalid.
+        Required unless an id is given referencing a stored access policy
+        which contains this field. This field must be omitted if it has
+        been specified in an associated stored access policy. Azure will always
+        convert values to UTC. If a date is passed in without timezone info, it
+        is assumed to be UTC.
+    :type expiry: datetime or str
+    :param start:
+        The time at which the shared access signature becomes valid. If
+        omitted, start time for this call is assumed to be the time when the
+        storage service receives the request. Azure will always convert values
+        to UTC. If a date is passed in without timezone info, it is assumed to
+        be UTC.
+    :type start: datetime or str
+    :param str policy_id:
+        A unique value up to 64 characters in length that correlates to a
+        stored access policy. To create a stored access policy, use
+        :func:`~azure.storage.blob.ContainerClient.set_container_access_policy`.
+    :param str ip:
+        Specifies an IP address or a range of IP addresses from which to accept requests.
+        If the IP address from which the request originates does not match the IP address
+        or address range specified on the SAS token, the request is not authenticated.
+        For example, specifying ip=168.1.5.65 or ip=168.1.5.60-168.1.5.70 on the SAS
+        restricts the request to those IP addresses.
+    :keyword str protocol:
+        Specifies the protocol permitted for a request made. The default value is https.
+    :keyword str cache_control:
+        Response header value for Cache-Control when resource is accessed
+        using this shared access signature.
+    :keyword str content_disposition:
+        Response header value for Content-Disposition when resource is accessed
+        using this shared access signature.
+    :keyword str content_encoding:
+        Response header value for Content-Encoding when resource is accessed
+        using this shared access signature.
+    :keyword str content_language:
+        Response header value for Content-Language when resource is accessed
+        using this shared access signature.
+    :keyword str content_type:
+        Response header value for Content-Type when resource is accessed
+        using this shared access signature.
+    :return: A Shared Access Signature (sas) token.
+    :rtype: str
+
+    .. admonition:: Example:
+
+        .. literalinclude:: ../tests/test_blob_samples_containers.py
+            :start-after: [START generate_sas_token]
+            :end-before: [END generate_sas_token]
+            :language: python
+            :dedent: 12
+            :caption: Generating a sas token.
+    """
+    if not user_delegation_key and not account_key:
+        raise ValueError("Either user_delegation_key or account_key must be provided.")
+
+    if user_delegation_key:
+        sas = BlobSharedAccessSignature(account_name, user_delegation_key=user_delegation_key)
+    else:
+        sas = BlobSharedAccessSignature(account_name, account_key=account_key)
+    return sas.generate_container(
+        container_name,
+        permission=permission,
+        expiry=expiry,
+        start=start,
+        policy_id=policy_id,
+        ip=ip,
+        **kwargs
+    )
+
+
+def generate_blob_sas(
+        account_name,  # type: str
+        container_name,  # type: str
+        blob_name,  # type: str
+        snapshot=None,  # type: Optional[str]
+        account_key=None,  # type: Optional[str]
+        user_delegation_key=None,  # type: Optional[UserDelegationKey]
+        permission=None,  # type: Optional[Union[BlobSasPermissions, str]]
+        expiry=None,  # type: Optional[Union[datetime, str]]
+        start=None,  # type: Optional[Union[datetime, str]]
+        policy_id=None,  # type: Optional[str]
+        ip=None,  # type: Optional[str]
+        **kwargs # type: Any
+    ):
+    # type: (...) -> Any
+    """Generates a shared access signature for a blob.
+
+    Use the returned signature with the credential parameter of any BlobServiceClient,
+    ContainerClient or BlobClient.
+
+    :param str account_name:
+        The storage account name used to generate the shared access signature.
+    :param str container_name:
+        The name of the container.
+    :param str blob_name:
+        The name of the blob.
+    :param str snapshot:
+        An optional blob snapshot ID.
+    :param str account_key:
+        The access key to generate the shared access signature. Either `account_key` or
+        `user_delegation_key` must be specified.
+    :param ~azure.storage.blob.UserDelegationKey user_delegation_key:
+        Instead of an account key, the user could pass in a user delegation key.
+        A user delegation key can be obtained from the service by authenticating with an AAD identity;
+        this can be accomplished by calling :func:`~azure.storage.blob.BlobServiceClient.get_user_delegation_key`.
+        When present, the SAS is signed with the user delegation key instead.
+    :param permission:
+        The permissions associated with the shared access signature. The
+        user is restricted to operations allowed by the permissions.
+        Permissions must be ordered read, write, delete, list.
+        Required unless an id is given referencing a stored access policy
+        which contains this field. This field must be omitted if it has been
+        specified in an associated stored access policy.
+    :type permission: str or ~azure.storage.blob.BlobSasPermissions
+    :param expiry:
+        The time at which the shared access signature becomes invalid.
+        Required unless an id is given referencing a stored access policy
+        which contains this field. This field must be omitted if it has
+        been specified in an associated stored access policy. Azure will always
+        convert values to UTC. If a date is passed in without timezone info, it
+        is assumed to be UTC.
+    :type expiry: ~datetime.datetime or str
+    :param start:
+        The time at which the shared access signature becomes valid. If
+        omitted, start time for this call is assumed to be the time when the
+        storage service receives the request. Azure will always convert values
+        to UTC. If a date is passed in without timezone info, it is assumed to
+        be UTC.
+    :type start: ~datetime.datetime or str
+    :param str policy_id:
+        A unique value up to 64 characters in length that correlates to a
+        stored access policy. To create a stored access policy, use
+        :func:`~azure.storage.blob.ContainerClient.set_container_access_policy()`.
+    :param str ip:
+        Specifies an IP address or a range of IP addresses from which to accept requests.
+        If the IP address from which the request originates does not match the IP address
+        or address range specified on the SAS token, the request is not authenticated.
+        For example, specifying ip=168.1.5.65 or ip=168.1.5.60-168.1.5.70 on the SAS
+        restricts the request to those IP addresses.
+    :keyword str protocol:
+        Specifies the protocol permitted for a request made. The default value is https.
+    :keyword str cache_control:
+        Response header value for Cache-Control when resource is accessed
+        using this shared access signature.
+    :keyword str content_disposition:
+        Response header value for Content-Disposition when resource is accessed
+        using this shared access signature.
+    :keyword str content_encoding:
+        Response header value for Content-Encoding when resource is accessed
+        using this shared access signature.
+    :keyword str content_language:
+        Response header value for Content-Language when resource is accessed
+        using this shared access signature.
+    :keyword str content_type:
+        Response header value for Content-Type when resource is accessed
+        using this shared access signature.
+    :return: A Shared Access Signature (sas) token.
+    :rtype: str
+    """
+    if not user_delegation_key and not account_key:
+        raise ValueError("Either user_delegation_key or account_key must be provided.")
+
+    if user_delegation_key:
+        sas = BlobSharedAccessSignature(account_name, user_delegation_key=user_delegation_key)
+    else:
+        sas = BlobSharedAccessSignature(account_name, account_key=account_key)
+    return sas.generate_blob(
+        container_name,
+        blob_name,
+        snapshot=snapshot,
+        permission=permission,
+        expiry=expiry,
+        start=start,
+        policy_id=policy_id,
+        ip=ip,
+        **kwargs
+    )