Skip to content

Commit ecdb806

Browse files
bluewwblueww
authored
[Storage] Support new permission in container access policy (#13119)
* [Storage] Support new permission in container access policy * [Storage] Upgrade to Track2 SDK for STG74
1 parent edb02b1 commit ecdb806

18 files changed

+339
-86
lines changed

‎src/Accounts/Authentication/Utilities/CustomAssemblyResolver.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ public static class CustomAssemblyResolver
1010
private static IDictionary<string, Version> NetFxPreloadAssemblies =
1111
new Dictionary<string, Version>(StringComparer.InvariantCultureIgnoreCase)
1212
{
13-
{"Azure.Core", new Version("1.4.1.0")},
13+
{"Azure.Core", new Version("1.5.0.0")},
1414
{"Microsoft.Bcl.AsyncInterfaces", new Version("1.0.0.0")},
1515
{"Microsoft.IdentityModel.Clients.ActiveDirectory", new Version("3.19.2.6005")},
1616
{"Microsoft.IdentityModel.Clients.ActiveDirectory.Platform", new Version("3.19.2.6005")},

‎src/Storage/Storage.Management.Test/Storage.Management.Test.csproj‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@
1111
</PropertyGroup>
1212

1313
<ItemGroup>
14-
<PackageReference Include="Azure.Storage.Blobs" Version="12.5.0-preview.6" />
15-
<PackageReference Include="Azure.Storage.Files.DataLake" Version="12.3.0-preview.2" />
16-
<PackageReference Include="Azure.Storage.Files.Shares" Version="12.3.0-preview.2" />
17-
<PackageReference Include="Azure.Storage.Queues" Version="12.4.0-preview.6" />
14+
<PackageReference Include="Azure.Storage.Blobs" Version="12.7.0-preview.1" />
15+
<PackageReference Include="Azure.Storage.Files.DataLake" Version="12.5.0-preview.1" />
16+
<PackageReference Include="Azure.Storage.Files.Shares" Version="12.5.0-preview.1" />
17+
<PackageReference Include="Azure.Storage.Queues" Version="12.5.0-preview.1" />
1818
<PackageReference Include="Microsoft.Azure.Management.Storage" Version="17.2.0" />
1919
</ItemGroup>
2020

‎src/Storage/Storage.Management/ChangeLog.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,15 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21-
* Support create/update file share with access tier
21+
* Supported create/update file share with access tier
2222
- `New-AzRmStorageShare`
2323
- `Update-AzRmStorageShare`
24+
* Supported Container access policy with new permission x,t
25+
- `New-AzStorageContainerStoredAccessPolicy`
26+
- `Set-AzStorageContainerStoredAccessPolicy`
27+
* Changed the output of get/set Container/Share/Queue/Table access policy cmdlet, by change the child property Permission type from enum to String
28+
- `Get-AzStorageContainerStoredAccessPolicy`
29+
- `Set-AzStorageContainerStoredAccessPolicy`
2430

2531
## Version 2.7.0
2632
* Supported enable/disable/get share soft delete properties on file Service of a Storage account

‎src/Storage/Storage/Blob/Cmdlet/GetAzureStorageBlob.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -378,14 +378,14 @@ internal async Task ListBlobsByTag(long taskId, IStorageBlobManagement localChan
378378
{
379379
requestCount = Math.Min(listCount, MaxListCount);
380380
realListCount = 0;
381-
IAsyncEnumerator<Page<BlobTagItem>> enumerator = blobServiceClient.FindBlobsByTagsAsync(tagFilterSqlExpression, CmdletCancellationToken)
381+
IAsyncEnumerator<Page<TaggedBlobItem>> enumerator = blobServiceClient.FindBlobsByTagsAsync(tagFilterSqlExpression, CmdletCancellationToken)
382382
.AsPages(track2ContinuationToken, requestCount)
383383
.GetAsyncEnumerator();
384384

385-
Page<BlobTagItem> page;
385+
Page<TaggedBlobItem> page;
386386
await enumerator.MoveNextAsync().ConfigureAwait(false);
387387
page = enumerator.Current;
388-
foreach (BlobTagItem item in page.Values)
388+
foreach (TaggedBlobItem item in page.Values)
389389
{
390390
BlobContainerClient track2container = blobServiceClient.GetBlobContainerClient(item.BlobContainerName);
391391
OutputStream.WriteObject(taskId, GetAzureStorageBlob(item, track2container, localChannel.StorageContext, page.ContinuationToken, ClientOptions));
@@ -413,7 +413,7 @@ public static AzureStorageBlob GetAzureStorageBlob(BlobItem blobItem, BlobContai
413413
return outputblob;
414414
}
415415

416-
public static AzureStorageBlob GetAzureStorageBlob(BlobTagItem blobTagItem, BlobContainerClient track2container, AzureStorageContext context, string continuationToken = null, BlobClientOptions options = null)
416+
public static AzureStorageBlob GetAzureStorageBlob(TaggedBlobItem blobTagItem, BlobContainerClient track2container, AzureStorageContext context, string continuationToken = null, BlobClientOptions options = null)
417417
{
418418
BlobBaseClient blobClient = Util.GetTrack2BlobClient(track2container, blobTagItem.BlobName, context, options: options);
419419
AzureStorageBlob outputblob = new AzureStorageBlob(blobClient, context, options);

‎src/Storage/Storage/Blob/Cmdlet/GetAzureStorageContainer.cs‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,8 @@ internal async Task GetContainerPermission(long taskId, IStorageBlobManagement l
237237
BlobRequestOptions requestOptions = RequestOptions;
238238
AccessCondition accessCondition = null;
239239
BlobContainerPermissions permissions = null;
240+
bool needUseTrack2 = false;
241+
240242
try
241243
{
242244
permissions = await localChannel.GetContainerPermissionsAsync(container, accessCondition,
@@ -247,7 +249,24 @@ internal async Task GetContainerPermission(long taskId, IStorageBlobManagement l
247249
// 404 Not found, or 403 Forbidden means we don't have permission to query the Permission of the specified container.
248250
// Just skip return container permission in this case.
249251
}
250-
WriteCloudContainerObject(taskId, localChannel, container, permissions, continuationToken);
252+
catch (StorageException e) when (e.IsConflictException())
253+
{
254+
// 409 Conflict, might caused by the container has an Stored access policy contains a permission that is not supported by Track1 SDK API veresion, so switch to Track2 SDK
255+
needUseTrack2 = true;
256+
}
257+
258+
if (!needUseTrack2) // Track1
259+
{
260+
WriteCloudContainerObject(taskId, localChannel, container, permissions, continuationToken);
261+
}
262+
else //Track2
263+
{
264+
AzureStorageContainer azureContainer = new AzureStorageContainer(container, null);
265+
azureContainer.Context = localChannel.StorageContext;
266+
azureContainer.ContinuationToken = continuationToken;
267+
azureContainer.SetTrack2Permission();
268+
OutputStream.WriteObject(taskId, azureContainer);
269+
}
251270
}
252271

253272
/// <summary>

‎src/Storage/Storage/Blob/Cmdlet/GetAzureStorageContainerStoredAccessPolicy.cs‎

Lines changed: 23 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,13 @@
1515
namespace Microsoft.WindowsAzure.Commands.Storage.Blob.Cmdlet
1616
{
1717
using Common;
18+
using global::Azure.Storage.Blobs;
19+
using global::Azure.Storage.Blobs.Models;
1820
using Microsoft.Azure.Storage.Blob;
19-
using Microsoft.WindowsAzure.Commands.Common.CustomAttributes;
21+
using Microsoft.WindowsAzure.Commands.Common.Storage.ResourceModel;
2022
using Model.Contract;
2123
using System;
24+
using System.Collections.Generic;
2225
using System.Globalization;
2326
using System.Management.Automation;
2427
using System.Security.Permissions;
@@ -27,8 +30,7 @@ namespace Microsoft.WindowsAzure.Commands.Storage.Blob.Cmdlet
2730
/// <summary>
2831
/// create a new azure container
2932
/// </summary>
30-
[CmdletOutputBreakingChange(typeof(SharedAccessBlobPolicy), ChangeDescription = "The output type will change from 'SharedAccessBlobPolicy' to 'PSObject', with the child property 'Permissions' type change from enum to string in a future release.")]
31-
[Cmdlet("Get", Azure.Commands.ResourceManager.Common.AzureRMConstants.AzurePrefix + "StorageContainerStoredAccessPolicy"), OutputType(typeof(SharedAccessBlobPolicy))]
33+
[Cmdlet("Get", Azure.Commands.ResourceManager.Common.AzureRMConstants.AzurePrefix + "StorageContainerStoredAccessPolicy"), OutputType(typeof(PSObject))]
3234
public class GetAzureStorageContainerStoredAccessPolicyCommand : StorageCloudBlobCmdletBase
3335
{
3436
[Alias("N", "Name")]
@@ -63,36 +65,40 @@ public GetAzureStorageContainerStoredAccessPolicyCommand(IStorageBlobManagement
6365

6466
internal async Task GetAzureContainerStoredAccessPolicyAsync(long taskId, IStorageBlobManagement localChannel, string containerName, string policyName)
6567
{
66-
SharedAccessBlobPolicies shareAccessPolicies = await GetPoliciesAsync(localChannel, containerName, policyName).ConfigureAwait(false);
68+
//Get container instance, Get existing permissions
69+
CloudBlobContainer container_Track1 = Channel.GetContainerReference(containerName);
70+
BlobContainerClient container = AzureStorageContainer.GetTrack2BlobContainerClient(container_Track1, Channel.StorageContext, ClientOptions);
71+
BlobContainerAccessPolicy accessPolicy = (await container.GetAccessPolicyAsync(BlobRequestConditions, cancellationToken: CmdletCancellationToken).ConfigureAwait(false)).Value;
72+
IEnumerable<BlobSignedIdentifier> signedIdentifiers = accessPolicy.SignedIdentifiers;
6773

6874
if (!String.IsNullOrEmpty(policyName))
6975
{
70-
if (shareAccessPolicies.Keys.Contains(policyName))
76+
BlobSignedIdentifier signedIdentifier = null;
77+
foreach (BlobSignedIdentifier identifier in signedIdentifiers)
7178
{
72-
OutputStream.WriteObject(taskId, AccessPolicyHelper.ConstructPolicyOutputPSObject<SharedAccessBlobPolicy>(shareAccessPolicies, policyName));
79+
if (identifier.Id == policyName)
80+
{
81+
signedIdentifier = identifier;
82+
}
7383
}
74-
else
84+
if (signedIdentifier == null)
7585
{
7686
throw new ResourceNotFoundException(String.Format(CultureInfo.CurrentCulture, Resources.PolicyNotFound, policyName));
7787
}
88+
else
89+
{
90+
OutputStream.WriteObject(taskId, AccessPolicyHelper.ConstructPolicyOutputPSObject<BlobSignedIdentifier>(signedIdentifier));
91+
}
7892
}
7993
else
8094
{
81-
foreach (string key in shareAccessPolicies.Keys)
95+
foreach (BlobSignedIdentifier identifier in signedIdentifiers)
8296
{
83-
OutputStream.WriteObject(taskId, AccessPolicyHelper.ConstructPolicyOutputPSObject<SharedAccessBlobPolicy>(shareAccessPolicies, key));
97+
OutputStream.WriteObject(taskId, AccessPolicyHelper.ConstructPolicyOutputPSObject<BlobSignedIdentifier>(identifier));
8498
}
8599
}
86100
}
87101

88-
internal async Task<SharedAccessBlobPolicies> GetPoliciesAsync(IStorageBlobManagement localChannel, string containerName, string policyName)
89-
{
90-
CloudBlobContainer container = localChannel.GetContainerReference(containerName);
91-
BlobContainerPermissions blobContainerPermissions = await localChannel.GetContainerPermissionsAsync(container, null, null, OperationContext, CmdletCancellationToken).ConfigureAwait(false);
92-
return blobContainerPermissions.SharedAccessPolicies;
93-
}
94-
95-
96102
/// <summary>
97103
/// execute command
98104
/// </summary>

‎src/Storage/Storage/Blob/Cmdlet/NewAzureStorageContainerStoredAccessPolicy.cs‎

Lines changed: 35 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,13 @@
1515
namespace Microsoft.WindowsAzure.Commands.Storage.Blob.Cmdlet
1616
{
1717
using Common;
18+
using global::Azure.Storage.Blobs;
19+
using global::Azure.Storage.Blobs.Models;
1820
using Microsoft.Azure.Storage.Blob;
21+
using Microsoft.WindowsAzure.Commands.Common.Storage.ResourceModel;
1922
using Model.Contract;
2023
using System;
24+
using System.Collections.Generic;
2125
using System.Globalization;
2226
using System.Management.Automation;
2327
using System.Security.Permissions;
@@ -41,7 +45,7 @@ public class NewAzureStorageContainerStoredAccessPolicyCommand : StorageCloudBlo
4145
[ValidateNotNullOrEmpty]
4246
public string Policy { get; set; }
4347

44-
[Parameter(HelpMessage = "Permissions for a container. Permissions can be any subset of \"rwdl\".")]
48+
[Parameter(HelpMessage = "Permissions for a container. Permissions can be any subset of \"racwdxlt\", make the permission order also same as it")]
4549
public string Permission { get; set; }
4650

4751
[Parameter(HelpMessage = "Start Time")]
@@ -50,6 +54,11 @@ public class NewAzureStorageContainerStoredAccessPolicyCommand : StorageCloudBlo
5054
[Parameter(HelpMessage = "Expiry Time")]
5155
public DateTime? ExpiryTime { get; set; }
5256

57+
protected override bool UseTrack2Sdk()
58+
{
59+
return true;
60+
}
61+
5362
/// <summary>
5463
/// Initializes a new instance of the NewAzureStorageContainerStoredAccessPolicyCommand class.
5564
/// </summary>
@@ -75,22 +84,37 @@ internal string CreateAzureContainerStoredAccessPolicy(IStorageBlobManagement lo
7584
throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, Resources.InvalidAccessPolicyName, policyName));
7685
}
7786

78-
//Get existing permissions
79-
CloudBlobContainer container = localChannel.GetContainerReference(containerName);
80-
BlobContainerPermissions blobContainerPermissions = localChannel.GetContainerPermissions(container, null, null, OperationContext);
87+
//Get container instance, Get existing permissions
88+
CloudBlobContainer container_Track1 = Channel.GetContainerReference(containerName);
89+
BlobContainerClient container = AzureStorageContainer.GetTrack2BlobContainerClient(container_Track1, Channel.StorageContext, ClientOptions);
90+
BlobContainerAccessPolicy accessPolicy = container.GetAccessPolicy(cancellationToken: CmdletCancellationToken).Value;
91+
IEnumerable<BlobSignedIdentifier> signedIdentifiers = accessPolicy.SignedIdentifiers;
8192

8293
//Add new policy
83-
if (blobContainerPermissions.SharedAccessPolicies.Keys.Contains(policyName))
94+
foreach (BlobSignedIdentifier identifier in signedIdentifiers)
8495
{
85-
throw new ResourceAlreadyExistException(String.Format(CultureInfo.CurrentCulture, Resources.PolicyAlreadyExists, policyName));
96+
if (identifier.Id == policyName)
97+
{
98+
throw new ResourceAlreadyExistException(String.Format(CultureInfo.CurrentCulture, Resources.PolicyAlreadyExists, policyName));
99+
}
86100
}
87-
88-
SharedAccessBlobPolicy policy = new SharedAccessBlobPolicy();
89-
AccessPolicyHelper.SetupAccessPolicy<SharedAccessBlobPolicy>(policy, startTime, expiryTime, permission);
90-
blobContainerPermissions.SharedAccessPolicies.Add(policyName, policy);
101+
BlobSignedIdentifier signedIdentifier = new BlobSignedIdentifier();
102+
signedIdentifier.Id = policyName;
103+
signedIdentifier.AccessPolicy = new BlobAccessPolicy();
104+
if (StartTime != null)
105+
{
106+
signedIdentifier.AccessPolicy.PolicyStartsOn = StartTime.Value.ToUniversalTime();
107+
}
108+
if (ExpiryTime != null)
109+
{
110+
signedIdentifier.AccessPolicy.PolicyExpiresOn = ExpiryTime.Value.ToUniversalTime();
111+
}
112+
signedIdentifier.AccessPolicy.Permissions = AccessPolicyHelper.OrderBlobPermission(this.Permission);
113+
var newsignedIdentifiers = new List<BlobSignedIdentifier>(signedIdentifiers);
114+
newsignedIdentifiers.Add(signedIdentifier);
91115

92116
//Set permissions back to container
93-
localChannel.SetContainerPermissions(container, blobContainerPermissions, null, null, OperationContext);
117+
container.SetAccessPolicy(accessPolicy.BlobPublicAccess, newsignedIdentifiers, BlobRequestConditions, CmdletCancellationToken);
94118
return policyName;
95119
}
96120

‎src/Storage/Storage/Blob/Cmdlet/RemoveAzureStorageContainerStoredAccessPolicy.cs‎

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,13 @@
1515
namespace Microsoft.WindowsAzure.Commands.Storage.Blob.Cmdlet
1616
{
1717
using Common;
18+
using global::Azure.Storage.Blobs;
19+
using global::Azure.Storage.Blobs.Models;
1820
using Microsoft.Azure.Storage.Blob;
21+
using Microsoft.WindowsAzure.Commands.Common.Storage.ResourceModel;
1922
using Model.Contract;
2023
using System;
24+
using System.Collections.Generic;
2125
using System.Globalization;
2226
using System.Management.Automation;
2327
using System.Security.Permissions;
@@ -67,20 +71,34 @@ internal bool RemoveAzureContainerStoredAccessPolicy(IStorageBlobManagement loca
6771
bool success = false;
6872
string result = string.Empty;
6973

70-
//Get existing permissions
71-
CloudBlobContainer container = localChannel.GetContainerReference(containerName);
72-
BlobContainerPermissions blobContainerPermissions = localChannel.GetContainerPermissions(container, null, null, OperationContext);
74+
//Get container instance, Get existing permissions
75+
CloudBlobContainer container_Track1 = Channel.GetContainerReference(containerName);
76+
BlobContainerClient container = AzureStorageContainer.GetTrack2BlobContainerClient(container_Track1, Channel.StorageContext, ClientOptions);
77+
BlobContainerAccessPolicy accessPolicy = container.GetAccessPolicy(cancellationToken: CmdletCancellationToken).Value;
78+
IEnumerable<BlobSignedIdentifier> signedIdentifiers = accessPolicy.SignedIdentifiers;
7379

74-
//remove the specified policy
75-
if (!blobContainerPermissions.SharedAccessPolicies.Keys.Contains(policyName))
80+
//remove policy
81+
BlobSignedIdentifier signedIdentifier = null;
82+
foreach (BlobSignedIdentifier identifier in signedIdentifiers)
7683
{
77-
throw new ResourceNotFoundException(String.Format(CultureInfo.CurrentCulture, Resources.PolicyNotFound, policyName));
84+
if (identifier.Id == policyName)
85+
{
86+
signedIdentifier = identifier;
87+
}
88+
}
89+
90+
if (signedIdentifier == null)
91+
{
92+
throw new ArgumentException(string.Format(CultureInfo.CurrentCulture, Resources.PolicyNotFound, policyName));
7893
}
7994

8095
if (ShouldProcess(policyName, "Remove policy"))
8196
{
82-
blobContainerPermissions.SharedAccessPolicies.Remove(policyName);
83-
localChannel.SetContainerPermissions(container, blobContainerPermissions, null, null, OperationContext);
97+
List<BlobSignedIdentifier> policyList = new List<BlobSignedIdentifier>(signedIdentifiers);
98+
policyList.Remove(signedIdentifier);
99+
100+
//Set permissions back to container
101+
container.SetAccessPolicy(accessPolicy.BlobPublicAccess, policyList, BlobRequestConditions, CmdletCancellationToken);
84102
success = true;
85103
}
86104

0 commit comments

Comments
 (0)