Azure_blob file retrieval doesn't work for non-public access storage

[ion-elgreco]

What happened?

I've configure my librechat with an aks managed identity, this works fine. You can also see:

{"level":"info","message":"Azure Blob Service initialized using Managed Identity","timestamp":"2025-07-14T06:58:19.750Z"}

It also correctly uploads them to the blob storage.

The problem is the fetching and showing it in the UI. I've set: AZURE_STORAGE_PUBLIC_ACCESS: "False", but it doesn't use pre-signed urls, it's using direct blob urls which is not correct, which aren't accessible since it's a non-public storage account.

See below:

<img alt="8d93bd79-5054-4f0a-9e05-b9e243840742-dalle_call_aAu9arAgLM1hSURkQ0Fcv58K_img_c8vuDbQ5e3eHWB_Sszykm.png" class="transition-opacity duration-100 opacity-0" src="https://<REDACTED>.blob.core.windows.net/<REDACTED>/images/6870d0a5775abebf278cc3d3/8d93bd79-5054-4f0a-9e05-b9e243840742-dalle_call_aAu9arAgLM1hSURkQ0Fcv58K_img_c8vuDbQ5e3eHWB_Sszykm.png" style="width: auto; height: auto; color: transparent; display: block;">

Version Information

version: 0.7.9-rc1

Steps to Reproduce

1. Create azure storage blob account with no anonymous access
2. Create container
3. Use managed identity with Azure blob storage data contributor
4. Configure librechat with aks workload identity
5. Run dalle-3 for example, to generate an image
6. See how it's blank in the UI:

What browsers are you seeing the problem on?

No response

Relevant log output

There is none that mention the whole file strategy part.

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[ion-elgreco]

Looking at the integration, it doesn't use pre-signed urls or SaS url's at all regardless of setting AZURE_STORAGE_PUBLIC_ACCESS = False.

[danny-avila]

For "non-public access" was how it was implemented. Further work on this is not planned but maybe @rubentalstra can look into it as he implemented this in the first place

[ion-elgreco]

What's the point of AZURE_STORAGE_PUBLIC_ACCESS=False? It auto creates a container with non-public access if you set that flag, then why doesn't it use pre-signed urls when fetching from this container.

Not sure why you closed the issue because it's clearly a bug. Being able to auto create containers with non-public access and then not being able to access the files from librechat is very pointless

[ion-elgreco]

@rubentalstra any thoughts on this topic?