feat(storage): sign Azure layer-file uploads with a SAS - #3634
Closed
michalsuba-e2b wants to merge 3 commits into
Closed
michalsuba-e2b wants to merge 3 commits into
michalsuba-e2b wants to merge 3 commits into
Conversation
…load headers
Azure's Put Blob requires the request header "x-ms-blob-type: BlockBlob". A SAS can
only pin response headers, so no signed URL alone can satisfy it and the provider
refused to issue one at all — every template build with a COPY instruction failed on
Azure at the get-signed-URL step.
UploadSignedURL now returns {URL, Headers} instead of a bare URL, and the header
travels with the URL through the gRPC and public API responses for the upload client
to apply. Azure mints a create+write blob SAS with whichever credential the provider
already authenticated with: a user delegation key for a token credential (the managed
identity path), or the shared key when one is configured. A SAS-only connection string
can sign neither and now says so at construction and at the call. GCS, S3 and the
filesystem provider return nil headers and byte-identical URLs.
The proto and OpenAPI additions are additive — url stays optional, and a client that
ignores the new field parses the response unchanged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…rance' into feat/azure-signed-upload-headers # Conflicts: # packages/api/internal/api/api.gen.go
Standing review rule: a comment states one constraint on one line; reasoning lives here, not at the fix site. No behavior change; tests unchanged and green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
michalsuba-e2b
marked this pull request as ready for review
September 14, 2026 08:01
michalsuba-e2b
requested review from
ValentaTomas,
dobrac and
jakubno
as code owners
September 14, 2026 08:01
michalsuba-e2b
added a commit
to e2b-dev/E2B
that referenced
this pull request
Sep 15, 2026
… link (#1870) The API now returns request headers with a file-upload link (e2b-dev/belt#3308, moved from e2b-dev/runtime#3634 — Azure `Put Blob` needs `x-ms-blob-type`, which its SAS cannot carry); both SDKs apply them on the upload PUT. Header-less providers (S3/GCS/fs) get byte-identical requests, so nothing changes off Azure. - JS: `getFileUploadLink` returns `headers`; `putFileStream` merges them under our own `Content-Length`, stripping any API-sent Content-Length case-insensitively. - Python sync + async: `upload_file` takes keyword-only `headers`, merged the same way (sync mirrored to async per review). - Tests: header pass-through, no-headers guard, and Content-Length-stays-ours (lowercase spelling to pin case-insensitivity), in JS and both Python variants; live suites (GCS production path) green. - Validated e2e at head against an Azure BYOC env (miso9) through staging api + edge: multi-COPY build green with uploads landing (cache miss) and a zero-upload green rerun (cache hit); earlier direct probes: headers applied → 201, stripped → `MissingRequiredHeader`. - `spec/runtime-ref` pins runtime `main` (`756512ca8`), which carries the merged contract (e2b-dev/belt#3308). Changesets: one patch per SDK. Sponsor: @michalsuba-e2b 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.