feat: Support Azure ADLS Gen2 in Browser SQL Playground

[quintanadaniel]

Summary

The Browser SQL Playground currently uses DuckDB WASM, which only supports
S3 and GCS storage backends. When a warehouse is backed by Azure ADLS Gen2,
the playground is unavailable with the following message:

DuckDB WASM currently only supports S3 AND GCS storage. Your warehouse uses adls.

Current behavior

Users on Azure ADLS Gen2 see "SQL Queries Not Available" in the Query tab.
The rest of the Lakekeeper UI works correctly — only the browser playground
is affected.

Expected behavior

The playground should be usable with ADLS Gen2 warehouses, either via:

• Native DuckDB WASM support for ADLS (if/when available upstream), or
• A server-side proxy that streams data from ADLS to DuckDB WASM, avoiding
  the need for direct browser-to-ADLS access

Context

ADLS Gen2 requires Azure AD token-based authentication, which cannot be safely
exposed to the browser — this is likely the core blocker for direct WASM support.
A server-side approach (Lakekeeper backend proxies the reads) may be more
architecturally appropriate for Azure environments.

Environment

• Lakekeeper: v0.12.0
• Storage backend: Azure ADLS Gen2
• Affected: any warehouse configured with ADLS Gen2 storage —
  not specific to a particular namespace or table

[v-kessler]

@quintanadaniel thanks. unfortunately this is a current duckdb limitation https://duckdb.org/docs/current/core_extensions/iceberg/iceberg_rest_catalogs#limitations

Maybe you can open an issue on duckdb side?

[quintanadaniel]

Hi @v-kessler, following up: I opened a discussion on the DuckDB WASM side to request support for ADLS Gen2 via HTTPS / SAS token URL resolution. Note that duckdb/duckdb-wasm does not allow feature request issues, they redirect those to Discussions, so that's where this ended up:

duckdb/duckdb-wasm#2217

The proposal suggests that DuckDB's Iceberg extension consume pre-signed HTTPS URLs (SAS tokens) when provided by the catalog server, which would allow ADLS Gen2 to work transparently without needing the azure extension compiled into WASM.