create session

sdk/storage/azure-storage-blob/assets.json

@@ -2,5 +2,5 @@
   "AssetsRepo": "Azure/azure-sdk-assets",
   "AssetsRepoPrefixPath": "java",
   "TagPrefix": "java/storage/azure-storage-blob",
-  "Tag": "java/storage/azure-storage-blob_47f4243e59"
+  "Tag": "java/storage/azure-storage-blob_4f95fc8478"
 }

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobClientBuilder.java

@@ -200,7 +200,7 @@ private HttpPipeline constructPipeline() {
             ? httpPipeline
             : BuilderHelper.buildPipeline(storageSharedKeyCredential, tokenCredential, azureSasCredential, sasToken,
                 endpoint, retryOptions, coreRetryOptions, logOptions, clientOptions, httpClient, perCallPolicies,
-                perRetryPolicies, configuration, audience, LOGGER);
+                perRetryPolicies, configuration, audience, LOGGER, null, null);
     }
 
     /**

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobContainerAsyncClient.java

@@ -28,6 +28,9 @@
 import com.azure.storage.blob.implementation.models.EncryptionScope;
 import com.azure.storage.blob.implementation.models.ListBlobsFlatSegmentResponse;
 import com.azure.storage.blob.implementation.models.ListBlobsHierarchySegmentResponse;
+import com.azure.storage.blob.implementation.models.AuthenticationType;
+import com.azure.storage.blob.implementation.models.CreateSessionConfiguration;
+import com.azure.storage.blob.implementation.models.CreateSessionResponse;
 import com.azure.storage.blob.implementation.util.BlobConstants;
 import com.azure.storage.blob.implementation.util.BlobSasImplUtil;
 import com.azure.storage.blob.implementation.util.ModelHelper;
@@ -1691,11 +1694,39 @@ public String generateSas(BlobServiceSasSignatureValues blobServiceSasSignatureV
             .generateSas(SasImplUtils.extractSharedKeyCredential(getHttpPipeline()), stringToSignHandler, context);
     }
 
-    //    private boolean validateNoTime(BlobRequestConditions modifiedRequestConditions) {
-    //        if (modifiedRequestConditions == null) {
-    //            return true;
-    //        }
-    //        return modifiedRequestConditions.getIfModifiedSince() == null
-    //            && modifiedRequestConditions.getIfUnmodifiedSince() == null;
-    //    }
+    /**
+     * Creates a session scoped to this container. The session provides temporary credentials (a session token and
+     * session key) that can be used to sign subsequent requests using the Shared Key protocol.
+     *
+     * @return A {@link Mono} containing the {@link CreateSessionResponse} with session credentials.
+     */
+    @ServiceMethod(returns = ReturnType.SINGLE)
+    Mono<CreateSessionResponse> createSession() {
+        return createSessionWithResponse().flatMap(FluxUtil::toMono);
+    }
+
+    /**
+     * Creates a session scoped to this container. The session provides temporary credentials (a session token and
+     * session key) that can be used to sign subsequent requests using the Shared Key protocol.
+     *
+     * @return A {@link Mono} containing a {@link Response} with the {@link CreateSessionResponse}.
+     */
+    @ServiceMethod(returns = ReturnType.SINGLE)
+    Mono<Response<CreateSessionResponse>> createSessionWithResponse() {
+        try {
+            return withContext(this::createSessionWithResponse);
+        } catch (RuntimeException ex) {
+            return monoError(LOGGER, ex);
+        }
+    }
+
+    Mono<Response<CreateSessionResponse>> createSessionWithResponse(Context context) {
+        context = context == null ? Context.NONE : context;
+        CreateSessionConfiguration config
+            = new CreateSessionConfiguration().setAuthenticationType(AuthenticationType.HMAC);
+        return this.azureBlobStorage.getContainers()
+            .createSessionWithResponseAsync(containerName, config, null, null, context)
+            .map(response -> new SimpleResponse<>(response, response.getValue()));
+    }
+
 }

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobContainerClient.java

@@ -31,6 +31,9 @@
 import com.azure.storage.blob.implementation.models.FilterBlobSegment;
 import com.azure.storage.blob.implementation.models.ListBlobsFlatSegmentResponse;
 import com.azure.storage.blob.implementation.models.ListBlobsHierarchySegmentResponse;
+import com.azure.storage.blob.implementation.models.AuthenticationType;
+import com.azure.storage.blob.implementation.models.CreateSessionConfiguration;
+import com.azure.storage.blob.implementation.models.CreateSessionResponse;
 import com.azure.storage.blob.implementation.util.BlobConstants;
 import com.azure.storage.blob.implementation.util.BlobSasImplUtil;
 import com.azure.storage.blob.implementation.util.ModelHelper;
@@ -1509,4 +1512,37 @@ public String generateSas(BlobServiceSasSignatureValues blobServiceSasSignatureV
             .generateSas(SasImplUtils.extractSharedKeyCredential(getHttpPipeline()), stringToSignHandler, context);
     }
 
+    /**
+     * Creates a session scoped to this container. The session provides temporary credentials (a session token and
+     * session key) that can be used to sign subsequent requests using the Shared Key protocol.
+     *
+     * @return The {@link CreateSessionResponse} with session credentials.
+     */
+    @ServiceMethod(returns = ReturnType.SINGLE)
+    CreateSessionResponse createSession() {
+        return createSessionWithResponse(null, Context.NONE).getValue();
+    }
+
+    /**
+     * Creates a session scoped to this container. The session provides temporary credentials (a session token and
+     * session key) that can be used to sign subsequent requests using the Shared Key protocol.
+     *
+     * @param timeout An optional timeout value beyond which a {@link RuntimeException} will be raised.
+     * @param context Additional context that is passed through the Http pipeline during the service call.
+     * @return A {@link Response} containing the {@link CreateSessionResponse}.
+     */
+    @ServiceMethod(returns = ReturnType.SINGLE)
+    Response<CreateSessionResponse> createSessionWithResponse(Duration timeout, Context context) {
+        Context finalContext = context == null ? Context.NONE : context;
+        CreateSessionConfiguration config
+            = new CreateSessionConfiguration().setAuthenticationType(AuthenticationType.HMAC);
+
+        Callable<Response<CreateSessionResponse>> operation = () -> {
+            Response<CreateSessionResponse> response = this.azureBlobStorage.getContainers()
+                .createSessionWithResponse(containerName, config, null, null, finalContext);
+            return new SimpleResponse<>(response, response.getValue());
+        };
+
+        return sendRequest(operation, timeout, BlobStorageException.class);
+    }
 }

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobContainerClientBuilder.java

@@ -32,6 +32,8 @@
 import com.azure.storage.blob.models.BlobContainerEncryptionScope;
 import com.azure.storage.blob.models.CpkInfo;
 import com.azure.storage.blob.models.CustomerProvidedKey;
+import com.azure.storage.blob.models.SessionOptions;
+import com.azure.storage.blob.models.SessionMode;
 import com.azure.storage.common.StorageSharedKeyCredential;
 import com.azure.storage.common.implementation.connectionstring.StorageAuthenticationSettings;
 import com.azure.storage.common.implementation.connectionstring.StorageConnectionString;
@@ -91,6 +93,7 @@ public final class BlobContainerClientBuilder implements TokenCredentialTrait<Bl
     private Configuration configuration;
     private BlobServiceVersion version;
     private BlobAudience audience;
+    private SessionOptions sessionOptions = new SessionOptions();
 
     /**
      * Creates a builder instance that is able to configure and construct {@link BlobContainerClient ContainerClients}
@@ -124,6 +127,8 @@ public BlobContainerClient buildClient() {
                 new IllegalArgumentException("Customer provided key and encryption " + "scope cannot both be set"));
         }
 
+        validateSessionMode();
+
         /*
         Implicit and explicit root container access are functionally equivalent, but explicit references are easier
         to read and debug.
@@ -133,7 +138,7 @@ public BlobContainerClient buildClient() {
 
         BlobServiceVersion serviceVersion = version != null ? version : BlobServiceVersion.getLatest();
 
-        HttpPipeline pipeline = constructPipeline();
+        HttpPipeline pipeline = constructPipeline(blobContainerName, serviceVersion);
 
         return new BlobContainerClient(pipeline, endpoint, serviceVersion, accountName, blobContainerName,
             customerProvidedKey, encryptionScope, blobContainerEncryptionScope);
@@ -165,6 +170,8 @@ public BlobContainerAsyncClient buildAsyncClient() {
                 new IllegalArgumentException("Customer provided key and encryption " + "scope cannot both be set"));
         }
 
+        validateSessionMode();
+
         /*
         Implicit and explicit root container access are functionally equivalent, but explicit references are easier
         to read and debug.
@@ -174,18 +181,32 @@ public BlobContainerAsyncClient buildAsyncClient() {
 
         BlobServiceVersion serviceVersion = version != null ? version : BlobServiceVersion.getLatest();
 
-        HttpPipeline pipeline = constructPipeline();
+        HttpPipeline pipeline = constructPipeline(blobContainerName, serviceVersion);
 
         return new BlobContainerAsyncClient(pipeline, endpoint, serviceVersion, accountName, blobContainerName,
             customerProvidedKey, encryptionScope, blobContainerEncryptionScope);
     }
 
-    private HttpPipeline constructPipeline() {
-        return (httpPipeline != null)
-            ? httpPipeline
-            : BuilderHelper.buildPipeline(storageSharedKeyCredential, tokenCredential, azureSasCredential, sasToken,
-                endpoint, retryOptions, coreRetryOptions, logOptions, clientOptions, httpClient, perCallPolicies,
-                perRetryPolicies, configuration, audience, LOGGER);
+    private HttpPipeline constructPipeline(String containerName, BlobServiceVersion serviceVersion) {
+        if (httpPipeline != null) {
+            return httpPipeline;
+        }
+        if (containerName != null) {
+            sessionOptions.setContainerName(containerName);
+        }
+        if (sessionOptions.getAccountName() == null) {
+            sessionOptions.setAccountName(accountName);
+        }
+        return BuilderHelper.buildPipeline(storageSharedKeyCredential, tokenCredential, azureSasCredential, sasToken,
+            endpoint, retryOptions, coreRetryOptions, logOptions, clientOptions, httpClient, perCallPolicies,
+            perRetryPolicies, configuration, audience, LOGGER, sessionOptions, serviceVersion);
+    }
+
+    private void validateSessionMode() {
+        if (sessionOptions.getSessionMode().resolve() != SessionMode.NONE && CoreUtils.isNullOrEmpty(containerName)) {
+            throw LOGGER.logExceptionAsError(new IllegalArgumentException(
+                "containerName must be set when using SessionMode." + sessionOptions.getSessionMode()));
+        }
     }
 
     /**
@@ -606,4 +627,22 @@ public BlobContainerClientBuilder audience(BlobAudience audience) {
         this.audience = audience;
         return this;
     }
+
+    /**
+     * Sets the {@link SessionOptions} that controls how the SDK manages session-based authentication
+     * for this container.
+     * <p>
+     * Sessions amortize authentication and authorization cost across many requests by signing them
+     * with a lightweight HMAC key instead of a full bearer token. When the session mode within the options
+     * is set to a value other than {@link SessionMode#NONE},
+     * {@link #containerName(String) containerName} must also be set.
+     *
+     * @param sessionOptions The session options to use. If {@code null}, defaults to {@link SessionMode#AUTO}
+     * when identity-based authentication (bearer token) is configured.
+     * @return the updated BlobContainerClientBuilder object.
+     */
+    public BlobContainerClientBuilder sessionOptions(SessionOptions sessionOptions) {
+        this.sessionOptions = SessionOptions.orDefault(sessionOptions);
+        return this;
+    }
 }

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobServiceAsyncClient.java

@@ -22,7 +22,9 @@
 import com.azure.storage.blob.implementation.AzureBlobStorageImplBuilder;
 import com.azure.storage.blob.implementation.models.EncryptionScope;
 import com.azure.storage.blob.implementation.models.ServicesGetAccountInfoHeaders;
+import com.azure.storage.blob.implementation.util.BuilderHelper;
 import com.azure.storage.blob.implementation.util.ModelHelper;
+import com.azure.storage.blob.models.SessionOptions;
 import com.azure.storage.blob.models.BlobContainerEncryptionScope;
 import com.azure.storage.blob.models.BlobContainerItem;
 import com.azure.storage.blob.models.BlobCorsRule;
@@ -33,6 +35,7 @@
 import com.azure.storage.blob.models.KeyInfo;
 import com.azure.storage.blob.models.ListBlobContainersOptions;
 import com.azure.storage.blob.models.PublicAccessType;
+import com.azure.storage.blob.models.SessionMode;
 import com.azure.storage.blob.models.StorageAccountInfo;
 import com.azure.storage.blob.models.TaggedBlobItem;
 import com.azure.storage.blob.models.UserDelegationKey;
@@ -54,6 +57,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.function.BiFunction;
 import java.util.function.Consumer;
 import java.util.stream.Collectors;
@@ -95,6 +99,7 @@ public final class BlobServiceAsyncClient {
     private final BlobContainerEncryptionScope blobContainerEncryptionScope; // only used to pass down to container
     // clients
     private final boolean anonymousAccess;
+    private final SessionOptions sessionOptions;
 
     /**
      * Package-private constructor for use by {@link BlobServiceClientBuilder}.
@@ -108,10 +113,12 @@ public final class BlobServiceAsyncClient {
      * @param encryptionScope Encryption scope used during encryption of the blob's data on the server, pass
      * {@code null} to allow the service to use its own encryption.
      * @param anonymousAccess Whether the client was built with anonymousAccess
+     * @param sessionOptions Session options for session-based authentication.
      */
     BlobServiceAsyncClient(HttpPipeline pipeline, String url, BlobServiceVersion serviceVersion, String accountName,
         CpkInfo customerProvidedKey, EncryptionScope encryptionScope,
-        BlobContainerEncryptionScope blobContainerEncryptionScope, boolean anonymousAccess) {
+        BlobContainerEncryptionScope blobContainerEncryptionScope, boolean anonymousAccess,
+        SessionOptions sessionOptions) {
         /* Check to make sure the uri is valid. We don't want the error to occur later in the generated layer
            when the sas token has already been applied. */
         try {
@@ -130,6 +137,7 @@ public final class BlobServiceAsyncClient {
         this.encryptionScope = encryptionScope;
         this.blobContainerEncryptionScope = blobContainerEncryptionScope;
         this.anonymousAccess = anonymousAccess;
+        this.sessionOptions = Objects.requireNonNull(sessionOptions, "'sessionOptions' cannot be null.");
     }
 
     /**

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobServiceClient.java

@@ -27,7 +27,10 @@
 import com.azure.storage.blob.implementation.models.ServicesGetPropertiesHeaders;
 import com.azure.storage.blob.implementation.models.ServicesGetStatisticsHeaders;
 import com.azure.storage.blob.implementation.models.ServicesGetUserDelegationKeyHeaders;
+import com.azure.storage.blob.implementation.util.BuilderHelper;
 import com.azure.storage.blob.implementation.util.ModelHelper;
+import com.azure.storage.blob.models.SessionMode;
+import com.azure.storage.blob.models.SessionOptions;
 import com.azure.storage.blob.models.BlobContainerEncryptionScope;
 import com.azure.storage.blob.models.BlobContainerItem;
 import com.azure.storage.blob.models.BlobContainerListDetails;
@@ -60,6 +63,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.concurrent.Callable;
 import java.util.function.BiFunction;
 import java.util.stream.Collectors;
@@ -91,6 +95,7 @@ public final class BlobServiceClient {
     private final BlobContainerEncryptionScope blobContainerEncryptionScope; // only used to pass down to container
     // clients
     private final boolean anonymousAccess;
+    private final SessionOptions sessionOptions;
 
     /**
      * Package-private constructor for use by {@link BlobServiceClientBuilder}.
@@ -107,7 +112,8 @@ public final class BlobServiceClient {
      */
     BlobServiceClient(HttpPipeline pipeline, String url, BlobServiceVersion serviceVersion, String accountName,
         CpkInfo customerProvidedKey, EncryptionScope encryptionScope,
-        BlobContainerEncryptionScope blobContainerEncryptionScope, boolean anonymousAccess) {
+        BlobContainerEncryptionScope blobContainerEncryptionScope, boolean anonymousAccess,
+        SessionOptions sessionOptions) {
         /* Check to make sure the uri is valid. We don't want the error to occur later in the generated layer
            when the sas token has already been applied. */
         try {
@@ -126,6 +132,7 @@ public final class BlobServiceClient {
         this.encryptionScope = encryptionScope;
         this.blobContainerEncryptionScope = blobContainerEncryptionScope;
         this.anonymousAccess = anonymousAccess;
+        this.sessionOptions = Objects.requireNonNull(sessionOptions, "'sessionOptions' cannot be null.");
     }
 
     /**
@@ -147,6 +154,7 @@ public BlobContainerClient getBlobContainerClient(String containerName) {
         if (CoreUtils.isNullOrEmpty(containerName)) {
             containerName = BlobContainerClient.ROOT_CONTAINER_NAME;
         }
+
         return new BlobContainerClient(getHttpPipeline(), getAccountUrl(), getServiceVersion(), getAccountName(),
             containerName, customerProvidedKey, encryptionScope, blobContainerEncryptionScope);
     }