gitlab-fog-azure-rm 2.5.0 → 2.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3c8efd2c5ce76c59fe96a72faceb7470f8a1bc0e75ffdef6808434583108cdf
-  data.tar.gz: 72fce32424077553bb8c4b6e8a1a6ffa56307261352a801355b1a93878628715
+  metadata.gz: 82912caef21af9f05608fd07eb07dd1c1a5d2693a805562a33448997f7897177
+  data.tar.gz: 245ab6fc1a0f8f64d775872c622696debcd1594cb72e75d7a533eef689d19e27
 SHA512:
-  metadata.gz: 6cf9691fa2a0423b6da2f5b0874447364207d0a1e10852a11f3e14cd5fc213fc20a8de8987263e70d0f04ac59d5c044779ced3c8bb8451d13622c608f1e73f29
-  data.tar.gz: e92ddc401cdf2b5e606afd6342ef6a136e7d6dae56590fa27338cdfb42dd6a6b2f563f1cde3290274182e3d1370355cc94aefeb1b67261bb555ff031df631b8d
+  metadata.gz: a28a7bc76b170937760e54e276386b6b555077ad01d5b2e0259841c70d93247904b94ea899ad2ecbde12799bdc4786091879919695b00dbe4d83977678a82172
+  data.tar.gz: deb8fdf6983ae0e8ca2350cf35c4ca334e08cfd1779c1fd463fee5f6c338ed1db364ecae5b05f3b4b9816409d466c8115faa1ba6462f737bece557ad7756c0c6

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 ## Unreleased
 
+## 2.5.2
+
+- Refresh credentials on all blob storage requests !67
+- Parse expires_in from OAuth token responses so token expiry is honored !67
+
+## 2.5.1
+
+- Fix thread-safety race in SAS signer credential refresh !64
+
 ## 2.5.0
 
 - Support Ruby 4 !61

data/lib/fog/azurerm/identity/base_client.rb

@@ -43,12 +43,22 @@ module Fog
 
           return unless access_token
 
-          expires_at = ::Time.now
+          Credentials.new(access_token, token_expires_at(body))
+        rescue ::JSON::ParserError # rubocop:disable Lint/SuppressedException
+        end
+
+        # IMDS returns an absolute expires_on (epoch seconds), while the OAuth
+        # v2.0 token endpoint used by workload identity returns a relative
+        # expires_in. Handle both so refresh_needed? has a real expiry; otherwise
+        # it defaults to now and forces a token fetch on every request.
+        def token_expires_at(body)
           expires_on = body['expires_on']
-          expires_at = ::Time.at(expires_on.to_i) if expires_on
+          return ::Time.at(expires_on.to_i) if expires_on
 
-          Credentials.new(access_token, expires_at)
-        rescue ::JSON::ParserError # rubocop:disable Lint/SuppressedException
+          expires_in = body['expires_in']
+          return ::Time.now + expires_in.to_i if expires_in
+
+          ::Time.now
         end
 
         private

data/lib/fog/azurerm/requests/storage/acquire_blob_lease.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            lease_id = @blob_client.acquire_blob_lease(container_name, name, options)
+            lease_id = blob_client.acquire_blob_lease(container_name, name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/acquire_container_lease.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            lease_id = @blob_client.acquire_container_lease(name, options)
+            lease_id = blob_client.acquire_container_lease(name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/commit_blob_blocks.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.commit_blob_blocks(container_name, blob_name, blocks, options)
+            blob_client.commit_blob_blocks(container_name, blob_name, blocks, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/copy_blob.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            copy_id, copy_status = @blob_client.copy_blob(destination_container, destination_blob, source_container, source_blob, options)
+            copy_id, copy_status = blob_client.copy_blob(destination_container, destination_blob, source_container, source_blob, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/copy_blob_from_uri.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            copy_id, copy_status = @blob_client.copy_blob_from_uri(destination_container, destination_blob, source_blob_uri, options)
+            copy_id, copy_status = blob_client.copy_blob_from_uri(destination_container, destination_blob, source_blob_uri, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/create_block_blob.rb

@@ -8,7 +8,7 @@ module Fog
           msg = "create_block_blob #{blob_name} to the container #{container_name}. options: #{options}"
           Fog::Logger.debug msg
 
-          @blob_client.create_block_blob(container_name, blob_name, body, options)
+          blob_client.create_block_blob(container_name, blob_name, body, options)
         rescue Azure::Core::Http::HTTPError => ex
           raise_azure_exception(ex, msg)
         end

data/lib/fog/azurerm/requests/storage/create_container.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            container = @blob_client.create_container(name, options)
+            container = blob_client.create_container(name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/create_page_blob.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.create_page_blob(container_name, blob_name, blob_size, options)
+            blob_client.create_page_blob(container_name, blob_name, blob_size, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/delete_blob.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.delete_blob(container_name, blob_name, options)
+            blob_client.delete_blob(container_name, blob_name, options)
           rescue Azure::Core::Http::HTTPError => ex
             return true if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)

data/lib/fog/azurerm/requests/storage/delete_container.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.delete_container(name, options)
+            blob_client.delete_container(name, options)
           rescue Azure::Core::Http::HTTPError => ex
             return true if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)

data/lib/fog/azurerm/requests/storage/get_blob.rb

@@ -11,7 +11,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            blob = @blob_client.get_blob_properties(container_name, blob_name, options)
+            blob = blob_client.get_blob_properties(container_name, blob_name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise 'NotFound' if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)
@@ -49,7 +49,7 @@ module Fog
             begin
               msg = "get_blob_with_block_given: blob #{blob_name} in the container #{container_name}. options: #{params}"
               Fog::Logger.debug msg
-              _, content = @blob_client.get_blob(container_name, blob_name, params)
+              _, content = blob_client.get_blob(container_name, blob_name, params)
             rescue Azure::Core::Http::HTTPError => ex
               raise 'NotFound' if ex.message.include?('(404)')
               raise_azure_exception(ex, msg)
@@ -71,7 +71,7 @@ module Fog
             Fog::Logger.debug msg
 
             begin
-              blob, content = @blob_client.get_blob(container_name, blob_name, options)
+              blob, content = blob_client.get_blob(container_name, blob_name, options)
               Fog::Logger.debug "Get blob #{blob_name} successfully."
               [blob, content]
             rescue Azure::Core::Http::HTTPError => ex

data/lib/fog/azurerm/requests/storage/get_blob_properties.rb

@@ -8,7 +8,7 @@ module Fog
           msg = "Get Blob #{name} properties in container #{container_name}, options: #{options}."
           Fog::Logger.debug msg
           begin
-            blob = @blob_client.get_blob_properties(container_name, name, options)
+            blob = blob_client.get_blob_properties(container_name, name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise 'NotFound' if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)

data/lib/fog/azurerm/requests/storage/get_container_acl.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            container, signed_identifiers = @blob_client.get_container_acl(container_name, options)
+            container, signed_identifiers = blob_client.get_container_acl(container_name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/get_container_properties.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            container = @blob_client.get_container_properties(name, options)
+            container = blob_client.get_container_properties(name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise 'NotFound' if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)

data/lib/fog/azurerm/requests/storage/list_blobs.rb

@@ -19,7 +19,7 @@ module Fog
               options[:request_id] = SecureRandom.uuid
               msg = "Listing blobs in container: #{container_name}, options: #{options}"
               Fog::Logger.debug msg
-              temp = @blob_client.list_blobs(container_name, options)
+              temp = blob_client.list_blobs(container_name, options)
               # Workaround for the issue https://github.com/Azure/azure-storage-ruby/issues/37
               raise temp unless temp.instance_of?(Azure::Storage::Common::Service::EnumerationResults)
 

data/lib/fog/azurerm/requests/storage/list_containers.rb

@@ -14,7 +14,7 @@ module Fog
               options[:request_id] = SecureRandom.uuid
               msg = "Listing containers. options: #{options}"
               Fog::Logger.debug msg
-              temp = @blob_client.list_containers(options)
+              temp = blob_client.list_containers(options)
               # Workaround for the issue https://github.com/Azure/azure-storage-ruby/issues/37
               raise temp unless temp.instance_of?(Azure::Storage::Common::Service::EnumerationResults)
 

data/lib/fog/azurerm/requests/storage/put_blob_block.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.put_blob_block(container_name, blob_name, block_id, data, options)
+            blob_client.put_blob_block(container_name, blob_name, block_id, data, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_blob_metadata.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.set_blob_metadata(container_name, name, metadata, options)
+            blob_client.set_blob_metadata(container_name, name, metadata, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_blob_pages.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.put_blob_pages(container_name, blob_name, start_range, end_range, data, options)
+            blob_client.put_blob_pages(container_name, blob_name, start_range, end_range, data, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_blob_properties.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.set_blob_properties(container_name, name, options)
+            blob_client.set_blob_properties(container_name, name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_container_acl.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.set_container_acl(name, acl, options)
+            blob_client.set_container_acl(name, acl, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_container_metadata.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.set_container_metadata(name, metadata, options)
+            blob_client.set_container_metadata(name, metadata, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/release_blob_lease.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.release_blob_lease(container_name, name, lease_id, options)
+            blob_client.release_blob_lease(container_name, name, lease_id, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/release_container_lease.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.release_container_lease(name, lease_id, options)
+            blob_client.release_container_lease(name, lease_id, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/storage.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'json'
+require 'time'
 
 module Fog
   module AzureRM
@@ -87,6 +88,25 @@ module Fog
 
         attr_accessor :options
 
+        # Immutable snapshot of a built SharedAccessSignature and the delegation
+        # key expiry it is valid until. It is published by a single reference
+        # assignment so signature_client can read it on a lock-free fast path.
+        # A nil expiry means the signature never expires (shared-key auth, which
+        # signs with the access key rather than a user delegation key).
+        class SignatureState
+          attr_reader :client, :expiry
+
+          def initialize(client, expiry)
+            @client = client
+            @expiry = expiry
+            freeze
+          end
+
+          def covers?(requested_expiry)
+            expiry.nil? || expiry >= requested_expiry
+          end
+        end
+
         def initialize(options)
           begin
             require 'azure/storage/common'
@@ -100,8 +120,8 @@ module Fog
             raise e.message
           end
 
-          @user_delegation_key_mutex = Mutex.new
-          @blob_client_mutex = Mutex.new
+          @credential_mutex = Mutex.new
+          @signature_mutex = Mutex.new
 
           options[:environment] = options[:environment] || ENV['AZURE_ENVIRONMENT'] || ENVIRONMENT_AZURE_CLOUD
           @environment = options[:environment]
@@ -117,7 +137,7 @@ module Fog
           @azure_storage_endpoint = options[:azure_storage_endpoint]
           @azure_storage_domain = options[:azure_storage_domain]
 
-          refresh_blob_client
+          @blob_client = build_blob_client(@azure_storage_token_signer)
         end
 
         private
@@ -142,62 +162,129 @@ module Fog
           Azure::Storage::Common::Core::Auth::TokenSigner.new(cred)
         end
 
+        # Returns a SharedAccessSignature for signing a URL that expires at
+        # requested_expiry.
+        #
+        # A user delegation key is valid for up to a week
+        # (MAX_USER_DELEGATION_KEY_SECONDS), so the built signature is cached in
+        # a frozen @signature_state snapshot and reused on a lock-free fast path.
+        # This keeps signing off the lock in the common case, so an in-flight
+        # credential or delegation-key refresh on another thread never stalls it.
+        #
+        # Only the slow path (no cached signature, or the cached delegation key
+        # no longer covers the requested expiry) takes @signature_mutex, where
+        # the delegation-key fetch and the snapshot rebuild happen atomically.
+        # Holding the lock there also collapses a burst of concurrent refetches
+        # into a single fetch.
         def signature_client(requested_expiry)
-          access_key = @azure_storage_access_key.to_s
-          user_delegation_key = user_delegation_key(requested_expiry)
-
-          # invalidate cache when the delegation key changes
-          unless @signature_client_delegation_key == user_delegation_key
-            @signature_client_delegation_key = user_delegation_key
-            @signature_client = nil
+          # Keep the blob client's credentials fresh without blocking signing;
+          # see maybe_refresh_credentials.
+          maybe_refresh_credentials
+
+          state = @signature_state
+          return state.client if state&.covers?(requested_expiry)
+
+          @signature_mutex.synchronize do
+            # Re-check: another thread may have rebuilt the snapshot while we
+            # were waiting for the lock.
+            state = @signature_state
+            return state.client if state&.covers?(requested_expiry)
+
+            delegation_key = fetch_user_delegation_key(requested_expiry)
+            client = Azure::Storage::Common::Core::Auth::SharedAccessSignature.new(
+              @azure_storage_account_name,
+              @azure_storage_access_key.to_s,
+              delegation_key
+            )
+            @signature_state = SignatureState.new(client, @user_delegation_key_expiry)
+            client
           end
-
-          @signature_client ||= Azure::Storage::Common::Core::Auth::SharedAccessSignature.new(
-            @azure_storage_account_name,
-            access_key,
-            user_delegation_key
-          )
         end
 
-        def user_delegation_key(requested_expiry)
-          return nil unless @azure_storage_token_signer
+        # Refreshes the credential-derived state (@credentials, the token signer
+        # and the blob client) when the access token is near expiry. The SAS URL
+        # requests reach this through signature_client, and the data-plane
+        # requests reach it through the blob_client reader, so both keep their
+        # token fresh across rotation.
+        #
+        # The refresh is best-effort and non-blocking: a token fetch can be slow
+        # (or hang), so only one thread performs it at a time via a try-lock, and
+        # every other thread proceeds with the current, still-valid credentials
+        # rather than waiting. This keeps a slow token endpoint from stalling all
+        # callers that share the instance.
+        #
+        # The new signer and client are built into locals first and @credentials
+        # is published last. If building raises, @credentials is unchanged so
+        # refresh_needed? stays true and the next call retries, rather than
+        # leaving the swap half-applied with a stale signer or client.
+        def maybe_refresh_credentials
+          return unless @credential_client
+
+          current = @credentials
+          return unless current.nil? || current.refresh_needed?
+          return unless @credential_mutex.try_lock
+
+          begin
+            return unless @credentials.nil? || @credentials.refresh_needed?
 
-          if @credential_client
             new_credentials = @credential_client.fetch_credentials_if_needed
-            changed = new_credentials != @credentials
+            return if new_credentials.nil? || new_credentials == @credentials
+
+            signer = access_token_signer(new_credentials.token)
+            client = build_blob_client(signer)
 
-            if changed
-              @credentials = new_credentials
-              @azure_storage_token_signer = token_signer
-              refresh_blob_client
-            end
+            @azure_storage_token_signer = signer
+            @blob_client = client
+            @credentials = new_credentials
+          ensure
+            @credential_mutex.unlock
           end
+        end
+
+        # Reader for the data-plane blob client. It refreshes an expiring access
+        # token first, so operations that read the client directly (blob
+        # properties, downloads, uploads, deletes) stay authenticated across
+        # token rotation, not only the SAS URL path. See
+        # https://gitlab.com/gitlab-org/ruby/gems/gitlab-fog-azure-rm/-/issues/11
+        def blob_client
+          maybe_refresh_credentials
+          @blob_client
+        end
 
-          @user_delegation_key_mutex.synchronize do
-            if @user_delegation_key_expiry.nil? || @user_delegation_key_expiry < requested_expiry
-              start = Time.now
-              expiry = start + Azure::Storage::Blob::BlobConstants::MAX_USER_DELEGATION_KEY_SECONDS
-
-              @user_delegation_key = @blob_client.get_user_delegation_key(
-                start,
-                expiry
-              )
-              @user_delegation_key_expiry = expiry
-            end
+        # Returns the cached user delegation key, fetching a new one when the
+        # cache is empty or no longer covers requested_expiry. Must be called
+        # while holding @signature_mutex. Returns nil for shared-key auth, where
+        # the SAS is signed with the access key instead.
+        def fetch_user_delegation_key(requested_expiry)
+          return nil unless @azure_storage_token_signer
+
+          if @user_delegation_key_expiry.nil? || @user_delegation_key_expiry < requested_expiry
+            start = Time.now
+            expiry = start + Azure::Storage::Blob::BlobConstants::MAX_USER_DELEGATION_KEY_SECONDS
+
+            @user_delegation_key = @blob_client.get_user_delegation_key(start, expiry)
+            # Cache against the expiry Azure granted (signed_expiry), not the one
+            # we requested: Azure uses its own clock and may return an earlier
+            # time, and keying on the request would over-claim validity and emit
+            # SAS URLs that Azure rejects.
+            @user_delegation_key_expiry = Time.parse(@user_delegation_key.signed_expiry)
           end
 
           @user_delegation_key
         end
 
-        def refresh_blob_client
-          @blob_client_mutex.synchronize do
-            azure_client = create_azure_client
-            azure_client.storage_blob_host = storage_blob_host
-            @blob_client = Azure::Storage::Blob::BlobService.new(client: azure_client, api_version: @api_version)
-            @blob_client.with_filter(Fog::AzureRM::IdentityEncodingFilter.new)
-            @blob_client.with_filter(Azure::Storage::Common::Core::Filter::ExponentialRetryPolicyFilter.new)
-            @blob_client.with_filter(Azure::Core::Http::DebugFilter.new) if @debug
-          end
+        # Builds and returns a fully configured blob client. The caller publishes
+        # it with a single reference assignment (see initialize and
+        # maybe_refresh_credentials), so a concurrent reader of @blob_client never
+        # observes a client that is missing its filters mid-build.
+        def build_blob_client(signer)
+          azure_client = create_azure_client(signer)
+          azure_client.storage_blob_host = storage_blob_host
+          client = Azure::Storage::Blob::BlobService.new(client: azure_client, api_version: @api_version)
+          client.with_filter(Fog::AzureRM::IdentityEncodingFilter.new)
+          client.with_filter(Azure::Storage::Common::Core::Filter::ExponentialRetryPolicyFilter.new)
+          client.with_filter(Azure::Core::Http::DebugFilter.new) if @debug
+          client
         end
 
         def storage_blob_host
@@ -210,11 +297,11 @@ module Fog
           end
         end
 
-        def create_azure_client
+        def create_azure_client(signer)
           Azure::Storage::Common::Client.create({
             storage_account_name: @azure_storage_account_name,
             storage_access_key: @azure_storage_access_key,
-            signer: @azure_storage_token_signer
+            signer: signer
           }.compact)
         end
       end

data/lib/fog/azurerm/version.rb

@@ -1,5 +1,5 @@
 module Fog
   module AzureRM
-    VERSION = '2.5.0'.freeze
+    VERSION = '2.5.2'.freeze
   end
 end

data/test/requests/storage/test_credential_refresh_on_blob_requests.rb

@@ -0,0 +1,85 @@
+require File.expand_path '../../test_helper', __dir__
+require 'azure/storage/common'
+require 'azure/storage/blob'
+require 'azure/core/auth/signer'
+
+# Regression tests for
+# https://gitlab.com/gitlab-org/ruby/gems/gitlab-fog-azure-rm/-/issues/11
+#
+# Data-plane requests (get_blob_properties, downloads, uploads, ...) read the
+# blob client directly. They must refresh an expiring access token the same way
+# the SAS URL path does, otherwise a long-lived process keeps signing with a
+# stale token and Azure starts returning 401 after the token lifetime.
+class TestCredentialRefreshOnBlobRequests < Minitest::Test
+  CONTAINER = 'test_container'.freeze
+  BLOB = 'test_blob'.freeze
+
+  # A blob client stand-in that needs no network and records the token it was
+  # built with, so a test can tell the refreshed client from the stale one.
+  class FakeBlobClient
+    attr_reader :token
+
+    def initialize(token)
+      @token = token
+    end
+
+    def with_filter(*)
+      self
+    end
+
+    def get_blob_properties(*)
+      MockBlob.new { |b| b.name = @token }
+    end
+  end
+
+  def setup
+    @service = Fog::AzureRM::Storage.new(storage_account_credentials_with_token_signer)
+  end
+
+  def credentials(token, expires_at)
+    Fog::AzureRM::Identity::Credentials.new(token, expires_at)
+  end
+
+  def credential_client(&fetch)
+    client = Object.new
+    client.define_singleton_method(:fetch_credentials_if_needed, &fetch)
+    client
+  end
+
+  # An expiring token is refreshed before the request runs, and the request uses
+  # the rebuilt client rather than the stale one.
+  def test_get_blob_properties_refreshes_an_expiring_token
+    stale = FakeBlobClient.new('stale-token')
+    fresh = FakeBlobClient.new('fresh-token')
+    fresh_credentials = credentials('fresh-token', Time.now + 3600)
+
+    @service.instance_variable_set(:@blob_client, stale)
+    @service.instance_variable_set(:@credentials, credentials('stale-token', Time.now - 1))
+    @service.instance_variable_set(:@credential_client, credential_client { fresh_credentials })
+
+    Azure::Storage::Blob::BlobService.stub(:new, ->(*, **) { fresh }) do
+      blob = @service.get_blob_properties(CONTAINER, BLOB)
+      assert_equal 'fresh-token', blob.name
+    end
+
+    assert_same fresh, @service.instance_variable_get(:@blob_client)
+  end
+
+  # A token that is still valid is not rebuilt, so a healthy request does not pay
+  # for a token fetch or a client rebuild on every call.
+  def test_get_blob_properties_does_not_rebuild_a_valid_token
+    current = FakeBlobClient.new('current-token')
+
+    @service.instance_variable_set(:@blob_client, current)
+    @service.instance_variable_set(:@credentials, credentials('current-token', Time.now + 3600))
+    @service.instance_variable_set(:@credential_client,
+                                   credential_client { raise 'should not refresh a valid token' })
+
+    Azure::Storage::Blob::BlobService.stub(:new, ->(*, **) { raise 'should not rebuild the client' }) do
+      blob = @service.get_blob_properties(CONTAINER, BLOB)
+      assert_equal 'current-token', blob.name
+    end
+
+    assert_same current, @service.instance_variable_get(:@blob_client)
+  end
+end

data/test/requests/storage/test_get_blob_https_url.rb

@@ -118,18 +118,7 @@ class TestGetBlobHttpsUrl < Minitest::Test
 
     requested_expiry = Time.now + 60
 
-    response = <<~MSG
-      <UserDelegationKey>
-          <SignedOid>f81d4fae-7dec-11d0-a765-00a0c91e6bf6</SignedOid>
-          <SignedTid>72f988bf-86f1-41af-91ab-2d7cd011db47</SignedTid>
-          <SignedStart>2024-09-19T00:00:00Z</SignedStart>
-          <SignedExpiry>2024-09-26T00:00:00Z</SignedExpiry>
-          <SignedService>b</SignedService>
-          <SignedVersion>2020-02-10</SignedVersion>
-          <Value>UDELEGATIONKEYXYZ....</Value>
-          <SignedKey>rL7...ABC</SignedKey>
-      </UserDelegationKey>
-    MSG
+    response = user_delegation_key_response
 
     stub_request(:post, 'https://mockaccount.blob.core.windows.net?comp=userdelegationkey&restype=service')
       .to_return(status: 200, headers: { 'Content-Type': 'application/xml' }, body: response)
@@ -159,29 +148,19 @@ class TestGetBlobHttpsUrl < Minitest::Test
 
     ref_time = Time.now
 
-    stubbed_times = []
-    requested_expiries = []
-    expected_user_delegation_key_starts = []
+    # Each entry: [Time.now offset from ref_time, requested-expiry offset from
+    # that time, whether a fresh delegation key is expected]. A delegation key
+    # is valid for one WEEK from its start.
+    plan = [
+      [0,          1 * HOUR, true],  # initial request
+      [5.5 * DAY,  1 * DAY,  false], # second request during expiry window
+      [6.5 * DAY,  1 * DAY,  true],  # request extending past current expiry
+      [10.5 * DAY, 1 * DAY,  false]  # second request within new expiry
+    ]
 
-    # initial request
-    stubbed_times << ref_time
-    requested_expiries << stubbed_times.last + 1 * HOUR
-    expected_user_delegation_key_starts << stubbed_times.last
-
-    # second request during expiry window
-    stubbed_times << ref_time + 5.5 * DAY
-    requested_expiries << stubbed_times.last + 1 * DAY
-    # no additonal expected_user_delegation_key_starts
-
-    # request extending past current expiry
-    stubbed_times << ref_time + 6.5 * DAY
-    requested_expiries << stubbed_times.last + 1 * DAY
-    expected_user_delegation_key_starts << stubbed_times.last
-
-    # second request within new expiry
-    stubbed_times << ref_time + 10.5 * DAY
-    requested_expiries << stubbed_times.last + 1 * DAY
-    # no additional expected_user_delegation_key_starts
+    stubbed_times = plan.map { |now_offset,| ref_time + now_offset }
+    requested_expiries = stubbed_times.each_with_index.map { |time, i| time + plan[i][1] }
+    expected_user_delegation_key_starts = stubbed_times.select.with_index { |_, i| plan[i][2] }
 
     user_delegation_key_starts = []
     mock_user_delegation_key = lambda do |start, expiry|
@@ -190,7 +169,7 @@ class TestGetBlobHttpsUrl < Minitest::Test
 
       key = Azure::Storage::Common::Service::UserDelegationKey.new
       key.signed_start = "start-#{start.to_i}"
-      key.signed_expiry = 'test-expiry'
+      key.signed_expiry = expiry.utc.iso8601 # Azure grants the full requested window here
       key.value = 'delegation-key'
       key
     end
@@ -201,7 +180,7 @@ class TestGetBlobHttpsUrl < Minitest::Test
     end
 
     requested_expiries.each do
-      mock_token_signer.expect(:sign, 'test-signature', [/\Ar\n.+test_blob\n.+\nstart-\d+\ntest-expiry/m])
+      mock_token_signer.expect(:sign, 'test-signature', [/\Ar\n.+test_blob\n.+\nstart-\d+\n\S+/m])
     end
 
     Time.stub :now, -> { stubbed_times.first } do
@@ -220,6 +199,42 @@ class TestGetBlobHttpsUrl < Minitest::Test
     assert_equal expected_user_delegation_key_starts, user_delegation_key_starts
   end
 
+  # Regression: the delegation-key cache keys on the expiry Azure granted
+  # (signed_expiry), not the requested one. Keying on the request would serve a
+  # cached key for a window Azure already ended, so this asserts a refetch.
+  def test_delegation_key_cache_uses_signed_expiry_not_requested
+    service = Fog::AzureRM::Storage.new(storage_account_credentials_with_token_signer)
+    blob_client = service.instance_variable_get(:@blob_client)
+
+    ref_time = Time.now
+    granted_expiry = (ref_time + 2 * DAY).utc # Azure grants far less than the 1-week request
+
+    starts = []
+    mock_key = lambda do |start, _expiry|
+      starts << start
+      key = Azure::Storage::Common::Service::UserDelegationKey.new
+      key.signed_start = "start-#{start.to_i}"
+      key.signed_expiry = granted_expiry.iso8601
+      key.value = 'delegation-key'
+      key
+    end
+    mock_new_signer = ->(_token) { mock_token_signer }
+    2.times { mock_token_signer.expect(:sign, 'test-signature', [String]) }
+
+    Time.stub :now, -> { ref_time } do
+      blob_client.stub :get_user_delegation_key, mock_key do
+        Azure::Core::Auth::Signer.stub :new, mock_new_signer do
+          service.get_blob_https_url('test_container', 'test_blob', ref_time + 1 * HOUR)
+          # Requested expiry is past Azure's granted window but within start+MAX.
+          service.get_blob_https_url('test_container', 'test_blob', ref_time + 3 * DAY)
+        end
+      end
+    end
+
+    assert_equal 2, starts.length,
+                 'expected a refetch once the requested expiry exceeded the granted signed_expiry'
+  end
+
   def test_get_blob_https_url_mock
     assert_equal "#{@url}?#{@token}", @mock_service.get_blob_https_url('test_container', 'test_blob', Time.now.utc + 3600)
     assert_equal "#{@url}?#{@token}", @mock_service.get_object_url('test_container', 'test_blob', Time.now.utc + 3600)
@@ -247,18 +262,9 @@ class TestGetBlobHttpsUrl < Minitest::Test
       )
 
     # Setup user delegation key responses
-    delegation_response = <<~MSG
-      <UserDelegationKey>
-          <SignedOid>f81d4fae-7dec-11d0-a765-00a0c91e6bf6</SignedOid>
-          <SignedTid>72f988bf-86f1-41af-91ab-2d7cd011db47</SignedTid>
-          <SignedStart>2024-09-19T00:00:00Z</SignedStart>
-          <SignedExpiry>2024-09-26T00:00:00Z</SignedExpiry>
-          <SignedService>b</SignedService>
-          <SignedVersion>2020-02-10</SignedVersion>
-          <Value>UDELEGATIONKEY_INITIAL</Value>
-          <SignedKey>rL7...INITIAL</SignedKey>
-      </UserDelegationKey>
-    MSG
+    delegation_response = user_delegation_key_response(
+      value: 'UDELEGATIONKEY_INITIAL', signed_key: 'rL7...INITIAL'
+    )
 
     stub_request(:post, 'https://mockaccount.blob.core.windows.net?comp=userdelegationkey&restype=service')
       .to_return(

data/test/requests/storage/test_storage_thread_safety.rb

@@ -0,0 +1,138 @@
+require File.expand_path '../../test_helper', __dir__
+require 'uri'
+require 'azure/storage/common'
+require 'azure/storage/blob'
+require 'azure/core/auth/signer'
+
+# Tests for the concurrency guarantees of SAS signing. Each drives the public
+# get_blob_https_url (which calls signature_client and maybe_refresh_credentials)
+# and checks one property in isolation, so no private methods or stress loops
+# are needed.
+class TestStorageThreadSafety < Minitest::Test
+  CONTAINER = 'test_container'.freeze
+  BLOB = 'test_blob'.freeze
+
+  # A blob client stand-in that needs no network. Optionally parks on its first
+  # with_filter call so a test can inspect state while a rebuild is in progress.
+  class FakeBlobClient
+    def initialize(&on_first_filter)
+      @filters = []
+      @on_first_filter = on_first_filter
+    end
+
+    def with_filter(filter)
+      @on_first_filter.call if @filters.empty? && @on_first_filter
+      @filters << filter
+      self
+    end
+
+    def generate_uri(path, *)
+      URI.parse("https://mockaccount.blob.core.windows.net/#{path}")
+    end
+
+    def get_user_delegation_key(*)
+      key = Azure::Storage::Common::Service::UserDelegationKey.new
+      key.value = 'ZGVsZWdhdGlvbg==' # any string; Base64.decode64 is lenient
+      key.signed_expiry = '2999-12-31T23:59:59Z' # far future so the cached key covers the request
+      key
+    end
+  end
+
+  # Stands in for @signature_mutex and fails the test if the lock is taken.
+  class RaisingMutex
+    def synchronize
+      raise 'signature_client took the lock when it should have hit the cache'
+    end
+  end
+
+  def setup
+    @service = Fog::AzureRM::Storage.new(storage_account_credentials_with_token_signer)
+  end
+
+  def in_one_hour
+    Time.now.utc + 3600
+  end
+
+  def credentials(expires_at)
+    Fog::AzureRM::Identity::Credentials.new('token', expires_at)
+  end
+
+  def credential_client(&fetch)
+    client = Object.new
+    client.define_singleton_method(:fetch_credentials_if_needed, &fetch)
+    client
+  end
+
+  # A cached signature that still covers the requested expiry is returned
+  # without taking @signature_mutex, so signing never waits on a refresh.
+  def test_cached_signature_is_returned_without_locking
+    @service.instance_variable_set(:@blob_client, FakeBlobClient.new)
+    @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour) # builds and caches it
+
+    @service.instance_variable_set(:@signature_mutex, RaisingMutex.new)
+
+    url = @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour)
+    assert_match %r{\Ahttps://mockaccount\.blob\.core\.windows\.net/#{CONTAINER}/#{BLOB}\?}, url
+  end
+
+  # While one thread is stuck in a slow token fetch, another caller must still
+  # return instead of blocking on the credential lock.
+  def test_a_slow_credential_refresh_does_not_block_other_callers
+    entered_fetch = Queue.new
+    finish_fetch = Queue.new
+    fresh = credentials(Time.now + 3600)
+
+    slow_client = credential_client do
+      entered_fetch << true
+      finish_fetch.pop # simulate a slow or hanging token endpoint
+      fresh
+    end
+
+    Azure::Storage::Blob::BlobService.stub(:new, ->(*, **) { FakeBlobClient.new }) do
+      @service.instance_variable_set(:@blob_client, FakeBlobClient.new)
+      @service.instance_variable_set(:@credential_client, slow_client)
+      @service.instance_variable_set(:@credentials, credentials(Time.now - 1))
+
+      refreshing = Thread.new { @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour) }
+      entered_fetch.pop # the refresh now holds @credential_mutex inside the fetch
+
+      other = Thread.new { @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour) }
+      returned = other.join(5)
+
+      begin
+        refute_nil returned, 'a second caller blocked while one thread was refreshing credentials'
+      ensure
+        finish_fetch << true
+        [refreshing, other].each(&:join)
+      end
+    end
+  end
+
+  # A rebuilt blob client is published only once it is fully built, so a
+  # concurrent reader never sees one that is missing its filters.
+  def test_rebuilt_blob_client_is_published_only_when_fully_built
+    original = @service.instance_variable_get(:@blob_client)
+    fresh = credentials(Time.now + 3600)
+    @service.instance_variable_set(:@credential_client, credential_client { fresh })
+    @service.instance_variable_set(:@credentials, credentials(Time.now - 1))
+
+    mid_build = Queue.new
+    resume = Queue.new
+    half_built = FakeBlobClient.new do
+      mid_build << true
+      resume.pop
+    end
+
+    Azure::Storage::Blob::BlobService.stub(:new, ->(*, **) { half_built }) do
+      builder = Thread.new { @service.get_blob_https_url(CONTAINER, BLOB, in_one_hour) }
+      mid_build.pop # the new client exists but its filters are not applied yet
+      observed = @service.instance_variable_get(:@blob_client)
+      resume << true
+      builder.join
+
+      refute_same half_built, observed, 'the half-built client was published before its filters were applied'
+      assert_same original, observed
+      assert_same half_built, @service.instance_variable_get(:@blob_client)
+    end
+  end
+end

data/test/test_helper.rb

@@ -79,6 +79,21 @@ def mock_token_signer
   @mock_token_signer ||= Minitest::Mock.new(Azure::Core::Auth::Signer.new('access-token'))
 end
 
+def user_delegation_key_response(value: 'UDELEGATIONKEYXYZ....', signed_key: 'rL7...ABC')
+  <<~MSG
+    <UserDelegationKey>
+        <SignedOid>f81d4fae-7dec-11d0-a765-00a0c91e6bf6</SignedOid>
+        <SignedTid>72f988bf-86f1-41af-91ab-2d7cd011db47</SignedTid>
+        <SignedStart>2024-09-19T00:00:00Z</SignedStart>
+        <SignedExpiry>2024-09-26T00:00:00Z</SignedExpiry>
+        <SignedService>b</SignedService>
+        <SignedVersion>2020-02-10</SignedVersion>
+        <Value>#{value}</Value>
+        <SignedKey>#{signed_key}</SignedKey>
+    </UserDelegationKey>
+  MSG
+end
+
 # Mock Class for Blob
 class MockBlob
   def initialize

data/test/unit/test_workflow_identity_client.rb

@@ -47,6 +47,36 @@ class TestWorkflowIdentityClient < Minitest::Test
     end
   end
 
+  # The OAuth v2.0 token endpoint returns expires_in, not expires_on. A fresh
+  # token must therefore report a real future expiry so refresh_needed? stays
+  # false until it is near expiry, rather than forcing a fetch on every request.
+  def test_fetch_credentials_uses_expires_in
+    ENV['AZURE_TENANT_ID'] = 'fake_tenant_id'
+    ENV['AZURE_CLIENT_ID'] = 'fake_client_id'
+    ENV['AZURE_FEDERATED_TOKEN_FILE'] = 'fake_token_file'
+
+    @client = Fog::AzureRM::Identity::WorkflowIdentityClient.new(@options)
+
+    token_response = {
+      'access_token' => 'fake_access_token',
+      'expires_in' => 3600
+    }
+
+    File.stub :exist?, true do
+      File.stub :readable?, true do
+        File.stub :read, 'fake_oidc_token' do
+          stub_request(:post, "#{@client.authority}/fake_tenant_id/oauth2/v2.0/token")
+            .to_return(status: 200, body: token_response.to_json)
+
+          credentials = @client.fetch_credentials
+
+          assert_in_delta (Time.now + 3600).to_f, credentials.expires_at.to_f, 5
+          refute credentials.refresh_needed?
+        end
+      end
+    end
+  end
+
   def test_fetch_credentials_failure
     ENV['AZURE_TENANT_ID'] = 'fake_tenant_id'
     ENV['AZURE_CLIENT_ID'] = 'fake_client_id'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-fog-azure-rm
 version: !ruby/object:Gem::Version
-  version: 2.5.0
+  version: 2.5.2
 platform: ruby
 authors:
 - Shaffan Chaudhry
@@ -18,7 +18,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-31 00:00:00.000000000 Z
+date: 2026-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: codeclimate-test-reporter
@@ -449,6 +449,7 @@ files:
 - test/requests/storage/test_create_block_blob.rb
 - test/requests/storage/test_create_container.rb
 - test/requests/storage/test_create_page_blob.rb
+- test/requests/storage/test_credential_refresh_on_blob_requests.rb
 - test/requests/storage/test_delete_blob.rb
 - test/requests/storage/test_delete_blob_https_url.rb
 - test/requests/storage/test_delete_container.rb
@@ -476,6 +477,7 @@ files:
 - test/requests/storage/test_release_blob_lease.rb
 - test/requests/storage/test_release_container_lease.rb
 - test/requests/storage/test_save_page_blob.rb
+- test/requests/storage/test_storage_thread_safety.rb
 - test/requests/storage/test_wait_blob_copy_operation_to_finish.rb
 - test/test_helper.rb
 - test/unit/test_credentials.rb