gitlab-fog-azure-rm 2.5.1 → 2.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: faf6ef8f40417712f91769e2ac0dea345c7451f1457919399c1aa574cf6a44a5
-  data.tar.gz: 4596861b6a717a743ff2d250f91f3bb4cafd911cb57e0efeeae14368e04162eb
+  metadata.gz: 82912caef21af9f05608fd07eb07dd1c1a5d2693a805562a33448997f7897177
+  data.tar.gz: 245ab6fc1a0f8f64d775872c622696debcd1594cb72e75d7a533eef689d19e27
 SHA512:
-  metadata.gz: f59d2e0764335c68f69462f380781e3a6f395467959f8af92f076dd4492f968d82bdc52b471f93a3fb1568e939c277e70cf6eac8fc79ed65e144b53eb1d966a2
-  data.tar.gz: ea77ec4d01cff9bebec6642ad94517c0df51246de8ab41f48241f8281841737c08da6f20ec17e9c79a9ad5d6f56bc51940c8cac169a17d226f0037c84ea5c706
+  metadata.gz: a28a7bc76b170937760e54e276386b6b555077ad01d5b2e0259841c70d93247904b94ea899ad2ecbde12799bdc4786091879919695b00dbe4d83977678a82172
+  data.tar.gz: deb8fdf6983ae0e8ca2350cf35c4ca334e08cfd1779c1fd463fee5f6c338ed1db364ecae5b05f3b4b9816409d466c8115faa1ba6462f737bece557ad7756c0c6

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 ## Unreleased
 
+## 2.5.2
+
+- Refresh credentials on all blob storage requests !67
+- Parse expires_in from OAuth token responses so token expiry is honored !67
+
 ## 2.5.1
 
 - Fix thread-safety race in SAS signer credential refresh !64

data/lib/fog/azurerm/identity/base_client.rb

@@ -43,12 +43,22 @@ module Fog
 
           return unless access_token
 
-          expires_at = ::Time.now
+          Credentials.new(access_token, token_expires_at(body))
+        rescue ::JSON::ParserError # rubocop:disable Lint/SuppressedException
+        end
+
+        # IMDS returns an absolute expires_on (epoch seconds), while the OAuth
+        # v2.0 token endpoint used by workload identity returns a relative
+        # expires_in. Handle both so refresh_needed? has a real expiry; otherwise
+        # it defaults to now and forces a token fetch on every request.
+        def token_expires_at(body)
           expires_on = body['expires_on']
-          expires_at = ::Time.at(expires_on.to_i) if expires_on
+          return ::Time.at(expires_on.to_i) if expires_on
 
-          Credentials.new(access_token, expires_at)
-        rescue ::JSON::ParserError # rubocop:disable Lint/SuppressedException
+          expires_in = body['expires_in']
+          return ::Time.now + expires_in.to_i if expires_in
+
+          ::Time.now
         end
 
         private

data/lib/fog/azurerm/requests/storage/acquire_blob_lease.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            lease_id = @blob_client.acquire_blob_lease(container_name, name, options)
+            lease_id = blob_client.acquire_blob_lease(container_name, name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/acquire_container_lease.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            lease_id = @blob_client.acquire_container_lease(name, options)
+            lease_id = blob_client.acquire_container_lease(name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/commit_blob_blocks.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.commit_blob_blocks(container_name, blob_name, blocks, options)
+            blob_client.commit_blob_blocks(container_name, blob_name, blocks, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/copy_blob.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            copy_id, copy_status = @blob_client.copy_blob(destination_container, destination_blob, source_container, source_blob, options)
+            copy_id, copy_status = blob_client.copy_blob(destination_container, destination_blob, source_container, source_blob, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/copy_blob_from_uri.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            copy_id, copy_status = @blob_client.copy_blob_from_uri(destination_container, destination_blob, source_blob_uri, options)
+            copy_id, copy_status = blob_client.copy_blob_from_uri(destination_container, destination_blob, source_blob_uri, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/create_block_blob.rb

@@ -8,7 +8,7 @@ module Fog
           msg = "create_block_blob #{blob_name} to the container #{container_name}. options: #{options}"
           Fog::Logger.debug msg
 
-          @blob_client.create_block_blob(container_name, blob_name, body, options)
+          blob_client.create_block_blob(container_name, blob_name, body, options)
         rescue Azure::Core::Http::HTTPError => ex
           raise_azure_exception(ex, msg)
         end

data/lib/fog/azurerm/requests/storage/create_container.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            container = @blob_client.create_container(name, options)
+            container = blob_client.create_container(name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/create_page_blob.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.create_page_blob(container_name, blob_name, blob_size, options)
+            blob_client.create_page_blob(container_name, blob_name, blob_size, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/delete_blob.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.delete_blob(container_name, blob_name, options)
+            blob_client.delete_blob(container_name, blob_name, options)
           rescue Azure::Core::Http::HTTPError => ex
             return true if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)

data/lib/fog/azurerm/requests/storage/delete_container.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.delete_container(name, options)
+            blob_client.delete_container(name, options)
           rescue Azure::Core::Http::HTTPError => ex
             return true if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)

data/lib/fog/azurerm/requests/storage/get_blob.rb

@@ -11,7 +11,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            blob = @blob_client.get_blob_properties(container_name, blob_name, options)
+            blob = blob_client.get_blob_properties(container_name, blob_name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise 'NotFound' if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)
@@ -49,7 +49,7 @@ module Fog
             begin
               msg = "get_blob_with_block_given: blob #{blob_name} in the container #{container_name}. options: #{params}"
               Fog::Logger.debug msg
-              _, content = @blob_client.get_blob(container_name, blob_name, params)
+              _, content = blob_client.get_blob(container_name, blob_name, params)
             rescue Azure::Core::Http::HTTPError => ex
               raise 'NotFound' if ex.message.include?('(404)')
               raise_azure_exception(ex, msg)
@@ -71,7 +71,7 @@ module Fog
             Fog::Logger.debug msg
 
             begin
-              blob, content = @blob_client.get_blob(container_name, blob_name, options)
+              blob, content = blob_client.get_blob(container_name, blob_name, options)
               Fog::Logger.debug "Get blob #{blob_name} successfully."
               [blob, content]
             rescue Azure::Core::Http::HTTPError => ex

data/lib/fog/azurerm/requests/storage/get_blob_properties.rb

@@ -8,7 +8,7 @@ module Fog
           msg = "Get Blob #{name} properties in container #{container_name}, options: #{options}."
           Fog::Logger.debug msg
           begin
-            blob = @blob_client.get_blob_properties(container_name, name, options)
+            blob = blob_client.get_blob_properties(container_name, name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise 'NotFound' if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)

data/lib/fog/azurerm/requests/storage/get_container_acl.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            container, signed_identifiers = @blob_client.get_container_acl(container_name, options)
+            container, signed_identifiers = blob_client.get_container_acl(container_name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/get_container_properties.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            container = @blob_client.get_container_properties(name, options)
+            container = blob_client.get_container_properties(name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise 'NotFound' if ex.message.include?('(404)')
             raise_azure_exception(ex, msg)

data/lib/fog/azurerm/requests/storage/list_blobs.rb

@@ -19,7 +19,7 @@ module Fog
               options[:request_id] = SecureRandom.uuid
               msg = "Listing blobs in container: #{container_name}, options: #{options}"
               Fog::Logger.debug msg
-              temp = @blob_client.list_blobs(container_name, options)
+              temp = blob_client.list_blobs(container_name, options)
               # Workaround for the issue https://github.com/Azure/azure-storage-ruby/issues/37
               raise temp unless temp.instance_of?(Azure::Storage::Common::Service::EnumerationResults)
 

data/lib/fog/azurerm/requests/storage/list_containers.rb

@@ -14,7 +14,7 @@ module Fog
               options[:request_id] = SecureRandom.uuid
               msg = "Listing containers. options: #{options}"
               Fog::Logger.debug msg
-              temp = @blob_client.list_containers(options)
+              temp = blob_client.list_containers(options)
               # Workaround for the issue https://github.com/Azure/azure-storage-ruby/issues/37
               raise temp unless temp.instance_of?(Azure::Storage::Common::Service::EnumerationResults)
 

data/lib/fog/azurerm/requests/storage/put_blob_block.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.put_blob_block(container_name, blob_name, block_id, data, options)
+            blob_client.put_blob_block(container_name, blob_name, block_id, data, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_blob_metadata.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.set_blob_metadata(container_name, name, metadata, options)
+            blob_client.set_blob_metadata(container_name, name, metadata, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_blob_pages.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.put_blob_pages(container_name, blob_name, start_range, end_range, data, options)
+            blob_client.put_blob_pages(container_name, blob_name, start_range, end_range, data, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_blob_properties.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.set_blob_properties(container_name, name, options)
+            blob_client.set_blob_properties(container_name, name, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_container_acl.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.set_container_acl(name, acl, options)
+            blob_client.set_container_acl(name, acl, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/put_container_metadata.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.set_container_metadata(name, metadata, options)
+            blob_client.set_container_metadata(name, metadata, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/release_blob_lease.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.release_blob_lease(container_name, name, lease_id, options)
+            blob_client.release_blob_lease(container_name, name, lease_id, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/requests/storage/release_container_lease.rb

@@ -9,7 +9,7 @@ module Fog
           Fog::Logger.debug msg
 
           begin
-            @blob_client.release_container_lease(name, lease_id, options)
+            blob_client.release_container_lease(name, lease_id, options)
           rescue Azure::Core::Http::HTTPError => ex
             raise_azure_exception(ex, msg)
           end

data/lib/fog/azurerm/storage.rb

@@ -202,10 +202,10 @@ module Fog
         end
 
         # Refreshes the credential-derived state (@credentials, the token signer
-        # and the blob client) when the access token is near expiry. Only the
-        # SAS URL requests reach this, through signature_client; the other blob
-        # operations read @blob_client directly and do not refresh, so this does
-        # not by itself keep their token fresh across rotation.
+        # and the blob client) when the access token is near expiry. The SAS URL
+        # requests reach this through signature_client, and the data-plane
+        # requests reach it through the blob_client reader, so both keep their
+        # token fresh across rotation.
         #
         # The refresh is best-effort and non-blocking: a token fetch can be slow
         # (or hang), so only one thread performs it at a time via a try-lock, and
@@ -241,6 +241,16 @@ module Fog
           end
         end
 
+        # Reader for the data-plane blob client. It refreshes an expiring access
+        # token first, so operations that read the client directly (blob
+        # properties, downloads, uploads, deletes) stay authenticated across
+        # token rotation, not only the SAS URL path. See
+        # https://gitlab.com/gitlab-org/ruby/gems/gitlab-fog-azure-rm/-/issues/11
+        def blob_client
+          maybe_refresh_credentials
+          @blob_client
+        end
+
         # Returns the cached user delegation key, fetching a new one when the
         # cache is empty or no longer covers requested_expiry. Must be called
         # while holding @signature_mutex. Returns nil for shared-key auth, where

data/lib/fog/azurerm/version.rb

@@ -1,5 +1,5 @@
 module Fog
   module AzureRM
-    VERSION = '2.5.1'.freeze
+    VERSION = '2.5.2'.freeze
   end
 end

data/test/requests/storage/test_credential_refresh_on_blob_requests.rb

@@ -0,0 +1,85 @@
+require File.expand_path '../../test_helper', __dir__
+require 'azure/storage/common'
+require 'azure/storage/blob'
+require 'azure/core/auth/signer'
+
+# Regression tests for
+# https://gitlab.com/gitlab-org/ruby/gems/gitlab-fog-azure-rm/-/issues/11
+#
+# Data-plane requests (get_blob_properties, downloads, uploads, ...) read the
+# blob client directly. They must refresh an expiring access token the same way
+# the SAS URL path does, otherwise a long-lived process keeps signing with a
+# stale token and Azure starts returning 401 after the token lifetime.
+class TestCredentialRefreshOnBlobRequests < Minitest::Test
+  CONTAINER = 'test_container'.freeze
+  BLOB = 'test_blob'.freeze
+
+  # A blob client stand-in that needs no network and records the token it was
+  # built with, so a test can tell the refreshed client from the stale one.
+  class FakeBlobClient
+    attr_reader :token
+
+    def initialize(token)
+      @token = token
+    end
+
+    def with_filter(*)
+      self
+    end
+
+    def get_blob_properties(*)
+      MockBlob.new { |b| b.name = @token }
+    end
+  end
+
+  def setup
+    @service = Fog::AzureRM::Storage.new(storage_account_credentials_with_token_signer)
+  end
+
+  def credentials(token, expires_at)
+    Fog::AzureRM::Identity::Credentials.new(token, expires_at)
+  end
+
+  def credential_client(&fetch)
+    client = Object.new
+    client.define_singleton_method(:fetch_credentials_if_needed, &fetch)
+    client
+  end
+
+  # An expiring token is refreshed before the request runs, and the request uses
+  # the rebuilt client rather than the stale one.
+  def test_get_blob_properties_refreshes_an_expiring_token
+    stale = FakeBlobClient.new('stale-token')
+    fresh = FakeBlobClient.new('fresh-token')
+    fresh_credentials = credentials('fresh-token', Time.now + 3600)
+
+    @service.instance_variable_set(:@blob_client, stale)
+    @service.instance_variable_set(:@credentials, credentials('stale-token', Time.now - 1))
+    @service.instance_variable_set(:@credential_client, credential_client { fresh_credentials })
+
+    Azure::Storage::Blob::BlobService.stub(:new, ->(*, **) { fresh }) do
+      blob = @service.get_blob_properties(CONTAINER, BLOB)
+      assert_equal 'fresh-token', blob.name
+    end
+
+    assert_same fresh, @service.instance_variable_get(:@blob_client)
+  end
+
+  # A token that is still valid is not rebuilt, so a healthy request does not pay
+  # for a token fetch or a client rebuild on every call.
+  def test_get_blob_properties_does_not_rebuild_a_valid_token
+    current = FakeBlobClient.new('current-token')
+
+    @service.instance_variable_set(:@blob_client, current)
+    @service.instance_variable_set(:@credentials, credentials('current-token', Time.now + 3600))
+    @service.instance_variable_set(:@credential_client,
+                                   credential_client { raise 'should not refresh a valid token' })
+
+    Azure::Storage::Blob::BlobService.stub(:new, ->(*, **) { raise 'should not rebuild the client' }) do
+      blob = @service.get_blob_properties(CONTAINER, BLOB)
+      assert_equal 'current-token', blob.name
+    end
+
+    assert_same current, @service.instance_variable_get(:@blob_client)
+  end
+end

data/test/unit/test_workflow_identity_client.rb

@@ -47,6 +47,36 @@ class TestWorkflowIdentityClient < Minitest::Test
     end
   end
 
+  # The OAuth v2.0 token endpoint returns expires_in, not expires_on. A fresh
+  # token must therefore report a real future expiry so refresh_needed? stays
+  # false until it is near expiry, rather than forcing a fetch on every request.
+  def test_fetch_credentials_uses_expires_in
+    ENV['AZURE_TENANT_ID'] = 'fake_tenant_id'
+    ENV['AZURE_CLIENT_ID'] = 'fake_client_id'
+    ENV['AZURE_FEDERATED_TOKEN_FILE'] = 'fake_token_file'
+
+    @client = Fog::AzureRM::Identity::WorkflowIdentityClient.new(@options)
+
+    token_response = {
+      'access_token' => 'fake_access_token',
+      'expires_in' => 3600
+    }
+
+    File.stub :exist?, true do
+      File.stub :readable?, true do
+        File.stub :read, 'fake_oidc_token' do
+          stub_request(:post, "#{@client.authority}/fake_tenant_id/oauth2/v2.0/token")
+            .to_return(status: 200, body: token_response.to_json)
+
+          credentials = @client.fetch_credentials
+
+          assert_in_delta (Time.now + 3600).to_f, credentials.expires_at.to_f, 5
+          refute credentials.refresh_needed?
+        end
+      end
+    end
+  end
+
   def test_fetch_credentials_failure
     ENV['AZURE_TENANT_ID'] = 'fake_tenant_id'
     ENV['AZURE_CLIENT_ID'] = 'fake_client_id'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-fog-azure-rm
 version: !ruby/object:Gem::Version
-  version: 2.5.1
+  version: 2.5.2
 platform: ruby
 authors:
 - Shaffan Chaudhry
@@ -18,7 +18,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-10 00:00:00.000000000 Z
+date: 2026-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: codeclimate-test-reporter
@@ -449,6 +449,7 @@ files:
 - test/requests/storage/test_create_block_blob.rb
 - test/requests/storage/test_create_container.rb
 - test/requests/storage/test_create_page_blob.rb
+- test/requests/storage/test_credential_refresh_on_blob_requests.rb
 - test/requests/storage/test_delete_blob.rb
 - test/requests/storage/test_delete_blob_https_url.rb
 - test/requests/storage/test_delete_container.rb