azure-storage-blob 12.21.0__py3-none-any.whl → 12.22.0__py3-none-any.whl

azure/storage/blob/aio/_blob_client_async.py

@@ -6,11 +6,13 @@
 # pylint: disable=too-many-lines, invalid-overridden-method, docstring-keyword-should-match-keyword-only
 
 import warnings
+from datetime import datetime
 from functools import partial
-from typing import (  # pylint: disable=unused-import
-    Any, AnyStr, AsyncIterable, Dict, IO, Iterable, List, Optional, overload, Tuple, Union,
+from typing import (
+    Any, AnyStr, AsyncIterable, cast, Dict, IO, Iterable, List, Optional, overload, Tuple, Union,
     TYPE_CHECKING
 )
+from typing_extensions import Self
 
 from azure.core.async_paging import AsyncItemPaged
 from azure.core.exceptions import ResourceNotFoundError, HttpResponseError, ResourceExistsError
@@ -18,44 +20,76 @@ from azure.core.pipeline import AsyncPipeline
 from azure.core.tracing.decorator import distributed_trace
 from azure.core.tracing.decorator_async import distributed_trace_async
 
-from .._shared.base_client_async import AsyncStorageAccountHostsMixin, AsyncTransportWrapper
-from .._shared.policies_async import ExponentialRetry
-from .._shared.response_handlers import return_response_headers, process_storage_error
-from .._generated.aio import AzureBlobStorage
-from .._generated.models import CpkInfo
-from .._blob_client import BlobClient as BlobClientBase
-from .._deserialize import (
-    deserialize_blob_properties,
-    deserialize_pipeline_response_into_cls,
-    get_page_ranges_result,
-    parse_tags
-)
-from .._encryption import StorageEncryptionMixin
-from .._models import BlobType, BlobBlock, BlobProperties, PageRange
-from .._serialize import get_modify_conditions, get_api_version, get_access_conditions, get_version_id
 from ._download_async import StorageStreamDownloader
 from ._lease_async import BlobLeaseClient
 from ._models import PageRangePaged
 from ._upload_helpers import (
-    upload_block_blob,
     upload_append_blob,
+    upload_block_blob,
     upload_page_blob
 )
+from .._blob_client import StorageAccountHostsMixin
+from .._blob_client_helpers import (
+    _abort_copy_options,
+    _append_block_from_url_options,
+    _append_block_options,
+    _clear_page_options,
+    _commit_block_list_options,
+    _create_append_blob_options,
+    _create_page_blob_options,
+    _create_snapshot_options,
+    _delete_blob_options,
+    _download_blob_options,
+    _format_url,
+    _from_blob_url,
+    _get_blob_tags_options,
+    _get_block_list_result,
+    _get_page_ranges_options,
+    _parse_url,
+    _resize_blob_options,
+    _seal_append_blob_options,
+    _set_blob_metadata_options,
+    _set_blob_tags_options,
+    _set_http_headers_options,
+    _set_sequence_number_options,
+    _stage_block_from_url_options,
+    _stage_block_options,
+    _start_copy_from_url_options,
+    _upload_blob_from_url_options,
+    _upload_blob_options,
+    _upload_page_options,
+    _upload_pages_from_url_options
+)
+from .._deserialize import (
+    deserialize_blob_properties,
+    deserialize_pipeline_response_into_cls,
+    get_page_ranges_result,
+    parse_tags
+)
+from .._encryption import StorageEncryptionMixin, _ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION
+from .._generated.aio import AzureBlobStorage
+from .._generated.models import CpkInfo
+from .._models import BlobType, BlobBlock, BlobProperties, PageRange
+from .._serialize import get_access_conditions, get_api_version, get_modify_conditions, get_version_id
+from .._shared.base_client_async import AsyncStorageAccountHostsMixin, AsyncTransportWrapper, parse_connection_str
+from .._shared.policies_async import ExponentialRetry
+from .._shared.response_handlers import process_storage_error, return_response_headers
 
 if TYPE_CHECKING:
     from azure.core.credentials import AzureNamedKeyCredential, AzureSasCredential
     from azure.core.credentials_async import AsyncTokenCredential
-    from datetime import datetime
-    from .._models import (  # pylint: disable=unused-import
+    from azure.core.pipeline.policies import AsyncHTTPPolicy
+    from azure.storage.blob.aio import ContainerClient
+    from .._models import (
         ContentSettings,
         ImmutabilityPolicy,
         PremiumPageBlobTier,
-        StandardBlobTier,
-        SequenceNumberAction
+        SequenceNumberAction,
+        StandardBlobTier
     )
 
 
-class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptionMixin):  # pylint: disable=too-many-public-methods
+class BlobClient(AsyncStorageAccountHostsMixin, StorageAccountHostsMixin, StorageEncryptionMixin):  # type: ignore [misc] # pylint: disable=too-many-public-methods
     """A client to interact with a specific blob, although that blob may not yet exist.
 
     :param str account_url:
@@ -128,22 +162,139 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
             snapshot: Optional[Union[str, Dict[str, Any]]] = None,
             credential: Optional[Union[str, Dict[str, str], "AzureNamedKeyCredential", "AzureSasCredential", "AsyncTokenCredential"]] = None,  # pylint: disable=line-too-long
             **kwargs: Any
-        ) -> None:
+    ) -> None:
         kwargs['retry_policy'] = kwargs.get('retry_policy') or ExponentialRetry(**kwargs)
-        super(BlobClient, self).__init__(
-            account_url,
+        parsed_url, sas_token, path_snapshot = _parse_url(
+            account_url=account_url,
             container_name=container_name,
-            blob_name=blob_name,
-            snapshot=snapshot,
-            credential=credential,
-            **kwargs)
+            blob_name=blob_name)
+        self.container_name = container_name
+        self.blob_name = blob_name
+
+        if snapshot is not None and hasattr(snapshot, 'snapshot'):
+            self.snapshot = snapshot.snapshot
+        elif isinstance(snapshot, dict):
+            self.snapshot = snapshot['snapshot']
+        else:
+            self.snapshot = snapshot or path_snapshot
+        self.version_id = kwargs.pop('version_id', None)
+
+        # This parameter is used for the hierarchy traversal. Give precedence to credential.
+        self._raw_credential = credential if credential else sas_token
+        self._query_str, credential = self._format_query_string(sas_token, credential, snapshot=self.snapshot)
+        super(BlobClient, self).__init__(parsed_url, service='blob', credential=credential, **kwargs)
         self._client = AzureBlobStorage(self.url, base_url=self.url, pipeline=self._pipeline)
-        self._client._config.version = get_api_version(kwargs)  # pylint: disable=protected-access
+        self._client._config.version = get_api_version(kwargs)  # type: ignore [assignment] # pylint: disable=protected-access
         self._configure_encryption(kwargs)
 
+    def _format_url(self, hostname: str) -> str:
+        return _format_url(
+            container_name=self.container_name,
+            scheme=self.scheme,
+            blob_name=self.blob_name,
+            query_str=self._query_str,
+            hostname=hostname
+        )
+
+    @classmethod
+    def from_blob_url(
+        cls, blob_url: str,
+        credential: Optional[Union[str, Dict[str, str], "AzureNamedKeyCredential", "AzureSasCredential", "AsyncTokenCredential"]] = None,  # pylint: disable=line-too-long
+        snapshot: Optional[Union[str, Dict[str, Any]]] = None,
+        **kwargs: Any
+    ) -> Self:
+        """Create BlobClient from a blob url. This doesn't support customized blob url with '/' in blob name.
+
+        :param str blob_url:
+            The full endpoint URL to the Blob, including SAS token and snapshot if used. This could be
+            either the primary endpoint, or the secondary endpoint depending on the current `location_mode`.
+        :type blob_url: str
+        :param credential:
+            The credentials with which to authenticate. This is optional if the
+            account URL already has a SAS token, or the connection string already has shared
+            access key values. The value can be a SAS token string,
+            an instance of a AzureSasCredential or AzureNamedKeyCredential from azure.core.credentials,
+            an account shared access key, or an instance of a TokenCredentials class from azure.identity.
+            If the resource URI already contains a SAS token, this will be ignored in favor of an explicit credential
+            - except in the case of AzureSasCredential, where the conflicting SAS tokens will raise a ValueError.
+            If using an instance of AzureNamedKeyCredential, "name" should be the storage account name, and "key"
+            should be the storage account key.
+        :type credential: Optional[Union[str, Dict[str, str], "AzureNamedKeyCredential", "AzureSasCredential", "AsyncTokenCredential"]]  # pylint: disable=line-too-long
+        :param str snapshot:
+            The optional blob snapshot on which to operate. This can be the snapshot ID string
+            or the response returned from :func:`create_snapshot`. If specified, this will override
+            the snapshot in the url.
+        :keyword str version_id: The version id parameter is an opaque DateTime value that, when present,
+            specifies the version of the blob to operate on.
+        :keyword str audience: The audience to use when requesting tokens for Azure Active Directory
+            authentication. Only has an effect when credential is of type TokenCredential. The value could be
+            https://storage.azure.com/ (default) or https://<account>.blob.core.windows.net.
+        :returns: A Blob client.
+        :rtype: ~azure.storage.blob.BlobClient
+        """
+        account_url, container_name, blob_name, path_snapshot = _from_blob_url(blob_url=blob_url, snapshot=snapshot)
+        return cls(
+            account_url, container_name=container_name, blob_name=blob_name,
+            snapshot=path_snapshot, credential=credential, **kwargs
+        )
+
+    @classmethod
+    def from_connection_string(
+        cls, conn_str: str,
+        container_name: str,
+        blob_name: str,
+        snapshot: Optional[Union[str, Dict[str, Any]]] = None,
+        credential: Optional[Union[str, Dict[str, str], "AzureNamedKeyCredential", "AzureSasCredential", "AsyncTokenCredential"]] = None,  # pylint: disable=line-too-long
+        **kwargs: Any
+    ) -> Self:
+        """Create BlobClient from a Connection String.
+
+        :param str conn_str:
+            A connection string to an Azure Storage account.
+        :param container_name: The container name for the blob.
+        :type container_name: str
+        :param blob_name: The name of the blob with which to interact.
+        :type blob_name: str
+        :param str snapshot:
+            The optional blob snapshot on which to operate. This can be the snapshot ID string
+            or the response returned from :func:`create_snapshot`.
+        :param credential:
+            The credentials with which to authenticate. This is optional if the
+            account URL already has a SAS token, or the connection string already has shared
+            access key values. The value can be a SAS token string,
+            an instance of a AzureSasCredential or AzureNamedKeyCredential from azure.core.credentials,
+            an account shared access key, or an instance of a TokenCredentials class from azure.identity.
+            Credentials provided here will take precedence over those in the connection string.
+            If using an instance of AzureNamedKeyCredential, "name" should be the storage account name, and "key"
+            should be the storage account key.
+        :type credential: Optional[Union[str, Dict[str, str], "AzureNamedKeyCredential", "AzureSasCredential", "AsyncTokenCredential"]]  # pylint: disable=line-too-long
+        :keyword str version_id: The version id parameter is an opaque DateTime value that, when present,
+            specifies the version of the blob to operate on.
+        :keyword str audience: The audience to use when requesting tokens for Azure Active Directory
+            authentication. Only has an effect when credential is of type TokenCredential. The value could be
+            https://storage.azure.com/ (default) or https://<account>.blob.core.windows.net.
+        :returns: A Blob client.
+        :rtype: ~azure.storage.blob.BlobClient
+
+        .. admonition:: Example:
+
+            .. literalinclude:: ../samples/blob_samples_authentication.py
+                :start-after: [START auth_from_connection_string_blob]
+                :end-before: [END auth_from_connection_string_blob]
+                :language: python
+                :dedent: 8
+                :caption: Creating the BlobClient from a connection string.
+        """
+        account_url, secondary, credential = parse_connection_str(conn_str, credential, 'blob')
+        if 'secondary_hostname' not in kwargs:
+            kwargs['secondary_hostname'] = secondary
+        return cls(
+            account_url, container_name=container_name, blob_name=blob_name,
+            snapshot=snapshot, credential=credential, **kwargs
+        )
+
     @distributed_trace_async
-    async def get_account_information(self, **kwargs): # type: ignore
-        # type: (Optional[int]) -> Dict[str, str]
+    async def get_account_information(self, **kwargs: Any) -> Dict[str, str]:
         """Gets information related to the storage account in which the blob resides.
 
         The information can also be retrieved if the user has a SAS to a container or blob.
@@ -153,13 +304,13 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :rtype: dict(str, str)
         """
         try:
-            return await self._client.blob.get_account_info(cls=return_response_headers, **kwargs) # type: ignore
+            return cast(Dict[str, str],
+                        await self._client.blob.get_account_info(cls=return_response_headers, **kwargs))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def upload_blob_from_url(self, source_url, **kwargs):
-        # type: (str, Any) -> Dict[str, Any]
+    async def upload_blob_from_url(self, source_url: str, **kwargs: Any) -> Dict[str, Any]:
         """
         Creates a new Block Blob where the content of the blob is read from a given URL.
         The content of an existing blob is overwritten with the new blob.
@@ -257,25 +408,28 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Response from creating a new block blob for a given URL.
         :rtype: Dict[str, Any]
         """
-        options = self._upload_blob_from_url_options(
-            source_url=self._encode_source_url(source_url),
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _upload_blob_from_url_options(
+            source_url=source_url,
             **kwargs)
         try:
-            return await self._client.block_blob.put_blob_from_url(**options)
+            return cast(Dict[str, Any], await self._client.block_blob.put_blob_from_url(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
     async def upload_blob(
-            self, data: Union[bytes, str, Iterable[AnyStr], AsyncIterable[AnyStr], IO[AnyStr]],
-            blob_type: Union[str, BlobType] = BlobType.BlockBlob,
-            length: Optional[int] = None,
-            metadata: Optional[Dict[str, str]] = None,
-            **kwargs
-        ) -> Dict[str, Any]:
+        self, data: Union[bytes, str, Iterable[AnyStr], AsyncIterable[AnyStr], IO[bytes]],
+        blob_type: Union[str, BlobType] = BlobType.BLOCKBLOB,
+        length: Optional[int] = None,
+        metadata: Optional[Dict[str, str]] = None,
+        **kwargs: Any
+    ) -> Dict[str, Any]:
         """Creates a new blob from a data source with automatic chunking.
 
         :param data: The blob data to upload.
+        :type data: Union[bytes, str, Iterable[AnyStr], AsyncIterable[AnyStr], IO[AnyStr]]
         :param ~azure.storage.blob.BlobType blob_type: The type of the blob. This can be
             either BlockBlob, PageBlob or AppendBlob. The default value is BlockBlob.
         :param int length:
@@ -411,43 +565,59 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 :dedent: 16
                 :caption: Upload a blob to the container.
         """
-        options = self._upload_blob_options(
-            data,
+        if self.require_encryption and not self.key_encryption_key:
+            raise ValueError("Encryption required but no key was provided.")
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _upload_blob_options(
+            data=data,
             blob_type=blob_type,
             length=length,
             metadata=metadata,
+            encryption_options={
+                'required': self.require_encryption,
+                'version': self.encryption_version,
+                'key': self.key_encryption_key,
+                'resolver': self.key_resolver_function
+            },
+            config=self._config,
+            sdk_moniker=self._sdk_moniker,
+            client=self._client,
             **kwargs)
         if blob_type == BlobType.BlockBlob:
-            return await upload_block_blob(**options)
+            return cast(Dict[str, Any], await upload_block_blob(**options))
         if blob_type == BlobType.PageBlob:
-            return await upload_page_blob(**options)
-        return await upload_append_blob(**options)
+            return cast(Dict[str, Any], await upload_page_blob(**options))
+        return cast(Dict[str, Any], await upload_append_blob(**options))
 
     @overload
     async def download_blob(
-            self, offset: int = None,
-            length: int = None,
-            *,
-            encoding: str,
-            **kwargs) -> StorageStreamDownloader[str]:
+        self, offset: Optional[int] = None,
+        length: Optional[int] = None,
+        *,
+        encoding: str,
+        **kwargs: Any
+    ) -> StorageStreamDownloader[str]:
         ...
 
     @overload
     async def download_blob(
-            self, offset: int = None,
-            length: int = None,
-            *,
-            encoding: None = None,
-            **kwargs) -> StorageStreamDownloader[bytes]:
+        self, offset: Optional[int] = None,
+        length: Optional[int] = None,
+        *,
+        encoding: None = None,
+        **kwargs: Any
+    ) -> StorageStreamDownloader[bytes]:
         ...
 
     @distributed_trace_async
     async def download_blob(
-            self, offset: int = None,
-            length: int = None,
-            *,
-            encoding: Optional[str] = None,
-            **kwargs) -> StorageStreamDownloader:
+        self, offset: Optional[int] = None,
+        length: Optional[int] = None,
+        *,
+        encoding: Union[str, None] = None,
+        **kwargs: Any
+    ) -> Union[StorageStreamDownloader[str], StorageStreamDownloader[bytes]]:
         """Downloads a blob to the StorageStreamDownloader. The readall() method must
         be used to read all the content or readinto() must be used to download the blob into
         a stream. Using chunks() returns an async iterator which allows the user to iterate over the content in chunks.
@@ -538,18 +708,35 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 :dedent: 16
                 :caption: Download a blob.
         """
-        options = self._download_blob_options(
+        if self.require_encryption and not (self.key_encryption_key or self.key_resolver_function):
+            raise ValueError("Encryption required but no key was provided.")
+        if length is not None and offset is None:
+            raise ValueError("Offset value must not be None if length is set.")
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _download_blob_options(
+            blob_name=self.blob_name,
+            container_name=self.container_name,
+            version_id=get_version_id(self.version_id, kwargs),
             offset=offset,
             length=length,
             encoding=encoding,
+            encryption_options={
+                'required': self.require_encryption,
+                'version': self.encryption_version,
+                'key': self.key_encryption_key,
+                'resolver': self.key_resolver_function
+            },
+            config=self._config,
+            sdk_moniker=self._sdk_moniker,
+            client=self._client,
             **kwargs)
         downloader = StorageStreamDownloader(**options)
         await downloader._setup()  # pylint: disable=protected-access
         return downloader
 
     @distributed_trace_async
-    async def delete_blob(self, delete_snapshots=None, **kwargs):
-        # type: (str, Any) -> None
+    async def delete_blob(self, delete_snapshots: Optional[str] = None, **kwargs: Any) -> None:
         """Marks the specified blob for deletion.
 
         The blob is later deleted during garbage collection.
@@ -620,15 +807,18 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 :dedent: 16
                 :caption: Delete a blob.
         """
-        options = self._delete_blob_options(delete_snapshots=delete_snapshots, **kwargs)
+        options = _delete_blob_options(
+            snapshot=self.snapshot,
+            version_id=get_version_id(self.version_id, kwargs),
+            delete_snapshots=delete_snapshots,
+            **kwargs)
         try:
             await self._client.blob.delete(**options)
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def undelete_blob(self, **kwargs):
-        # type: (Any) -> None
+    async def undelete_blob(self, **kwargs: Any) -> None:
         """Restores soft-deleted blobs or snapshots.
 
         Operation will only be successful if used within the specified number of days
@@ -661,8 +851,7 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
             process_storage_error(error)
 
     @distributed_trace_async
-    async def exists(self, **kwargs):
-        # type: (**Any) -> bool
+    async def exists(self, **kwargs: Any) -> bool:
         """
         Returns True if a blob exists with the defined parameters, and returns
         False otherwise.
@@ -696,8 +885,7 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 return False
 
     @distributed_trace_async
-    async def get_blob_properties(self, **kwargs):
-        # type: (Any) -> BlobProperties
+    async def get_blob_properties(self, **kwargs: Any) -> BlobProperties:
         """Returns all user-defined metadata, standard HTTP properties, and
         system properties for the blob. It does not return the content of the blob.
 
@@ -788,11 +976,13 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         if isinstance(blob_props, BlobProperties):
             blob_props.container = self.container_name
             blob_props.snapshot = self.snapshot
-        return blob_props # type: ignore
+        return cast(BlobProperties, blob_props)
 
     @distributed_trace_async
-    async def set_http_headers(self, content_settings=None, **kwargs):
-        # type: (Optional[ContentSettings], Any) -> None
+    async def set_http_headers(
+        self, content_settings: Optional["ContentSettings"] = None,
+        **kwargs: Any
+    ) -> Dict[str, Any]:
         """Sets system properties on the blob.
 
         If one property is set for the content_settings, all properties will be overridden.
@@ -836,15 +1026,17 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified)
         :rtype: Dict[str, Any]
         """
-        options = self._set_http_headers_options(content_settings=content_settings, **kwargs)
+        options = _set_http_headers_options(content_settings=content_settings, **kwargs)
         try:
-            return await self._client.blob.set_http_headers(**options) # type: ignore
+            return cast(Dict[str, Any], await self._client.blob.set_http_headers(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def set_blob_metadata(self, metadata=None, **kwargs):
-        # type: (Optional[Dict[str, str]], Any) -> Dict[str, Union[str, datetime]]
+    async def set_blob_metadata(
+        self, metadata: Optional[Dict[str, str]] = None,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime]]:
         """Sets user-defined metadata for the blob as one or more name-value pairs.
 
         :param metadata:
@@ -901,15 +1093,19 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified)
         :rtype: Dict[str, Union[str, datetime]]
         """
-        options = self._set_blob_metadata_options(metadata=metadata, **kwargs)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _set_blob_metadata_options(metadata=metadata, **kwargs)
         try:
-            return await self._client.blob.set_metadata(**options)  # type: ignore
+            return cast(Dict[str, Union[str, datetime]], await self._client.blob.set_metadata(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def set_immutability_policy(self, immutability_policy, **kwargs):
-        # type: (ImmutabilityPolicy, **Any) -> Dict[str, str]
+    async def set_immutability_policy(
+        self, immutability_policy: "ImmutabilityPolicy",
+        **kwargs: Any
+    ) -> Dict[str, str]:
         """The Set Immutability Policy operation sets the immutability policy on the blob.
 
         .. versionadded:: 12.10.0
@@ -933,11 +1129,11 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
 
         kwargs['immutability_policy_expiry'] = immutability_policy.expiry_time
         kwargs['immutability_policy_mode'] = immutability_policy.policy_mode
-        return await self._client.blob.set_immutability_policy(cls=return_response_headers, **kwargs)
+        return cast(Dict[str, str],
+                    await self._client.blob.set_immutability_policy(cls=return_response_headers, **kwargs))
 
     @distributed_trace_async
-    async def delete_immutability_policy(self, **kwargs):
-        # type: (**Any) -> None
+    async def delete_immutability_policy(self, **kwargs: Any) -> None:
         """The Delete Immutability Policy operation deletes the immutability policy on the blob.
 
         .. versionadded:: 12.10.0
@@ -956,8 +1152,7 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         await self._client.blob.delete_immutability_policy(**kwargs)
 
     @distributed_trace_async
-    async def set_legal_hold(self, legal_hold, **kwargs):
-        # type: (bool, **Any) -> Dict[str, Union[str, datetime, bool]]
+    async def set_legal_hold(self, legal_hold: bool, **kwargs: Any) -> Dict[str, Union[str, datetime, bool]]:
         """The Set Legal Hold operation sets a legal hold on the blob.
 
         .. versionadded:: 12.10.0
@@ -975,17 +1170,17 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :rtype: Dict[str, Union[str, datetime, bool]]
         """
 
-        return await self._client.blob.set_legal_hold(legal_hold, cls=return_response_headers, **kwargs)
+        return cast(Dict[str, Union[str, datetime, bool]],
+                    await self._client.blob.set_legal_hold(legal_hold, cls=return_response_headers, **kwargs))
 
     @distributed_trace_async
-    async def create_page_blob(  # type: ignore
-            self, size,  # type: int
-            content_settings=None,  # type: Optional[ContentSettings]
-            metadata=None, # type: Optional[Dict[str, str]]
-            premium_page_blob_tier=None,  # type: Optional[Union[str, PremiumPageBlobTier]]
-            **kwargs
-        ):
-        # type: (...) -> Dict[str, Union[str, datetime]]
+    async def create_page_blob(
+        self, size: int,
+        content_settings: Optional["ContentSettings"] = None,
+        metadata: Optional[Dict[str, str]] = None,
+        premium_page_blob_tier: Optional[Union[str, "PremiumPageBlobTier"]] = None,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime]]:
         """Creates a new Page Blob of the specified size.
 
         :param int size:
@@ -1070,20 +1265,27 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified).
         :rtype: dict[str, Any]
         """
-        options = self._create_page_blob_options(
-            size,
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _create_page_blob_options(
+            size=size,
             content_settings=content_settings,
             metadata=metadata,
             premium_page_blob_tier=premium_page_blob_tier,
             **kwargs)
         try:
-            return await self._client.page_blob.create(**options) # type: ignore
+            return cast(Dict[str, Any], await self._client.page_blob.create(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def create_append_blob(self, content_settings=None, metadata=None, **kwargs):
-        # type: (Optional[ContentSettings], Optional[Dict[str, str]], Any) -> Dict[str, Union[str, datetime]]
+    async def create_append_blob(
+        self, content_settings: Optional["ContentSettings"] = None,
+        metadata: Optional[Dict[str, str]] = None,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime]]:
         """Creates a new Append Blob. This operation creates a new 0-length append blob. The content
         of any existing blob is overwritten with the newly initialized append blob. To add content to
         the append blob, call the :func:`append_block` or :func:`append_block_from_url` method.
@@ -1159,18 +1361,24 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified).
         :rtype: dict[str, Any]
         """
-        options = self._create_append_blob_options(
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _create_append_blob_options(
             content_settings=content_settings,
             metadata=metadata,
             **kwargs)
         try:
-            return await self._client.append_blob.create(**options) # type: ignore
+            return cast(Dict[str, Union[str, datetime]], await self._client.append_blob.create(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def create_snapshot(self, metadata=None, **kwargs):
-        # type: (Optional[Dict[str, str]], Any) -> Dict[str, Union[str, datetime]]
+    async def create_snapshot(
+        self, metadata: Optional[Dict[str, str]] = None,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime]]:
         """Creates a snapshot of the blob.
 
         A snapshot is a read-only version of a blob that's taken at a point in time.
@@ -1242,15 +1450,21 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 :dedent: 12
                 :caption: Create a snapshot of the blob.
         """
-        options = self._create_snapshot_options(metadata=metadata, **kwargs)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _create_snapshot_options(metadata=metadata, **kwargs)
         try:
-            return await self._client.blob.create_snapshot(**options) # type: ignore
+            return cast(Dict[str, Any], await self._client.blob.create_snapshot(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def start_copy_from_url(self, source_url, metadata=None, incremental_copy=False, **kwargs):
-        # type: (str, Optional[Dict[str, str]], bool, Any) -> Dict[str, Union[str, datetime]]
+    async def start_copy_from_url(
+        self, source_url: str,
+        metadata: Optional[Dict[str, str]] = None,
+        incremental_copy: bool = False,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime]]:
         """Copies a blob from the given URL.
 
         This operation returns a dictionary containing `copy_status` and `copy_id`,
@@ -1433,21 +1647,23 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 :dedent: 16
                 :caption: Copy a blob from a URL.
         """
-        options = self._start_copy_from_url_options(
-            source_url=self._encode_source_url(source_url),
+        options = _start_copy_from_url_options(
+            source_url=source_url,
             metadata=metadata,
             incremental_copy=incremental_copy,
             **kwargs)
         try:
             if incremental_copy:
-                return await self._client.page_blob.copy_incremental(**options)
-            return await self._client.blob.start_copy_from_url(**options)
+                return cast(Dict[str, Union[str, datetime]], await self._client.page_blob.copy_incremental(**options))
+            return cast(Dict[str, Union[str, datetime]], await self._client.blob.start_copy_from_url(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def abort_copy(self, copy_id, **kwargs):
-        # type: (Union[str, Dict[str, Any], BlobProperties], Any) -> None
+    async def abort_copy(
+        self, copy_id: Union[str, Dict[str, Any], BlobProperties],
+        **kwargs: Any
+    ) -> None:
         """Abort an ongoing copy operation.
 
         This will leave a destination blob with zero length and full metadata.
@@ -1468,15 +1684,18 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 :dedent: 16
                 :caption: Abort copying a blob from URL.
         """
-        options = self._abort_copy_options(copy_id, **kwargs)
+        options = _abort_copy_options(copy_id, **kwargs)
         try:
             await self._client.blob.abort_copy_from_url(**options)
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def acquire_lease(self, lease_duration=-1, lease_id=None, **kwargs):
-        # type: (int, Optional[str], Any) -> BlobLeaseClient
+    async def acquire_lease(
+        self, lease_duration: int =-1,
+        lease_id: Optional[str] = None,
+        **kwargs: Any
+    ) -> BlobLeaseClient:
         """Requests a new lease.
 
         If the blob does not have an active lease, the Blob
@@ -1532,13 +1751,12 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 :dedent: 12
                 :caption: Acquiring a lease on a blob.
         """
-        lease = BlobLeaseClient(self, lease_id=lease_id) # type: ignore
+        lease = BlobLeaseClient(self, lease_id=lease_id)
         await lease.acquire(lease_duration=lease_duration, **kwargs)
         return lease
 
     @distributed_trace_async
-    async def set_standard_blob_tier(self, standard_blob_tier, **kwargs):
-        # type: (Union[str, StandardBlobTier], Any) -> None
+    async def set_standard_blob_tier(self, standard_blob_tier: Union[str, "StandardBlobTier"], **kwargs: Any) -> None:
         """This operation sets the tier on a block blob.
 
         A block blob's tier determines Hot/Cool/Archive storage type.
@@ -1590,19 +1808,18 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
 
     @distributed_trace_async
     async def stage_block(
-            self, block_id,  # type: str
-            data,  # type: Union[Iterable[AnyStr], IO[AnyStr]]
-            length=None,  # type: Optional[int]
-            **kwargs
-        ):
-        # type: (...) -> Dict[str, Any]
+        self, block_id: str,
+        data: Union[bytes, str, Iterable[AnyStr], IO[AnyStr]],
+        length: Optional[int] = None,
+        **kwargs: Any
+    ) -> Dict[str, Any]:
         """Creates a new block to be committed as part of a blob.
 
         :param str block_id: A string value that identifies the block.
              The string should be less than or equal to 64 bytes in size.
              For a given blob, the block_id must be the same size for each block.
         :param data: The blob data.
-        :type data: Union[Iterable[AnyStr], IO[AnyStr]]
+        :type data: Union[bytes, str, Iterable[AnyStr], IO[AnyStr]]
         :param int length: Size of the block.
         :keyword bool validate_content:
             If true, calculates an MD5 hash for each chunk of the blob. The storage
@@ -1641,26 +1858,29 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob property dict.
         :rtype: Dict[str, Any]
         """
-        options = self._stage_block_options(
-            block_id,
-            data,
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _stage_block_options(
+            block_id=block_id,
+            data=data,
             length=length,
             **kwargs)
         try:
-            return await self._client.block_blob.stage_block(**options)
+            return cast(Dict[str, Any], await self._client.block_blob.stage_block(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
     async def stage_block_from_url(
-            self, block_id,  # type: Union[str, int]
-            source_url,  # type: str
-            source_offset=None,  # type: Optional[int]
-            source_length=None,  # type: Optional[int]
-            source_content_md5=None,  # type: Optional[Union[bytes, bytearray]]
-            **kwargs
-        ):
-        # type: (...) -> Dict[str, Any]
+        self, block_id: str,
+        source_url: str,
+        source_offset: Optional[int] = None,
+        source_length: Optional[int] = None,
+        source_content_md5: Optional[Union[bytes, bytearray]] = None,
+        **kwargs: Any
+    ) -> Dict[str, Any]:
         """Creates a new block to be committed as part of a blob where
         the contents are read from a URL.
 
@@ -1704,21 +1924,25 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob property dict.
         :rtype: Dict[str, Any]
         """
-        options = self._stage_block_from_url_options(
-            block_id,
-            source_url=self._encode_source_url(source_url),
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _stage_block_from_url_options(
+            block_id=block_id,
+            source_url=source_url,
             source_offset=source_offset,
             source_length=source_length,
             source_content_md5=source_content_md5,
             **kwargs)
         try:
-            return await self._client.block_blob.stage_block_from_url(**options)
+            return cast(Dict[str, Any], await self._client.block_blob.stage_block_from_url(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def get_block_list(self, block_list_type="committed", **kwargs):
-        # type: (Optional[str], Any) -> Tuple[List[BlobBlock], List[BlobBlock]]
+    async def get_block_list(
+        self, block_list_type: str = "committed",
+        **kwargs: Any
+    ) -> Tuple[List[BlobBlock], List[BlobBlock]]:
         """The Get Block List operation retrieves the list of blocks that have
         been uploaded as part of a block blob.
 
@@ -1743,7 +1967,7 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
             see `here <https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/storage/azure-storage-blob
             #other-client--per-operation-configuration>`__.
         :returns: A tuple of two lists - committed and uncommitted blocks
-        :rtype: tuple(list(~azure.storage.blob.BlobBlock), list(~azure.storage.blob.BlobBlock))
+        :rtype: Tuple[List[BlobBlock], List[BlobBlock]]
         """
         access_conditions = get_access_conditions(kwargs.pop('lease', None))
         mod_conditions = get_modify_conditions(kwargs)
@@ -1757,16 +1981,15 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
                 **kwargs)
         except HttpResponseError as error:
             process_storage_error(error)
-        return self._get_block_list_result(blocks)
+        return _get_block_list_result(blocks)
 
     @distributed_trace_async
-    async def commit_block_list( # type: ignore
-            self, block_list,  # type: List[BlobBlock]
-            content_settings=None,  # type: Optional[ContentSettings]
-            metadata=None,  # type: Optional[Dict[str, str]]
-            **kwargs
-        ):
-        # type: (...) -> Dict[str, Union[str, datetime]]
+    async def commit_block_list(
+        self, block_list: List[BlobBlock],
+        content_settings: Optional["ContentSettings"] = None,
+        metadata: Optional[Dict[str, str]] = None,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime]]:
         """The Commit Block List operation writes a blob by specifying the list of
         block IDs that make up the blob.
 
@@ -1859,19 +2082,22 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified).
         :rtype: dict(str, Any)
         """
-        options = self._commit_block_list_options(
-            block_list,
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _commit_block_list_options(
+            block_list=block_list,
             content_settings=content_settings,
             metadata=metadata,
             **kwargs)
         try:
-            return await self._client.block_blob.commit_block_list(**options) # type: ignore
+            return cast(Dict[str, Any], await self._client.block_blob.commit_block_list(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def set_premium_page_blob_tier(self, premium_page_blob_tier, **kwargs):
-        # type: (Union[str, PremiumPageBlobTier], **Any) -> None
+    async def set_premium_page_blob_tier(self, premium_page_blob_tier: "PremiumPageBlobTier", **kwargs: Any) -> None:
         """Sets the page blob tiers on the blob. This API is only supported for page blobs on premium accounts.
 
         :param premium_page_blob_tier:
@@ -1912,8 +2138,7 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
             process_storage_error(error)
 
     @distributed_trace_async
-    async def set_blob_tags(self, tags=None, **kwargs):
-        # type: (Optional[Dict[str, str]], **Any) -> Dict[str, Any]
+    async def set_blob_tags(self, tags: Optional[Dict[str, str]] = None, **kwargs: Any) -> Dict[str, Any]:
         """The Set Tags operation enables users to set tags on a blob or specific blob version, but not snapshot.
             Each call to this operation replaces all existing tags attached to the blob. To remove all
             tags from the blob, call this operation with no tags set.
@@ -1954,15 +2179,15 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified)
         :rtype: Dict[str, Any]
         """
-        options = self._set_blob_tags_options(tags=tags, **kwargs)
+        version_id = get_version_id(self.version_id, kwargs)
+        options = _set_blob_tags_options(version_id=version_id, tags=tags, **kwargs)
         try:
-            return await self._client.blob.set_tags(**options)
+            return cast(Dict[str, Any], await self._client.blob.set_tags(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def get_blob_tags(self, **kwargs):
-        # type: (**Any) -> Dict[str, str]
+    async def get_blob_tags(self, **kwargs: Any) -> Dict[str, str]:
         """The Get Tags operation enables users to get tags on a blob or specific blob version, but not snapshot.
 
         .. versionadded:: 12.4.0
@@ -1987,21 +2212,21 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Key value pairs of blob tags.
         :rtype: Dict[str, str]
         """
-        options = self._get_blob_tags_options(**kwargs)
+        version_id = get_version_id(self.version_id, kwargs)
+        options = _get_blob_tags_options(version_id=version_id, snapshot=self.snapshot, **kwargs)
         try:
             _, tags = await self._client.blob.get_tags(**options)
-            return parse_tags(tags)  # pylint: disable=protected-access
+            return cast(Dict[str, str], parse_tags(tags))  # pylint: disable=protected-access
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def get_page_ranges( # type: ignore
-            self, offset=None, # type: Optional[int]
-            length=None, # type: Optional[int]
-            previous_snapshot_diff=None,  # type: Optional[Union[str, Dict[str, Any]]]
-            **kwargs
-        ):
-        # type: (...) -> Tuple[List[Dict[str, int]], List[Dict[str, int]]]
+    async def get_page_ranges(
+        self, offset: Optional[int] = None,
+        length: Optional[int] = None,
+        previous_snapshot_diff: Optional[Union[str, Dict[str, Any]]] = None,
+        **kwargs: Any
+    ) -> Tuple[List[Dict[str, int]], List[Dict[str, int]]]:
         """DEPRECATED: Returns the list of valid page ranges for a Page Blob or snapshot
         of a page blob.
 
@@ -2066,7 +2291,8 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
             DeprecationWarning
         )
 
-        options = self._get_page_ranges_options(
+        options = _get_page_ranges_options(
+            snapshot=self.snapshot,
             offset=offset,
             length=length,
             previous_snapshot_diff=previous_snapshot_diff,
@@ -2082,13 +2308,13 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
 
     @distributed_trace
     def list_page_ranges(
-            self,
-            *,
-            offset: Optional[int] = None,
-            length: Optional[int] = None,
-            previous_snapshot: Optional[Union[str, Dict[str, Any]]] = None,
-            **kwargs: Any
-        ) -> AsyncItemPaged[PageRange]:
+        self,
+        *,
+        offset: Optional[int] = None,
+        length: Optional[int] = None,
+        previous_snapshot: Optional[Union[str, Dict[str, Any]]] = None,
+        **kwargs: Any
+    ) -> AsyncItemPaged[PageRange]:
         """Returns the list of valid page ranges for a Page Blob or snapshot
         of a page blob. If `previous_snapshot` is specified, the result will be
         a diff of changes between the target blob and the previous snapshot.
@@ -2152,7 +2378,8 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :rtype: ~azure.core.paging.ItemPaged[~azure.storage.blob.PageRange]
         """
         results_per_page = kwargs.pop('results_per_page', None)
-        options = self._get_page_ranges_options(
+        options = _get_page_ranges_options(
+            snapshot=self.snapshot,
             offset=offset,
             length=length,
             previous_snapshot_diff=previous_snapshot,
@@ -2172,12 +2399,11 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
 
     @distributed_trace_async
     async def get_page_range_diff_for_managed_disk(
-            self, previous_snapshot_url,  # type: str
-            offset=None, # type: Optional[int]
-            length=None,  # type: Optional[int]
-            **kwargs
-        ):
-        # type: (...) -> Tuple[List[Dict[str, int]], List[Dict[str, int]]]
+        self, previous_snapshot_url: str,
+        offset: Optional[int] = None,
+        length: Optional[int] = None,
+        **kwargs: Any
+    ) -> Tuple[List[Dict[str, int]], List[Dict[str, int]]]:
         """Returns the list of valid page ranges for a managed disk or snapshot.
 
         .. note::
@@ -2236,7 +2462,8 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
             The first element are filled page ranges, the 2nd element is cleared page ranges.
         :rtype: tuple(list(dict(str, str), list(dict(str, str))
         """
-        options = self._get_page_ranges_options(
+        options = _get_page_ranges_options(
+            snapshot=self.snapshot,
             offset=offset,
             length=length,
             prev_snapshot_url=previous_snapshot_url,
@@ -2248,12 +2475,11 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         return get_page_ranges_result(ranges)
 
     @distributed_trace_async
-    async def set_sequence_number( # type: ignore
-            self, sequence_number_action,  # type: Union[str, SequenceNumberAction]
-            sequence_number=None,  # type: Optional[str]
-            **kwargs
-        ):
-        # type: (...) -> Dict[str, Union[str, datetime]]
+    async def set_sequence_number(
+        self, sequence_number_action: Union[str, "SequenceNumberAction"],
+        sequence_number: Optional[str] = None,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime]]:
         """Sets the blob sequence number.
 
         :param str sequence_number_action:
@@ -2299,16 +2525,14 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified).
         :rtype: dict(str, Any)
         """
-        options = self._set_sequence_number_options(
-            sequence_number_action, sequence_number=sequence_number, **kwargs)
+        options = _set_sequence_number_options(sequence_number_action, sequence_number=sequence_number, **kwargs)
         try:
-            return await self._client.page_blob.update_sequence_number(**options) # type: ignore
+            return cast(Dict[str, Any], await self._client.page_blob.update_sequence_number(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def resize_blob(self, size, **kwargs):
-        # type: (int, Any) -> Dict[str, Union[str, datetime]]
+    async def resize_blob(self, size: int, **kwargs: Any) -> Dict[str, Union[str, datetime]]:
         """Resizes a page blob to the specified size.
 
         If the specified value is less than the current size of the blob,
@@ -2357,20 +2581,21 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified).
         :rtype: dict(str, Any)
         """
-        options = self._resize_blob_options(size, **kwargs)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _resize_blob_options(size=size, **kwargs)
         try:
-            return await self._client.page_blob.resize(**options) # type: ignore
+            return cast(Dict[str, Any], await self._client.page_blob.resize(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def upload_page( # type: ignore
-            self, page,  # type: bytes
-            offset,  # type: int
-            length,  # type: int
-            **kwargs
-        ):
-        # type: (...) -> Dict[str, Union[str, datetime]]
+    async def upload_page(
+        self, page: bytes,
+        offset: int,
+        length: int,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime]]:
         """The Upload Pages operation writes a range of pages to a page blob.
 
         :param bytes page:
@@ -2452,24 +2677,28 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified).
         :rtype: dict(str, Any)
         """
-        options = self._upload_page_options(
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _upload_page_options(
             page=page,
             offset=offset,
             length=length,
             **kwargs)
         try:
-            return await self._client.page_blob.upload_pages(**options) # type: ignore
+            return cast(Dict[str, Any], await self._client.page_blob.upload_pages(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def upload_pages_from_url(self, source_url,  # type: str
-                                    offset,  # type: int
-                                    length,  # type: int
-                                    source_offset,  # type: int
-                                    **kwargs
-                                    ):
-        # type: (...) -> Dict[str, Any]
+    async def upload_pages_from_url(
+        self, source_url: str,
+        offset: int,
+        length: int,
+        source_offset: int,
+        **kwargs: Any
+    ) -> Dict[str, Any]:
         """
         The Upload Pages operation writes a range of pages to a page blob where
         the contents are read from a URL.
@@ -2571,21 +2800,24 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :rtype: Dict[str, Any]
         """
 
-        options = self._upload_pages_from_url_options(
-            source_url=self._encode_source_url(source_url),
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _upload_pages_from_url_options(
+            source_url=source_url,
             offset=offset,
             length=length,
             source_offset=source_offset,
             **kwargs
         )
         try:
-            return await self._client.page_blob.upload_pages_from_url(**options)  # type: ignore
+            return cast(Dict[str, Any], await self._client.page_blob.upload_pages_from_url(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def clear_page(self, offset, length, **kwargs):
-        # type: (int, int, Any) -> Dict[str, Union[str, datetime]]
+    async def clear_page(self, offset: int, length: int, **kwargs: Any) -> Dict[str, Union[str, datetime]]:
         """Clears a range of pages.
 
         :param int offset:
@@ -2648,19 +2880,26 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag and last modified).
         :rtype: dict(str, Any)
         """
-        options = self._clear_page_options(offset, length, **kwargs)
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _clear_page_options(
+            offset=offset,
+            length=length,
+            **kwargs
+        )
         try:
-            return await self._client.page_blob.clear_pages(**options)  # type: ignore
+            return cast(Dict[str, Any], await self._client.page_blob.clear_pages(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def append_block( # type: ignore
-            self, data,  # type: Union[bytes, str, Iterable[AnyStr], IO[AnyStr]]
-            length=None,  # type: Optional[int]
-            **kwargs
-        ):
-        # type: (...) -> Dict[str, Union[str, datetime, int]]
+    async def append_block(
+        self, data: Union[bytes, str, Iterable[AnyStr], IO[AnyStr]],
+        length: Optional[int] = None,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime, int]]:
         """Commits a new block of data to the end of the existing append blob.
 
         :param data:
@@ -2738,22 +2977,27 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag, last modified, append offset, committed block count).
         :rtype: dict(str, Any)
         """
-        options = self._append_block_options(
-            data,
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _append_block_options(
+            data=data,
             length=length,
             **kwargs
         )
         try:
-            return await self._client.append_blob.append_block(**options)  # type: ignore
+            return cast(Dict[str, Any], await self._client.append_blob.append_block(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def append_block_from_url(self, copy_source_url,  # type: str
-                                    source_offset=None,  # type: Optional[int]
-                                    source_length=None,  # type: Optional[int]
-                                    **kwargs):
-        # type: (...) -> Dict[str, Union[str, datetime, int]]
+    async def append_block_from_url(
+        self, copy_source_url: str,
+        source_offset: Optional[int] = None,
+        source_length: Optional[int] = None,
+        **kwargs: Any
+    ) -> Dict[str, Union[str, datetime, int]]:
         """
         Creates a new block to be committed as part of a blob, where the contents are read from a source url.
 
@@ -2848,20 +3092,24 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Result after appending a new block.
         :rtype: Dict[str, Union[str, datetime, int]]
         """
-        options = self._append_block_from_url_options(
-            copy_source_url=self._encode_source_url(copy_source_url),
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        if kwargs.get('cpk') and self.scheme.lower() != 'https':
+            raise ValueError("Customer provided encryption key must be used over HTTPS.")
+        options = _append_block_from_url_options(
+            copy_source_url=copy_source_url,
             source_offset=source_offset,
             source_length=source_length,
             **kwargs
         )
         try:
-            return await self._client.append_blob.append_block_from_url(**options)  # type: ignore
+            return cast(Dict[str, Union[str, datetime, int]],
+                        await self._client.append_blob.append_block_from_url(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
     @distributed_trace_async
-    async def seal_append_blob(self, **kwargs):
-        # type: (...) -> Dict[str, Union[str, datetime, int]]
+    async def seal_append_blob(self, **kwargs: Any) -> Dict[str, Union[str, datetime, int]]:
         """The Seal operation seals the Append Blob to make it read-only.
 
             .. versionadded:: 12.4.0
@@ -2902,14 +3150,15 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         :returns: Blob-updated property dict (Etag, last modified, append offset, committed block count).
         :rtype: dict(str, Any)
         """
-        options = self._seal_append_blob_options(**kwargs)
+        if self.require_encryption or (self.key_encryption_key is not None):
+            raise ValueError(_ERROR_UNSUPPORTED_METHOD_FOR_ENCRYPTION)
+        options = _seal_append_blob_options(**kwargs)
         try:
-            return await self._client.append_blob.seal(**options) # type: ignore
+            return cast(Dict[str, Any], await self._client.append_blob.seal(**options))
         except HttpResponseError as error:
             process_storage_error(error)
 
-    def _get_container_client(self): # pylint: disable=client-method-missing-kwargs
-        # type: (...) -> ContainerClient
+    def _get_container_client(self) -> "ContainerClient":
         """Get a client to interact with the blob's parent container.
 
         The container need not already exist. Defaults to current blob's credentials.
@@ -2930,7 +3179,8 @@ class BlobClient(AsyncStorageAccountHostsMixin, BlobClientBase, StorageEncryptio
         if not isinstance(self._pipeline._transport, AsyncTransportWrapper): # pylint: disable = protected-access
             _pipeline = AsyncPipeline(
                 transport=AsyncTransportWrapper(self._pipeline._transport), # pylint: disable = protected-access
-                policies=self._pipeline._impl_policies # pylint: disable = protected-access
+                policies=cast(Iterable["AsyncHTTPPolicy"],
+                              self._pipeline._impl_policies) # pylint: disable = protected-access
             )
         else:
             _pipeline = self._pipeline  # pylint: disable = protected-access