Fix blob SAS when using version 2026-04-06

[Socolin - Bertrand Provost (Socolin)]

This should fix #2649

The SDK is generating signature with new parameters

https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/storage/Azure.Storage.Common/src/Sas/SasQueryParameters.cs#L103-L107

https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/storage/Azure.Storage.Blobs/src/Sas/BlobSasBuilder.cs#L573-L574

# SDK
        // r\n2026-06-15T17:46:26Z\n2026-06-22T17:46:26Z\n/blob/dev/some-container-name/abc.png\n7c751eb2-acf8-4ce2-b92c-8724f0644194\nff51635d-1eb2-4fe3-8828-0c3de5b45b35\n2026-06-15T17:46:26Z\n2026-06-15T18:46:26Z\nb\n2025-11-05\n\n\n\n\n\n\n\n2026-04-06\nb\n\n\n\n\n\n\n\n\n
# Azurite
        // r\n2026-06-15T17:46:26Z\n2026-06-22T17:46:26Z\n/blob/dev/some-container-name/abc.png\n7c751eb2-acf8-4ce2-b92c-8724f0644194\nff51635d-1eb2-4fe3-8828-0c3de5b45b35\n2026-06-15T17:46:26Z\n2026-06-15T18:46:26Z\nb\n2025-11-05\n\n\n\n\n\n\n\n2026-04-06\nb\n\n\n\n\n\n\n

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for User Delegation Key (UDK) Blob SAS signing and parsing for service version 2026-04-06, including new optional signed request headers/query parameters.

Changes:

• Extended IBlobSASSignatureValues with signedRequestHeaders / signedRequestQueryParameters.
• Added a new 2026-04-06 string-to-sign implementation for generateBlobSASSignatureWithUDK.
• Updated SAS request parsing to read srh / srq query params and changelog entry.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/blob/authentication/IBlobSASSignatureValues.ts	Adds new SAS fields and introduces a new signing function for version 2026-04-06.
src/blob/authentication/BlobSASAuthenticator.ts	Parses new query parameters (srh, srq) and wires them into the in-memory SAS values.
ChangeLog.md	Documents upcoming release support for 2026-04-06 delegation SAS.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Akanksha Jain (jainakanksha-msft)]

Socolin - Bertrand Provost (@Socolin) generateBlobSASBlobSASSignatureWithUDK20260406 this function already exists.
Can you please update the existing function with new handling.
And add the reference document to support the new capability

[Socolin - Bertrand Provost (Socolin)]

Is this a copilot review ? :p

This function was added last week, so yeah now it's a duplicate, but you can just reject this PR now if it exists.

decde65

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

src/blob/authentication/BlobSASAuthenticator.ts:532

• After adding delegatedUserObjectId decoding, include it in the constructed blobSASValues so the signature generator can use it when present.

      signedService,
      signedVersion,
      delegatedUserTenantId,
      signedStartsOn,
      signedExpiresOn,

src/blob/authentication/BlobSASAuthenticator.ts:488

• delegatedUserObjectId is part of IBlobSASSignatureValues and is included in the UDK string-to-sign, but this request parser doesn’t read it from the query string. If the client includes skduoid, Azurite will compute a different signature.

Add decoding for skduoid alongside skdutid.

This issue also appears on line 528 of the same file.

    const signedStartsOn = this.decodeIfExist(req.getQuery("skt"));
    const signedExpiresOn = this.decodeIfExist(req.getQuery("ske"));
    const signedVersion = this.decodeIfExist(req.getQuery("skv"));
    const delegatedUserTenantId = this.decodeIfExist(req.getQuery("skdutid"));
    const signedService = this.decodeIfExist(req.getQuery("sks"));
    const signedRequestHeaders = this.decodeIfExist(

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/blob/authentication/IBlobSASSignatureValues.ts:896

• generateBlobSASBlobSASSignatureWithUDK20260406 is already declared earlier in this file (around line 749). Adding a second function with the same name will fail TypeScript compilation (duplicate implementation) and also introduces logic differences that break existing expectations for the UDK path (e.g., the new version’s validation allows identifier-only, and its canonical name omits blobName for BlobSnapshot, which contradicts the unit test for snapshot resources).

Recommendation: remove this duplicate implementation and instead update the existing generateBlobSASBlobSASSignatureWithUDK20260406 to use signedRequestHeaders/signedRequestQueryParameters (instead of hard-coded placeholders) while keeping its current resource handling/validation consistent with the other UDK versions and the existing tests.

function generateBlobSASBlobSASSignatureWithUDK20260406(
  blobSASSignatureValues: IBlobSASSignatureValues,
  resource: BlobSASResourceType,
  accountName: string,
  userDelegationKeyValue: Buffer