Skip to content

feat: Add SAS token support to azure_storage_queue#3645

Draft
lsiddiquee wants to merge 2 commits intomainfrom
feat/queue-sas-support
Draft

feat: Add SAS token support to azure_storage_queue#3645
lsiddiquee wants to merge 2 commits intomainfrom
feat/queue-sas-support

Conversation

@lsiddiquee
Copy link
Member

Adds support for Shared Access Signature (SAS) token authentication to the Azure Queue Storage client library, aligning with the authentication patterns used in azure_storage_blob.

Changes

Features Added

  • Added from_url() constructors for QueueClient and QueueServiceClient to enable direct URL-based client construction
  • Added support for SAS token authentication through URL query parameters
  • Made credential parameter optional (Option<Arc<dyn TokenCredential>>) on both new() and from_url() methods to support multiple authentication scenarios:
    • Entra ID authentication (when credential is provided)
    • SAS token authentication (when credential is None and URL contains SAS token)
    • Public access (when credential is None and no authentication in URL)

Breaking Changes

  • Changed credential parameter to Option<Arc<dyn TokenCredential>> on client constructors
  • Changed queue_name parameter from owned String to &str reference on QueueClient::new()
  • Removed queue_name() accessor from QueueClient
  • Removed public endpoint struct field (now accessed via method)
  • Changed QueueServiceClient::queue_client() to return Result<QueueClient> instead of QueueClient

Implementation Details

  • Created extension methods on generated clients (GeneratedQueueClient and GeneratedQueueServiceClient) to implement custom construction logic
  • Added conditional pipeline building with BearerTokenAuthorizationPolicy only when credentials are provided
  • Fixed test recording issue where child clients created by QueueServiceClient weren't inheriting test proxy instrumentation
  • Stored QueueServiceClientOptions in QueueServiceClient to pass client options to child QueueClient instances

Examples and Tests

  • Updated examples to demonstrate both Entra ID and SAS token authentication
  • Added comprehensive test coverage for SAS token scenarios
  • Refactored examples to use shared test logic for both authentication methods
  • All tests pass in both record and playback modes

Documentation

  • Updated README with corrected credential parameter usage
  • Added example README documenting required environment variables for SAS token testing
  • Updated CHANGELOG following azure_storage_blob conventions

@github-actions github-actions bot added the Storage Storage Service (Queues, Blobs, Files) label Feb 2, 2026
This release introduces several significant changes, including:
- Updated version to 0.4.0 in Cargo.toml and Cargo.lock.
- Added support for constructing clients directly from SAS URLs.
- Removed deprecated methods and changed parameter types for better flexibility.
- Enhanced examples to demonstrate SAS token usage.
- Updated tests to validate SAS token functionality for both QueueClient and QueueServiceClient.
@lsiddiquee lsiddiquee force-pushed the feat/queue-sas-support branch from 806aa08 to 2d2c9d7 Compare February 2, 2026 15:19
@github-actions
Copy link

github-actions bot commented Feb 2, 2026

API Change Check

APIView identified API level changes in this PR and created the following API reviews

azure_storage_queue

Copy link
Member

@vincenttran-msft vincenttran-msft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One nit about changelog, but other than that refactor looks like went smoothly! Thanks for your contributions here Likhan, we greatly appreciate it and Queue crate consumers surely will too 😄

Going to leave Jacob to do a final-pass.

…not released

Updated the version of the azure_storage_queue package to 0.3.0 in Cargo.toml and Cargo.lock. Adjusted the CHANGELOG to reflect the correct versioning.
Added documentation for using SAS URLs in the README.

/// Test creating, listing, and deleting a queue using SAS token authentication with from_url
#[recorded::test]
async fn test_sas_token_from_url(ctx: TestContext) -> Result<()> {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, we can't really check-in SAS tests for now as we don't have the ability to generate a SAS from the SDK. Also be careful about accidentally recording a real SAS URL into the assets and that would leak your account info (and flag us). I took a look at your assets for this PR, and it doesn't look like you leaked anything (the recordings for these tests were empty for some reason) but best to just remove these checked-in tests for now.

When removing tests, it's best to delete the recordings from the assets too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Storage Storage Service (Queues, Blobs, Files)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants