Filter by tags (#2311)

* Filter blob by tags

* Added cases for filter/Tag permission check

* Resove merge conflict

Author: EmmaZhu

README.md

@@ -981,7 +981,8 @@ Detailed support matrix:
   - OAuth authentication
   - Shared Access Signature Account Level
   - Shared Access Signature Service Level (Not support response header override in service SAS)
-  - Container Public Access
+  - Container Public Access  
+  - Blob Tags (preview)
 - Supported REST APIs
   - List Containers
   - Set Service Properties
@@ -1017,7 +1018,6 @@ Detailed support matrix:
   - Soft delete & Undelete Container
   - Soft delete & Undelete Blob
   - Incremental Copy Blob
-  - Blob Tags
   - Blob Query
   - Blob Versions
   - Blob Last Access Time

src/blob/authentication/ContainerSASPermissions.ts

@@ -5,5 +5,6 @@ export enum ContainerSASPermission {
   Write = "w",
   Delete = "d",
   List = "l",
+  Filter = "f",
   Any = "AnyPermission" // This is only for blob batch operation.
 }

src/blob/authentication/OperationBlobSASPermission.ts

@@ -369,6 +369,10 @@ OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
   Operation.Container_ListBlobFlatSegment,
   new OperationBlobSASPermission(ContainerSASPermission.List)
 );
+OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
+  Operation.Container_FilterBlobs,
+  new OperationBlobSASPermission(ContainerSASPermission.Filter)
+);
 OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
   Operation.Container_ListBlobHierarchySegment,
   new OperationBlobSASPermission(ContainerSASPermission.List)

src/blob/conditions/ConditionResourceAdapter.ts

@@ -1,10 +1,11 @@
-import { BlobModel, ContainerModel } from "../persistence/IBlobMetadataStore";
+import { BlobModel, ContainerModel, FilterBlobModel } from "../persistence/IBlobMetadataStore";
 import IConditionResource from "./IConditionResource";
 
 export default class ConditionResourceAdapter implements IConditionResource {
   public exist: boolean;
   public etag: string;
   public lastModified: Date;
+  public blobItemWithTags?: FilterBlobModel;
 
   public constructor(resource: BlobModel | ContainerModel | undefined | null) {
     if (
@@ -33,5 +34,12 @@ export default class ConditionResourceAdapter implements IConditionResource {
 
     this.lastModified = new Date(resource.properties.lastModified);
     this.lastModified.setMilliseconds(0); // Precision to seconds
+
+    const blobItem = resource as BlobModel;
+    this.blobItemWithTags = {
+      name: blobItem.name,
+      containerName: blobItem.containerName,
+      tags: blobItem.blobTags
+    };
   }
 }

src/blob/conditions/ConditionalHeadersAdapter.ts

@@ -7,6 +7,7 @@ export default class ConditionalHeadersAdapter implements IConditionalHeaders {
   public ifUnmodifiedSince?: Date;
   public ifMatch?: string[];
   public ifNoneMatch?: string[];
+  public ifTags?: string;
 
   public constructor(
     context: Context,
@@ -43,5 +44,7 @@ export default class ConditionalHeadersAdapter implements IConditionalHeaders {
     if (this.ifUnmodifiedSince) {
       this.ifUnmodifiedSince.setMilliseconds(0); // Precision to seconds
     }
+
+    this.ifTags = modifiedAccessConditions.ifTags;
   }
 }

src/blob/conditions/IConditionResource.ts

@@ -1,3 +1,5 @@
+import { FilterBlobModel } from "../persistence/IBlobMetadataStore";
+
 export default interface IConditionResource {
   /**
    * Whether resource exists or not.
@@ -13,4 +15,5 @@ export default interface IConditionResource {
    * last modified time for container or blob.
    */
   lastModified: Date;
+  blobItemWithTags?: FilterBlobModel;
 }

src/blob/conditions/IConditionalHeaders.ts

@@ -11,4 +11,9 @@ export interface IConditionalHeaders {
    * If-None-Match etag list without quotes.
    */
   ifNoneMatch?: string[];
+
+  /**
+   * Specify a SQL where clause on blob tags to operate only on blobs with a matching value.
+   */
+  ifTags?: string;
 }

src/blob/conditions/IConditionalHeadersValidator.ts

@@ -6,6 +6,7 @@ export interface IConditionalHeadersValidator {
   validate(
     context: Context,
     conditionalHeaders: IConditionalHeaders,
-    resource: IConditionResource
+    resource: IConditionResource,
+    isSourceBlob?: boolean
   ): void;
 }

src/blob/conditions/ReadConditionalHeadersValidator.ts

@@ -2,6 +2,7 @@ import StorageErrorFactory from "../errors/StorageErrorFactory";
 import { ModifiedAccessConditions } from "../generated/artifacts/models";
 import Context from "../generated/Context";
 import { BlobModel, ContainerModel } from "../persistence/IBlobMetadataStore";
+import { generateQueryBlobWithTagsWhereFunction } from "../persistence/QueryInterpreter/QueryInterpreter";
 import ConditionalHeadersAdapter from "./ConditionalHeadersAdapter";
 import ConditionResourceAdapter from "./ConditionResourceAdapter";
 import { IConditionalHeaders } from "./IConditionalHeaders";
@@ -11,12 +12,14 @@ import IConditionResource from "./IConditionResource";
 export function validateReadConditions(
   context: Context,
   conditionalHeaders?: ModifiedAccessConditions,
-  model?: BlobModel | ContainerModel | null
+  model?: BlobModel | ContainerModel | null,
+  isSourceBlob?: boolean
 ) {
   new ReadConditionalHeadersValidator().validate(
     context,
     new ConditionalHeadersAdapter(context, conditionalHeaders),
-    new ConditionResourceAdapter(model)
+    new ConditionResourceAdapter(model),
+    isSourceBlob
   );
 }
 
@@ -30,11 +33,13 @@ export default class ReadConditionalHeadersValidator
    * @param context
    * @param conditionalHeaders
    * @param resource
+   * @param isSourceBlob 
    */
   public validate(
     context: Context,
     conditionalHeaders: IConditionalHeaders,
-    resource: IConditionResource
+    resource: IConditionResource,
+    isSourceBlob?: boolean
   ): void {
     // If-Match && If-Unmodified-Since && (If-None-Match || If-Modified-Since)
 
@@ -66,7 +71,7 @@ export default class ReadConditionalHeadersValidator
       // If-Match
       const ifMatchPass = conditionalHeaders.ifMatch
         ? conditionalHeaders.ifMatch.includes(resource.etag) ||
-          conditionalHeaders.ifMatch[0] === "*"
+        conditionalHeaders.ifMatch[0] === "*"
         : undefined;
 
       // If-Unmodified-Since
@@ -107,6 +112,16 @@ export default class ReadConditionalHeadersValidator
       if (isModifiedSincePass === false && ifNoneMatchPass !== true) {
         throw StorageErrorFactory.getNotModified(context.contextId!);
       }
+
+      if (conditionalHeaders.ifTags) {
+        const againstSourceBlob = isSourceBlob === undefined ? false : isSourceBlob;
+        const validateFunction = generateQueryBlobWithTagsWhereFunction(context, conditionalHeaders.ifTags, againstSourceBlob ? 'x-ms-source-if-tags' : 'x-ms-if-tags');
+
+        if (conditionalHeaders?.ifTags !== undefined
+          && validateFunction(resource.blobItemWithTags).length === 0) {
+          throw StorageErrorFactory.getConditionNotMet(context.contextId!);
+        }
+      }
     }
   }
 }

src/blob/conditions/WriteConditionalHeadersValidator.ts

@@ -5,6 +5,7 @@ import {
 } from "../generated/artifacts/models";
 import Context from "../generated/Context";
 import { BlobModel, ContainerModel } from "../persistence/IBlobMetadataStore";
+import { generateQueryBlobWithTagsWhereFunction } from "../persistence/QueryInterpreter/QueryInterpreter";
 import ConditionalHeadersAdapter from "./ConditionalHeadersAdapter";
 import ConditionResourceAdapter from "./ConditionResourceAdapter";
 import { IConditionalHeaders } from "./IConditionalHeaders";
@@ -29,7 +30,7 @@ export function validateSequenceNumberWriteConditions(
   if (
     conditionalHeaders.ifSequenceNumberLessThanOrEqualTo !== undefined &&
     conditionalHeaders.ifSequenceNumberLessThanOrEqualTo <
-      model.properties.blobSequenceNumber
+    model.properties.blobSequenceNumber
   ) {
     throw StorageErrorFactory.getSequenceNumberConditionNotMet(
       context.contextId!
@@ -39,7 +40,7 @@ export function validateSequenceNumberWriteConditions(
   if (
     conditionalHeaders.ifSequenceNumberLessThan !== undefined &&
     conditionalHeaders.ifSequenceNumberLessThan <=
-      model.properties.blobSequenceNumber
+    model.properties.blobSequenceNumber
   ) {
     throw StorageErrorFactory.getSequenceNumberConditionNotMet(
       context.contextId!
@@ -49,7 +50,7 @@ export function validateSequenceNumberWriteConditions(
   if (
     conditionalHeaders.ifSequenceNumberEqualTo !== undefined &&
     conditionalHeaders.ifSequenceNumberEqualTo !==
-      model.properties.blobSequenceNumber
+    model.properties.blobSequenceNumber
   ) {
     throw StorageErrorFactory.getSequenceNumberConditionNotMet(
       context.contextId!
@@ -167,6 +168,15 @@ export default class WriteConditionalHeadersValidator
         }
         return;
       }
+
+      if (conditionalHeaders.ifTags) {
+        const validateFunction = generateQueryBlobWithTagsWhereFunction(context, conditionalHeaders.ifTags, 'x-ms-if-tags');
+
+        if (conditionalHeaders?.ifTags !== undefined
+          && validateFunction(resource.blobItemWithTags).length === 0) {
+          throw StorageErrorFactory.getConditionNotMet(context.contextId!);
+        }
+      }
     }
   }