fabric-lakehouse-query-function

verify_sas.py — validate a SAS token for COPY INTO

verify_sas.py checks whether a SAS token has the right scope and permissions to be used by Fabric / Synapse COPY INTO against an ADLS Gen2 / Blob path. It performs three probes:

1. SAS inspection — parses sv/ss/srt/sp/st/se/spr and flags missing flags.
2. Service probe (srt=s) — calls Get Account Info.
3. List probe (srt=c, sp=l) — lists blobs under the prefix.
4. Read probe (srt=o, sp=r) — downloads the first few bytes of up to N matched files.

For COPY INTO with wildcards, the SAS must have ss=b, srt=sco, and sp containing at least rl.

Setup

# from the repo root
python -m venv .venv
.\.venv\Scripts\Activate.ps1
pip install -r requirements.txt

# create your local .env from the template
Copy-Item .env.example .env

Then edit .env and fill in the SAS_* values. .env is gitignored.

.env variables

Variable	Required	Default	Description
SAS_ACCOUNT	yes	—	Storage account name (no .blob.core.windows.net).
SAS_CONTAINER	yes	—	Container name.
SAS_PREFIX	no	""	Blob name prefix (folder path) to list under.
SAS_TOKEN	yes	—	Full SAS query string, with or without leading ?.
SAS_FILE_PATTERN	no	.csv	Suffix used to filter listed blobs.
SAS_MAX_FILES_TO_TEST	no	3	How many matched files to download-probe.
SAS_PROBE_BYTES	no	512	Bytes to download per file as a read check.

Run

python verify_sas.py

Exit codes:

• 0 — SAS can list and read; COPY INTO should succeed.
• 1 — list or read failed (output shows status code and likely cause).
• 2 — required env var missing, or SAS_TOKEN still contains the REPLACE_ME placeholder.

Common failures

• AuthorizationResourceTypeMismatch on read → srt is missing o.
• 403 on list → srt is missing c, or sp is missing l, or the storage account firewall blocks your IP.
• AuthenticationFailed → sig is wrong (often re-encoded by copy/paste), the token is expired (se), or not yet valid (st).