pomerium / pomerium / 26985500573
52%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 705
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 52.167% (-0.05%) from 52.213%
26985500573

push

github

web-flow 
fix(azblob): strict signing on blob operations ordering with BeforeRead middleware (#6420)

## Summary

Similar to s3 audit middleware the implementation of the azblob provider
signs requests with different sets of criteria. Headers with the
`x-ms-*` headers are included in the request signature when strict
verification is enabled, which can cause issues with signing.

The fix is to add `PerCallPolicies` to the client which can only be done
by providing `ClientOptions` to the Client used by the underlying bucket
URI.

The azure client is not available through the typical `asFunc(...)` type
casting by BeforeRead/BeforeWrite/BeforeList methods on the go-cloud
bucket.

It's not possible to change the header key to something without
`x-ms-*`, since those headers are how metadata is surfaced in the cloud
provider audit logs for correlation with Pomerium.


The only solution I could find is unfortunately copying over how the
default client is constructed from the go-cloud/azblob upstream, and
adding a `PerCallPolicies` for adding `x-ms` headers through context
propagation.


## Related issues


[ENG-4102](https://linear.app/pomerium/issue/ENG-4102/bug-strict-signing-on-azure-inconsistent-with-custom-header-middleware)

## User Explanation

N/A

## AI disclosure

none

## Checklist

- [X] reference any related issues
- [X] updated unit tests
- [X] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [X] disclosed AI usage (or wrote "none") per AI_POLICY.md
- [X] ready for review

10 of 74 new or added lines in 3 files covered. (13.51%)

38 existing lines in 10 files now uncovered.

36768 of 70482 relevant lines covered (52.17%)

463.46 hits per line

Uncovered Changes

Lines Coverage ∆ File
54
0.0
 pkg/storage/blob/providers/azblob_client.go
10
0.0
 0.0% pkg/storage/blob/providers/providers.go

Coverage Regressions

Lines Coverage ∆ File
11
72.3
 -7.43% pkg/grpcutil/client_manager.go
9
80.34
 0.0% pkg/ssh/manager.go
6
87.62
 -2.97% config/config_source.go
2
69.52
 -0.3% internal/databroker/server_backend.go
2
48.66
 0.89% internal/databroker/server_clustered_follower.go
2
94.55
 0.0% pkg/fanout/receive.go
2
78.36
 1.06% pkg/storage/postgres/backend.go
2
85.88
 1.18% pkg/storage/postgres/iterate.go
1
95.83
 -1.04% pkg/identity/manager/schedulers.go
1
0.0
 0.0% pkg/storage/blob/providers/providers.go
Jobs
ID Job ID Ran Files Coverage
1 26985500573.1 705
52.17
 GitHub Action Run
Source Files on build 26985500573