mirror of
https://github.com/mattermost/mattermost.git
synced 2026-06-11 20:07:34 +00:00
Alejandro García Montoro
8e8b807a42
* Implement FileBackendWithLinkGenerator for Azure (SAS for export downloads) Restores feature parity with the S3 driver for the optional presigned export-download path. Today on Azure-backed deployments the path falls through with "driver doesn't support link generation"; with this change admins can opt into direct downloads of bulk export archives just like they can on S3. Auth-mode aware: * Shared key signs a Service SAS in process with the credential the backend was constructed with. * Default credential fetches a user-delegation key from Entra ID per call and signs a user-delegation SAS with it. The link forces Content-Disposition: attachment to mirror the S3 driver's response-content-disposition behavior, and pins HTTPS-only when the backend was configured with TLS so the SAS cannot be exfiltrated over plaintext. Plaintext setups (Azurite, on-prem reverse proxies) keep working because we fall back to allowing both schemes. Adds ExportAzurePresignExpiresSeconds to FileSettings, defaulting to 21600 seconds (6h), to match the S3 export presign field. The primary backend never issues SAS, so no AzurePresignExpiresSeconds. Covered by new unit tests against Azurite (Service SAS round trip, tamper detection, missing configuration, unknown auth mode). The user- delegation SAS path needs Entra ID and is verified manually per the recipe in the docs PR. ------ AI assisted commit * Rename GeneratePublicLink's argument p to path * Improve comment on AzureFileBackend.sharedKey * Simplify the clock skew fix * Remove MaxAzurePresignExpiresSeconds