Azure 存储文件：为目录生成 SAS 时出现问题

Question

我正在尝试为 Azure 存储文件中的目录生成共享访问签名 (SAS)。下面是我用来创建 SAS 的代码：

ShareSasBuilder sasBuilder = new ShareSasBuilder
{
    Resource = "s",
    StartsOn = DateTimeOffset.UtcNow,
    ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(5),
};
sasBuilder.SetPermissions(ShareFileSasPermissions.Read);

string containerProjectsName = "projects";

string directoryPath = "folder 0/folder 1";

var storageConnectionString = "DefaultEndpointsProtocol=https;AccountName=XXXXXX;AccountKey=XXXXX;EndpointSuffix=core.windows.net";

ShareFileClient shareFileClient = new ShareFileClient(storageConnectionString, containerProjectsName, directoryPath);

var uri = shareFileClient.GenerateSasUri(sasBuilder);

return Results.Ok(uri);

当我使用生成的链接时，例如：

https://storagepocv2.file.core.windows.net/projects/folder%200/folder%201?sv=2025-01-05&st=2024-12-19T10%3A25%3A06Z&se=2024-12-19T10%3A30%3A06Z&sr=f&sp=r&sig=xxxxxx

并在浏览器或Postman中尝试，我收到以下错误：

<Error>
  <Code>ResourceNotFound</Code>
  <Message>
    The specified resource does not exist.
    RequestId:955d2d79-901a-0047-1400-52b616000000
    Time:2024-12-19T10:25:13.4746276Z
  </Message>
</Error>

根据我的研究，ShareFileClient 似乎适用于单个文件而不是目录。但是，我需要一个 SAS 来授予对整个目录（包括所有文件和子目录）的访问权限。

非常感谢任何提示或想法！

我尝试过的：

• 使用 Azure 存储资源管理器检查目录和文件是否存在。
• 尝试为单个文件创建 SAS，效果很好。
• 尝试将资源从“s”更改为“f”，但没有成功。

问题：

• 有没有办法为 Azure 存储文件中的整个目录生成 SAS？
• 如果没有，允许使用 SAS 访问目录中所有文件的最佳方法是什么？

Answer 1

Azure 存储文件：为目录生成 SAS 时出现问题

截至目前，无法生成专门限制对目录的访问的 SAS 令牌。只能创建 SAS 令牌来授予对整个文件共享或单个文件的访问权限，但不能授予对共享中的目录的访问权限。

但是，我需要一个 SAS 来授予对整个目录的访问权限 （包括所有文件和子目录）。

您可以使用以下代码，使用 Azure .NET SDK 为特定目录和子目录以及所有文件创建 SAS URL。

代码：

using Azure.Storage.Files.Shares;
using Azure.Storage.Files.Shares.Models;
using Azure.Storage.Sas;

namespace AzureFilesDirectorySas
{
    class Program
    {
        static async Task Main(string[] args)
        {
            // Azure Storage connection details
            string storageConnectionString = "your connection string";
            string shareName = "share1";       // Replace with your file share name
            string directoryPath = "sample/demo";   // Replace with your directory path

            // Generate SAS for files in the directory
            List<Uri> sasUris = await GenerateSasForDirectoryAsync(storageConnectionString, shareName, directoryPath);

            // Output SAS URIs
            Console.WriteLine("SAS URIs for files in the directory:");
            foreach (var uri in sasUris)
            {
                Console.WriteLine(uri);
            }
        }

        private static async Task<List<Uri>> GenerateSasForDirectoryAsync(string connectionString, string shareName, string directoryPath)
        {
            ShareDirectoryClient directoryClient = new ShareDirectoryClient(connectionString, shareName, directoryPath);

            // List to store SAS URIs
            List<Uri> sasUris = new List<Uri>();

            if (!await directoryClient.ExistsAsync())
            {
                Console.WriteLine($"Directory '{directoryPath}' does not exist.");
                return sasUris;
            }

            // Recursive helper function to list files and generate SAS URIs
            async Task ListFilesRecursivelyAsync(ShareDirectoryClient dirClient)
            {
                await foreach (ShareFileItem item in dirClient.GetFilesAndDirectoriesAsync())
                {
                    if (item.IsDirectory)
                    {
                        // Recursively handle subdirectories
                        ShareDirectoryClient subDirClient = dirClient.GetSubdirectoryClient(item.Name);
                        await ListFilesRecursivelyAsync(subDirClient);
                    }
                    else
                    {
                        ShareFileClient fileClient = dirClient.GetFileClient(item.Name);

                        var sasBuilder = new ShareSasBuilder
                        {
                            Resource = "f", // File resource
                            StartsOn = DateTimeOffset.UtcNow,
                            ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), // Set SAS expiration
                        };
                        sasBuilder.SetPermissions(ShareFileSasPermissions.Read); // Set desired permissions

                        // Generate the SAS URI
                        Uri fileSasUri = fileClient.GenerateSasUri(sasBuilder);
                        sasUris.Add(fileSasUri);
                    }
                }
            }

            // Start the recursive listing from the root directory
            await ListFilesRecursivelyAsync(directoryClient);

            return sasUris;
        }
    }
}

输出：

SAS URIs for files in the directory:
https://venkat326123.file.core.windows.net/share1/sample/demo/test/13-xxx.html?sv=2025-01-05&st=2024-12-19T11%3A31%3A24Z&se=2024-12-19T12%3A31%3A24Z&sr=f&sp=r&sig=redacted
https://venkat326123.file.core.windows.net/share1/sample/demo/test/2024-12-09 08_26_37-SuccessFxxxx.png?sv=2025-01-05&st=2024-12-19T11%3A31%3A24Z&se=2024-12-19T12%3A31%3A24Z&sr=f&sp=r&sig=redacted
https://venkat326123.file.core.windows.net/share1/sample/demo/test/sxx.pdf?sv=2025-01-05&st=2024-12-19T11%3A31%3A24Z&se=2024-12-19T12%3A31%3A24Z&sr=f&sp=r&sig=redacted
https://venkat326123.file.core.windows.net/share1/sample/demo/25-11-2xx.html?sv=2025-01-05&st=2024-12-19T11%3A31%3A24Z&se=2024-12-19T12%3A31%3A24Z&sr=f&sp=r&sig=redacted
https://venkat326123.file.core.windows.net/share1/sample/demo/25-xxx.html?sv=2025-01-05&st=2024-12-19T11%3A31%3A24Z&se=2024-12-19T12%3A31%3A24Z&sr=f&sp=r&sig=redacted
https://venkat326123.file.core.windows.net/share1/sample/demo/team.xlsx?sv=2025-01-05&st=2024-12-19T11%3A31%3A24Z&se=2024-12-19T12%3A31%3A24Z&sr=f&sp=r&sig=redacted

参考：

ShareSasBuilder 类 (Azure.Storage.Sas) - 适用于 .NET 开发人员的 Azure |微软学习