Implement Put Blob From URL

ChangeLog.md

@@ -61,6 +61,7 @@ Blob:
 - Fixed issue #2672 startup failures with legacy persisted data by adding backward-compatible restore for persisted `contentMD5` formats.
 - Added CRC-64/NVME transactional checksum support for `StageBlock`, `PutBlock`, `PutBlob`, `AppendBlock`, and `PutPage` (`x-ms-content-crc64`).
 - Harden transactional checksum validation for `PutBlob`, `StageBlock`, `AppendBlock`, and `PutPage`: unified MD5/CRC64 validation logic with accurate `InvalidMd5`/`InvalidHeaderValue` (malformed) and `Md5Mismatch`/`Crc64Mismatch` (mismatch) errors, matching real Azure semantics verified against live.
+- Implement `PutBlobFromUrl` (`Put Blob From URL`), which previously returned 501. The source is fetched over loopback, as `PutBlockFromURL` already does, so that SAS authentication and the `x-ms-source-if-*` conditions are enforced by the existing download path. Standard blob properties are copied from the source unless `x-ms-copy-source-blob-properties` is false, request blob content headers override them either way, request metadata replaces the source's rather than adding to it, and `x-ms-copy-source-tag-option: COPY` reads the source's tags over that same authorized path. As with `CopyBlobFromURL`, only sources on the same Azurite instance are supported.
 - Implement `PutBlockFromURL` (`Put Block From URL`), which previously returned 501. The source is fetched over loopback so that SAS authentication, `x-ms-source-range`, and the `x-ms-source-if-*` conditions are enforced by the existing download path; unmet source conditions return 412 `SourceConditionNotMet`. As with `CopyBlobFromURL`, only sources on the same Azurite instance are supported.
 - Fix `x-ms-blob-content-md5` precedence over `Content-MD5` for `PutBlob` transit integrity verification, matching real Azure behavior.
 - Make `CopyBlobFromURL` echo back the source `Content-MD5` when supplied via `x-ms-source-content-md5`, matching real Azure behavior.

README.md

@@ -1077,6 +1077,7 @@ Detailed support matrix:
   - Abort Copy Blob (Only supports copy within same Azurite instance)
   - Copy Blob From URL (Only supports copy within same Azurite instance, only on Loki)
   - Put Block From URL (Only supports source within same Azurite instance)
+  - Put Blob From URL (Only supports source within same Azurite instance)
   - Access control based on conditional headers
 - Following features or REST APIs are NOT supported or limited supported in this release (will support more features per customers feedback in future releases)
   - SharedKey Lite
@@ -1090,7 +1091,6 @@ Detailed support matrix:
   - Concurrent Append
   - Blob Expiry
   - Object Replication Service
-  - Put Blob From URL
   - Version Level Worm
   - Sync copy blob by access source with oauth
   - Encryption Scope

src/blob/authentication/AccountSASAuthenticator.ts

@@ -256,6 +256,7 @@ export default class AccountSASAuthenticator implements IAuthenticator {
     // If copy destination blob exists, then permission must be Write only
     if (
       operation === Operation.BlockBlob_Upload ||
+      operation === Operation.BlockBlob_PutBlobFromUrl ||
       operation === Operation.PageBlob_Create ||
       operation === Operation.AppendBlob_Create ||
       operation === Operation.Blob_StartCopyFromURL ||

src/blob/authentication/BlobSASAuthenticator.ts

@@ -418,6 +418,7 @@ export default class BlobSASAuthenticator implements IAuthenticator {
     // If copy destination blob exists, then permission must be Write only
     if (
       operation === Operation.BlockBlob_Upload ||
+      operation === Operation.BlockBlob_PutBlobFromUrl ||
       operation === Operation.PageBlob_Create ||
       operation === Operation.AppendBlob_Create ||
       operation === Operation.Blob_StartCopyFromURL ||

src/blob/authentication/OperationAccountSASPermission.ts

@@ -363,6 +363,16 @@ OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
   )
 );
 
+OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
+  Operation.BlockBlob_PutBlobFromUrl,
+  new OperationAccountSASPermission(
+    AccountSASService.Blob,
+    AccountSASResourceType.Object,
+    // Create permission is only available for nonexistent block blob. Handle this scenario separately
+    AccountSASPermission.Write + AccountSASPermission.Create
+  )
+);
+
 OPERATION_ACCOUNT_SAS_PERMISSIONS.set(
   Operation.PageBlob_Create,
   new OperationAccountSASPermission(

src/blob/authentication/OperationBlobSASPermission.ts

@@ -258,6 +258,13 @@ OPERATION_BLOB_SAS_BLOB_PERMISSIONS.set(
     BlobSASPermission.Write + BlobSASPermission.Create
   )
 );
+OPERATION_BLOB_SAS_BLOB_PERMISSIONS.set(
+  Operation.BlockBlob_PutBlobFromUrl,
+  // TODO: When destination blob doesn't exist, needs create permission
+  new OperationBlobSASPermission(
+    BlobSASPermission.Write + BlobSASPermission.Create
+  )
+);
 OPERATION_BLOB_SAS_BLOB_PERMISSIONS.set(
   Operation.BlockBlob_StageBlock,
   new OperationBlobSASPermission(BlobSASPermission.Write)
@@ -522,6 +529,13 @@ OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
     BlobSASPermission.Write + BlobSASPermission.Create
   )
 );
+OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
+  Operation.BlockBlob_PutBlobFromUrl,
+  // Create a new blob, must be write
+  new OperationBlobSASPermission(
+    BlobSASPermission.Write + BlobSASPermission.Create
+  )
+);
 OPERATION_BLOB_SAS_CONTAINER_PERMISSIONS.set(
   Operation.BlockBlob_StageBlock,
   new OperationBlobSASPermission(BlobSASPermission.Write)