fix: added token credential to azure-storage if rbac is used

[tago-SE]

What?

Made the connectionString configuration in storage-azure optional and added an option to use TokenCredential for connecting to StorageClient.

Why?

This enables organizations to move away from connectionString and use RBAC for resource access, as recommended by Azure.

How?

Added credential as an optional configuration and checked for it in the getStorageClient function.

import type { ContainerClient } from '@azure/storage-blob'

import { BlobServiceClient } from '@azure/storage-blob'

import type { AzureStorageOptions } from '../index.js'

let storageClient: ContainerClient | null = null

export function getStorageClient(
  options: Pick<
    AzureStorageOptions,
    'baseURL' | 'connectionString' | 'containerName' | 'credential'
  >,
): ContainerClient {
  if (storageClient) {
    return storageClient
  }
  //
  // Change which firsts checks if the connectionString is present and if not checks if credential is provided otherwise throws.
  const { baseURL, connectionString, containerName, credential } = options
  let blobServiceClient: BlobServiceClient | undefined = undefined
  if (typeof connectionString === 'string') {
    blobServiceClient = BlobServiceClient.fromConnectionString(connectionString)
  } else if (typeof credential === 'object') {
    blobServiceClient = new BlobServiceClient(baseURL, credential, {})
  }
  if (!blobServiceClient) {
    throw new Error('connectionString or credential must be provided')
  }
  //
  storageClient = blobServiceClient.getContainerClient(containerName)
  return storageClient
}

Configuration change example

export default buildConfig({
  collections: [Media, MediaWithPrefix],
  plugins: [
    azureStorage({
      collections: {
        media: true,
        'media-with-prefix': {
          prefix,
        },
      },
      allowContainerCreate: process.env.AZURE_STORAGE_ALLOW_CONTAINER_CREATE === 'true',
      baseURL: process.env.AZURE_STORAGE_ACCOUNT_BASEURL,
    //   connectionString: process.env.AZURE_STORAGE_CONNECTION_STRING,
    credential: new ChainedTokenCredential(
      ...[
        new VisualStudioCodeCredential(),
        new VisualStudioCodeCredential(),
        new DefaultAzureCredential(),
      ], // Or any TokenCredential
containerName: process.env.AZURE_STORAGE_CONTAINER_NAME,
    }),
  ],
})