From d1375a04eaba27cf5274ecc1b9bd06aba3139395 Mon Sep 17 00:00:00 2001
From: Yuang Gao <yuang@apache.org>
Date: Wed, 28 Oct 2026 20:11:28 -0700
Subject: [PATCH 1/2] fix(services/azblob): authorize copy source with the
 configured SAS token

---
 core/services/azblob/src/backend.rs | 1 +
 core/services/azblob/src/core.rs    | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/core/services/azblob/src/backend.rs b/core/services/azblob/src/backend.rs
index 5208c4350521..b6c8054d1216 100644
--- a/core/services/azblob/src/backend.rs
+++ b/core/services/azblob/src/backend.rs
@@ -468,6 +468,7 @@ impl Builder for AzblobBuilder {
                 encryption_algorithm,
                 container: self.config.container.clone(),
                 skip_signature: self.config.skip_signature,
+                sas_token: self.config.sas_token.clone(),
                 signer,
             }),
         })
diff --git a/core/services/azblob/src/core.rs b/core/services/azblob/src/core.rs
index c0a5b1453638..f0104e42d906 100644
--- a/core/services/azblob/src/core.rs
+++ b/core/services/azblob/src/core.rs
@@ -82,6 +82,7 @@ pub struct AzblobCore {
     pub encryption_key_sha256: Option<HeaderValue>,
     pub encryption_algorithm: Option<HeaderValue>,
     pub skip_signature: bool,
+    pub sas_token: Option<String>,
     pub signer: Signer<Credential>,
 }
 
@@ -790,6 +791,10 @@ impl AzblobCore {
                 .push("versionid", &percent_encode_path(version))
                 .finish();
         }
+        if let Some(sas_token) = &self.sas_token {
+            let sep = if source.contains('?') { '&' } else { '?' };
+            source = format!("{source}{sep}{sas_token}");
+        }
         let target = self.build_path_url(to);
 
         let mut req = Request::put(&target)
@@ -955,6 +960,7 @@ mod tests {
             encryption_key_sha256: None,
             encryption_algorithm: None,
             skip_signature: true,
+            sas_token: None,
             signer: Signer::new(
                 Context::new(),
                 StaticCredentialProvider::new_shared_key("acc", "a2V5"),

From 815c3f7ceecf4aa4cd69a4289f75774fb337a31b Mon Sep 17 00:00:00 2001
From: Yuang Gao <yuang@apache.org>
Date: Wed, 28 Oct 2026 20:23:37 -0700
Subject: [PATCH 2/2] fix(services/ghac): initialize sas_token in AzblobCore

---
 core/services/ghac/src/writer.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/services/ghac/src/writer.rs b/core/services/ghac/src/writer.rs
index c56e820943cd..e64d61561784 100644
--- a/core/services/ghac/src/writer.rs
+++ b/core/services/ghac/src/writer.rs
@@ -122,6 +122,7 @@ impl GhacWriter {
                     encryption_key_sha256: None,
                     encryption_algorithm: None,
                     skip_signature: false,
+                    sas_token: None,
                     signer,
                 });
                 let w = AzblobWriter::new(