fix(storage): preserve signed upload headers and isolate credentials (#13)

* fix(sdk): preserve signed uploads and add stdin helpers

* refactor(tests): isolate storage changes and consolidate upload coverage

Author: sid-rl

README-SDK.md

@@ -585,6 +585,17 @@ snapshot.delete()
 
 ### StorageObject
 
+Uploads retain the create response's signed URL **and** required headers (including
+Azure's `x-ms-blob-type`). All upload helpers use those instructions before marking
+the object complete. Treat both as credentials; retrieval does not refresh them.
+
+Signed uploads reuse the configured HTTP transport but exclude client-level default
+headers, cookies, and authentication. Custom HTTP transports and event hooks must
+not add API credentials to storage requests. Redirects and SDK-level upload retries
+are disabled. Upload exception messages omit signed credentials and storage response
+bodies; HTTPX request/response objects and third-party debug logging can still contain
+sensitive data and must not be logged indiscriminately.
+
 Object-oriented interface for working with storage objects. Created via `runloop.storage_object.create()` or `runloop.storage_object.from_id()`:
 
 ```python

src/runloop_api_client/sdk/async_.py

@@ -338,7 +338,7 @@ async def create(
         :rtype: AsyncStorageObject
         """
         obj = await self._client.objects.create(**params)
-        return AsyncStorageObject(self._client, obj.id, upload_url=obj.upload_url)
+        return AsyncStorageObject(self._client, obj.id, upload_url=obj.upload_url, upload_headers=obj.upload_headers)
 
     def from_id(self, object_id: str) -> AsyncStorageObject:
         """Return a storage object wrapper by identifier.

src/runloop_api_client/sdk/async_storage_object.py

@@ -2,9 +2,11 @@
 
 from __future__ import annotations
 
-from typing import Iterable
+from typing import Mapping, Iterable
 from typing_extensions import Unpack, override
 
+import httpx
+
 from ._types import BaseRequestOptions, LongRequestOptions, SDKObjectDownloadParams
 from .._client import AsyncRunloop
 from ..types.object_view import ObjectView
@@ -15,7 +17,13 @@
 class AsyncStorageObject:
     """Async wrapper around storage object operations, including uploads and downloads."""
 
-    def __init__(self, client: AsyncRunloop, object_id: str, upload_url: str | None) -> None:
+    def __init__(
+        self,
+        client: AsyncRunloop,
+        object_id: str,
+        upload_url: str | None,
+        upload_headers: Mapping[str, str] | None = None,
+    ) -> None:
         """Initialize the wrapper.
 
         :param client: Generated AsyncRunloop client
@@ -24,10 +32,12 @@ def __init__(self, client: AsyncRunloop, object_id: str, upload_url: str | None)
         :type object_id: str
         :param upload_url: Optional pre-signed upload URL if the object is still open, defaults to None
         :type upload_url: str | None, optional
+        :param upload_headers: Required signed-upload headers returned with the URL; copied on construction
         """
         self._client = client
         self._id = object_id
         self._upload_url = upload_url
+        self._upload_headers = dict(upload_headers or {})
 
     @override
     def __repr__(self) -> str:
@@ -81,6 +91,7 @@ async def complete(
             **options,
         )
         self._upload_url = None
+        self._upload_headers = {}
         return result
 
     async def get_download_url(
@@ -151,16 +162,30 @@ async def delete(
     async def upload_content(self, content: str | bytes | Iterable[bytes]) -> None:
         """Upload content to the object's pre-signed URL.
 
+        The URL and required headers are sensitive upload credentials. Requests use
+        the configured HTTP transport, but not its default headers, cookies, or auth.
+        Custom transport implementations and event hooks must preserve this isolation.
+        Uploads are not retried and redirects are not followed.
+
         :param content: Bytes payload, text payload, or an iterable streaming bytes
         :type content: str | bytes | Iterable[bytes]
         :return: None
         :rtype: None
         :raises RuntimeError: If no upload URL is available
-        :raises httpx.HTTPStatusError: Propagated from the underlying ``httpx`` client when the upload fails
+        :raises httpx.HTTPStatusError: If storage rejects the upload (message excludes signed credentials)
+        :raises httpx.RequestError: If the upload cannot be sent
         """
         url = self._ensure_upload_url()
-        response = await self._client._client.put(url, content=content)
-        response.raise_for_status()
+        # Construct directly so HTTPX does not merge API-client defaults into storage requests.
+        request = httpx.Request("PUT", url, content=content, headers=self._upload_headers)
+        try:
+            response = await self._client._client.send(request, auth=None, follow_redirects=False)
+        except httpx.RequestError:
+            raise httpx.RequestError("Storage upload failed during transport", request=request) from None
+        if not response.is_success:
+            raise httpx.HTTPStatusError(
+                f"Storage upload failed (HTTP {response.status_code})", request=request, response=response
+            )
 
     def as_build_context(self) -> BuildContext:
         """Return this object in the shape expected for a Blueprint build context.

src/runloop_api_client/sdk/storage_object.py

@@ -2,9 +2,11 @@
 
 from __future__ import annotations
 
-from typing import Iterable
+from typing import Mapping, Iterable
 from typing_extensions import Unpack, override
 
+import httpx
+
 from ._types import BaseRequestOptions, LongRequestOptions, SDKObjectDownloadParams
 from .._client import Runloop
 from ..types.object_view import ObjectView
@@ -15,7 +17,13 @@
 class StorageObject:
     """Wrapper around storage object operations, including uploads and downloads."""
 
-    def __init__(self, client: Runloop, object_id: str, upload_url: str | None) -> None:
+    def __init__(
+        self,
+        client: Runloop,
+        object_id: str,
+        upload_url: str | None,
+        upload_headers: Mapping[str, str] | None = None,
+    ) -> None:
         """Initialize the wrapper.
 
         :param client: Generated Runloop client
@@ -24,10 +32,12 @@ def __init__(self, client: Runloop, object_id: str, upload_url: str | None) -> N
         :type object_id: str
         :param upload_url: Pre-signed upload URL, if the object is in draft state, defaults to None
         :type upload_url: str | None, optional
+        :param upload_headers: Required signed-upload headers returned with the URL; copied on construction
         """
         self._client = client
         self._id = object_id
         self._upload_url = upload_url
+        self._upload_headers = dict(upload_headers or {})
 
     @override
     def __repr__(self) -> str:
@@ -81,6 +91,7 @@ def complete(
             **options,
         )
         self._upload_url = None
+        self._upload_headers = {}
         return result
 
     def get_download_url(
@@ -151,16 +162,30 @@ def delete(
     def upload_content(self, content: str | bytes | Iterable[bytes]) -> None:
         """Upload content to the object's pre-signed URL.
 
+        The URL and required headers are sensitive upload credentials. Requests use
+        the configured HTTP transport, but not its default headers, cookies, or auth.
+        Custom transport implementations and event hooks must preserve this isolation.
+        Uploads are not retried and redirects are not followed.
+
         :param content: Bytes payload, text payload, or an iterable streaming bytes
         :type content: str | bytes | Iterable[bytes]
         :return: None
         :rtype: None
         :raises RuntimeError: If no upload URL is available
-        :raises httpx.HTTPStatusError: Propagated from the underlying ``httpx`` client when the upload fails
+        :raises httpx.HTTPStatusError: If storage rejects the upload (message excludes signed credentials)
+        :raises httpx.RequestError: If the upload cannot be sent
         """
         url = self._ensure_upload_url()
-        response = self._client._client.put(url, content=content)
-        response.raise_for_status()
+        # Construct directly so HTTPX does not merge API-client defaults into storage requests.
+        request = httpx.Request("PUT", url, content=content, headers=self._upload_headers)
+        try:
+            response = self._client._client.send(request, auth=None, follow_redirects=False)
+        except httpx.RequestError:
+            raise httpx.RequestError("Storage upload failed during transport", request=request) from None
+        if not response.is_success:
+            raise httpx.HTTPStatusError(
+                f"Storage upload failed (HTTP {response.status_code})", request=request, response=response
+            )
 
     def as_build_context(self) -> BuildContext:
         """Return this object in the shape expected for a Blueprint build context.

src/runloop_api_client/sdk/sync.py

@@ -336,7 +336,7 @@ def create(
         :rtype: StorageObject
         """
         obj = self._client.objects.create(**params)
-        return StorageObject(self._client, obj.id, upload_url=obj.upload_url)
+        return StorageObject(self._client, obj.id, upload_url=obj.upload_url, upload_headers=obj.upload_headers)
 
     def from_id(self, object_id: str) -> StorageObject:
         """Return a storage object wrapper by identifier.

tests/sdk/conftest.py

@@ -88,6 +88,7 @@ class MockObjectView:
 
     id: str = TEST_IDS["object"]
     upload_url: str = "https://upload.example.com/obj_123"
+    upload_headers: dict[str, str] | None = None
     name: str = "test-object"
 
 

tests/sdk/devbox/test_edge_cases.py

@@ -138,11 +138,11 @@ def test_path_handling(self, mock_client: Mock, tmp_path: Path) -> None:
 
         http_client = Mock()
         mock_response = create_mock_httpx_response()
-        http_client.put.return_value = mock_response
+        http_client.send.return_value = mock_response
         mock_client._client = http_client
 
         obj = StorageObject(mock_client, "obj_123", "https://upload.example.com")
         obj.upload_content(temp_file.read_text())
         obj.upload_content(temp_file.read_bytes())
 
-        assert http_client.put.call_count == 2
+        assert http_client.send.call_count == 2

tests/sdk/test_async_ops.py

@@ -402,7 +402,7 @@ async def test_upload_from_file(
 
         http_client = AsyncMock()
         mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
+        http_client.send = AsyncMock(return_value=mock_response)
         mock_async_client._client = http_client
 
         ops = AsyncStorageObjectOps(mock_async_client)
@@ -416,57 +416,8 @@ async def test_upload_from_file(
             metadata=None,
             ttl_ms=None,
         )
-        http_client.put.assert_awaited_once_with(object_view.upload_url, content=b"test content")
-        mock_async_client.objects.complete.assert_awaited_once()
-
-    @pytest.mark.asyncio
-    async def test_upload_from_text(self, mock_async_client: AsyncMock, object_view: MockObjectView) -> None:
-        """Test upload_from_text method."""
-        mock_async_client.objects.create = AsyncMock(return_value=object_view)
-        mock_async_client.objects.complete = AsyncMock(return_value=object_view)
-
-        http_client = AsyncMock()
-        mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
-        mock_async_client._client = http_client
-
-        ops = AsyncStorageObjectOps(mock_async_client)
-        obj = await ops.upload_from_text("test content", name="test.txt", metadata={"key": "value"})
-
-        assert isinstance(obj, AsyncStorageObject)
-        assert obj.id == "obj_123"
-        mock_async_client.objects.create.assert_awaited_once_with(
-            name="test.txt",
-            content_type="text",
-            metadata={"key": "value"},
-            ttl_ms=None,
-        )
-        http_client.put.assert_awaited_once_with(object_view.upload_url, content="test content")
-        mock_async_client.objects.complete.assert_awaited_once()
-
-    @pytest.mark.asyncio
-    async def test_upload_from_bytes(self, mock_async_client: AsyncMock, object_view: MockObjectView) -> None:
-        """Test upload_from_bytes method."""
-        mock_async_client.objects.create = AsyncMock(return_value=object_view)
-        mock_async_client.objects.complete = AsyncMock(return_value=object_view)
-
-        http_client = AsyncMock()
-        mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
-        mock_async_client._client = http_client
-
-        ops = AsyncStorageObjectOps(mock_async_client)
-        obj = await ops.upload_from_bytes(b"test content", name="test.bin", content_type="binary")
-
-        assert isinstance(obj, AsyncStorageObject)
-        assert obj.id == "obj_123"
-        mock_async_client.objects.create.assert_awaited_once_with(
-            name="test.bin",
-            content_type="binary",
-            metadata=None,
-            ttl_ms=None,
-        )
-        http_client.put.assert_awaited_once_with(object_view.upload_url, content=b"test content")
+        assert http_client.send.call_count == 1
+        assert http_client.send.call_args[0][0].read() == b"test content"
         mock_async_client.objects.complete.assert_awaited_once()
 
     @pytest.mark.asyncio
@@ -506,7 +457,7 @@ async def test_upload_from_dir(
 
         http_client = AsyncMock()
         mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
+        http_client.send = AsyncMock(return_value=mock_response)
         mock_async_client._client = http_client
 
         ops = AsyncStorageObjectOps(mock_async_client)
@@ -520,13 +471,13 @@ async def test_upload_from_dir(
             metadata={"key": "value"},
             ttl_ms=None,
         )
-        # Verify that put was called with tarball content
-        http_client.put.assert_awaited_once()
-        call_args = http_client.put.call_args
-        assert call_args[0][0] == object_view.upload_url
+        # Verify that a request was sent with tarball content
+        http_client.send.assert_awaited_once()
+        call_args = http_client.send.call_args
+        assert str(call_args[0][0].url) == object_view.upload_url
 
         # Verify it's a valid gzipped tarball
-        uploaded_content = call_args[1]["content"]
+        uploaded_content = call_args[0][0].read()
         with tarfile.open(fileobj=io.BytesIO(uploaded_content), mode="r:gz") as tar:
             members = tar.getmembers()
             member_names = [m.name for m in members]
@@ -555,7 +506,7 @@ async def test_upload_from_dir_with_inline_ignore_patterns(
 
         http_client = AsyncMock()
         mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
+        http_client.send = AsyncMock(return_value=mock_response)
         mock_async_client._client = http_client
 
         client = AsyncStorageObjectOps(mock_async_client)
@@ -569,7 +520,7 @@ def ignore_logs_and_build(ti: tarfile.TarInfo) -> tarfile.TarInfo | None:
         obj = await client.upload_from_dir(test_dir, ignore=ignore_logs_and_build)
 
         assert isinstance(obj, AsyncStorageObject)
-        uploaded_content = http_client.put.call_args[1]["content"]
+        uploaded_content = http_client.send.call_args[0][0].read()
 
         with tarfile.open(fileobj=io.BytesIO(uploaded_content), mode="r:gz") as tar:
             names = {m.name for m in tar.getmembers()}
@@ -592,7 +543,7 @@ async def test_upload_from_dir_default_name(
 
         http_client = AsyncMock()
         mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
+        http_client.send = AsyncMock(return_value=mock_response)
         mock_async_client._client = http_client
 
         ops = AsyncStorageObjectOps(mock_async_client)
@@ -623,7 +574,7 @@ async def test_upload_from_dir_with_ttl(
 
         http_client = AsyncMock()
         mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
+        http_client.send = AsyncMock(return_value=mock_response)
         mock_async_client._client = http_client
 
         ops = AsyncStorageObjectOps(mock_async_client)
@@ -650,7 +601,7 @@ async def test_upload_from_dir_empty_directory(
 
         http_client = AsyncMock()
         mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
+        http_client.send = AsyncMock(return_value=mock_response)
         mock_async_client._client = http_client
 
         ops = AsyncStorageObjectOps(mock_async_client)
@@ -664,7 +615,7 @@ async def test_upload_from_dir_empty_directory(
             metadata=None,
             ttl_ms=None,
         )
-        http_client.put.assert_awaited_once()
+        http_client.send.assert_awaited_once()
         mock_async_client.objects.complete.assert_awaited_once()
 
     @pytest.mark.asyncio
@@ -681,7 +632,7 @@ async def test_upload_from_dir_with_string_path(
 
         http_client = AsyncMock()
         mock_response = create_mock_httpx_response()
-        http_client.put = AsyncMock(return_value=mock_response)
+        http_client.send = AsyncMock(return_value=mock_response)
         mock_async_client._client = http_client
 
         ops = AsyncStorageObjectOps(mock_async_client)
@@ -696,7 +647,7 @@ async def test_upload_from_dir_with_string_path(
             metadata=None,
             ttl_ms=None,
         )
-        http_client.put.assert_awaited_once()
+        http_client.send.assert_awaited_once()
         mock_async_client.objects.complete.assert_awaited_once()