From 057806d7f116506a0f184604591e9427047bead7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?d=20=F0=9F=94=B9?= Date: Thu, 7 May 2026 20:48:32 +0800 Subject: [PATCH] fix: prepend bucket prefix to Azure SPN and SAS storage paths (#14185) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Fixes #14159 — files from different datasets can overwrite each other in Azure Blob storage. ## Problem Both `azure_spn_conn.py` and `azure_sas_conn.py` ignore the `bucket` parameter in all storage operations (`put`, `get`, `rm`, `obj_exist`, `get_presigned_url`). Files are stored flat using only the filename, so two datasets containing a file with the same name will overwrite each other. The MinIO and S3 implementations correctly use the bucket (typically the knowledge base ID) as a path prefix to create logical folder isolation: - MinIO: uses `use_prefix_path` decorator → `{orig_bucket}/{fnm}` - S3: uses `use_prefix_path` decorator → `{prefix_path}/{bucket}/{fnm}` ## Fix Prepend `{bucket}/` to the file path in all 5 operations across both Azure connector files: | File | Methods fixed | |------|---------------| | `azure_spn_conn.py` | `put`, `get`, `rm`, `obj_exist`, `get_presigned_url` | | `azure_sas_conn.py` | `put`, `get`, `rm`, `obj_exist`, `get_presigned_url` | This matches the existing convention where `bucket` is the knowledge base ID used as a directory prefix. ## ⚠️ Migration Note Existing Azure SPN/SAS deployments have files stored without the bucket prefix. After this fix, new files will be stored under `{bucket}/{filename}` while existing files remain at `{filename}`. A one-time migration script or manual file move may be needed for existing deployments. New deployments are unaffected. ## Testing - Verified the fix is consistent across all 5 methods in both files - The `health()` method is intentionally left unchanged as it uses a hardcoded test filename without bucket semantics Co-authored-by: Jin Hai --- rag/utils/azure_sas_conn.py | 15 +++++++++------ rag/utils/azure_spn_conn.py | 13 ++++++++----- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/rag/utils/azure_sas_conn.py b/rag/utils/azure_sas_conn.py index 1a9e5e7fd1..96442a2f07 100644 --- a/rag/utils/azure_sas_conn.py +++ b/rag/utils/azure_sas_conn.py @@ -52,11 +52,12 @@ class RAGFlowAzureSasBlob: return self.conn.upload_blob(name=fnm, data=BytesIO(binary), length=len(binary)) def put(self, bucket, fnm, binary, tenant_id=None): + blob_name = f"{bucket}/{fnm}" for _ in range(3): try: - return self.conn.upload_blob(name=f"{bucket}/{fnm}", data=BytesIO(binary), length=len(binary)) + return self.conn.upload_blob(name=blob_name, data=BytesIO(binary), length=len(binary)) except Exception: - logging.exception(f"Fail put {bucket}/{fnm}") + logging.exception(f"Fail put {blob_name}") self.__open__() time.sleep(1) @@ -67,12 +68,13 @@ class RAGFlowAzureSasBlob: logging.exception(f"Fail rm {bucket}/{fnm}") def get(self, bucket, fnm): + blob_name = f"{bucket}/{fnm}" for _ in range(1): try: - r = self.conn.download_blob(f"{bucket}/{fnm}") + r = self.conn.download_blob(blob_name) return r.read() except Exception: - logging.exception(f"fail get {bucket}/{fnm}") + logging.exception(f"fail get {blob_name}") self.__open__() time.sleep(1) return @@ -85,11 +87,12 @@ class RAGFlowAzureSasBlob: return False def get_presigned_url(self, bucket, fnm, expires): + blob_name = f"{bucket}/{fnm}" for _ in range(10): try: - return self.conn.get_presigned_url("GET", bucket, fnm, expires) + return self.conn.get_presigned_url("GET", bucket, blob_name, expires) except Exception: - logging.exception(f"fail get {bucket}/{fnm}") + logging.exception(f"fail get {blob_name}") self.__open__() time.sleep(1) return diff --git a/rag/utils/azure_spn_conn.py b/rag/utils/azure_spn_conn.py index 691e4027ca..e19c2e1fe1 100644 --- a/rag/utils/azure_spn_conn.py +++ b/rag/utils/azure_spn_conn.py @@ -69,13 +69,14 @@ class RAGFlowAzureSpnBlob: return f.flush_data(len(binary)) def put(self, bucket, fnm, binary, tenant_id=None): + blob = f"{bucket}/{fnm}" for _ in range(3): try: - f = self.conn.create_file(f"{bucket}/{fnm}") + f = self.conn.create_file(f"{blob}") f.append_data(binary, offset=0, length=len(binary)) return f.flush_data(len(binary)) except Exception: - logging.exception(f"Fail put {bucket}/{fnm}") + logging.exception(f"Fail put {blob}") self.__open__() time.sleep(1) return None @@ -88,13 +89,14 @@ class RAGFlowAzureSpnBlob: logging.exception(f"Fail rm {bucket}/{fnm}") def get(self, bucket, fnm): + blob = f"{bucket}/{fnm}" for _ in range(1): try: - client = self.conn.get_file_client(f"{bucket}/{fnm}") + client = self.conn.get_file_client(f"{blob}") r = client.download_file() return r.read() except Exception: - logging.exception(f"fail get {bucket}/{fnm}") + logging.exception(f"fail get {blob}") self.__open__() time.sleep(1) return None @@ -108,9 +110,10 @@ class RAGFlowAzureSpnBlob: return False def get_presigned_url(self, bucket, fnm, expires): + f_path = f"{bucket}/{fnm}" for _ in range(10): try: - return self.conn.get_presigned_url("GET", bucket, fnm, expires) + return self.conn.get_presigned_url("GET", bucket, f_path, expires) except Exception: logging.exception(f"fail get {bucket}/{fnm}") self.__open__()