Fix blob SAS when using version 2026-04-06

[Socolin]

This should fix #2649

The SDK is generating signature with new parameters

https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/storage/Azure.Storage.Common/src/Sas/SasQueryParameters.cs#L103-L107

https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/storage/Azure.Storage.Blobs/src/Sas/BlobSasBuilder.cs#L573-L574

# SDK
        // r\n2026-06-15T17:46:26Z\n2026-06-22T17:46:26Z\n/blob/dev/some-container-name/abc.png\n7c751eb2-acf8-4ce2-b92c-8724f0644194\nff51635d-1eb2-4fe3-8828-0c3de5b45b35\n2026-06-15T17:46:26Z\n2026-06-15T18:46:26Z\nb\n2025-11-05\n\n\n\n\n\n\n\n2026-04-06\nb\n\n\n\n\n\n\n\n\n
# Azurite
        // r\n2026-06-15T17:46:26Z\n2026-06-22T17:46:26Z\n/blob/dev/some-container-name/abc.png\n7c751eb2-acf8-4ce2-b92c-8724f0644194\nff51635d-1eb2-4fe3-8828-0c3de5b45b35\n2026-06-15T17:46:26Z\n2026-06-15T18:46:26Z\nb\n2025-11-05\n\n\n\n\n\n\n\n2026-04-06\nb\n\n\n\n\n\n\n

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for User Delegation Key (UDK) Blob SAS signing and parsing for service version 2026-04-06, including new optional signed request headers/query parameters.

Changes:

• Extended IBlobSASSignatureValues with signedRequestHeaders / signedRequestQueryParameters.
• Added a new 2026-04-06 string-to-sign implementation for generateBlobSASSignatureWithUDK.
• Updated SAS request parsing to read srh / srq query params and changelog entry.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/blob/authentication/IBlobSASSignatureValues.ts	Adds new SAS fields and introduces a new signing function for version 2026-04-06.
src/blob/authentication/BlobSASAuthenticator.ts	Parses new query parameters (srh, srq) and wires them into the in-memory SAS values.
ChangeLog.md	Documents upcoming release support for 2026-04-06 delegation SAS.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jainakanksha-msft]

@Socolin generateBlobSASBlobSASSignatureWithUDK20260406 this function already exists.
Can you please update the existing function with new handling.
And add the reference document to support the new capability

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

src/blob/authentication/BlobSASAuthenticator.ts:532

• After adding delegatedUserObjectId decoding, include it in the constructed blobSASValues so the signature generator can use it when present.

      signedService,
      signedVersion,
      delegatedUserTenantId,
      signedStartsOn,
      signedExpiresOn,

src/blob/authentication/BlobSASAuthenticator.ts:488

• delegatedUserObjectId is part of IBlobSASSignatureValues and is included in the UDK string-to-sign, but this request parser doesn’t read it from the query string. If the client includes skduoid, Azurite will compute a different signature.

Add decoding for skduoid alongside skdutid.

This issue also appears on line 528 of the same file.

    const signedStartsOn = this.decodeIfExist(req.getQuery("skt"));
    const signedExpiresOn = this.decodeIfExist(req.getQuery("ske"));
    const signedVersion = this.decodeIfExist(req.getQuery("skv"));
    const delegatedUserTenantId = this.decodeIfExist(req.getQuery("skdutid"));
    const signedService = this.decodeIfExist(req.getQuery("sks"));
    const signedRequestHeaders = this.decodeIfExist(