fix(uploads): fix Azure Blob connection-string-only auth and document self-host parity

[waleedlatif1]

Summary

• Fixed a bug where every Azure Blob storage operation (upload, download, delete, head, presigned URLs) threw at runtime when only AZURE_CONNECTION_STRING was set — even though that's the documented alternative to AZURE_ACCOUNT_NAME/AZURE_ACCOUNT_KEY across .env.example, env.ts, and the Helm chart
• Fixed a second related bug: presigned upload (SAS) URL generation for Azure Blob had no fallback to derive credentials from the connection string, unlike the sibling download-URL path
• Verified the full Azure Blob code path end-to-end against a live Azurite emulator — upload, download, head, delete, multipart/block-blob upload, and real HTTP PUT/GET through generated SAS URLs — using the connection-string-only config
• Added regression tests for both bugs (confirmed they fail on the pre-fix code)
• Documented the remaining Azure self-host env vars that were missing from the Helm chart and .env.example: AZURE_ACS_CONNECTION_STRING (email), OCR_AZURE_* (OCR), KB_OPENAI_MODEL_NAME, WAND_OPENAI_MODEL_NAME

Type of Change

• Bug fix

Testing

• Live verification against Azurite emulator (upload/download/head/delete/multipart/presigned SAS PUT+GET) using connection-string-only auth
• bun run type-check, biome check, bun run vitest run lib/uploads/ (127/127 passing) all clean
• helm lint + helm template against base chart and Azure example profile
• bun run check:api-validation passes

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 10, 2026 1:00am

[cursor]

PR Summary

Medium Risk
Changes core file-upload auth and SAS generation paths; mis-parsed connection strings could break uploads, but scope is limited to Azure Blob config validation and credential derivation with new regression tests.

Overview
Fixes Azure Blob storage when deployers use only AZURE_CONNECTION_STRING (no separate account name/key), matching documented self-host config.

Storage behavior: createBlobConfig no longer requires accountName when a connection string is present; auth is either the connection string or both account name and key. Presigned upload SAS URLs now parse credentials from the connection string (aligned with download SAS). parseConnectionString is exported; BlobConfig.accountName is optional. Regression tests cover headObject and generatePresignedUploadUrl under connection-string-only config.

Docs / Helm: .env.example adds Azure Blob container variables and notes Blob takes precedence over S3. Chart values, schema, and values-azure.yaml document AZURE_ACS_CONNECTION_STRING, OCR_AZURE_*, KB_OPENAI_MODEL_NAME, and WAND_OPENAI_MODEL_NAME (including ESO remote-ref examples).

^{Reviewed by Cursor Bugbot for commit eeffe55. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes Azure Blob connection-string auth and updates Azure self-host documentation. The main changes are:

• Allows Azure Blob storage to work with only AZURE_CONNECTION_STRING.
• Derives SAS upload credentials from the Azure connection string when account credentials are absent.
• Adds tests for connection-string-only Azure Blob operations.
• Documents additional Azure self-host environment variables in the app and Helm chart.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
helm/sim/examples/values-azure.yaml	Adds Azure self-host env vars and matching External Secrets example mappings for the newly documented keys.
apps/sim/lib/uploads/core/storage-service.ts	Allows connection-string-only Azure Blob config and uses it for SAS upload URL generation.
apps/sim/lib/uploads/providers/blob/client.ts	Exports the Azure connection string parser for shared upload credential handling.

_{Reviews (2): Last reviewed commit: "fix(uploads): map new Azure keys in the ..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit eeffe55. Configure here.}