Remove public permissions from image store blob in favor of SAS

JfkWebApiSkills/JfkInitializer/Program.cs

@@ -128,12 +128,6 @@ private static async Task<bool> CreateBlobContainerForImageStore()
                 CloudBlobClient client = storageAccount.CreateCloudBlobClient();
                 CloudBlobContainer container = client.GetContainerReference(BlobContainerNameForImageStore);
                 await container.CreateIfNotExistsAsync();
-                // Note that setting this permission means that the container will be publically accessible.  This is necessary for
-                // the website to work properly.  Remove these next 3 lines if you start using this code to process any private or
-                // confidential data, but note that the website will stop working properly if you do.
-                BlobContainerPermissions permissions = container.GetPermissions();
-                permissions.PublicAccess = BlobContainerPublicAccessType.Container;
-                await container.SetPermissionsAsync(permissions);
             }
             catch (Exception ex)
             {

JfkWebApiSkills/JfkWebApiSkills/HocrGenerator/HocrDocument.cs

@@ -38,10 +38,10 @@ public class HocrPage
         StringWriter metadata = new StringWriter();
         StringWriter text = new StringWriter() { NewLine = " " };
 
-        public HocrPage(OcrImageMetadata imageMetadata, int pageNumber, Dictionary<string,string> wordAnnotations = null)
+        public HocrPage(OcrImageMetadata imageMetadata, int pageNumber, string imageBlobSAS, Dictionary<string,string> wordAnnotations = null)
         {
             // page
-            metadata.WriteLine($"<div class='ocr_page' id='page_{pageNumber}' title='image \"{imageMetadata.ImageStoreUri}\"; bbox 0 0 {imageMetadata.Width} {imageMetadata.Height}; ppageno {pageNumber}'>");
+            metadata.WriteLine($"<div class='ocr_page' id='page_{pageNumber}' title='image \"{imageMetadata.ImageStoreUri}{imageBlobSAS}\"; bbox 0 0 {imageMetadata.Width} {imageMetadata.Height}; ppageno {pageNumber}'>");
             metadata.WriteLine($"<div class='ocr_carea' id='block_{pageNumber}_1'>");
 
             IEnumerable<IEnumerable<NormalizedWord>> wordGroups;

JfkWebApiSkills/JfkWebApiSkills/ImageStore/ImageStore.cs

@@ -31,6 +31,15 @@ public async Task<string> UploadImageToLibrary(Stream stream, string name, bool
             return blockBlob.Uri.ToString();
         }
 
+        public string GetSharedAccessSignature(DateTimeOffset expiry)
+        {
+            return libraryContainer.GetSharedAccessSignature(new SharedAccessBlobPolicy
+            {
+                Permissions = SharedAccessBlobPermissions.Read,
+                SharedAccessExpiryTime = expiry,
+            });
+        }
+
         public Task<string> UploadToBlob(byte[] data, string name, bool overwrite = false)
         {
             return UploadImageToLibrary(new MemoryStream(data), name, overwrite);

JfkWebApiSkills/JfkWebApiSkills/JfkWebAPISkills.cs

@@ -18,6 +18,9 @@ namespace Microsoft.CognitiveSearch.WebApiSkills
 {
     public static class JfkWebApiSkills
     {
+        // Configure duration of SAS token for image store blobs here
+        private static readonly TimeSpan s_imageBlobSASDuration = TimeSpan.FromDays(365);
+
         [FunctionName("facet-graph-nodes")]
         public static IActionResult GetFacetGraphNodes([HttpTrigger(AuthorizationLevel.Function, "get", Route = null)]HttpRequest req, TraceWriter log, ExecutionContext executionContext)
         {
@@ -138,6 +141,16 @@ public static IActionResult RunHocrGenerator([HttpTrigger(AuthorizationLevel.Fun
                 return new BadRequestObjectResult($"{skillName} - Invalid request record array: Skill requires exactly 1 image per request.");
             }
 
+            var blobStorageConnectionString = GetAppSetting("BlobStorageAccountConnectionString");
+            var blobContainerName = String.IsNullOrEmpty(req.Headers["BlobContainerName"]) ? Config.AZURE_STORAGE_CONTAINER_NAME : (string)req.Headers["BlobContainerName"];
+            if (String.IsNullOrEmpty(blobStorageConnectionString) || String.IsNullOrEmpty(blobContainerName))
+            {
+                return new BadRequestObjectResult($"{skillName} - Information for the blob storage account is missing");
+            }
+            var imageStore = new ImageStore(blobStorageConnectionString, blobContainerName);
+            var expiry = DateTimeOffset.UtcNow.Add(s_imageBlobSASDuration);
+            var imageBlobSAS = imageStore.GetSharedAccessSignature(expiry);
+
             WebApiSkillResponse response = WebApiSkillHelpers.ProcessRequestRecords(skillName, requestRecords,
                 (inRecord, outRecord) => {
                     List<OcrImageMetadata> imageMetadataList = JsonConvert.DeserializeObject<List<OcrImageMetadata>>(JsonConvert.SerializeObject(inRecord.Data["ocrImageMetadataList"]));
@@ -150,7 +163,7 @@ public static IActionResult RunHocrGenerator([HttpTrigger(AuthorizationLevel.Fun
                     List<HocrPage> pages = new List<HocrPage>();
                     for(int i = 0; i < imageMetadataList.Count; i++)
                     {
-                        pages.Add(new HocrPage(imageMetadataList[i], i, annotations));
+                        pages.Add(new HocrPage(imageMetadataList[i], i, imageBlobSAS, annotations));
                     }
                     HocrDocument hocrDocument = new HocrDocument(pages);
                     outRecord.Data["hocrDocument"] = hocrDocument;