Reject blob Acquire Lease without x-ms-lease-duration

[Joel Town Road (hippi345)]

Problem

Acquire Lease without x-ms-lease-duration was accepted with 201, then later GET or list of that blob/container returned 500 (LeaseExpiredState:constructor() error, incoming leaseDurationSeconds undefined).

Fixes #2855

Azure Storage requires the header on acquire (API version 2012-02-12 and later) and returns 400 MissingRequiredHeader:

• Lease Blob: “A call to Lease Blob to acquire a lease now must include a lease duration header. If you try to acquire a lease without specifying a lease duration, the service returns 400 Bad Request – Missing required header.”
• Common REST API error codes: MissingRequiredHeader, HTTP 400, user message “A required HTTP header wasn't specified.”

Fix

BlobHandler.acquireLease now rejects a missing options.duration with StorageErrorFactory.getMissingRequiredHeader (400, MissingRequiredHeader, Azure’s documented message, and HeaderName x-ms-lease-duration). The blob is left unchanged so later GET/list succeed.

Testing

New test in tests/blob/apis/blob.test.ts: acquire without x-ms-lease-duration via raw HTTP, assert 400 / MissingRequiredHeader / documented message / HeaderName, then GET properties and list blobs.

Before (unmodified upstream main):

  BlobAPIs
    1) acquireLease without x-ms-lease-duration returns 400 MissingRequiredHeader @loki @sql


  0 passing (77ms)
  1 failing

  1) BlobAPIs
       acquireLease without x-ms-lease-duration returns 400 MissingRequiredHeader @loki @sql:

      AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:

201 !== 400

      + expected - actual

      -201
      +400
      
      at Context.<anonymous> (tests/blob/apis/blob.test.ts:804:12)
      at processTicksAndRejections (node:internal/process/task_queues:105:5)

After:

  BlobAPIs
    ✔ acquireLease without x-ms-lease-duration returns 400 MissingRequiredHeader @loki @sql


  1 passing (75ms)

Nearby lease tests (acquireLease|releaseLease|lease blob|Lease in blob.test.ts and container.test.ts):

  30 passing (51s)

This change was prepared with AI assistance. I remain responsible for the contribution and have reviewed it.

[Copilot]

🟡 Changes recommended

The regression test must preserve HTTPS for live-Azure endpoints to avoid failures and plaintext SAS transmission.

1 open issue

• Use HTTPS requests for live Azure test server URLs · New

What changed in this PR

Fixes #2855 by rejecting blob lease acquisition without a duration before it can corrupt lease state.

Changes:

• Return Azure-compatible 400 MissingRequiredHeader responses.
• Add regression coverage for rejection and subsequent properties/list requests.
• Document the fix in the changelog.

File	Description
tests/​blob/​apis/​blob.test.ts	Adds missing-duration regression coverage.
src/​blob/​handlers/​BlobHandler.ts	Rejects missing duration before updating storage.
src/​blob/​errors/​StorageErrorFactory.ts	Adds the required-header error response.
ChangeLog.md	Documents the lease validation fix.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The focused validation prevents invalid lease persistence, with regression coverage and no unresolved findings.

No open issues 🎉

1 resolved since last review

• Use HTTPS requests for live Azure test server URLs

_{Review effort: Balanced}