fix: include blob fields of azure in batch responses

[TejasGhatte]

Summary

Adds support for Azure Blob Storage URLs in batch API responses. When using Azure's batch API with blob storage for input/output, the response now includes the relevant blob URLs instead of only file IDs.

Changes

• Added InputBlob, OutputBlob, and ErrorBlob optional fields to OpenAIBatchResponse to capture Azure-returned blob storage URLs
• Propagated these fields through ToBifrostBatchCreateResponse and ToBifrostBatchRetrieveResponse conversion methods
• Added the same InputBlob, OutputBlob, and ErrorBlob fields to BifrostBatchCreateResponse and BifrostBatchRetrieveResponse schemas so callers can access blob URLs from both create and retrieve operations

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Submit or retrieve a batch job via the Azure OpenAI provider configured with blob storage input/output. The response should include populated input_blob, output_blob, and/or error_blob fields.

go test ./...

Breaking changes

• Yes
• No

Related issues

Security considerations

Blob storage URLs may contain SAS tokens or other credentials. Ensure these values are not logged or exposed unintentionally in downstream systems.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

tejas ghatte seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5ec62ac8-73dd-4428-bab8-696544513432

📥 Commits

Reviewing files that changed from the base of the PR and between 977d032 and 5c9dd58.

📒 Files selected for processing (3)

• core/providers/azure/azure.go
• core/providers/openai/batch.go
• core/schemas/batch.go

🚧 Files skipped from review as they are similar to previous changes (3)

• core/schemas/batch.go
• core/providers/openai/batch.go
• core/providers/azure/azure.go

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Batch API responses now optionally include blob URLs for input, output, and error files for direct access.
  • Batch result retrieval supports downloading results from Azure Blob Storage (via SAS or authenticated requests), with trusted-host validation, secure token handling, and improved latency reporting for blob retrieval.

Walkthrough

This PR exposes Azure Blob Storage URLs in Bifrost batch response schemas, maps them from OpenAI batch responses, and adds Azure provider helpers to download blob-backed batch results (choosing between Files API and direct blob GET) while recording retrieval latency.

Changes

Azure Blob Storage URL Support

Layer / File(s)	Summary
Bifrost batch response schemas core/schemas/batch.go	BifrostBatchCreateResponse and BifrostBatchRetrieveResponse each gain optional InputBlob, OutputBlob, and ErrorBlob fields to expose Azure Blob Storage URLs.
OpenAI provider blob field mapping core/providers/openai/batch.go	OpenAIBatchResponse is extended with InputBlob, OutputBlob, and ErrorBlob; ToBifrostBatchCreateResponse and ToBifrostBatchRetrieveResponse copy these fields into the Bifrost responses.
Azure provider blob retrieval & BatchResults core/providers/azure/azure.go	Added DefaultAzureStorageScope, helpers to obtain blob-scoped bearer tokens and download blobs (SAS or authenticated GET), updated batch-create input validation to allow inline/request-array inputs, and updated BatchResults to select between output_file_id (Files API) and output_blob (direct blob GET), parse JSONL, and record the selected-path latency.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant AzureProvider
  participant FilesAPI
  participant BlobStorage
  Client->>AzureProvider: Request BatchResults
  AzureProvider->>FilesAPI: FileContent(output_file_id) (if output_file_id present)
  AzureProvider->>BlobStorage: GET output_blob (SAS or Bearer token) (if output_blob present)
  BlobStorage-->>AzureProvider: bytes (JSONL)
  FilesAPI-->>AzureProvider: bytes (JSONL)
  AzureProvider->>Client: parsed JSONL results + latencyMs

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested reviewers

• akshaydeo

Poem

🐰 I nibbled URLs of input, output, error fine,
Azure blobs tucked in lines that now align,
OpenAI whispered links into my paw,
I fetched the JSONL and timed it with awe,
A carrot-clocked pipeline—hoppity, all is fine.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: adding blob storage URL fields to Azure batch responses, which is the core purpose of this changeset.
Description check	✅ Passed	The description covers all major sections of the template with relevant details about the feature, changes made, affected areas, and security considerations. All essential information is provided.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-13-fix_include_blob_fields_of_azure_in_batch_responses

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[TejasGhatte]

• fix: include blob fields of azure in batch responses #3469 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

🧪 Test Suite Available

This PR can be tested by a repository admin.

Run tests for PR #3469

[greptile-apps]

Confidence Score: 4/5

Safe to merge with the understanding that blob URLs containing SAS tokens are now surface-level in response structs and error messages; callers should ensure those values are not forwarded to logs or untrusted consumers.

The core logic in downloadBlobURL correctly validates the host before every outbound request — both SAS and bearer-token paths go through the same trusted-domain check. The only concern keeping the score from the maximum is that blob URLs (which may contain embedded SAS tokens) now appear in error messages and in response structs that may be logged verbatim downstream. The PR description acknowledges this, but no scrubbing or documentation guard is applied in the new code paths.

core/providers/azure/azure.go — the new blob download helpers and BatchResults switch logic warrant a close read; in particular, how error messages are constructed when URL validation fails.

Important Files Changed

Filename	Overview
core/providers/azure/azure.go	Adds getBlobStorageTokenForKey, downloadBlobURL, and doGetBlob helpers; extends BatchResults to handle blob-based output alongside file-based output. Host validation is correctly applied before any outbound request, covering both SAS and non-SAS paths. Minor comment typo on the new constant.
core/providers/openai/batch.go	Adds InputBlob, OutputBlob, ErrorBlob to OpenAIBatchResponse and propagates them through both ToBifrostBatchCreateResponse and ToBifrostBatchRetrieveResponse. Straightforward, consistent with existing field mappings.
core/schemas/batch.go	Adds optional InputBlob, OutputBlob, ErrorBlob pointer fields to both BifrostBatchCreateResponse and BifrostBatchRetrieveResponse. Schema additions are minimal and non-breaking.

_{Reviews (5): Last reviewed commit: "fix: include blob fields of azure in bat..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

core/providers/azure/azure.go (1)

2195-2244: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Require output_folder for blob-backed batch creation.

This now accepts input_blob without output_folder, then sends a request that the Azure contract in this block says is invalid. Fail it locally so callers get a deterministic validation error instead of an upstream 4xx.

Proposed fix

-	if inputFileID == "" && request.InputBlob == nil {
-		return nil, providerUtils.NewBifrostOperationError("either input_file_id, input_blob, or requests array is required for Azure batch API", nil)
-	}
+	if inputFileID == "" {
+		switch {
+		case request.InputBlob == nil:
+			return nil, providerUtils.NewBifrostOperationError("either input_file_id, input_blob, or requests array is required for Azure batch API", nil)
+		case request.OutputFolder == nil:
+			return nil, providerUtils.NewBifrostOperationError("output_folder is required when input_blob is provided for Azure batch API", nil)
+		}
+	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@core/providers/azure/azure.go` around lines 2195 - 2244, The code currently
allows request.InputBlob without request.OutputFolder which violates the Azure
contract; update the validation in the batch creation flow (around inputFileID,
request.InputBlob, request.OutputFolder and openAIReq) to reject requests where
inputFileID == "" and request.InputBlob != nil but request.OutputFolder == nil
by returning a providerUtils.NewBifrostOperationError with a clear message
(e.g., "output_folder is required when using input_blob for Azure batch
creation"); perform this check before populating
openAIReq.InputBlob/OutputFolder so callers get a deterministic local validation
error instead of an upstream 4xx.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@core/providers/azure/azure.go`:
- Around line 2621-2647: In getBlobStorageTokenForKey, avoid falling back to
DefaultAzureCredential when a key explicitly provides a service principal: if
AzureKeyConfig is present and you call getOrCreateAuth (and then cred.GetToken)
for that ClientID/ClientSecret/TenantID, treat any error or empty token from
those calls as terminal and immediately return "" rather than proceeding to
getOrCreateDefaultAzureCredential; mirror the behavior in getAzureAuthHeaders by
returning on explicit SP failures (reference
AzureProvider.getBlobStorageTokenForKey, getOrCreateAuth, cred.GetToken,
getOrCreateDefaultAzureCredential, and getAzureAuthHeaders).
- Around line 2653-2707: The downloadBlobURL/doGetBlob flow currently accepts
blobURL verbatim which allows SSRF and token leakage; before calling doGetBlob
or attaching a bearer from getBlobStorageTokenForKey, parse blobURL (e.g., via
url.Parse), enforce scheme == "https", and validate the hostname against a
whitelist of trusted Azure Blob endpoints (e.g., *.blob.core.windows.net,
*.dfs.core.windows.net and any configured allowed hosts); if the URL fails
validation return a BifrostOperationError. Apply the same validation when the
URL contains "sig=" (SAS) so you still reject non-https or non-Azure hosts, and
only call provider.getBlobStorageTokenForKey + provider.doGetBlob when the host
passes the whitelist check.

---

Outside diff comments:
In `@core/providers/azure/azure.go`:
- Around line 2195-2244: The code currently allows request.InputBlob without
request.OutputFolder which violates the Azure contract; update the validation in
the batch creation flow (around inputFileID, request.InputBlob,
request.OutputFolder and openAIReq) to reject requests where inputFileID == ""
and request.InputBlob != nil but request.OutputFolder == nil by returning a
providerUtils.NewBifrostOperationError with a clear message (e.g.,
"output_folder is required when using input_blob for Azure batch creation");
perform this check before populating openAIReq.InputBlob/OutputFolder so callers
get a deterministic local validation error instead of an upstream 4xx.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9a06c94c-b9f9-420b-901f-f565e4b05da0

📥 Commits

Reviewing files that changed from the base of the PR and between 1d9c910 and 370ecb3.

📒 Files selected for processing (3)

• core/providers/azure/azure.go
• core/providers/openai/batch.go
• core/schemas/batch.go

🚧 Files skipped from review as they are similar to previous changes (1)

• core/schemas/batch.go

The base branch was changed.

[akshaydeo]

Merge activity

• May 14, 2:17 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 14, 2:18 PM UTC: @akshaydeo merged this pull request with Graphite.