Fix job attachment 401s for submitted jobs

[v-elegacheva]

Summary

Fixes job attachment operations failing after submission because the service stores an unsigned container URI.

upload_attachment, download_attachment, and list_attachments now:

• Preserve explicitly supplied method-level container URIs.
• Request a workspace-issued SAS for the job's actual linked container on first use.
• Cache and revalidate that SAS for HTTPS, container identity, the backend's fixed attachment capabilities (r, w, and l), start time, and expiry.
• Invalidate cache use when job container details change.
• Reject a refreshed URI when its storage hostname differs from the hostname stored in the job details.

Custom container names remain supported. The legacy Workspace(storage=...) connection-string path is intentionally outside this PR's scope; its deprecation will be tracked separately.

Testing

• Focused attachment validation: 25 passed.
• Full local suite: 127 passed, 18 skipped.
• Azure Quantum Python CI for the previous revision: build 183619 passed. CI will be rerun for the final revision.
• The relevant DPv2 attachment E2E in build 183473 passed upload, list, and download (34 passed, 2 skipped in the DPv2 SDK job). The broader live build had unrelated CLI and third-party failures. The attachment E2E will be rerun against the final revision.

Related

The generated job-update endpoint correction is intentionally left to #772, which regenerated the complete client with the corrected /jobs/{jobId} route.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

🟡 Changes recommended

Attachment methods now target the wrong container for jobs created with a custom container name.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes attachment authentication failures and the incorrect job-update endpoint.

Changes:

• Refreshes SAS-signed attachment container URIs.
• Corrects job PATCH requests to use /jobs/{jobId}.
• Adds regression tests for both fixes.

File summaries

File	Description
base_job.py	Refreshes attachment container SAS URIs.
_operations.py	Corrects the job update route.
test_job_attachments.py	Tests attachment URI handling.
test_workspace.py	Tests the PATCH resource path.

Review details

Suppressed comments (2)

azure-quantum/azure/quantum/job/base_job.py:381

• This selects the default job-{id} container rather than the container encoded in self._details.container_uri. Jobs created with a custom container_name will therefore download from the wrong location. Request the fresh SAS using self.container_name and update the test expectation accordingly.

            container_uri = self.workspace.get_container_uri(job_id=self.id)

azure-quantum/azure/quantum/job/base_job.py:400

• Listing now ignores the job's actual linked container name and always targets job-{id}. This breaks list_attachments() for the supported custom-container flow in from_input_data; obtain the fresh SAS for self.container_name and cover that case in the attachment tests.

        container_uri = self.workspace.get_container_uri(job_id=self.id)

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

🟡 Changes recommended

Caller-supplied containers from different storage accounts can be redirected to same-named workspace containers.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

azure-quantum/azure/quantum/job/base_job.py:387

• For jobs created with from_storage_uri(..., container_uri=...) against another storage account, this re-signs only the extracted container name in the workspace's configured account. The download then reads a different container rather than the job's explicitly linked one. Preserve a usable explicit job-level URI, or restrict workspace SAS refresh to URIs known to be in workspace storage.

            container_uri = self.workspace.get_container_uri(
                job_id=self.id,
                container_name=self.container_name,
            )

azure-quantum/azure/quantum/job/base_job.py:409

• This loses the storage-account identity from a caller-supplied job container_uri: get_container_uri selects the workspace-linked/configured account using only the name. Consequently, list_attachments() can list an unrelated same-named container (or create and list an empty one) instead of the explicit container retained by from_storage_uri. Preserve a usable explicit URI or verify the account before refreshing its SAS through the workspace.

        container_uri = self.workspace.get_container_uri(
            job_id=self.id,
            container_name=self.container_name,
        )

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Copilot review overview

🟡 Changes recommended

Cached and refreshed URIs lack required identity, security, start-time, signature, and permission validation.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Cache key ignores storage account identity changes · New

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Copilot review overview

🟡 Changes recommended

Cached and refreshed URIs lack the promised identity, permission, start-time, signature, and HTTPS validation.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Unvalidated workspace URI enables wrong-account or insecure attachment · New

Resolved since last review (1)

• Cache key ignores storage account identity changes

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[v-elegacheva]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).