[storage] StorageClient not setting the `credential` correctly

when using TokenCredential. This leads to the Blob batch operations won’t work for the BlobClient overload.

  public async deleteBlobs(
    blobClients: BlobClient[],
    options?: BlobDeleteOptions
  ): Promise<BlobBatchDeleteBlobsResponse>;

Root cause: https://github.com/Azure/azure-sdk-for-js/blob/b853e0d6ad61fb82c912a847cda99e20c1aaaa95/sdk/storage/storage-blob/src/StorageClient.ts#L93

  protected constructor(url: string, pipeline: Pipeline) {
    // URL should be encoded and only once, protocol layer shouldn't encode URL again
    this.url = escapeURLPath(url);
    this.accountName = getAccountNameFromUrl(url);
    this.pipeline = pipeline;
    this.storageClientContext = new StorageClientContext(
      this.url,
      pipeline.toServiceClientOptions()
    );

    this.isHttps = iEqual(getURLScheme(this.url) || "", "https");

    this.credential = new AnonymousCredential();
    for (const factory of this.pipeline.factories) {
      if (
        (isNode && factory instanceof StorageSharedKeyCredential) ||
        factory instanceof AnonymousCredential ||
        isTokenCredential(factory)
      ) {
        this.credential = factory;
      }
    }

    // Override protocol layer's default content-type
    const storageClientContext = this.storageClientContext as any;
    storageClientContext.requestContentType = undefined;
  }

But factory is bearerTokenAuthenticationPolicy in this case. https://github.com/Azure/azure-sdk-for-js/blob/79b0fdf31b0a70d5384d5d0328e90314db04a411/sdk/storage/storage-blob/src/Pipeline.ts#L220

export function newPipeline(
  credential?: StorageSharedKeyCredential | AnonymousCredential | TokenCredential,


  pipelineOptions: StoragePipelineOptions = {}
): Pipeline {
  if (credential === undefined) {
    credential = new AnonymousCredential();
  }

  // Order is important. Closer to the API at the top & closer to the network at the bottom.
  // The credential's policy factory must appear close to the wire so it can sign any
  // changes made by other factories (like UniqueRequestIDPolicyFactory)

  const telemetryPolicy = new TelemetryPolicyFactory(pipelineOptions.userAgentOptions);
  const factories: RequestPolicyFactory[] = [
    tracingPolicy({ userAgent: telemetryPolicy.telemetryString }),
    keepAlivePolicy(pipelineOptions.keepAliveOptions),
    telemetryPolicy,
    generateClientRequestIdPolicy(),
    new StorageBrowserPolicyFactory(),
    deserializationPolicy(), // Default deserializationPolicy is provided by protocol layer
    new StorageRetryPolicyFactory(pipelineOptions.retryOptions),
    logPolicy({
      logger: logger.info,
      allowedHeaderNames: StorageBlobLoggingAllowedHeaderNames,
      allowedQueryParameters: StorageBlobLoggingAllowedQueryParameters
    })
  ];

  if (isNode) {
    // policies only available in Node.js runtime, not in browsers
    factories.push(proxyPolicy(pipelineOptions.proxyOptions));
    factories.push(disableResponseDecompressionPolicy());
  }
  factories.push(
    isTokenCredential(credential)
      ? bearerTokenAuthenticationPolicy(credential, StorageOAuthScopes)
      : credential
  );

  return new Pipeline(factories, pipelineOptions);
}

[ljian3377]

@xirzec Yes, the commit is only a minimum POC and can be improved if we decide #2 is the way to go.

[jeremymeng]

Right. What we really need in blob batch client is re-using existing authentication request policy factory to create a new pipeline. In the future when we can afford break changes, and can use azure core v2 it will probably be easier to look up a factory from the existing pipeline and re-use it.

For now, exposing credential in a new interface seems the way to go?