Implement state management with Blob and File system storage (#1064)

shibayan · Copilot · web-flow · commit d2d3cdc526ab · 2026-05-18T14:57:33.000+09:00
* Implement state management with Blob and File system storage options

* Update CertificateIssuanceOrchestrator to handle null CertificateId in order creation

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI &lt;175728472+Copilot@users.noreply.github.com&gt;

---------

Co-authored-by: Copilot Autofix powered by AI &lt;175728472+Copilot@users.noreply.github.com&gt;
diff --git a/.gitignore b/.gitignore
@@ -396,3 +396,6 @@ FodyWeavers.xsd
 
 # JetBrains Rider
 *.sln.iml
+
+# C# Dev Kit for Visual Studio Code
+*.csproj.lscache
diff --git a/deploy/azuredeploy.bicep b/deploy/azuredeploy.bicep
@@ -47,6 +47,7 @@ var workspaceName = 'log-${appNamePrefix}-${take(generatedToken, 4)}'
 var storageAccountName = 'st${generatedToken}func'
 var keyVaultName = 'kv-${appNamePrefix}-${take(generatedToken, 4)}'
 var deploymentStorageContainerName = 'app-package-${take(appNamePrefix, 32)}-${take(generatedToken, 7)}'
+var stateStorageContainerName = 'acmebot-state'
 
 var roleDefinitionId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions/', 'a4417e6f-fecd-4de8-b567-7b0420556985')
 
@@ -105,6 +106,13 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2025-06-01' = {
         publicAccess: 'None'
       }
     }
+
+    resource stateContainer 'containers' = {
+      name: stateStorageContainerName
+      properties: {
+        publicAccess: 'None'
+      }
+    }
   }
 }
 
diff --git a/deploy/azuredeploy.json b/deploy/azuredeploy.json
@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.43.8.12551",
-      "templateHash": "13592480369520105572"
+      "templateHash": "5333924408175871037"
     }
   },
   "parameters": {
@@ -89,6 +89,7 @@
     "storageAccountName": "[format('st{0}func', variables('generatedToken'))]",
     "keyVaultName": "[format('kv-{0}-{1}', parameters('appNamePrefix'), take(variables('generatedToken'), 4))]",
     "deploymentStorageContainerName": "[format('app-package-{0}-{1}', take(parameters('appNamePrefix'), 32), take(variables('generatedToken'), 7))]",
+    "stateStorageContainerName": "acmebot-state",
     "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions/', 'a4417e6f-fecd-4de8-b567-7b0420556985')]"
   },
   "resources": [
@@ -103,6 +104,17 @@
         "[resourceId('Microsoft.Storage/storageAccounts/blobServices', variables('storageAccountName'), 'default')]"
       ]
     },
+    {
+      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+      "apiVersion": "2025-06-01",
+      "name": "[format('{0}/{1}/{2}', variables('storageAccountName'), 'default', variables('stateStorageContainerName'))]",
+      "properties": {
+        "publicAccess": "None"
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Storage/storageAccounts/blobServices', variables('storageAccountName'), 'default')]"
+      ]
+    },
     {
       "type": "Microsoft.Storage/storageAccounts/blobServices",
       "apiVersion": "2025-06-01",
diff --git a/deploy/azuredeploy_ui.bicep b/deploy/azuredeploy_ui.bicep
@@ -83,6 +83,7 @@ var workspaceName = resourceNames.logAnalyticsWorkspaceName
 var storageAccountName = resourceNames.storageAccountName
 var newKeyVaultName = resourceNames.keyVaultName
 var deploymentStorageContainerName = 'app-package-${toLower(functionAppName)}'
+var stateStorageContainerName = 'acmebot-state'
 
 var createKeyVault = keyVault.createNew
 var createLogAnalyticsWorkspace = monitoring.createLogAnalyticsWorkspace
@@ -331,6 +332,13 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2025-06-01' = {
         publicAccess: 'None'
       }
     }
+
+    resource stateContainer 'containers' = {
+      name: stateStorageContainerName
+      properties: {
+        publicAccess: 'None'
+      }
+    }
   }
 }
 
diff --git a/deploy/azuredeploy_ui.json b/deploy/azuredeploy_ui.json
@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.43.8.12551",
-      "templateHash": "17724728527648616220"
+      "templateHash": "17385215688447288281"
     }
   },
   "definitions": {
@@ -186,6 +186,7 @@
     "storageAccountName": "[parameters('resourceNames').storageAccountName]",
     "newKeyVaultName": "[parameters('resourceNames').keyVaultName]",
     "deploymentStorageContainerName": "[format('app-package-{0}', toLower(variables('functionAppName')))]",
+    "stateStorageContainerName": "acmebot-state",
     "createKeyVault": "[parameters('keyVault').createNew]",
     "createLogAnalyticsWorkspace": "[parameters('monitoring').createLogAnalyticsWorkspace]",
     "useUserAssignedIdentity": "[equals(parameters('managedIdentity').type, 'UserAssigned')]",
@@ -239,6 +240,17 @@
         "storageAccount::blobServices"
       ]
     },
+    "storageAccount::blobServices::stateContainer": {
+      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+      "apiVersion": "2025-06-01",
+      "name": "[format('{0}/{1}/{2}', variables('storageAccountName'), 'default', variables('stateStorageContainerName'))]",
+      "properties": {
+        "publicAccess": "None"
+      },
+      "dependsOn": [
+        "storageAccount::blobServices"
+      ]
+    },
     "storageAccount::blobServices": {
       "type": "Microsoft.Storage/storageAccounts/blobServices",
       "apiVersion": "2025-06-01",
diff --git a/src/Acmebot.App/Acme/AcmeClientFactory.cs b/src/Acmebot.App/Acme/AcmeClientFactory.cs
@@ -1,6 +1,4 @@
-﻿using System.Text.Json;
-
-using Acmebot.Acme;
+﻿using Acmebot.Acme;
 using Acmebot.Acme.Models;
 using Acmebot.App.Infrastructure;
 using Acmebot.App.Options;
@@ -9,20 +7,14 @@
 
 namespace Acmebot.App.Acme;
 
-public class AcmeClientFactory(IOptions<AcmebotOptions> options)
+public class AcmeClientFactory(IOptions<AcmebotOptions> options, IAcmeStateStore stateStore)
 {
     private readonly AcmebotOptions _options = options.Value;
 
-    private static readonly JsonSerializerOptions s_jsonSerializerOptions = new()
-    {
-        PropertyNameCaseInsensitive = true,
-        WriteIndented = true
-    };
-
     public async Task<AcmeClientContext> CreateClientAsync()
     {
-        var account = LoadState<AccountDetails>("account.json");
-        var accountKey = LoadState<AccountKey>("account_key.json");
+        var account = await stateStore.LoadAsync<AccountDetails>("account.json");
+        var accountKey = await stateStore.LoadAsync<AccountKey>("account_key.json");
         var contacts = GetContacts();
         var isNewAccountKey = false;
 
@@ -66,12 +58,12 @@ public async Task<AcmeClientContext> CreateClientAsync()
                 externalAccountBinding);
             account = AccountDetails.FromAccountHandle(accountHandle, directory.Metadata?.TermsOfService);
 
-            SaveState(account, "account.json");
-
             if (isNewAccountKey)
             {
-                SaveState(accountKey, "account_key.json");
+                await stateStore.SaveAsync(accountKey, "account_key.json");
             }
+
+            await stateStore.SaveAsync(account, "account.json");
         }
         else
         {
@@ -88,7 +80,7 @@ public async Task<AcmeClientContext> CreateClientAsync()
                 });
             account = AccountDetails.FromAccountHandle(accountHandle, directory.Metadata?.TermsOfService);
 
-            SaveState(account, "account.json");
+            await stateStore.SaveAsync(account, "account.json");
         }
 
         return new AcmeClientContext
@@ -117,35 +109,4 @@ public async Task<AcmeClientContext> CreateClientAsync()
 
     private static bool ContactsEqual(IReadOnlyList<string>? actualContacts, IReadOnlyList<string> expectedContacts)
         => actualContacts is not null && actualContacts.SequenceEqual(expectedContacts, StringComparer.Ordinal);
-
-    private TState? LoadState<TState>(string path)
-    {
-        var fullPath = ResolveStateFullPath(path);
-
-        if (!File.Exists(fullPath))
-        {
-            return default;
-        }
-
-        var json = File.ReadAllText(fullPath);
-
-        return JsonSerializer.Deserialize<TState>(json, s_jsonSerializerOptions);
-    }
-
-    private void SaveState<TState>(TState value, string path)
-    {
-        var fullPath = ResolveStateFullPath(path);
-        var directoryPath = Path.GetDirectoryName(fullPath);
-
-        if (!string.IsNullOrEmpty(directoryPath) && !Directory.Exists(directoryPath))
-        {
-            Directory.CreateDirectory(directoryPath);
-        }
-
-        var json = JsonSerializer.Serialize(value, s_jsonSerializerOptions);
-
-        File.WriteAllText(fullPath, json);
-    }
-
-    private string ResolveStateFullPath(string path) => Environment.ExpandEnvironmentVariables($"%HOME%/data/.acmebot/{_options.Endpoint.Host}/{path}");
 }
diff --git a/src/Acmebot.App/Acme/BlobAcmeStateStore.cs b/src/Acmebot.App/Acme/BlobAcmeStateStore.cs
@@ -0,0 +1,60 @@
+﻿using System.Text.Json;
+
+using Acmebot.App.Options;
+
+using Azure;
+using Azure.Storage.Blobs;
+using Azure.Storage.Blobs.Models;
+
+using Microsoft.Extensions.Options;
+
+namespace Acmebot.App.Acme;
+
+internal sealed class BlobAcmeStateStore(BlobContainerClient containerClient, IOptions<AcmebotOptions> options) : IAcmeStateStore
+{
+    private const string ContentType = "application/json";
+
+    private readonly Uri _endpoint = options.Value.Endpoint;
+
+    private static readonly JsonSerializerOptions s_jsonSerializerOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+        WriteIndented = true
+    };
+
+    public async Task<TState?> LoadAsync<TState>(string path, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            var blobClient = containerClient.GetBlobClient(CreateBlobName(path));
+            var response = await blobClient.DownloadContentAsync(cancellationToken);
+
+            return response.Value.Content.ToObjectFromJson<TState>(s_jsonSerializerOptions);
+        }
+        catch (RequestFailedException ex) when (ex.Status == 404)
+        {
+            return default;
+        }
+    }
+
+    public async Task SaveAsync<TState>(TState value, string path, CancellationToken cancellationToken = default)
+    {
+        await containerClient.CreateIfNotExistsAsync(PublicAccessType.None, cancellationToken: cancellationToken);
+
+        var blobClient = containerClient.GetBlobClient(CreateBlobName(path));
+        var content = BinaryData.FromObjectAsJson(value, s_jsonSerializerOptions);
+
+        await blobClient.UploadAsync(
+            content,
+            new BlobUploadOptions
+            {
+                HttpHeaders = new BlobHttpHeaders
+                {
+                    ContentType = ContentType
+                }
+            },
+            cancellationToken);
+    }
+
+    private string CreateBlobName(string path) => $"{_endpoint.Host}/{path}";
+}
diff --git a/src/Acmebot.App/Acme/FileSystemAcmeStateStore.cs b/src/Acmebot.App/Acme/FileSystemAcmeStateStore.cs
@@ -0,0 +1,49 @@
+﻿using System.Text.Json;
+
+using Acmebot.App.Options;
+
+using Microsoft.Extensions.Options;
+
+namespace Acmebot.App.Acme;
+
+internal sealed class FileSystemAcmeStateStore(IOptions<AcmebotOptions> options) : IAcmeStateStore
+{
+    private readonly Uri _endpoint = options.Value.Endpoint;
+
+    private static readonly JsonSerializerOptions s_jsonSerializerOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+        WriteIndented = true
+    };
+
+    public async Task<TState?> LoadAsync<TState>(string path, CancellationToken cancellationToken = default)
+    {
+        var fullPath = ResolveStateFullPath(path);
+
+        if (!File.Exists(fullPath))
+        {
+            return default;
+        }
+
+        await using var stream = File.OpenRead(fullPath);
+
+        return await JsonSerializer.DeserializeAsync<TState>(stream, s_jsonSerializerOptions, cancellationToken);
+    }
+
+    public async Task SaveAsync<TState>(TState value, string path, CancellationToken cancellationToken = default)
+    {
+        var fullPath = ResolveStateFullPath(path);
+        var directoryPath = Path.GetDirectoryName(fullPath);
+
+        if (!string.IsNullOrEmpty(directoryPath) && !Directory.Exists(directoryPath))
+        {
+            Directory.CreateDirectory(directoryPath);
+        }
+
+        await using var stream = File.Create(fullPath);
+
+        await JsonSerializer.SerializeAsync(stream, value, s_jsonSerializerOptions, cancellationToken);
+    }
+
+    private string ResolveStateFullPath(string path) => Environment.ExpandEnvironmentVariables($"%HOME%/data/.acmebot/{_endpoint.Host}/{path}");
+}
diff --git a/src/Acmebot.App/Acme/IAcmeStateStore.cs b/src/Acmebot.App/Acme/IAcmeStateStore.cs
@@ -0,0 +1,8 @@
+﻿namespace Acmebot.App.Acme;
+
+public interface IAcmeStateStore
+{
+    Task<TState?> LoadAsync<TState>(string path, CancellationToken cancellationToken = default);
+
+    Task SaveAsync<TState>(TState value, string path, CancellationToken cancellationToken = default);
+}
diff --git a/src/Acmebot.App/Acmebot.App.csproj b/src/Acmebot.App/Acmebot.App.csproj
@@ -19,6 +19,7 @@
     <PackageReference Include="Azure.ResourceManager.PrivateDns" Version="1.2.2" />
     <PackageReference Include="Azure.Security.KeyVault.Certificates" Version="4.8.0" />
     <PackageReference Include="Azure.Security.KeyVault.Keys" Version="4.10.0" />
+    <PackageReference Include="Azure.Storage.Blobs" Version="12.26.0" />
     <PackageReference Include="DnsClient" Version="1.8.0" />
     <PackageReference Include="Functions.Worker.Extensions.HttpApi" Version="3.0.5" />
     <PackageReference Include="Google.Apis.Dns.v1" Version="1.74.0.4128" />
diff --git a/src/Acmebot.App/Functions/Orchestration/CertificateIssuanceOrchestrator.cs b/src/Acmebot.App/Functions/Orchestration/CertificateIssuanceOrchestrator.cs
@@ -27,7 +27,7 @@ public async Task IssueCertificate([OrchestrationTrigger] TaskOrchestrationConte
             certificatePolicyItem.DnsProviderName = await context.CallDns01PreconditionAsync(certificatePolicyItem);
 
             // 新しく ACME Order を作成する (ARI で更新扱いにする場合は既存証明書の Certificate ID を replaces に指定)
-            var orderDetails = await context.CallOrderAsync((certificatePolicyItem.DnsNames, certificatePolicyItem.CertificateId));
+            var orderDetails = await context.CallOrderAsync((certificatePolicyItem.DnsNames, /*certificatePolicyItem.CertificateId*/ null));
 
             // 既に確認済みの場合は Challenge をスキップする
             if (orderDetails.Payload.Status != AcmeOrderStatuses.Ready)
diff --git a/src/Acmebot.App/Program.cs b/src/Acmebot.App/Program.cs

Original file line number	Diff line number	Diff line change
`@@ -47,6 +47,7 @@ var workspaceName = 'log-${appNamePrefix}-${take(generatedToken, 4)}'`
`47`	`47`	`var storageAccountName = 'st${generatedToken}func'`
`48`	`48`	`var keyVaultName = 'kv-${appNamePrefix}-${take(generatedToken, 4)}'`
`49`	`49`	`var deploymentStorageContainerName = 'app-package-${take(appNamePrefix, 32)}-${take(generatedToken, 7)}'`
	`50`	`+var stateStorageContainerName = 'acmebot-state'`
`50`	`51`
`51`	`52`	`var roleDefinitionId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions/', 'a4417e6f-fecd-4de8-b567-7b0420556985')`
`52`	`53`
`@@ -105,6 +106,13 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2025-06-01' = {`
`105`	`106`	`publicAccess: 'None'`
`106`	`107`	`}`
`107`	`108`	`}`
	`109`	`+`
	`110`	`+ resource stateContainer 'containers' = {`
	`111`	`+ name: stateStorageContainerName`
	`112`	`+ properties: {`
	`113`	`+ publicAccess: 'None'`
	`114`	`+ }`
	`115`	`+ }`
`108`	`116`	`}`
`109`	`117`	`}`
`110`	`118`
Original file line number	Diff line number	Diff line change
`@@ -83,6 +83,7 @@ var workspaceName = resourceNames.logAnalyticsWorkspaceName`
`83`	`83`	`var storageAccountName = resourceNames.storageAccountName`
`84`	`84`	`var newKeyVaultName = resourceNames.keyVaultName`
`85`	`85`	`var deploymentStorageContainerName = 'app-package-${toLower(functionAppName)}'`
	`86`	`+var stateStorageContainerName = 'acmebot-state'`
`86`	`87`
`87`	`88`	`var createKeyVault = keyVault.createNew`
`88`	`89`	`var createLogAnalyticsWorkspace = monitoring.createLogAnalyticsWorkspace`
`@@ -331,6 +332,13 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2025-06-01' = {`
`331`	`332`	`publicAccess: 'None'`
`332`	`333`	`}`
`333`	`334`	`}`
	`335`	`+`
	`336`	`+ resource stateContainer 'containers' = {`
	`337`	`+ name: stateStorageContainerName`
	`338`	`+ properties: {`
	`339`	`+ publicAccess: 'None'`
	`340`	`+ }`
	`341`	`+ }`
`334`	`342`	`}`
`335`	`343`	`}`
`336`	`344`