Secure Table Access Token Generator

Build a secure access token generator for cloud table storage that creates time-limited, permission-scoped access tokens with network-level security controls.

Requirements

Core Functionality

The system must generate access tokens with the following security features:

1. Time-based Access Control: Tokens must be valid only within a specified time window, with both start and expiry timestamps
2. Permission Scoping: Tokens must support granular permissions including read, add, update, and delete operations
3. IP-based Restrictions: Tokens must enforce network-level security by restricting access to specific IP addresses or IP ranges
4. Protocol Enforcement: Tokens must enforce HTTPS-only access to prevent protocol downgrade attacks

Input Parameters

The generator must accept:

• Storage account credentials (account name and key)
• Table name for which to generate the token
• Start time (when token becomes valid)
• Expiry time (when token expires)
• Permission set (combination of read, add, update, delete)
• IP address or IP range restriction
• Protocol requirement (HTTPS only)

Output

The generator must return a valid access token string that can be used to authenticate table operations.

Test Cases

Basic Token Generation

• Generate a token for a table with read and add permissions that is valid for 1 hour starting now, with no IP restrictions @test

IP Restriction

• Generate a token restricted to a single IP address (e.g., "192.168.1.100") with read permission @test
• Generate a token restricted to an IP range (e.g., "192.168.1.0-192.168.1.255") with read and update permissions @test

Permission Combinations

• Generate a token with all permissions (read, add, update, delete) @test
• Generate a token with only delete permission @test

Time-based Access

• Generate a token that starts 1 hour in the future and expires 2 hours after that @test

Implementation

@generates

API

def generate_secure_table_token(
    account_name: str,
    account_key: str,
    table_name: str,
    start_time: datetime,
    expiry_time: datetime,
    permissions: str,
    ip_address: str = None,
    require_https: bool = True
) -> str:
    """
    Generate a secure access token for table storage operations.

    Args:
        account_name: The storage account name
        account_key: The storage account access key
        table_name: Name of the table to grant access to
        start_time: When the token becomes valid
        expiry_time: When the token expires
        permissions: String containing permission letters (r=read, a=add, u=update, d=delete)
        ip_address: Optional IP address or range (e.g., "192.168.1.100" or "192.168.1.0-192.168.1.255")
        require_https: Whether to enforce HTTPS-only access (default: True)

    Returns:
        str: The generated access token
    """
    pass

Dependencies { .dependencies }

azure-data-tables { .dependency }

Provides table storage access and token generation capabilities.