static string GetContainerSasUri(CloudBlobContainer container)
 {
     SharedAccessBlobPolicy sasConstraints = new SharedAccessBlobPolicy();
     sasConstraints.SharedAccessExpiryTime = DateTime.UtcNow.AddHours(24);
     sasConstraints.Permissions = SharedAccessBlobPermissions.Write | SharedAccessBlobPermissions.List;
     string sasContainerToken = container.GetSharedAccessSignature(sasConstraints);
     return container.Uri + sasContainerToken;
 }

        /// <summary>
        /// We return a limited access key that allows the caller to upload a file to this specific destination for defined period of time
        /// </summary>
        private StorageEntitySas GetSharedAccessReferenceForUpload(string blobName)
        {
            var blobClient = this.account.CreateCloudBlobClient();
            var container = blobClient.GetContainerReference(this.blobContainer);

            var blob = container.GetBlockBlobReference(blobName);

            var policy = new SharedAccessBlobPolicy
            {
                Permissions = SharedAccessBlobPermissions.Write,

                // Create a signature for 5 min earlier to leave room for clock skew
                SharedAccessStartTime = DateTime.UtcNow.AddMinutes(-5),

                // Create the signature for as long as necessary -  we can 
                SharedAccessExpiryTime = DateTime.UtcNow.AddMinutes(5)
            };

            var sas = blob.GetSharedAccessSignature(policy);

            return new StorageEntitySas
            {
                BlobUri = blob.Uri,
                Credentials = sas,
                Name = blobName
            };
        }

        public GetUploadLocationResponse Post(GetUploadLocationRequest request)
        {
            _log.StartLog(request);
            try
            {

                var contName = "deletable" + Guid.NewGuid().ToString("D").ToLowerInvariant();

                var container = _azure.CreateContainerIfDoesNotExist(contName);

                var blobPolicy = new SharedAccessBlobPolicy {
                                                                Permissions = SharedAccessBlobPermissions.Read | SharedAccessBlobPermissions.Write | SharedAccessBlobPermissions.List,
                                                                SharedAccessExpiryTime = DateTimeOffset.Now.AddHours(HOURS_FILE_SHOULD_BE_ACCESSIBLE)

                                                            };

                var permissions = new BlobContainerPermissions();
                permissions.SharedAccessPolicies.Add("mypolicy", blobPolicy);
                permissions.PublicAccess = BlobContainerPublicAccessType.Container;
                container.SetPermissions(permissions);
                var sharedAccessSignature = container.GetSharedAccessSignature("mypolicy");

                return new GetUploadLocationResponse {Name= container.Name, Location = container.Uri.ToString(), Sas = sharedAccessSignature, Account = _azure.Account};
            }
            catch (Exception e)
            {
                _log.Fatal("error", e);
                Errors.Add(e.Message + " " + e.StackTrace);

                return new GetUploadLocationResponse {Errors = Errors};
            }
        }

        public override bool Execute()
        {
            Log.LogMessage(MessageImportance.High, "Creating container named '{0}' in storage account {1}.", ContainerName, AccountName);

            CloudStorageAccount storageAccount = CloudStorageAccount.Parse(string.Format("DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1}", AccountName, AccountKey));
            CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();
            CloudBlobContainer newContainer = blobClient.GetContainerReference(ContainerName);
            newContainer.CreateIfNotExists();
            StorageUri = newContainer.Uri.ToString();

            if (ReadOnlyTokenDaysValid > 0)
            {
                var sasRO = new SharedAccessBlobPolicy();
                sasRO.SharedAccessExpiryTime = DateTime.UtcNow.AddDays(ReadOnlyTokenDaysValid);
                sasRO.Permissions = SharedAccessBlobPermissions.Read;
                ReadOnlyToken = newContainer.GetSharedAccessSignature(sasRO);
            }

            if (WriteOnlyTokenDaysValid > 0)
            {
                var sasWO = new SharedAccessBlobPolicy();
                sasWO.SharedAccessExpiryTime = DateTime.UtcNow.AddDays(WriteOnlyTokenDaysValid);
                sasWO.Permissions = SharedAccessBlobPermissions.Write;
                WriteOnlyToken = newContainer.GetSharedAccessSignature(sasWO);
            }

            return true;
        }

 public PolicyView(string name, SharedAccessBlobPolicy policy)
 {
     PolicyName = name;
     Policy = policy;
     StartTime = Policy.SharedAccessStartTime.ToString();
     ExpiryTime = Policy.SharedAccessExpiryTime.ToString();
 }

 public void SetupAccessPolicyPermissionTest()
 {
     SharedAccessBlobPolicy accessPolicy = new SharedAccessBlobPolicy();
     command.SetupAccessPolicyPermission(accessPolicy, "");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessBlobPermissions.None);
     accessPolicy.Permissions = SharedAccessBlobPermissions.Read;
     command.SetupAccessPolicyPermission(accessPolicy, "");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessBlobPermissions.Read);
     command.SetupAccessPolicyPermission(accessPolicy, "D");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessBlobPermissions.Delete);
     command.SetupAccessPolicyPermission(accessPolicy, "DdDdd");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessBlobPermissions.Delete);
     command.SetupAccessPolicyPermission(accessPolicy, "DR");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessBlobPermissions.Delete | SharedAccessBlobPermissions.Read);
     command.SetupAccessPolicyPermission(accessPolicy, "DRrddrrr");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessBlobPermissions.Delete | SharedAccessBlobPermissions.Read);
     command.SetupAccessPolicyPermission(accessPolicy, "rwd");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessBlobPermissions.Delete | SharedAccessBlobPermissions.Read | SharedAccessBlobPermissions.Write);
     command.SetupAccessPolicyPermission(accessPolicy, "dwr");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessBlobPermissions.Delete | SharedAccessBlobPermissions.Read | SharedAccessBlobPermissions.Write);
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "rwDl"));
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "x"));
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "rwx"));
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "ABC"));
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "xyz"));
 }

        static string GetBlobSasUri(CloudBlobContainer container)
        {
            //Get a reference to a blob within the container.
            CloudBlockBlob blob = container.GetBlockBlobReference("sasblob.txt");

            //Upload text to the blob. If the blob does not yet exist, it will be created.
            //If the blob does exist, its existing content will be overwritten.
            string blobContent = "This blob will be accessible to clients via a Shared Access Signature.";
            MemoryStream ms = new MemoryStream(Encoding.UTF8.GetBytes(blobContent));
            ms.Position = 0;
            using (ms)
            {
                blob.UploadFromStream(ms);
            }

            //Set the expiry time and permissions for the blob.
            //In this case the start time is specified as a few minutes in the past, to mitigate clock skew.
            //The shared access signature will be valid immediately.
            SharedAccessBlobPolicy sasConstraints = new SharedAccessBlobPolicy();
            sasConstraints.SharedAccessStartTime = DateTime.UtcNow.AddMinutes(-5);
            sasConstraints.SharedAccessExpiryTime = DateTime.UtcNow.AddHours(4);
            sasConstraints.Permissions = SharedAccessBlobPermissions.Read | SharedAccessBlobPermissions.Write;

            //Generate the shared access signature on the blob, setting the constraints directly on the signature.
            string sasBlobToken = blob.GetSharedAccessSignature(sasConstraints);

            //Return the URI string for the container, including the SAS token.
            return blob.Uri + sasBlobToken;
        }

        public void ValidateSetupAccessPolicyPermissionTest()
        {
            SharedAccessBlobPolicy blobAccessPolicy = new SharedAccessBlobPolicy();
            AccessPolicyHelper.SetupAccessPolicyPermission(blobAccessPolicy, null);
            Assert.AreEqual(blobAccessPolicy.Permissions, SharedAccessBlobPermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(blobAccessPolicy, "");
            Assert.AreEqual(blobAccessPolicy.Permissions, SharedAccessBlobPermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(blobAccessPolicy, "D");
            Assert.AreEqual(blobAccessPolicy.Permissions, SharedAccessBlobPermissions.Delete);

            SharedAccessTablePolicy tableAccessPolicy = new SharedAccessTablePolicy();
            AccessPolicyHelper.SetupAccessPolicyPermission(tableAccessPolicy, null);
            Assert.AreEqual(tableAccessPolicy.Permissions, SharedAccessTablePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(tableAccessPolicy, "");
            Assert.AreEqual(tableAccessPolicy.Permissions, SharedAccessTablePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(tableAccessPolicy, "ar");
            Assert.AreEqual(tableAccessPolicy.Permissions, SharedAccessTablePermissions.Add | SharedAccessTablePermissions.Query);

            SharedAccessQueuePolicy queueAccessPolicy = new SharedAccessQueuePolicy();
            AccessPolicyHelper.SetupAccessPolicyPermission(queueAccessPolicy, null);
            Assert.AreEqual(queueAccessPolicy.Permissions, SharedAccessQueuePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(queueAccessPolicy, "");
            Assert.AreEqual(queueAccessPolicy.Permissions, SharedAccessQueuePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(queueAccessPolicy, "p");
            Assert.AreEqual(queueAccessPolicy.Permissions, SharedAccessQueuePermissions.ProcessMessages);

            SharedAccessFilePolicy fileAccessPolicy = new SharedAccessFilePolicy();
            AccessPolicyHelper.SetupAccessPolicyPermission(fileAccessPolicy, null);
            Assert.AreEqual(fileAccessPolicy.Permissions, SharedAccessFilePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(fileAccessPolicy, "");
            Assert.AreEqual(fileAccessPolicy.Permissions, SharedAccessFilePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(fileAccessPolicy, "lwc");
            Assert.AreEqual(fileAccessPolicy.Permissions, SharedAccessFilePermissions.List | SharedAccessFilePermissions.Write | SharedAccessFilePermissions.Create); 

        }

        /// <summary>
        /// Constructs a container shared access signature.
        /// </summary>
        /// <param name="storageAccountName">The Azure Storage account name.</param>
        /// <param name="storageAccountKey">The Azure Storage account key.</param>
        /// <param name="storageEndpoint">The Azure Storage endpoint.</param>
        /// <param name="containerName">The container name to construct a SAS for.</param>
        /// <returns>The container URL with the SAS.</returns>
        public static string ConstructContainerSas(
            string storageAccountName,
            string storageAccountKey,
            string storageEndpoint,
            string containerName)
        {
            //Lowercase the container name because containers must always be all lower case
            containerName = containerName.ToLower();

            StorageCredentials credentials = new StorageCredentials(storageAccountName, storageAccountKey);
            CloudStorageAccount storageAccount = new CloudStorageAccount(credentials, storageEndpoint, true);

            CloudBlobClient client = storageAccount.CreateCloudBlobClient();

            CloudBlobContainer container = client.GetContainerReference(containerName);

            DateTimeOffset sasStartTime = DateTime.UtcNow;
            TimeSpan sasDuration = TimeSpan.FromHours(2);
            DateTimeOffset sasEndTime = sasStartTime.Add(sasDuration);

            SharedAccessBlobPolicy sasPolicy = new SharedAccessBlobPolicy()
                                                   {
                                                       Permissions = SharedAccessBlobPermissions.Read,
                                                       SharedAccessExpiryTime = sasEndTime
                                                   };

            string sasString = container.GetSharedAccessSignature(sasPolicy);
            return string.Format("{0}{1}", container.Uri, sasString); ;
        }

        public ActionResult GetTimbradoLog()
        {
            CloudStorageAccount account = CloudStorageAccount.Parse(ConfigurationManager.AppSettings["AzureDefaultStorageConnectionString"]);
            CloudBlobClient client = account.CreateCloudBlobClient();
            CloudBlobContainer container = client.GetContainerReference(ConfigurationManager.AppSettings["AzureDefaultStorage"]);

            var list = container.ListBlobs();
            var itemList = new List<CloudStorageItem>();

            var readPolicy = new Microsoft.WindowsAzure.Storage.Blob.SharedAccessBlobPolicy() {
                Permissions = Microsoft.WindowsAzure.Storage.Blob.SharedAccessBlobPermissions.Read, // SharedAccessPermissions.Read,
                SharedAccessExpiryTime = DateTime.UtcNow + TimeSpan.FromMinutes(10)
            };

            foreach (var blob in list.OfType<Microsoft.WindowsAzure.Storage.Blob.CloudBlockBlob>().OrderByDescending(x => x.Name)) {
                blob.FetchAttributes();
                var item = new CloudStorageItem {
                    Name = blob.Name,
                    Url = new Uri(blob.Uri.AbsoluteUri + blob.GetSharedAccessSignature(readPolicy)).ToString(), //  blob.Uri.AbsolutePath
                    ContentMD5 = blob.Properties.ContentMD5
                };
                itemList.Add(item);
            }

            var model = new GetTimbradoLogViewModel {
                CloudStorageItems = itemList
            };

            return View(model);
        }

        /// <summary>
        /// Generates the blob container SAS URL.
        /// </summary>
        /// <param name="storageAccount">The storage account.</param>
        /// <param name="dto">The data transfer object.</param>
        private static void GenerateBlobContainerSasUrl(CloudStorageAccount storageAccount, DataDto dto)
        {
            // Create the blob client.
            var blobClient = storageAccount.CreateCloudBlobClient();

            // Use the client's name as container
            var container = blobClient.GetContainerReference("datacontainer");

            // Create the container if it doesn't already exist.
            // TODO: Avoid the next line of code in productive systems, since it makes a call to azure blob storage.
            // It's better to make sure the container always exists from the beginning.
            container.CreateIfNotExists();

            // Set the expiry time and permissions for the container.
            // In this case no start time is specified, so the shared access signature becomes valid immediately.
            var accessBlobPolicy = new SharedAccessBlobPolicy();
            accessBlobPolicy.SharedAccessExpiryTime = DateTime.UtcNow.AddHours(1);
            accessBlobPolicy.Permissions = SharedAccessBlobPermissions.Write;

            // Generate the SAS token. No access policy identifier is used which makes it non revocable.
            // The token is generated without issuing any calls against the Windows Azure Storage.
            string sasToken = container.GetSharedAccessSignature(accessBlobPolicy);

            dto.BlobContainerUrl = container.Uri;
            dto.BlobSasToken = sasToken;
        }

        private async Task<StorageEntitySas> GetSharedAccessReferenceForDownload(string blobName)
        {
            var blobClient = this.account.CreateCloudBlobClient();
            var container = blobClient.GetContainerReference(this.blobContainer);

            var blob = container.GetBlockBlobReference(blobName);
            
            if (!await blob.ExistsAsync())
            {
                throw new Exception("Blob does not exist");
            }

            var policy = new SharedAccessBlobPolicy
            {
                Permissions = SharedAccessBlobPermissions.Read,

                // Create a signature for 5 min earlier to leave room for clock skew
                SharedAccessStartTime = DateTime.UtcNow.AddMinutes(-5),

                // Create the signature for as long as necessary -  we can 
                SharedAccessExpiryTime = DateTime.UtcNow.AddMinutes(5)
            };
            
            var sas = blob.GetSharedAccessSignature(policy);

            return new StorageEntitySas
            {
                BlobUri = blob.Uri,
                Credentials = sas
            };
        }

 public Uri GetUri(SharedAccessBlobPermissions permissions)
 {
     var policy = new SharedAccessBlobPolicy
     {
         SharedAccessExpiryTime = DateTime.UtcNow.AddDays(31.0),
         Permissions = permissions
     };
     return new Uri(_containerReference.Uri, _containerReference.GetSharedAccessSignature(policy) + "&comp=list&restype=container");
 }

        private async Task<string> GetBlobContainerSas(DateTimeOffset expirationTime, string clientId)
        {
            CloudBlobContainer container = await HelperMethods.GetJobContainer(clientId);

            SharedAccessBlobPolicy policy = new SharedAccessBlobPolicy();
            policy.SharedAccessExpiryTime = expirationTime;
            policy.Permissions = SharedAccessBlobPermissions.Read | SharedAccessBlobPermissions.Write | SharedAccessBlobPermissions.Delete;
            return container.Uri + container.GetSharedAccessSignature(policy);
        }

        public static async Task<string> SaveBinaryToAzureStorage(MobileAppSettingsDictionary settings, string blobId, string blobData )
        {
            string storageAccountName;
            string storageAccountKey;


            // Try to get the Azure storage account token from app settings.  
            if (!(settings.TryGetValue("STORAGE_ACCOUNT_NAME", out storageAccountName) |
                settings.TryGetValue("STORAGE_ACCOUNT_ACCESS_KEY", out storageAccountKey)))
            {
                return string.Empty;
            }

            // Set the URI for the Blob Storage service.
            Uri blobEndpoint = new Uri(string.Format("https://{0}.blob.core.windows.net", storageAccountName));

            // Create the BLOB service client.
            CloudBlobClient blobClient = new CloudBlobClient(blobEndpoint,
                new StorageCredentials(storageAccountName, storageAccountKey));

            string ContainerName = "beerdrinkinimages";

            // Create a container, if it doesn't already exist.
            CloudBlobContainer container = blobClient.GetContainerReference(ContainerName);
            await container.CreateIfNotExistsAsync();

            // Create a shared access permission policy. 
            BlobContainerPermissions containerPermissions = new BlobContainerPermissions();

            // Enable anonymous read access to BLOBs.
            containerPermissions.PublicAccess = BlobContainerPublicAccessType.Blob;
            container.SetPermissions(containerPermissions);

            // Define a policy that gives write access to the container for 1 minute.                                   
            SharedAccessBlobPolicy sasPolicy = new SharedAccessBlobPolicy()
            {
                SharedAccessStartTime = DateTime.UtcNow,
                SharedAccessExpiryTime = DateTime.UtcNow.AddMinutes(1),
                Permissions = SharedAccessBlobPermissions.Write
            };

            // Get the SAS as a string.
            var SasQueryString = container.GetSharedAccessSignature(sasPolicy);

            // Set the URL used to store the image.
            var avatarUri = string.Format("{0}{1}/{2}", blobEndpoint.ToString(),
                ContainerName, blobId.ToLower());

            // Upload the new image as a BLOB from the string.
            CloudBlockBlob blobFromSASCredential =
                container.GetBlockBlobReference(blobId.ToLower());
            blobFromSASCredential.UploadTextAsync(blobData);

            return avatarUri;
        }

 public static string GetSasUrl(ICloudBlob blob, SharedAccessBlobPermissions permissions)
 {
     var policy = new SharedAccessBlobPolicy
     {
         SharedAccessExpiryTime = DateTime.Now.AddMinutes(30),
         Permissions = permissions
     };
     string sasBlobToken = blob.GetSharedAccessSignature(policy);
     //Return the URI string for the container, including the SAS token.
     return blob.Uri + sasBlobToken;
 }

 public Uri GetWriteUrl(string fileName)
 {
     var now = DateTimeOffset.UtcNow;
     var sharedAccessPolicy = new SharedAccessBlobPolicy()
     {
         Permissions = SharedAccessBlobPermissions.Write,
         SharedAccessStartTime = now,
         SharedAccessExpiryTime = now.AddMinutes(2)
     };
     var blob = this.stagingContainer.GetBlockBlobReference(fileName);
     var sharedAccessToken = blob.GetSharedAccessSignature(sharedAccessPolicy);
     var blobUri = blob.Uri.ToString();
     return new Uri($"{blobUri}{sharedAccessToken}");
 }

        static string GetContainerSasUri(CloudBlobContainer container)
        {
            //Set the expiry time and permissions for the container.
            //In this case no start time is specified, so the shared access signature becomes valid immediately.
            SharedAccessBlobPolicy sasConstraints = new SharedAccessBlobPolicy();
            sasConstraints.SharedAccessExpiryTime = DateTime.UtcNow.AddHours(24);
            sasConstraints.SharedAccessStartTime = DateTime.UtcNow;
            sasConstraints.Permissions = SharedAccessBlobPermissions.Write | SharedAccessBlobPermissions.List;

            //Generate the shared access signature on the container, setting the constraints directly on the signature.
            string sasContainerToken = container.GetSharedAccessSignature(sasConstraints);

            //Return the URI string for the container, including the SAS token.
            return container.Uri + sasContainerToken;
        }

        public string GetDownloadUrl()
        {
            if (_fileStoredata.IsPublic)
            {
                return string.IsNullOrEmpty(_fileStoredata.CdnUrl) ? _blob.Uri.ToString() : new Uri(new Uri(_fileStoredata.CdnUrl),_blob.Uri.PathAndQuery).ToString();
            }

            var policy = new SharedAccessBlobPolicy()
            {
                SharedAccessExpiryTime = DateTime.UtcNow.AddHours(2),
                Permissions = SharedAccessBlobPermissions.Read
            };

            var accessSignature = _blob.GetSharedAccessSignature(policy);
            return _blob.Uri + accessSignature;
        }

        /// <summary>
        /// Get the complete query builder for creating the Shared Access Signature query.
        /// </summary>
        /// <param name="policy">The shared access policy to hash.</param>
        /// <param name="headers">The optional header values to set for a blob returned with this SAS.</param>
        /// <param name="accessPolicyIdentifier">An optional identifier for the policy.</param>
        /// <param name="resourceType">Either "b" for blobs or "c" for containers.</param>
        /// <param name="signature">The signature to use.</param>
        /// <param name="accountKeyName">The name of the key used to create the signature, or <c>null</c> if the key is implicit.</param>
        /// <param name="sasVersion">A string indicating the desired SAS version to use, in storage service version format.</param>
        /// <param name="protocols">The HTTP/HTTPS protocols for Account SAS.</param>
        /// <param name="ipAddressOrRange">The IP range for IPSAS.</param>
        /// <returns>The finished query builder.</returns>
        internal static UriQueryBuilder GetSignature(
            SharedAccessBlobPolicy policy,
            SharedAccessBlobHeaders headers,
            string accessPolicyIdentifier,
            string resourceType,
            string signature,
            string accountKeyName,
            string sasVersion,
            SharedAccessProtocol? protocols,
            IPAddressOrRange ipAddressOrRange
            )
        {
            CommonUtility.AssertNotNullOrEmpty("resourceType", resourceType);

            UriQueryBuilder builder = new UriQueryBuilder();

            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedVersion, sasVersion);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedResource, resourceType);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedIdentifier, accessPolicyIdentifier);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedKey, accountKeyName);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.Signature, signature);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedProtocols, GetProtocolString(protocols));
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedIP, ipAddressOrRange == null ? null : ipAddressOrRange.ToString());

            if (policy != null)
            {
                AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedStart, GetDateTimeOrNull(policy.SharedAccessStartTime));
                AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedExpiry, GetDateTimeOrNull(policy.SharedAccessExpiryTime));

                string permissions = SharedAccessBlobPolicy.PermissionsToString(policy.Permissions);
                if (!string.IsNullOrEmpty(permissions))
                {
                    AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedPermissions, permissions);
                }
            }

            if (headers != null)
            {
                AddEscapedIfNotNull(builder, Constants.QueryConstants.CacheControl, headers.CacheControl);
                AddEscapedIfNotNull(builder, Constants.QueryConstants.ContentType, headers.ContentType);
                AddEscapedIfNotNull(builder, Constants.QueryConstants.ContentEncoding, headers.ContentEncoding);
                AddEscapedIfNotNull(builder, Constants.QueryConstants.ContentLanguage, headers.ContentLanguage);
                AddEscapedIfNotNull(builder, Constants.QueryConstants.ContentDisposition, headers.ContentDisposition);
            }

            return builder;
        }