Feat support snowflake spcs OIDC

[costrouc]

Moved to a branch within the repository to run tests so closed PR #715

Intent

Prior to recent changes on the Snowflake side, proxied authentication headers carried enough information for Connect running in Snowflake SPCS to identify users. With the move to OIDC, Connect servers no longer trust Snowflake headers for username identification. This requires users to provide both a Snowflake connection (for proxied authentication) and a Connect API key (for OIDC authentication).

This commit is how we will be performing authentication within the Snowflake Posit Team Native Application. This will serve as a good example of how it can be supported in the rsconnect* packages. Posit Connect supports alternate headers for authorization https://docs.posit.co/connect/admin/authentication/proxied/#api-use.

I think this PR also highlights the importance of OIDC device flow authentication which is supported in PPM
https://packagemanager.rstudio.com/__docs__/admin/appendix//cli/rspm_login_sso.html which would again eliminate the need for an api key which this PR reintroduces for SPCS.

Example

(.venv) costrouc@puffin:~/p/posit-dev/rsconnect-python$ rsconnect add --server https://abcdefghijklmnop-org-account.snowflakecomputing.app/ --snowflake-connection-name myconnection --name dev-test --api-key X8iPx.....ZVPxSk
Checking Posit Connect (SPCS) credential...      [OK]
Updated Posit Connect (SPCS) credential "dev-test".

Type of Change

• Bug Fix
• New Feature
• Breaking Change (this changes how SPCS rsconnect authentication is performed)

Approach

Automated Tests

Directions for Reviewers

Checklist

• I have updated CHANGELOG.md to cover notable changes.
• I have updated all related GitHub issues to reflect their current state.

[github-actions]

PR Preview Action v1.6.2
Preview removed because the pull request was closed.
2025-10-30 20:22 UTC

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
5156	3999	78%	0%	🟢

New Files

No new covered files...

Modified Files

File	Coverage	Status
rsconnect/api.py	77%	🟢
rsconnect/main.py	69%	🟢
rsconnect/metadata.py	91%	🟢
TOTAL	79%	🟢

updated for commit: 6da5825 by action🐍

[aronatkins]

Additional changes needed:

rsconnect-python/rsconnect/metadata.py

Lines 350 to 357 in f06b8ee

	if api_key:
	target_data = dict(api_key=api_key, insecure=insecure, ca_cert=ca_data)
	elif snowflake_connection_name:
	target_data = dict(snowflake_connection_name=snowflake_connection_name)
	elif account_name:
	target_data = dict(account_name=account_name, token=token, secret=secret)
	else:
	target_data = dict(token=token, secret=secret)

[aronatkins]

Additional changes needed:

rsconnect-python/rsconnect/main.py

Lines 587 to 595 in f06b8ee

	real_server_spcs = api.SPCSConnectServer(server, api_key, snowflake_connection_name)
	_test_spcs_creds(real_server_spcs)
	server_store.set(name, server, snowflake_connection_name=snowflake_connection_name)
	if old_server:
	click.echo('Updated {} credential "{}".'.format(real_server_spcs.remote_name, name))
	else:
	click.echo('Added {} credential "{}".'.format(real_server_spcs.remote_name, name))

[aronatkins]

Both changes have been made and I have been able to successfully deploy to SPCS-hosted Connect using a saved server configuration.

[aronatkins]

rebased from main to pick up CI changes.