Feat support snowflake spcs OIDC

[costrouc]

Moved to a branch within the repository to run tests so closed PR #715

Intent

Prior to recent changes on the Snowflake side, proxied authentication headers carried enough information for Connect running in Snowflake SPCS to identify users. With the move to OIDC, Connect servers no longer trust Snowflake headers for username identification. This requires users to provide both a Snowflake connection (for proxied authentication) and a Connect API key (for OIDC authentication).

This commit is how we will be performing authentication within the Snowflake Posit Team Native Application. This will serve as a good example of how it can be supported in the rsconnect* packages. Posit Connect supports alternate headers for authorization https://docs.posit.co/connect/admin/authentication/proxied/#api-use.

I think this PR also highlights the importance of OIDC device flow authentication which is supported in PPM
https://packagemanager.rstudio.com/__docs__/admin/appendix//cli/rspm_login_sso.html which would again eliminate the need for an api key which this PR reintroduces for SPCS.

Example

(.venv) costrouc@puffin:~/p/posit-dev/rsconnect-python$ rsconnect add --server https://abcdefghijklmnop-org-account.snowflakecomputing.app/ --snowflake-connection-name myconnection --name dev-test --api-key X8iPx.....ZVPxSk
Checking Posit Connect (SPCS) credential...      [OK]
Updated Posit Connect (SPCS) credential "dev-test".

Type of Change

• Bug Fix
• New Feature
• Breaking Change (this changes how SPCS rsconnect authentication is performed)

Approach

Automated Tests

Directions for Reviewers

Checklist

• I have updated CHANGELOG.md to cover notable changes.
• I have updated all related GitHub issues to reflect their current state.

[github-actions]

PR Preview Action v1.6.2
🚀 View preview at https://posit-dev.github.io/rsconnect-python/pr-preview/pr-717/
Built to branch gh-pages at 2025-10-28 18:16 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
5154	3999	78%	0%	🟢

New Files

No new covered files...

Modified Files

File	Coverage	Status
rsconnect/api.py	77%	🟢
rsconnect/main.py	69%	🟢
TOTAL	73%	🟢

updated for commit: f06b8ee by action🐍

[aronatkins]

Additional changes needed:

rsconnect-python/rsconnect/metadata.py

Lines 350 to 357 in f06b8ee

	if api_key:
	target_data = dict(api_key=api_key, insecure=insecure, ca_cert=ca_data)
	elif snowflake_connection_name:
	target_data = dict(snowflake_connection_name=snowflake_connection_name)
	elif account_name:
	target_data = dict(account_name=account_name, token=token, secret=secret)
	else:
	target_data = dict(token=token, secret=secret)

[aronatkins]

Additional changes needed:

rsconnect-python/rsconnect/main.py

Lines 587 to 595 in f06b8ee

	real_server_spcs = api.SPCSConnectServer(server, api_key, snowflake_connection_name)
	_test_spcs_creds(real_server_spcs)
	server_store.set(name, server, snowflake_connection_name=snowflake_connection_name)
	if old_server:
	click.echo('Updated {} credential "{}".'.format(real_server_spcs.remote_name, name))
	else:
	click.echo('Added {} credential "{}".'.format(real_server_spcs.remote_name, name))

[aronatkins]

Both changes have been made and I have been able to successfully deploy to SPCS-hosted Connect using a saved server configuration.