[DO NOT MERGE] Add support for async io

[sfc-gh-turbaszek]

Please answer these questions before submitting your pull requests. Thanks!

1. What GitHub issue is this PR addressing? Make sure that there is an accompanying issue to your PR.

   Fixes #NNNN

2. Fill out the following pre-review checklist:

   • I am adding a new automated test(s) to verify correctness of my new code
   • I am adding new logging messages
   • I am adding a new telemetry message
   • I am modifying authorization mechanisms
   • I am adding new credentials
   • I am modifying OCSP code
   • I am adding a new dependency

3. Please describe how your code solves the related issue.

   Please write a short description of how your code change solves the related issue.

4. (Optional) PR for stored-proc connector:

To fix the problem, we must ensure that sensitive data such as passwords, passcodes, authentication tokens, and related credentials are never logged, regardless of whitelist configuration. The best way to do this is to explicitly identify and mask all such keys in the data before logging, overriding any whitelist logic. We should define a set of sensitive keys ({"PASSCODE", ...}) and always redact these in any log output. The edit is localized to the debug log statement, so add a hardcoded redaction for sensitive keys regardless of the whitelist, e.g., always replacing the value of keys like "PASSCODE" with "******".

In src/snowflake/connector/aio/auth/_auth.py:

• Add a definition near the log statement for a set of sensitive keys.
• Change the dictionary comprehension for logging so that if a key is in the set of sensitive keys (case-insensitive), the value is always masked as "******", regardless of the whitelist. For non-sensitive keys, continue with the previous logic.
• No new dependencies are required.

Only code in the shown snippet (lines 141-152) needs modification.

---

To address this issue, avoid printing the entire authorization request URL containing sensitive OAuth parameters (especially client_id) directly to STDOUT. Instead, redact sensitive fields such as client_id from the printed URL. The best method is to parse and reconstruct the URL, replacing the value of any sensitive query parameters (e.g., client_id) with a placeholder or asterisks before displaying to the user.

How to fix:

• In AuthByOauthCode._ask_authorization_callback_from_user, before printing the authorization_request string, parse its query parameters, identify any that are considered sensitive (at minimum client_id; extendable to others like client_secret if present), and replace their values with a masked version.
• Reconstruct the URL with redacted values for display.

Where to fix:

• The main change is in the body of _ask_authorization_callback_from_user in src/snowflake/connector/auth/oauth_code.py, where authorization_request is printed.
• Introduce a helper function (within the class or file) named redact_query_params_from_url(url, sensitive_keys) -> str which redacts specified keys from the query string.

Details:

• The helper can use urllib.parse to split and process the URL.
• After redacting, use the masked URL in the print statement.

Imports/Requirements:

• No new external dependencies are needed; only the standard urllib.parse (already imported).

---

To fix the issue, we should parse the URL before making assertions about its structure. Instead of checking if the URL string starts with "https://test-account.snowflakecomputing.com:443", the code should use urllib.parse.urlparse to break the URL into its components and then check that the scheme, netloc, hostname, and port are all precisely what we expect. This guarantees that the domain check cannot be bypassed by clever string-prefix tricks.

In the context of test_dashed_url_account_name, we need to:

• Import urllib.parse.urlparse if not present.
• In the assertion, parse each URL from the mocked calls and assert that scheme, hostname, and port equal what is expected ("https", "test-account.snowflakecomputing.com", and 443).

Modify only the relevant region (lines 717–724), leaving the rest of the code unchanged.

To correctly check whether the log line includes an Azure blob storage URL (i.e., whether the hostname is actually blob.core.windows.net or a subdomain such as *.blob.core.windows.net), parse any URLs found in the log line, and check if any of their parsed hostnames end with .blob.core.windows.net or are exactly blob.core.windows.net.

Since log lines may contain more than just URLs, search each line for substrings that look like URLs (e.g., using re.findall with a URL pattern), and then use urllib.parse.urlparse to extract and analyze the hostname.

Required changes:

• Add an import for re and for urlparse (from urllib.parse import urlparse).
• Replace the condition at line 97 so that, for each line in caplog.text.splitlines(), all URLs within the line are parsed, and their hostnames checked to ensure that hostname is exactly or ends with .blob.core.windows.net.
• If any such URL is found and contains the expected token, trigger the assertion.

---

To fix this vulnerability, update the rsa.generate_private_key() call to use a key_size of at least 2048 bits in place of the current 1024. This change will ensure the generated RSA key meets current security best practices and cryptographic standards. You do not need to change any logic or functionality; simply replace key_size=1024 with key_size=2048 or greater in the affected function. No new imports or definitions are required, and the fix should be made in test/unit/test_ocsp.py within the create_x509_cert function.

---