feat(pam): snowflake account

[lb-vn]

Description 📣

New Snowflake account type for PAM with 3 auth methods. Supports web access and CLI access (proxy).

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

# Here's some code block to paste some code snippets

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[linear]

PAM-426

[veria-ai]

PR overview

This pull request adds Snowflake account support to PAM, including REST-based password authentication and session token handling.

Five security issues have been addressed, with one remaining concern in password-authenticated sessions. The session token acts as an offline password verifier, allowing a PAM user to test guesses and potentially recover a weak Snowflake password for direct access outside the recorded session.

Open issues (1)

• Low: Session token exposes an offline password verifier — packages/pam/handlers/snowflake/rest.go:129

Fixed/addressed: 5 · PR risk: 4/10

[greptile-apps]

Confidence Score: 0/5

The PR is not safe to merge until credential-bearing Snowflake destinations are constrained and request and response decompression are bounded.

Findings

1.   Account Enables Request Redirection ▶
2.   Decompressed Requests Are Unbounded ▶
3.   Result Responses Are Unbounded ▶
4.  JDBC Parameters Are Unescaped ▶

Summary

• Adds Snowflake login, query polling, cancellation, token renewal, result translation, and logout behavior.
• Integrates Snowflake credentials and resource routing throughout PAM and gateway connection tests.
• Adds focused proxy, authentication, cancellation, parsing, and uploader tests.
• Introduces blocking outbound-request and memory-exhaustion risks that should be addressed before merge.