SNOW-3643369: Always set explicit GCS credentials to prevent ADC probe in SPCS

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: sfc-gh-dheyman

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 # Changelog
 - v4.3.1-SNAPSHOT
+  - Fixed GCS-backed internal stage PUT failing with opaque `invalid_gcs_credentials` in SPCS pods on GCP: the GCS SDK's Application Default Credentials (ADC) probe was reaching out to `metadata.google.internal` which is unreachable inside SPCS; explicit credentials are now always set when a `GCS_ACCESS_TOKEN` is present, suppressing the ADC probe entirely. Also fixed `GCSAccessStrategyAwsSdk` rejecting custom GCS endpoints that lack an `https://` scheme prefix (e.g. bare `storage.me-central2.rep.googleapis.com`), mirroring the existing handling in `GCSDefaultAccessStrategy`. The catch-all in `setupGCSClient` now chains and logs the original exception instead of swallowing it (snowflakedb/snowflake-jdbc#2664).
   - Fixed Azure PUT memory leak where each PUT instantiated a fresh `BlobServiceClient` whose underlying reactor-netty stack the SDK exposes no API to release; the Azure SDK `HttpClient` and its `ConnectionProvider` are now shared across all PUTs in a session and disposed at session close, mirroring the existing S3 pattern (snowflakedb/snowflake-jdbc#2658).
   - Fixed `SFResultJsonParser2Failed: invalid escaped unicode character` when a chunked JSON result contained UTF-16 surrogate-pair `\u` escapes (e.g. emoji) and the read buffer happened to split exactly 9 bytes after `\u`; the off-by-one boundary guard in `ResultJsonParserV2` now reserves the full 10 bytes a surrogate pair requires (snowflakedb/snowflake-jdbc#2660).
 

src/main/java/net/snowflake/client/internal/jdbc/cloud/storage/GCSAccessStrategyAwsSdk.java

@@ -60,7 +60,8 @@ class GCSAccessStrategyAwsSdk implements GCSAccessStrategy {
     Optional<String> oEndpoint = stage.gcsCustomEndpoint();
     String endpoint = "https://storage.googleapis.com";
     if (oEndpoint.isPresent()) {
-      endpoint = oEndpoint.get();
+      String custom = oEndpoint.get();
+      endpoint = custom.startsWith("https://") ? custom : "https://" + custom;
     }
     if (stage.getStorageAccount() != null && endpoint.startsWith(stage.getStorageAccount())) {
       endpoint = endpoint.replaceFirst(stage.getStorageAccount() + ".", "");

src/main/java/net/snowflake/client/internal/jdbc/cloud/storage/GCSDefaultAccessStrategy.java

@@ -51,20 +51,18 @@ class GCSDefaultAccessStrategy implements GCSAccessStrategy {
       StorageOptions.Builder builder = StorageOptions.newBuilder();
       overrideHost(stage, builder);
 
-      if (SnowflakeGCSClient.areDisabledGcsDefaultCredentials(session)) {
-        logger.debug(
-            "Adding explicit credentials to avoid default credential lookup by the GCS client");
-        builder.setCredentials(GoogleCredentials.create(new AccessToken(accessToken, null)));
-      }
+      // Always set explicit credentials to prevent Application Default Credentials (ADC) lookup.
+      // Without this, StorageOptions.build().getService() probes metadata.google.internal which
+      // is unreachable in environments like SPCS, causing an opaque "invalid_gcs_credentials"
+      // error.
+      // Actual API authentication is handled by the Authorization header below, not this credential
+      // object — it exists solely to suppress the ADC probe.
+      builder.setCredentials(GoogleCredentials.create(new AccessToken(accessToken, null)));
 
       if (transportFactory != null) {
         builder.setTransportOptions(
             HttpTransportOptions.newBuilder().setHttpTransportFactory(transportFactory).build());
       }
-
-      // Using GoogleCredential with access token will cause IllegalStateException when the token
-      // is expired and trying to refresh, which cause error cannot be caught. Instead, set a
-      // header so we can caught the error code.
       this.gcsClient =
           builder
               .setHeaderProvider(

src/main/java/net/snowflake/client/internal/jdbc/cloud/storage/SnowflakeGCSClient.java

@@ -1262,8 +1262,12 @@ private void setupGCSClient(
               encryptionKeySize);
         }
       }
+    } catch (SnowflakeSQLException ex) {
+      logger.debug("Failed to initialize GCS client", ex);
+      throw ex;
     } catch (Exception ex) {
-      throw new IllegalArgumentException("invalid_gcs_credentials");
+      logger.debug("Failed to initialize GCS client", ex);
+      throw new IllegalArgumentException("invalid_gcs_credentials", ex);
     }
   }