redeploy: reuse a saved credential matched by server URL

Publisher keeps its own credentials in VS Code SecretStorage, which a CLI
cannot read, and a .posit record stores only server_url (never the key). So
redeploy now matches the record's server_url against rsconnect-python's own
saved servers (ServerStore) by normalized URL -- the same join Publisher uses --
and deploys under that nickname when the caller gave no explicit credential.
Ambiguous matches (>1 saved server for the same URL) raise, asking for --name.

Also fixes normalize_url to strip a trailing slash before the /__api__ suffix
so '.../__api__/' compares equal to the base URL.

Author: mconflitti-pbc

rsconnect/main.py

@@ -2298,6 +2298,38 @@ def _finish_redeploy(
             ce.activate_deployment().emit_task_log()
 
 
+def _find_saved_server_by_url(server_url: Optional[str]) -> Optional[dict[str, Any]]:
+    """Find a saved rsconnect-python server whose URL matches ``server_url`` (normalized).
+
+    A ``.posit`` deployment record stores only the ``server_url`` (never the API
+    key), and Publisher keeps its own credentials in VS Code SecretStorage, which
+    a CLI cannot read. So to redeploy without re-specifying credentials, we match
+    the record's server against a credential the user already saved with
+    rsconnect-python -- using the same normalized-URL comparison Publisher uses to
+    join a record to a credential.
+
+    Returns the single match, or ``None`` if none match. Raises when more than one
+    saved server matches (e.g. two credentials for the same URL under different
+    nicknames), since guessing which credential to use would be unsafe -- the user
+    disambiguates with ``--name``.
+    """
+    if not server_url:
+        return None
+    target = publisher_normalize_url(server_url)
+    matches = [
+        entry
+        for entry in server_store.get_all_servers()
+        if entry.get("url") and publisher_normalize_url(entry["url"]) == target
+    ]
+    if len(matches) > 1:
+        raise RSConnectException(
+            "Multiple saved servers match {} ({}); pick one with --name.".format(
+                server_url, ", ".join(sorted(str(m.get("name")) for m in matches))
+            )
+        )
+    return matches[0] if matches else None
+
+
 def _legacy_records_for_dir(directory: str) -> list[dict[str, Any]]:
     """Read legacy per-directory deployment records from ``rsconnect-python/*.json``.
 
@@ -2369,10 +2401,17 @@ def _redeploy_from_legacy(
     entry = next(iter(by_server.values()))
 
     app_mode = read_manifest_app_mode(manifest_path)
+    deploy_server = server or entry["server_url"]
+    # Reuse a saved rsconnect-python credential matching the recorded server.
+    if not name and not server and not api_key:
+        matched = _find_saved_server_by_url(entry["server_url"])
+        if matched:
+            name = matched["name"]
+            deploy_server = None
     ce = RSConnectExecutor(
         ctx=ctx,
         name=name,
-        server=server or entry["server_url"],
+        server=deploy_server,
         api_key=api_key,
         snowflake_connection_name=snowflake_connection_name,
         insecure=insecure,
@@ -2531,6 +2570,13 @@ def redeploy(
     effective_app_id = app_id or target.app_id
     # Deploy to the record's server unless the caller overrode the destination.
     deploy_server = server or target.server_url
+    # With no explicit credential, reuse a saved rsconnect-python server whose URL
+    # matches the record's (Publisher's own credentials are not reachable here).
+    if not name and not server and not api_key:
+        matched = _find_saved_server_by_url(target.server_url)
+        if matched:
+            name = matched["name"]
+            deploy_server = None
 
     deploy_path, bundle_builder, bundle_args, bundle_kwargs = _plan_deploy_bundle(
         directory,

rsconnect/publisher/store.py

@@ -40,7 +40,9 @@ def normalize_url(url: str) -> str:
         return ""
     parsed = urlparse(url if "//" in url else "//" + url)
     netloc = parsed.netloc.lower()
-    path = parsed.path
+    # Strip trailing slashes first so a trailing slash after ``__api__``
+    # (".../__api__/") still lets the suffix be removed.
+    path = parsed.path.rstrip("/")
     if path.endswith("/__api__"):
         path = path[: -len("/__api__")]
     path = path.rstrip("/")

tests/test_redeploy.py

@@ -271,6 +271,76 @@ def test_redeploy_legacy_manifest_without_record_needs_server(runner: CliRunner,
     assert "No prior deployment found" in result.output
 
 
+def test_find_saved_server_by_url_matches_normalized(monkeypatch: pytest.MonkeyPatch):
+    from rsconnect import main as main_mod
+
+    saved = [{"name": "prod", "url": "https://connect.example.com/__api__"}]
+    monkeypatch.setattr(main_mod, "server_store", types.SimpleNamespace(get_all_servers=lambda: saved))
+
+    # trailing slash / __api__ differences still match
+    assert main_mod._find_saved_server_by_url("https://connect.example.com/")["name"] == "prod"
+    assert main_mod._find_saved_server_by_url("https://other.example.com") is None
+    assert main_mod._find_saved_server_by_url(None) is None
+
+
+def test_find_saved_server_by_url_ambiguous_raises(monkeypatch: pytest.MonkeyPatch):
+    """Two saved credentials for the same server must not be guessed between."""
+    from rsconnect import main as main_mod
+    from rsconnect.exception import RSConnectException
+
+    saved = [
+        {"name": "prod-a", "url": "https://connect.example.com"},
+        {"name": "prod-b", "url": "https://connect.example.com/__api__"},
+    ]
+    monkeypatch.setattr(main_mod, "server_store", types.SimpleNamespace(get_all_servers=lambda: saved))
+
+    with pytest.raises(RSConnectException, match="Multiple saved servers match"):
+        main_mod._find_saved_server_by_url("https://connect.example.com/")
+
+
+def test_redeploy_reuses_saved_credential_by_url(
+    runner: CliRunner, project_dir: pathlib.Path, monkeypatch: pytest.MonkeyPatch
+):
+    """With no explicit credential, redeploy matches the record's server_url to a
+    saved rsconnect-python server (normalized) and deploys under that nickname."""
+    from rsconnect import main as main_mod
+
+    saved = {"name": "prod", "url": "https://connect.example.com/__api__/"}
+    monkeypatch.setattr(
+        main_mod,
+        "server_store",
+        types.SimpleNamespace(get_all_servers=lambda: [saved], get_by_name=lambda n: saved if n == "prod" else None),
+    )
+
+    captured: dict[str, typing.Any] = {}
+
+    class FakeExecutor:
+        def __init__(self, **kwargs: typing.Any):
+            captured.update(kwargs)
+            self.client = None
+            self.supports_verify_before_activate = False
+
+        def __getattr__(self, _name: str):
+            # every fluent step is a no-op that returns self
+            return lambda *a, **k: self
+
+        def should_deploy_as_draft(self, *a: typing.Any, **k: typing.Any) -> bool:
+            return False
+
+    monkeypatch.setattr(main_mod, "RSConnectExecutor", FakeExecutor)
+    monkeypatch.setattr(main_mod, "prepare_deploy_metadata", lambda *a, **k: None)
+    fake_env = types.SimpleNamespace(python="python")
+    monkeypatch.setattr(main_mod.Environment, "create_python_environment", classmethod(lambda cls, *a, **k: fake_env))
+    _write_posit_project(project_dir)  # record server_url = https://connect.example.com
+
+    result = runner.invoke(cli, ["redeploy", str(project_dir)])
+
+    assert result.exit_code == 0, result.output
+    # matched the saved server: deploy under its nickname, no raw server URL
+    assert captured.get("name") == "prod"
+    assert captured.get("server") is None
+
+
 def test_redeploy_dispatches_quarto(runner: CliRunner, project_dir: pathlib.Path, monkeypatch: pytest.MonkeyPatch):
     captured = _spy_make_bundle(monkeypatch)
     from rsconnect import main as main_mod