fix(connect): rewrite Session to use rebuild_method override

[tdstein]

Summary

Replaces the hand-rolled redirect loop in Session.post (src/posit/connect/sessions.py) with a minimal rebuild_method override on top of requests.Session. The previous implementation reimplemented redirect handling from scratch and silently dropped everything requests.SessionRedirectMixin provides.

What the rewrite restores for free:

• rebuild_auth — strips Authorization on cross-origin hops (the original CVE behind fix(connect): strip Authorization on cross-origin redirects in custom Session #464)
• Cookie propagation via extract_cookies_to_jar on every hop
• response.history for the full redirect chain
• TooManyRedirects raised instead of silently returning the last 3xx response
• rebuild_proxies, Referer handling, and streaming semantics
• allow_redirects=False is no longer forced on every POST

Behavior preserved:

• preserve_post=True (default) keeps POST across 301/302, matching libcurl CURL_REDIR_POST_301|302.
• preserve_post=False falls back to the RFC 7231 default (downgrade to GET on 301/302).
• 303 always downgrades to GET; 307/308 always preserve (both handled by the base class).
• max_redirects is still accepted on post() and now enforced by requests itself.

Behavior change worth calling out:

• max_redirects exceeded now raises requests.exceptions.TooManyRedirects instead of returning the last 302 response. The old behavior was surprising and undocumented.

Relationship to other PRs

• Supersedes fix(connect): strip Authorization on cross-origin redirects in custom Session #464. fix(connect): strip Authorization on cross-origin redirects in custom Session #464 was a defensive stop-gap that patched the cross-origin auth leak without touching the broader design. Merge fix(connect): strip Authorization on cross-origin redirects in custom Session #464 first if you want the fix shipped immediately, then this PR cleans up the implementation and removes the hand-rolled loop entirely. Alternatively, close fix(connect): strip Authorization on cross-origin redirects in custom Session #464 in favor of this PR.

Test plan

• 9 tests in tests/posit/connect/test_sessions.py pass, including:
  • new: cross-origin redirect strips Authorization
  • new: same-origin redirect preserves Authorization
  • new: response.history is populated
  • updated: max_redirects exceeded raises TooManyRedirects
• CI
• Manual smoke test against a Connect instance that 302s from POST /__api__/v1/tasks style endpoints

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
2356	2206	94%	0%	🟢

New Files

No new covered files...

Modified Files

File	Coverage	Status
src/posit/connect/sessions.py	100%	🟢
TOTAL	100%	🟢

updated for commit: 5d5e377 by action🐍