Add credential rotation

[DanielBunting]

Summary

Fixes #395

Prior to this change, credentials were fixed at client construction. If a credential rotated, the only options are recreating the client, or patching the underlying http infrastructure and over-writing the auth header per request.

This change adds ClickHouseClientSettings.CredentialsProvider - a Func<ClickHouseCredentials> that is run once per HTTP request, before the auth header is set.

Example:

var currentPassword = "PasswordA";
var settings = new ClickHouseClientSettings
{
    CredentialsProvider = () => ClickHouseCredentials.CreateBasic("svc_user", currentPassword),
};
using var client = new ClickHouseClient(settings);

await client.ExecuteScalarAsync("SELECT 1");   // Uses PasswordA

currentPassword = "PasswordB";                 // rotates the password

await client.ExecuteScalarAsync("SELECT 1");   // Uses Password B - Same client, nothing changed but password. 

Checklist

Delete items not relevant to your PR:

• Unit and integration tests covering the common scenarios were added
• A human-readable description of the changes was provided to include in CHANGELOG

[Copilot]

Pull request overview

Adds first-class support for credential rotation in the .NET ClickHouse driver by introducing a per-request credentials callback on ClickHouseClientSettings, allowing long-lived clients/connections to pick up rotated Basic or Bearer credentials without recreating HTTP infrastructure (fixes #395).

Changes:

• Add ClickHouseClientSettings.CredentialsProvider (Func<ClickHouseCredentials>) and a new ClickHouseCredentials type with factory helpers for Basic/Bearer auth.
• Update request auth header application to honor precedence: per-query BearerToken override > provider result > static BearerToken > static Username/Password (and treat empty per-query bearer token as “unset”).
• Add unit + integration tests validating precedence and real password rotation behavior; update public API tracking and changelog fragment.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
ClickHouse.Driver/QueryOptions.cs	Clarifies doc precedence for per-query bearer token vs client-level auth settings.
ClickHouse.Driver/PublicAPI/PublicAPI.Unshipped.txt	Records the new public API surface (CredentialsProvider, ClickHouseCredentials).
ClickHouse.Driver/ClickHouseCredentials.cs	Introduces a dedicated immutable credentials carrier with Basic/Bearer factories.
ClickHouse.Driver/ClickHouseClient.cs	Centralizes and extends auth header logic to evaluate provider per request.
ClickHouse.Driver/ADO/ClickHouseCommand.cs	Updates command bearer-token override documentation to include CredentialsProvider.
ClickHouse.Driver/ADO/ClickHouseClientSettings.cs	Adds the CredentialsProvider setting, copies/equality/hash updates, and documents precedence/behavior.
ClickHouse.Driver.Tests/ADO/CredentialsProviderTests.cs	Unit tests verifying precedence, per-request invocation, null fallback, and exception propagation.
ClickHouse.Driver.Tests/ADO/CredentialsProviderRotationTests.cs	Integration tests validating live password rotation scenarios for both ADO and ClickHouseClient.
ClickHouse.Driver.Tests/ADO/ClickHouseClientSettingsTests.cs	Tests equality/hash/copy semantics when CredentialsProvider is set.
changelog.d/395-credential-rotation.features.md	Changelog fragment describing the new credentials rotation feature and edge-case behavior change.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.