Fix GoogleCredentialCache raising on a Hash-shaped json_key

[Clark-Thanx]

Summary

• GoogleCredentialCache#fetch_fresh_token wraps json_key in StringIO.new(json_key) before handing it to Google::Auth::ServiceAccountCredentials, which requires a String.
• Any Fcm::App whose json_key is backed by a native json/jsonb DB column gets it back from ActiveRecord as an already-deserialized Hash on every read — so every real send through such an app raised TypeError: no implicit conversion of Hash into String.
• This was previously latent because the one production app that's always used this code path (the unified/shared FCM app) authenticates via ENV vars instead of a stored json_key, so the Hash-shaped path had never actually been exercised until now (Thanx's ORD-867 rollout, which wires a real per-merchant json_key for the first time).

Fix: coerce to JSON text only when json_key isn't already a String.

Test plan

• Added spec/unit/daemon/google_credential_cache_spec.rb — reproduces the exact production error (TypeError: no implicit conversion of Hash into String, same line as the Sentry stack trace) against the unfixed code, passes after the fix.
• Also covers the pre-existing String json_key case to confirm no regression there.
• Full unit-level FCM suite (spec/unit/daemon/fcm/, spec/unit/client/active_record/fcm/): 38 examples, 0 failures, 1 pre-existing pending (unrelated).
• Confirmed the functional/fcm_spec.rb / fcm_priority_spec.rb failures are pre-existing and unrelated (a database_cleaner gem vs. Rails 7.1 ActiveRecord::SchemaMigration incompatibility in the test harness) — reproduced identically against a fresh test DB with the fix applied.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Improved Google credential handling when credentials are provided as structured data.
  • Credential-based access tokens can now be fetched consistently from either structured or JSON-formatted credentials.

• Tests

  • Added coverage for both supported credential formats and access token retrieval.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 468d5d74-0677-4430-b981-c0d71e15ba6e

📥 Commits

Reviewing files that changed from the base of the PR and between 38207ed and 8b36b41.

📒 Files selected for processing (2)

• lib/rpush/daemon/google_credential_cache.rb
• spec/unit/daemon/google_credential_cache_spec.rb

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

GoogleCredentialCache#fetch_fresh_token now converts Hash credentials to JSON before creating the credential stream. Existing String and nil handling remains unchanged. Unit tests cover Hash and JSON String inputs.

Changes

Google credential handling

Layer / File(s)	Summary
Credential serialization and validation lib/rpush/daemon/google_credential_cache.rb, spec/unit/daemon/google_credential_cache_spec.rb	fetch_fresh_token serializes Hash credentials and preserves String and nil handling. Tests verify credential parsing and returned access tokens for Hash and JSON String inputs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 8b36b

This localized fix converts Hash-shaped credential data to JSON text while preserving String inputs, with targeted regression coverage; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the fix for Hash-shaped json_key values in GoogleCredentialCache.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/google-credential-cache-json-key-hash

---

_{Comment @coderabbitai help to get the list of available commands.}