fix(reborn): refresh OAuth runtime credentials on staging

[serrrfirat]

Summary

• remove the per-process once-only refresh cache for OAuth runtime credentials
• refresh OAuth-backed ProductAuthAccount credentials whenever they are staged, so Google access tokens are not reused indefinitely after their provider TTL
• update the runtime credential regression test to assert repeated staging gets a fresh OAuth access secret

Tests

• cargo test -p ironclaw_reborn_composition product_auth_runtime_credentials::tests
• cargo test -p ironclaw_reborn_composition product_auth_runtime_credentials::tests::resolver_refreshes_oauth_account_for_each_runtime_staging -- --exact
• cargo clippy -p ironclaw_reborn_composition --all-targets -- -D warnings

[railway-app]

🚅 Deployed to the ironclaw-pr-5053 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Jun 17, 2026 at 10:36 pm

[gemini-code-assist]

Code Review

This pull request removes the tracking of refreshed credential account IDs in ProductAuthRuntimeCredentialAccountRefresher. This change ensures that each OAuth staging triggers a fresh credential refresh rather than indefinitely reusing a previously staged access secret, since access-token expiry is not part of the credential account record. The corresponding unit tests have been updated to assert that subsequent staging requests trigger a refresh. No review comments were provided.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b64a8f54-6c3b-4624-8821-2710e0655141

📥 Commits

Reviewing files that changed from the base of the PR and between a6f7395 and 876eb2c.

📒 Files selected for processing (2)

• crates/ironclaw_reborn_composition/src/product_auth_runtime_credentials.rs
• crates/ironclaw_reborn_composition/src/product_auth_runtime_credentials/tests.rs

---

📝 Walkthrough

Summary by CodeRabbit

• Refactor
  • Updated OAuth credential refresh mechanism to refresh access tokens on each request instead of caching them within a session, ensuring token freshness.

Walkthrough

Removes the refreshed_account_ids: Mutex<HashSet<CredentialAccountId>> deduplication guard from ProductAuthRuntimeCredentialAccountRefresher. The struct now holds only refresh_accounts and unconditionally invokes OAuth refresh on every staging call. Imports and the constructor are trimmed accordingly. The corresponding test is renamed and its handle-equality assertion is flipped to inequality.

Changes

Remove OAuth account refresh deduplication

Layer / File(s)	Summary
Remove dedup state and always-refresh logic crates/ironclaw_reborn_composition/src/product_auth_runtime_credentials.rs	Drops HashSet/CredentialAccountId imports; removes refreshed_account_ids field and its Mutex initialization from new; replaces the short-circuit branch with inline comments and an unconditional refresh path.
Update test to assert per-call refresh crates/ironclaw_reborn_composition/src/product_auth_runtime_credentials/tests.rs	Renames the test to reflect repeated-refresh semantics; changes the second staging expectation string to "refreshes again" and flips the handle assertion from eq to ne.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

The HashSet is gone, no cache in between,
Each token refresh, a brand-new clean scene.
Mutex unlocked, the dedup swept away,
ne where eq stood — the handles won't stay.
Fresh OAuth flows every call, as they should. 🦀

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows Conventional Commits style and accurately summarizes the main change: removing deduplication to refresh OAuth credentials on each staging.
Description check	✅ Passed	Summary and testing sections present and specific; however, required validation checkboxes and security/blast radius sections are unfilled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}