GoogleGcpCredentials: Enforce dictionary type #1207

Problem

GoogleGcpCredentials.sa_key is typed JsonValue:

# backend/app/core/providers.py:76
sa_key: JsonValue = Field(description="Service account key JSON")

Pydantic's JsonValue is the union of all JSON value types — str included. A service account key submitted as an escaped JSON string therefore passes validation and is persisted as-is.

The failure surfaces much later, at provider runtime:

# backend/app/core/batch/google_gcp.py:91
creds = build_gcp_sa_credentials(cast(dict[str, Any], creds_model.sa_key))

# backend/app/core/cloud/storage.py:516
def build_gcp_sa_credentials(sa_key: dict[str, Any]) -> service_account.Credentials:
    return service_account.Credentials.from_service_account_info(sa_key, scopes=list(GCS_SCOPES))

from_service_account_info calls .keys() on the argument, so a stored string raises:

'str' object has no attribute 'keys'

Impact

A batch assessment run fails with status: FAILED and error: "'str' object has no attribute 'keys'", after all items have already been dispatched. Observed with 9/9 items returning assessment: null. The message gives no hint that the stored credential is malformed, so the cost of diagnosis is high.

The cast(dict[str, Any], ...) at the call site also hides this from pyright — the cast asserts a shape the type system never guaranteed.

Proposed fix

Narrow the annotation so the type system enforces what the consumer requires:

sa_key: dict[str, JsonValue] = Field(description="Service account key JSON")

Validation then fails at credential-creation time with a clear Pydantic error instead of at run time. The cast in google_gcp.py becomes unnecessary and should be dropped.

Notes

• Existing rows holding a string sa_key will not be repaired by the type change; they need to be re-saved (or backfilled) with the key as a JSON object.
• Masking in mask_credentials (providers.py:260) already assumes non-string secrets for sa_key, so the dict shape is the one the rest of the code expects.