Rename apns-dev to push-dev and unify 1Password credentials

- Rename script from apns-dev to push-dev (handles both APNs and FCM)
- Fetch credentials from Deploy/Fizzy Production (same as Kamal)
- Use _B64 env vars to avoid escaping issues with multiline keys
- Update bin/dev flag from --apns to --push

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

bin/dev

@@ -2,27 +2,27 @@
 
 PORT=3006
 USE_TAILSCALE=0
-USE_APNS=0
+USE_PUSH=0
 
 for arg in "$@"; do
   case $arg in
     --tailscale) USE_TAILSCALE=1 ;;
-    --apns) USE_APNS=1 ;;
+    --push) USE_PUSH=1 ;;
   esac
 done
 
-if [ "$USE_APNS" = "1" ]; then
+if [ "$USE_PUSH" = "1" ]; then
   if [ ! -f tmp/saas.txt ]; then
-    echo "Enabling SaaS mode for APNs..."
+    echo "Enabling SaaS mode for push notifications..."
     ./bin/rails saas:enable
   fi
-  echo "Loading APNs credentials from 1Password..."
+  echo "Loading push credentials from 1Password..."
-  if ! eval "$(BUNDLE_GEMFILE=Gemfile.saas bundle exec apns-dev)"; then
+  if ! eval "$(BUNDLE_GEMFILE=Gemfile.saas bundle exec push-dev)"; then
-    echo "Error: failed to load APNs credentials. Are you signed into 1Password?" >&2
+    echo "Error: failed to load push credentials. Are you signed into 1Password?" >&2
     exit 1
   fi
-  if [ -z "$APNS_ENCRYPTION_KEY" ] || [ -z "$APNS_KEY_ID" ]; then
+  if [ -z "$APNS_ENCRYPTION_KEY_B64" ] || [ -z "$APNS_KEY_ID" ]; then
-    echo "Error: APNs credentials not set. Missing APNS_ENCRYPTION_KEY or APNS_KEY_ID." >&2
+    echo "Error: Push credentials not set. Missing APNS_ENCRYPTION_KEY_B64 or APNS_KEY_ID." >&2
     exit 1
   fi
 fi

saas/exe/apns-dev

@@ -1,48 +0,0 @@
-#!/usr/bin/env ruby
-#
-# Fetches APNs and FCM development environment variables from 1Password.
-#
-# Usage: eval "$(bundle exec apns-dev)"
-
-OP_ACCOUNT = "23QPQDKZC5BKBIIG7UGT5GR5RM"
-OP_VAULT = "Mobile"
-OP_APNS_ITEM = "37signals Push Notifications key"
-OP_FCM_ITEM = "Fizzy Firebase Push Notification Private Key"
-
-def op_read(item, field)
-  `op read "op://#{OP_VAULT}/#{item}/#{field}" --account #{OP_ACCOUNT} 2>/dev/null`.strip
-end
-
-# APNs credentials
-apns_key_id = op_read(OP_APNS_ITEM, "key ID")
-apns_team_id = op_read(OP_APNS_ITEM, "team ID")
-apns_encryption_key = op_read(OP_APNS_ITEM, "AuthKey_3CR5J2W8Q6.p8")
-
-# FCM credentials (JSON file attachment)
-fcm_encryption_key = op_read(OP_FCM_ITEM, "fizzy-a148c-firebase-adminsdk-fbsvc-bdc640ce13.json")
-
-if apns_key_id.empty? || apns_encryption_key.empty?
-  warn "Error: Could not fetch APNs credentials from 1Password"
-  warn "Make sure you're signed in: op signin --account #{OP_ACCOUNT}"
-  exit 1
-end
-
-if fcm_encryption_key.empty?
-  warn "Warning: Could not fetch FCM credentials from 1Password"
-  warn "Android push notifications will not work"
-end
-
-puts %Q(export APNS_KEY_ID="#{apns_key_id}")
-puts %Q(export APNS_TEAM_ID="#{apns_team_id}")
-puts %Q(export APNS_ENCRYPTION_KEY="#{apns_encryption_key.gsub("\n", "\\n")}")
-puts %Q(export APNS_TOPIC="do.fizzy.app.ios")
-puts %Q(export FCM_ENCRYPTION_KEY='#{fcm_encryption_key.gsub("'", "'\\\\''")}')
-puts %Q(export ENABLE_NATIVE_PUSH="true")
-
-warn ""
-warn "Push notification credentials loaded for development"
-warn "  APNs Key ID: #{apns_key_id}"
-warn "  APNs Team ID: #{apns_team_id}"
-warn "  APNs Topic: do.fizzy.app.ios"
-warn "  FCM: #{fcm_encryption_key.empty? ? "not configured" : "configured"}"
-warn "  Native push: enabled"

saas/exe/push-dev

@@ -0,0 +1,44 @@
+#!/usr/bin/env ruby
+#
+# Fetches push notification credentials from 1Password for development.
+# Uses the same 1Password items as production (Deploy/Fizzy Production).
+#
+# Usage: eval "$(bundle exec push-dev)"
+
+OP_ACCOUNT = "23QPQDKZC5BKBIIG7UGT5GR5RM"
+OP_VAULT = "Deploy"
+OP_ITEM = "Fizzy"
+
+def op_read(field)
+  `op read "op://#{OP_VAULT}/#{OP_ITEM}/Production/#{field}" --account #{OP_ACCOUNT} 2>/dev/null`.strip
+end
+
+apns_key_id = op_read("APNS_KEY_ID")
+apns_team_id = op_read("APNS_TEAM_ID")
+apns_encryption_key_b64 = op_read("APNS_ENCRYPTION_KEY_B64")
+fcm_encryption_key_b64 = op_read("FCM_ENCRYPTION_KEY_B64")
+
+if apns_key_id.empty? || apns_encryption_key_b64.empty?
+  warn "Error: Could not fetch APNs credentials from 1Password"
+  warn "Make sure you're signed in: op signin --account #{OP_ACCOUNT}"
+  exit 1
+end
+
+if fcm_encryption_key_b64.empty?
+  warn "Warning: Could not fetch FCM credentials from 1Password"
+  warn "Android push notifications will not work"
+end
+
+puts %Q(export APNS_KEY_ID="#{apns_key_id}")
+puts %Q(export APNS_TEAM_ID="#{apns_team_id}")
+puts %Q(export APNS_ENCRYPTION_KEY_B64="#{apns_encryption_key_b64}")
+puts %Q(export FCM_ENCRYPTION_KEY_B64="#{fcm_encryption_key_b64}")
+puts %Q(export ENABLE_NATIVE_PUSH="true")
+
+warn ""
+warn "Push notification credentials loaded for development"
+warn "  APNs Key ID: #{apns_key_id}"
+warn "  APNs Team ID: #{apns_team_id}"
+warn "  APNs: #{apns_encryption_key_b64.empty? ? "not configured" : "configured"}"
+warn "  FCM: #{fcm_encryption_key_b64.empty? ? "not configured" : "configured"}"
+warn "  Native push: enabled"

saas/fizzy-saas.gemspec

@@ -22,7 +22,7 @@ Gem::Specification.new do |spec|
   end
 
   spec.bindir = "exe"
-  spec.executables = [ "apns-dev", "stripe-dev" ]
+  spec.executables = [ "push-dev", "stripe-dev" ]
 
   spec.add_dependency "rails", ">= 8.1.0.beta1"
   spec.add_dependency "queenbee"