<?php

declare(strict_types=1);

/**
 * Plan 273 §C.1 — Secrets manifest.
 *
 * Single source of truth for which secrets MUST resolve in production.
 * `SecretsManagerManifestTest` enforces parity: every entry below must
 * be readable from the configured driver. A missing entry fails the
 * deploy rather than surfacing as a runtime null at the first send.
 *
 * Structure:
 *   - `secret_key` is the key the SecretsManager looks up (AWS Secrets
 *     Manager id in prod, env-var name in dev).
 *   - `config_key` is the Laravel config path that gets the value at
 *     boot, so service classes read it via the normal config() helper.
 *   - `rotated_at` tracks the last quarterly rotation; surfaces in the
 *     SecretsRotationDashboard widget.
 *
 * Adding a new secret requires:
 *   1. Add the row here.
 *   2. Put the value in AWS Secrets Manager (prod) or .env (dev).
 *   3. SecretsManagerManifestTest stays green.
 *
 * @return array<int, array{secret_key: string, config_key: string, rotated_at: ?string, owner: string}>
 */

return [
    [
        'secret_key' => 'prod/websites/cloudflare/api_token',
        'config_key' => 'services.cloudflare.api_token',
        'rotated_at' => null,
        'owner' => 'ops',
    ],
    [
        'secret_key' => 'prod/websites/cloudflare/zone_id',
        'config_key' => 'websites.cache_purge.zone_id',
        'rotated_at' => null,
        'owner' => 'ops',
    ],
    [
        'secret_key' => 'prod/websites/stripe/secret_key',
        'config_key' => 'services.stripe.secret',
        'rotated_at' => null,
        'owner' => 'finance',
    ],
    [
        'secret_key' => 'prod/websites/stripe/webhook_secret',
        'config_key' => 'services.websites.stripe.webhook_secret',
        'rotated_at' => null,
        'owner' => 'finance',
    ],
    [
        'secret_key' => 'prod/websites/ses/smtp_password',
        'config_key' => 'services.ses.secret',
        'rotated_at' => null,
        'owner' => 'ops',
    ],
    [
        'secret_key' => 'prod/websites/db/password',
        'config_key' => 'database.connections.mysql.password',
        'rotated_at' => null,
        'owner' => 'ops',
    ],
];