keyvault

type AzureKeyVaultSecret struct {
	SubscriptionId string
	VaultName      string
	SecretName     string
}

type KeyVault struct {
	Id         string `json:"id"`
	Name       string `json:"name"`
	Location   string `json:"location"`
	Properties struct {
		EnableSoftDelete      bool `json:"enableSoftDelete"`
		EnablePurgeProtection bool `json:"enablePurgeProtection"`
	} `json:"properties"`
}

type KeyVaultAppReference struct {
	// VaultURL is the full vault URL (e.g., "https://my-vault.vault.azure.net").
	VaultURL string

	// VaultName is the vault name extracted from the host.
	VaultName string

	// SecretName is the name of the secret.
	SecretName string

	// SecretVersion is the specific version, or empty for latest.
	SecretVersion string
}

type KeyVaultService interface {
	GetKeyVault(
		ctx context.Context,
		subscriptionId string,
		resourceGroupName string,
		vaultName string,
	) (*KeyVault, error)
	GetKeyVaultSecret(
		ctx context.Context,
		subscriptionId string,
		vaultName string,
		secretName string,
	) (*Secret, error)
	PurgeKeyVault(ctx context.Context, subscriptionId string, vaultName string, location string) error
	ListSubscriptionVaults(ctx context.Context, subscriptionId string) ([]Vault, error)
	CreateVault(
		ctx context.Context,
		tenantId string,
		subscriptionId string,
		resourceGroupName string,
		location string,
		vaultName string,
	) (Vault, error)
	ListKeyVaultSecrets(
		ctx context.Context,
		subscriptionId string,
		vaultName string,
	) ([]string, error)
	CreateKeyVaultSecret(
		ctx context.Context,
		subscriptionId string,
		vaultName string,
		secretName string,
		secretValue string,
	) error
	SecretFromAkvs(ctx context.Context, akvs string) (string, error)
	// SecretFromKeyVaultReference resolves a secret reference in either the
	// akvs:// or @Microsoft.KeyVault(SecretUri=...) format. The subscriptionId
	// is required for credential scoping; for @Microsoft.KeyVault references
	// (which lack a subscription), the caller should provide the environment's
	// default subscription.
	SecretFromKeyVaultReference(ctx context.Context, ref string, defaultSubscriptionId string) (string, error)
}

type Secret struct {
	Id    string `json:"id"`
	Name  string `json:"name"`
	Value string `json:"value"`
}

type Vault struct {
	Id   string
	Name string
}