namespace GoodBooks.PAY.PAYBLL.Vault
{
    /// <summary>
    /// KV v2 secret reader with in-process caching.
    /// Only VaultService calls HashiCorp Vault — no other class should.
    /// </summary>
    public interface IVaultService
    {
        /// <summary>
        /// Reads a secret from Vault KV v2. Cached for 5 minutes sliding TTL.
        /// <para>
        /// <paramref name="vaultKeyPath"/> is the mount-relative path stored in
        /// MPAYGATEWAYCONFIG (e.g. "pay/razorpay/api_key"). The mount point "secret" is
        /// assumed by the implementation.
        /// </para>
        /// </summary>
        Task<string> GetSecretAsync(string vaultKeyPath, CancellationToken ct = default);
    }
}