namespace SwBLL.Vault;

/// <summary>
/// KV v2 secret reader for SqlWorkbench's own contained-user credentials
/// (dba/app/readonly passwords written by ClientDatabaseProvisioner). Only this service
/// calls HashiCorp Vault on SqlWorkbench's behalf.
/// </summary>
public interface ISwVaultService
{
    /// <summary>Reads a secret previously written by ClientDatabaseProvisioner
    /// (e.g. a ClientDatabaseDTO.DbaVaultPath/AppVaultPath/ReadOnlyVaultPath value).</summary>
    Task<string> GetSecretAsync(string vaultPath, CancellationToken ct);
}