# neuron-web-secrets — runtime secrets pulled from Vault by ESO.
#
# Phase 1 deployment of neuron-web on Legion. Only ANTHROPIC_API_KEY and
# SUPABASE_ANON_KEY are critical for the page to render and the chat
# widget to talk to Claude. Stripe + Resend + DocuSeal are pulled from
# the existing marketing-test path so checkout flows can be exercised in
# stage; webhook + DocuSeal tokens are present but the public webhook
# routes still go to the Cloud Run prod URL until we cut over.
#
# Vault paths used:
#   secret/neuron-technologies/anthropic        api_key
#   secret/neuron-technologies/supabase         anon_key, service_role_key, project_url
#   secret/neuron-technologies/marketing-test   stripe_*, etc.
#   secret/neuron-technologies/notifications    resend_api_key
#
# To add a new secret without changing the ExternalSecret manifest:
#   vault kv patch secret/neuron-technologies/<path> key="value"
# then add a new data: entry below.
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: neuron-web-secrets
  namespace: neuron-web
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: neuron-web-secrets
    creationPolicy: Owner
  data:
    # Critical — chat widget + page render
    - secretKey: ANTHROPIC_API_KEY
      remoteRef:
        key: secret/data/neuron-technologies/anthropic
        property: api_key
    - secretKey: NEURON_LLM_0_KEY
      remoteRef:
        key: secret/data/neuron-technologies/anthropic
        property: api_key
    - secretKey: SUPABASE_ANON_KEY
      remoteRef:
        key: secret/data/neuron-technologies/supabase
        property: anon_key
    - secretKey: SUPABASE_SERVICE_KEY
      remoteRef:
        key: secret/data/neuron-technologies/supabase
        property: service_role_key
    - secretKey: SUPABASE_URL
      remoteRef:
        key: secret/data/neuron-technologies/supabase
        property: project_url
    # Stripe — test/stage keys
    - secretKey: STRIPE_PUBLISHABLE_KEY
      remoteRef:
        key: secret/data/neuron-technologies/marketing-test
        property: next_public_stripe_publishable_key
    - secretKey: STRIPE_SECRET_KEY
      remoteRef:
        key: secret/data/neuron-technologies/marketing-test
        property: stripe_secret_key
    - secretKey: STRIPE_WEBHOOK_SECRET
      remoteRef:
        key: secret/data/neuron-technologies/marketing-test
        property: stripe_webhook_secret
    - secretKey: STRIPE_PRICE_PROFESSIONAL
      remoteRef:
        key: secret/data/neuron-technologies/marketing-test
        property: stripe_price_professional
    - secretKey: STRIPE_PRICE_FOUNDING
      remoteRef:
        key: secret/data/neuron-technologies/marketing-test
        property: stripe_price_founding
    # Notifications
    - secretKey: RESEND_API_KEY
      remoteRef:
        key: secret/data/neuron-technologies/notifications
        property: resend_api_key