# INACTIVE TEMPLATE. Not imported by the development flake or any deployed host.
# Requires an owner-reviewed sops-nix NixOS module import in the host flake.
{ config, lib, ... }:
let cfg = config.aia.portalSecrets;
in {
  options.aia.portalSecrets = {
    enable = lib.mkEnableOption "owner-reviewed portal deployment secrets";
    encryptedFile = lib.mkOption { type = lib.types.path; description = "SOPS-encrypted YAML only; never a plaintext file"; };
    ageKeyFile = lib.mkOption { type = lib.types.str; description = "Private persisted host age key path outside the Nix store"; };
    readerUser = lib.mkOption { type = lib.types.str; description = "Approved resource authorization service user"; };
  };
  config = lib.mkIf cfg.enable {
    assertions = [{ assertion = lib.hasPrefix "/" cfg.ageKeyFile && !(lib.hasPrefix "/nix/store/" cfg.ageKeyFile);
      message = "The host age identity must be an absolute runtime path outside the Nix store."; }];
    sops.defaultSopsFile = cfg.encryptedFile;
    sops.age.keyFile = cfg.ageKeyFile;
    sops.age.generateKey = false;
    sops.age.sshKeyPaths = [];
    sops.gnupg.sshKeyPaths = [];
    sops.secrets."portal/staff-credentials" = { owner = cfg.readerUser; mode = "0400"; };
    sops.secrets."portal/management-credentials" = { owner = cfg.readerUser; mode = "0400"; };
    # Consumers reference config.sops.secrets.<name>.path at runtime.
    # Do not use builtins.readFile on a decrypted secret, environment.etc.text,
    # PUBLIC_* values, or Astro/Vite imports to transport secrets.
  };
}