# GitHub Secrets for e-conomic Live Verification

This document explains which secrets need to be configured in the `copenhagentruckwash/api` GitHub repository for the **Verify e-conomic Live** workflow (`.github/workflows/live-verify-economic.yml`) to work.

## Required Secrets

| Secret | Description | Where to find it | Required? |
|---|---|---|---|
| `ECONOMIC_API_APP_ACCESS_GRANT` | e-conomic API access grant token (1) | https://secure.e-conomic.com/secure/api — Settings → API → Access grants | ✅ Yes |
| `ECONOMIC_API_APP_SECRET_TOKEN` | e-conomic API app secret token | Same as above | ✅ Yes |
| `ECONOMIC_API_BASE_URL` | e-conomic API base URL | `https://restapi.e-conomic.com` (production) or sandbox URL | ❌ Optional (defaults to prod) |

## Optional Secrets (for Slack notifications)

| Secret | Description | Required? |
|---|---|---|
| `SLACK_BOT_TOKEN` | Slack bot token for posting notifications | ❌ Optional |
| `SLACK_DEFAULT_WEBHOOK` | Slack incoming webhook URL | ❌ Optional |
| `AI_DAILY_CHANNEL` | Slack channel ID (defaults to `C0AM3E43249`) | ❌ Optional |

## How to Configure

1. Go to: https://github.com/copenhagentruckwash/api/settings/secrets/actions
2. Click **"New repository secret"**
3. Add each of the required secrets above
4. The values are found in your e-conomic account settings

## How to Run the Live Verification

1. Go to: https://github.com/copenhagentruckwash/api/actions/workflows/live-verify-economic.yml
2. Click **"Run workflow"**
3. Leave `customer_number` as `12345679` (default)
4. Set `dry_run` to **`false`** for a real test
5. Click **"Run workflow"**
6. The workflow will:
   - Create a draft invoice for customer 12345679
   - Add 2 test lines (1 with discount, 1 without)
   - Verify the draft was created correctly
   - **Automatically delete the draft** to clean up

## Safety

- The verification script is **idempotent**: it always cleans up after itself
- On any error, it attempts emergency cleanup of any draft it created
- The script refuses to run without the required env vars
- The workflow defaults to `dry_run=true` so it can be safely triggered without making API calls

## When It Runs Automatically

- **Manual trigger only by default**
- A weekly schedule is also configured (Mondays at 06:00 UTC) for early detection of any e-conomic API changes
- The scheduled run uses `dry_run=true` (env check only) — no real API calls

## Setting Up in Production (api.truckwash.io)

The same e-conomic credentials are also used by the live API. They're stored in:
- The production server's `.env` file (loaded by PHP)
- The deploy.yml workflow uses `COMPOSE_ENV` secret to inject them at deploy time

If you have already configured e-conomic in production, the same credentials work for this GitHub workflow.

## Troubleshooting

### "ECONOMIC_API_APP_ACCESS_GRANT is not set"

The secret is not configured. Follow the "How to Configure" steps above.

### "ECONOMIC_API_APP_SECRET_TOKEN is not set"

Same as above for the secret token.

### "Draft creation returned HTTP 401"

The credentials are wrong or expired. Check that the access grant is still active in your e-conomic account.

### "Draft creation returned HTTP 403"

The access grant doesn't have permission to create drafts for customer 12345679. Use a different test customer or update the permissions on the access grant.

### "Customer 12345679 not found"

Change the `customer_number` workflow input to a customer that exists in your e-conomic test agreement.