# External Service Inventory

Canonical list of external systems the application integrates with at runtime. Sourced from `composer.json`, `config/services.php`, and grep of HTTP-client usage in `app/`.

Each row is a thing that needs a fake or recorded fixture in the test harness. New services added to the codebase must be added here and have a fake before merge.

| Service | Direction | Auth | Test approach | Status |
|---|---|---|---|---|
| Google Search Console | Outbound (sync), Inbound (OAuth callback) | OAuth 2.0 | Direct DB seed for analysis tests; `Http::fake()` for sync tests; fake OAuth provider for one auth test | M4 (planned) |
| WordPress (customer sites + plugin) | Bidirectional | HMAC SHA-256 shared secret | Real containerized WP for HMAC/publish suite; `Http::fake()` for everything else | M3 (planned) |
| OpenAI | Outbound | Bearer token (BYOK, encrypted at rest) | Recorded fixtures with prompt-fingerprint matching + explicit failure injection | M4 (planned) |
| DataForSEO | Outbound | Basic auth (BYOK) | Recorded fixtures; failure-mode helpers | M4 (planned) |
| Stripe | Bidirectional (webhooks) | API key + webhook signature | Stripe Test Mode + Cashier; `stripe trigger` for webhook fixtures | M4 (planned) |
| Sentry | Outbound (logs only) | DSN | No fake required (write-only telemetry); CI sets `SENTRY_LARAVEL_DSN=` empty | Established |
| Laravel Horizon Redis | Internal infrastructure | — | In-memory `array` queue driver in tests | Established |

## How to use this inventory

When AI is asked to add a new external service:

1. Confirm the service is added to this inventory before merge (manual step until automated).
2. A fake must exist in `tests/Fakes/` before any production code that calls the service is merged.
3. The fake must include at least one happy-path fixture and explicit failure-mode injection.
4. The drift canary (M6, planned) must include a contract test against the real API once test credentials are provisioned.

## Open questions

- Does `knuckleswtf/scribe` make any outbound calls in production code paths? (Reconnaissance: appears to be doc-generation only; verify before adding.)
- Does `laragear/two-factor` make external calls for TOTP verification? (Reconnaissance: TOTP is local-compute; no external dependency expected.)
- Verify `barryvdh/laravel-dompdf` does not load remote fonts/assets in production rendering paths.

These are flagged for the user to confirm.