From 3e549a79b581f31ff01ee21c4a71bf9ea423fb09 Mon Sep 17 00:00:00 2001
From: Chris Green <chrisgreen@arizona.edu>
Date: Fri, 20 Feb 2026 14:38:39 -0700
Subject: [PATCH 1/3] Working

---
 ...nfig_override.az_profiles_api_endpoint.yml | 13 +++
 ...ey.config_override.az_profiles_api_key.yml | 13 +++
 .../key.key.az_profiles_api_endpoint.yml      | 14 +++
 .../optional/key.key.az_profiles_api_key.yml  | 14 +++
 .../src/Form/AZPersonProfilesImportForm.php   | 28 +++++-
 .../AZPersonProfilesImportSettingsForm.php    | 75 +++++++++++++-
 .../data_fetcher/AZProfilesAPIFetcher.php     | 31 +++++-
 .../custom/az_secrets/az_secrets.services.yml |  5 +
 .../az_secrets/src/Service/SecretsChecker.php | 98 +++++++++++++++++++
 9 files changed, 284 insertions(+), 7 deletions(-)
 create mode 100644 modules/custom/az_person/az_person_profiles_import/config/optional/key.config_override.az_profiles_api_endpoint.yml
 create mode 100644 modules/custom/az_person/az_person_profiles_import/config/optional/key.config_override.az_profiles_api_key.yml
 create mode 100644 modules/custom/az_person/az_person_profiles_import/config/optional/key.key.az_profiles_api_endpoint.yml
 create mode 100644 modules/custom/az_person/az_person_profiles_import/config/optional/key.key.az_profiles_api_key.yml
 create mode 100644 modules/custom/az_secrets/az_secrets.services.yml
 create mode 100644 modules/custom/az_secrets/src/Service/SecretsChecker.php

diff --git a/modules/custom/az_person/az_person_profiles_import/config/optional/key.config_override.az_profiles_api_endpoint.yml b/modules/custom/az_person/az_person_profiles_import/config/optional/key.config_override.az_profiles_api_endpoint.yml
new file mode 100644
index 0000000000..d11b8bb30b
--- /dev/null
+++ b/modules/custom/az_person/az_person_profiles_import/config/optional/key.config_override.az_profiles_api_endpoint.yml
@@ -0,0 +1,13 @@
+langcode: en
+status: true
+dependencies:
+  config:
+    - key.key.az_profiles_api_endpoint
+    - az_person_profiles_import.settings
+id: az_profiles_api_endpoint
+label: 'Profiles API Endpoint'
+config_type: system.simple
+config_prefix: ''
+config_name: az_person_profiles_import.settings
+config_item: endpoint
+key_id: az_profiles_api_endpoint
diff --git a/modules/custom/az_person/az_person_profiles_import/config/optional/key.config_override.az_profiles_api_key.yml b/modules/custom/az_person/az_person_profiles_import/config/optional/key.config_override.az_profiles_api_key.yml
new file mode 100644
index 0000000000..bce4a94213
--- /dev/null
+++ b/modules/custom/az_person/az_person_profiles_import/config/optional/key.config_override.az_profiles_api_key.yml
@@ -0,0 +1,13 @@
+langcode: en
+status: true
+dependencies:
+  config:
+    - key.key.az_profiles_api_key
+    - az_person_profiles_import.settings
+id: az_profiles_api_key
+label: 'Profiles API Key'
+config_type: system.simple
+config_prefix: ''
+config_name: az_person_profiles_import.settings
+config_item: apikey
+key_id: az_profiles_api_key
diff --git a/modules/custom/az_person/az_person_profiles_import/config/optional/key.key.az_profiles_api_endpoint.yml b/modules/custom/az_person/az_person_profiles_import/config/optional/key.key.az_profiles_api_endpoint.yml
new file mode 100644
index 0000000000..e684170305
--- /dev/null
+++ b/modules/custom/az_person/az_person_profiles_import/config/optional/key.key.az_profiles_api_endpoint.yml
@@ -0,0 +1,14 @@
+langcode: en
+status: true
+dependencies: {  }
+id: az_profiles_api_endpoint
+label: 'Profiles API Endpoint'
+description: 'URL endpoint for the UA Profiles API service.'
+key_type: authentication
+key_type_settings: {  }
+key_provider: az_secrets
+key_provider_settings:
+  secret_name: AZ_PROFILES_API_ENDPOINT
+  base64_encoded: false
+key_input: none
+key_input_settings: {  }
diff --git a/modules/custom/az_person/az_person_profiles_import/config/optional/key.key.az_profiles_api_key.yml b/modules/custom/az_person/az_person_profiles_import/config/optional/key.key.az_profiles_api_key.yml
new file mode 100644
index 0000000000..1f7f9cee44
--- /dev/null
+++ b/modules/custom/az_person/az_person_profiles_import/config/optional/key.key.az_profiles_api_key.yml
@@ -0,0 +1,14 @@
+langcode: en
+status: true
+dependencies: {  }
+id: az_profiles_api_key
+label: 'Profiles API Key'
+description: 'API key for the UA Profiles API service.'
+key_type: authentication
+key_type_settings: {  }
+key_provider: az_secrets
+key_provider_settings:
+  secret_name: AZ_PROFILES_API_KEY
+  base64_encoded: false
+key_input: none
+key_input_settings: {  }
diff --git a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportForm.php b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportForm.php
index 610c07a3d5..c2e8953951 100644
--- a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportForm.php
+++ b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportForm.php
@@ -22,6 +22,13 @@ final class AZPersonProfilesImportForm extends FormBase {
    */
   protected $entityTypeManager;
 
+  /**
+   * The secrets checker service (if available).
+   *
+   * @var \Drupal\az_secrets\Service\SecretsChecker|null
+   */
+  protected $secretsChecker;
+
   /**
    * The LDAP query controller service (if available).
    *
@@ -46,6 +53,16 @@ final class AZPersonProfilesImportForm extends FormBase {
   public static function create(ContainerInterface $container) {
     $instance = parent::create($container);
     $instance->entityTypeManager = $container->get('entity_type.manager');
+
+    // Try to get the secrets checker service if available.
+    try {
+      $instance->secretsChecker = $container->get('az_secrets.checker');
+    }
+    catch (\Exception $e) {
+      // az_secrets module not enabled.
+      $instance->secretsChecker = NULL;
+    }
+
     try {
       // This service may not exist if ldap_query is not enabled.
       $instance->ldapQueryController = $container->get('ldap.query');
@@ -71,7 +88,16 @@ public function getFormId(): string {
   public function buildForm(array $form, FormStateInterface $form_state): array {
 
     $config = $this->config('az_person_profiles_import.settings');
-    $has_key = !empty(trim($config->get('apikey')));
+
+    // Check if we have an API key either via secrets or config.
+    $has_key = FALSE;
+    if ($this->secretsChecker && $this->secretsChecker->hasKey('az_profiles_api_key')) {
+      $has_key = TRUE;
+    }
+    elseif (!empty(trim($config->get('apikey')))) {
+      $has_key = TRUE;
+    }
+
     if (!$has_key) {
       $url = Url::fromRoute('az_person_profiles_import.settings_form')->toString();
       $this->messenger->addWarning($this->t('You must first configure a Profiles API token <a href=":link">here</a>.', [
diff --git a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
index 625f247f10..94e4996059 100644
--- a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
+++ b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
@@ -6,12 +6,39 @@
 
 use Drupal\Core\Form\ConfigFormBase;
 use Drupal\Core\Form\FormStateInterface;
+use Drupal\Component\Render\FormattableMarkup;
+use Symfony\Component\DependencyInjection\ContainerInterface;
 
 /**
  * Configure Quickstart Person Profiles Import settings for this site.
  */
 final class AZPersonProfilesImportSettingsForm extends ConfigFormBase {
 
+  /**
+   * The secrets checker service (if available).
+   *
+   * @var \Drupal\az_secrets\Service\SecretsChecker|null
+   */
+  protected $secretsChecker;
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    $instance = parent::create($container);
+
+    // Try to get the secrets checker service if available.
+    try {
+      $instance->secretsChecker = $container->get('az_secrets.checker');
+    }
+    catch (\Exception $e) {
+      // az_secrets module not enabled.
+      $instance->secretsChecker = NULL;
+    }
+
+    return $instance;
+  }
+
   /**
    * {@inheritdoc}
    */
@@ -31,13 +58,35 @@ protected function getEditableConfigNames(): array {
    */
   public function buildForm(array $form, FormStateInterface $form_state): array {
     $config = $this->config('az_person_profiles_import.settings');
+
+    // Check if az_secrets integration is active.
+    $using_secrets = FALSE;
+    if ($this->secretsChecker &&
+        $this->secretsChecker->hasKeys(['az_profiles_api_endpoint', 'az_profiles_api_key'])) {
+      $using_secrets = TRUE;
+
+      $form['secrets_status'] = [
+        '#type' => 'item',
+        '#markup' => new FormattableMarkup('<div class="messages messages--status">@message1<br>@message2</div>', [
+          '@message1' => $this->t('✓ API credentials are managed by Quickstart Secrets Management.'),
+          '@message2' => $this->t('Credentials are loaded from environment variables or Pantheon Secrets.'),
+        ]),
+      ];
+    }
+
     $form['endpoint'] = [
       '#type' => 'url',
       '#title' => $this->t('Profiles API Endpoint'),
       '#description' => $this->t('Enter a fully qualified URL for the endpoint of the profiles API service.'),
       '#default_value' => $config->get('endpoint'),
-      '#required' => TRUE,
+      '#required' => !$using_secrets,
+      '#disabled' => $using_secrets,
     ];
+
+    if ($using_secrets) {
+      $form['endpoint']['#description'] = $this->t('This value is managed by Quickstart Secrets Management and cannot be edited here.');
+    }
+
     $form['apikey'] = [
       '#type' => 'password',
       '#title' => $this->t('API Token'),
@@ -45,7 +94,12 @@ public function buildForm(array $form, FormStateInterface $form_state): array {
       '#maxlength' => 128,
       '#size' => 64,
       '#default_value' => $config->get('apikey'),
+      '#disabled' => $using_secrets,
     ];
+
+    if ($using_secrets) {
+      $form['apikey']['#description'] = $this->t('This value is managed by Quickstart Secrets Management and cannot be edited here.');
+    }
     return parent::buildForm($form, $form_state);
   }
 
@@ -53,10 +107,21 @@ public function buildForm(array $form, FormStateInterface $form_state): array {
    * {@inheritdoc}
    */
   public function submitForm(array &$form, FormStateInterface $form_state): void {
-    $this->config('az_person_profiles_import.settings')
-      ->set('endpoint', $form_state->getValue('endpoint'))
-      ->set('apikey', $form_state->getValue('apikey'))
-      ->save();
+    // Check if secrets are being used.
+    $using_secrets = FALSE;
+    if ($this->secretsChecker &&
+        $this->secretsChecker->hasKeys(['az_profiles_api_endpoint', 'az_profiles_api_key'])) {
+      $using_secrets = TRUE;
+    }
+
+    // Only save to config if not using secrets.
+    if (!$using_secrets) {
+      $this->config('az_person_profiles_import.settings')
+        ->set('endpoint', $form_state->getValue('endpoint'))
+        ->set('apikey', $form_state->getValue('apikey'))
+        ->save();
+    }
+
     parent::submitForm($form, $form_state);
   }
 
diff --git a/modules/custom/az_person/az_person_profiles_import/src/Plugin/migrate_plus/data_fetcher/AZProfilesAPIFetcher.php b/modules/custom/az_person/az_person_profiles_import/src/Plugin/migrate_plus/data_fetcher/AZProfilesAPIFetcher.php
index 5e684d2e5d..94115bbfb0 100644
--- a/modules/custom/az_person/az_person_profiles_import/src/Plugin/migrate_plus/data_fetcher/AZProfilesAPIFetcher.php
+++ b/modules/custom/az_person/az_person_profiles_import/src/Plugin/migrate_plus/data_fetcher/AZProfilesAPIFetcher.php
@@ -38,6 +38,13 @@ class AZProfilesAPIFetcher extends Http {
    */
   protected $configFactory;
 
+  /**
+   * The secrets checker service (if available).
+   *
+   * @var \Drupal\az_secrets\Service\SecretsChecker|null
+   */
+  protected $secretsChecker;
+
   /**
    * {@inheritdoc}
    */
@@ -59,6 +66,16 @@ public static function create(ContainerInterface $container, array $configuratio
       $instance->httpClient = $container->get('http_client');
     }
     $instance->configFactory = $container->get('config.factory');
+
+    // Try to get the secrets checker service if available.
+    try {
+      $instance->secretsChecker = $container->get('az_secrets.checker');
+    }
+    catch (ServiceNotFoundException $e) {
+      // az_secrets module not enabled, will use config values.
+      $instance->secretsChecker = NULL;
+    }
+
     return $instance;
   }
 
@@ -71,6 +88,13 @@ public function getResponseContent(string $url): string {
     $endpoint = $config->get('endpoint');
     $apikey = $config->get('apikey');
 
+    // Check if we should use secrets instead.
+    if ($this->secretsChecker &&
+        $this->secretsChecker->hasKeys(['az_profiles_api_endpoint', 'az_profiles_api_key'])) {
+      $endpoint = $this->secretsChecker->getKeyValue('az_profiles_api_endpoint');
+      $apikey = $this->secretsChecker->getKeyValue('az_profiles_api_key');
+    }
+
     // For this fetcher, the supplied URL is the netid.
     $netid = $url;
     // Construct the API call.
@@ -78,7 +102,12 @@ public function getResponseContent(string $url): string {
     try {
       $body = (string) $this->getResponse($url)->getBody();
     }
-    catch (MigrateException | RequestException $e) {
+    catch (RequestException $e) {
+      // Response from API had no data.
+      $json = ['Person' => ['netid' => $netid]];
+      $body = json_encode($json);
+    }
+    catch (MigrateException $e) {
       // Response from API had no data.
       $json = ['Person' => ['netid' => $netid]];
       $body = json_encode($json);
diff --git a/modules/custom/az_secrets/az_secrets.services.yml b/modules/custom/az_secrets/az_secrets.services.yml
new file mode 100644
index 0000000000..4f0193ebda
--- /dev/null
+++ b/modules/custom/az_secrets/az_secrets.services.yml
@@ -0,0 +1,5 @@
+services:
+  az_secrets.checker:
+    class: Drupal\az_secrets\Service\SecretsChecker
+    arguments:
+      - '@entity_type.manager'
diff --git a/modules/custom/az_secrets/src/Service/SecretsChecker.php b/modules/custom/az_secrets/src/Service/SecretsChecker.php
new file mode 100644
index 0000000000..b978a277fb
--- /dev/null
+++ b/modules/custom/az_secrets/src/Service/SecretsChecker.php
@@ -0,0 +1,98 @@
+<?php
+
+namespace Drupal\az_secrets\Service;
+
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+
+/**
+ * Service to check if secrets are configured and have values.
+ */
+class SecretsChecker {
+
+  /**
+   * The entity type manager.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * Constructs a SecretsChecker object.
+   *
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager.
+   */
+  public function __construct(EntityTypeManagerInterface $entity_type_manager) {
+    $this->entityTypeManager = $entity_type_manager;
+  }
+
+  /**
+   * Check if a key is configured with a value.
+   *
+   * @param string $key_id
+   *   The key entity ID.
+   *
+   * @return bool
+   *   TRUE if the key exists and has a value, FALSE otherwise.
+   */
+  public function hasKey(string $key_id): bool {
+    try {
+      $key_storage = $this->entityTypeManager->getStorage('key');
+      $key = $key_storage->load($key_id);
+
+      if ($key && method_exists($key, 'getKeyValue')) {
+        $value = $key->getKeyValue();
+        return !empty($value);
+      }
+    }
+    catch (\Exception $e) {
+      // Key storage not available.
+    }
+
+    return FALSE;
+  }
+
+  /**
+   * Check if multiple keys are all configured with values.
+   *
+   * @param array $key_ids
+   *   Array of key entity IDs.
+   *
+   * @return bool
+   *   TRUE if all keys exist and have values, FALSE otherwise.
+   */
+  public function hasKeys(array $key_ids): bool {
+    foreach ($key_ids as $key_id) {
+      if (!$this->hasKey($key_id)) {
+        return FALSE;
+      }
+    }
+    return TRUE;
+  }
+
+  /**
+   * Get the value of a key if it exists.
+   *
+   * @param string $key_id
+   *   The key entity ID.
+   *
+   * @return string|null
+   *   The key value or NULL if not found.
+   */
+  public function getKeyValue(string $key_id): ?string {
+    try {
+      $key_storage = $this->entityTypeManager->getStorage('key');
+      $key = $key_storage->load($key_id);
+
+      if ($key && method_exists($key, 'getKeyValue')) {
+        return $key->getKeyValue();
+      }
+    }
+    catch (\Exception $e) {
+      // Key storage not available.
+    }
+
+    return NULL;
+  }
+
+}

From 6d438aa6f0137a2dd90c1e40e7ef25d231c26f8b Mon Sep 17 00:00:00 2001
From: Chris Green <chrisgreen@arizona.edu>
Date: Wed, 25 Feb 2026 09:10:44 -0700
Subject: [PATCH 2/3] Update pr to remove service

---
 .../src/Form/AZPersonProfilesImportForm.php   | 26 +----
 .../AZPersonProfilesImportSettingsForm.php    | 70 ++++++++-----
 .../data_fetcher/AZProfilesAPIFetcher.php     | 26 +----
 .../custom/az_secrets/az_secrets.services.yml |  5 -
 .../az_secrets/src/Service/SecretsChecker.php | 98 -------------------
 5 files changed, 47 insertions(+), 178 deletions(-)
 delete mode 100644 modules/custom/az_secrets/az_secrets.services.yml
 delete mode 100644 modules/custom/az_secrets/src/Service/SecretsChecker.php

diff --git a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportForm.php b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportForm.php
index c2e8953951..c925ce8665 100644
--- a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportForm.php
+++ b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportForm.php
@@ -22,13 +22,6 @@ final class AZPersonProfilesImportForm extends FormBase {
    */
   protected $entityTypeManager;
 
-  /**
-   * The secrets checker service (if available).
-   *
-   * @var \Drupal\az_secrets\Service\SecretsChecker|null
-   */
-  protected $secretsChecker;
-
   /**
    * The LDAP query controller service (if available).
    *
@@ -54,15 +47,6 @@ public static function create(ContainerInterface $container) {
     $instance = parent::create($container);
     $instance->entityTypeManager = $container->get('entity_type.manager');
 
-    // Try to get the secrets checker service if available.
-    try {
-      $instance->secretsChecker = $container->get('az_secrets.checker');
-    }
-    catch (\Exception $e) {
-      // az_secrets module not enabled.
-      $instance->secretsChecker = NULL;
-    }
-
     try {
       // This service may not exist if ldap_query is not enabled.
       $instance->ldapQueryController = $container->get('ldap.query');
@@ -89,14 +73,8 @@ public function buildForm(array $form, FormStateInterface $form_state): array {
 
     $config = $this->config('az_person_profiles_import.settings');
 
-    // Check if we have an API key either via secrets or config.
-    $has_key = FALSE;
-    if ($this->secretsChecker && $this->secretsChecker->hasKey('az_profiles_api_key')) {
-      $has_key = TRUE;
-    }
-    elseif (!empty(trim($config->get('apikey')))) {
-      $has_key = TRUE;
-    }
+    // Check if we have an API key from either config or secrets (via override).
+    $has_key = !empty(trim($config->get('apikey')));
 
     if (!$has_key) {
       $url = Url::fromRoute('az_person_profiles_import.settings_form')->toString();
diff --git a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
index 94e4996059..3dc9261c61 100644
--- a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
+++ b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
@@ -4,9 +4,9 @@
 
 namespace Drupal\az_person_profiles_import\Form;
 
+use Drupal\Component\Render\FormattableMarkup;
 use Drupal\Core\Form\ConfigFormBase;
 use Drupal\Core\Form\FormStateInterface;
-use Drupal\Component\Render\FormattableMarkup;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 
 /**
@@ -15,27 +15,18 @@
 final class AZPersonProfilesImportSettingsForm extends ConfigFormBase {
 
   /**
-   * The secrets checker service (if available).
+   * The entity type manager.
    *
-   * @var \Drupal\az_secrets\Service\SecretsChecker|null
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
    */
-  protected $secretsChecker;
+  protected $entityTypeManager;
 
   /**
    * {@inheritdoc}
    */
   public static function create(ContainerInterface $container) {
     $instance = parent::create($container);
-
-    // Try to get the secrets checker service if available.
-    try {
-      $instance->secretsChecker = $container->get('az_secrets.checker');
-    }
-    catch (\Exception $e) {
-      // az_secrets module not enabled.
-      $instance->secretsChecker = NULL;
-    }
-
+    $instance->entityTypeManager = $container->get('entity_type.manager');
     return $instance;
   }
 
@@ -59,12 +50,10 @@ protected function getEditableConfigNames(): array {
   public function buildForm(array $form, FormStateInterface $form_state): array {
     $config = $this->config('az_person_profiles_import.settings');
 
-    // Check if az_secrets integration is active.
-    $using_secrets = FALSE;
-    if ($this->secretsChecker &&
-        $this->secretsChecker->hasKeys(['az_profiles_api_endpoint', 'az_profiles_api_key'])) {
-      $using_secrets = TRUE;
+    // Check if az_secrets integration is active by checking if keys exist and have values.
+    $using_secrets = $this->hasSecrets(['az_profiles_api_endpoint', 'az_profiles_api_key']);
 
+    if ($using_secrets) {
       $form['secrets_status'] = [
         '#type' => 'item',
         '#markup' => new FormattableMarkup('<div class="messages messages--status">@message1<br>@message2</div>', [
@@ -107,15 +96,8 @@ public function buildForm(array $form, FormStateInterface $form_state): array {
    * {@inheritdoc}
    */
   public function submitForm(array &$form, FormStateInterface $form_state): void {
-    // Check if secrets are being used.
-    $using_secrets = FALSE;
-    if ($this->secretsChecker &&
-        $this->secretsChecker->hasKeys(['az_profiles_api_endpoint', 'az_profiles_api_key'])) {
-      $using_secrets = TRUE;
-    }
-
     // Only save to config if not using secrets.
-    if (!$using_secrets) {
+    if (!$this->hasSecrets(['az_profiles_api_endpoint', 'az_profiles_api_key'])) {
       $this->config('az_person_profiles_import.settings')
         ->set('endpoint', $form_state->getValue('endpoint'))
         ->set('apikey', $form_state->getValue('apikey'))
@@ -125,4 +107,38 @@ public function submitForm(array &$form, FormStateInterface $form_state): void {
     parent::submitForm($form, $form_state);
   }
 
+  /**
+   * Check if secrets are configured with values.
+   *
+   * @param array $key_ids
+   *   Array of key entity IDs to check.
+   *
+   * @return bool
+   *   TRUE if all keys exist and have values, FALSE otherwise.
+   */
+  protected function hasSecrets(array $key_ids): bool {
+    try {
+      $key_storage = $this->entityTypeManager->getStorage('key');
+
+      foreach ($key_ids as $key_id) {
+        $key = $key_storage->load($key_id);
+
+        if (!$key || !method_exists($key, 'getKeyValue')) {
+          return FALSE;
+        }
+
+        $value = $key->getKeyValue();
+        if (empty($value)) {
+          return FALSE;
+        }
+      }
+
+      return TRUE;
+    }
+    catch (\Exception $e) {
+      // Key storage not available or error loading keys.
+      return FALSE;
+    }
+  }
+
 }
diff --git a/modules/custom/az_person/az_person_profiles_import/src/Plugin/migrate_plus/data_fetcher/AZProfilesAPIFetcher.php b/modules/custom/az_person/az_person_profiles_import/src/Plugin/migrate_plus/data_fetcher/AZProfilesAPIFetcher.php
index 94115bbfb0..e5edf913da 100644
--- a/modules/custom/az_person/az_person_profiles_import/src/Plugin/migrate_plus/data_fetcher/AZProfilesAPIFetcher.php
+++ b/modules/custom/az_person/az_person_profiles_import/src/Plugin/migrate_plus/data_fetcher/AZProfilesAPIFetcher.php
@@ -38,13 +38,6 @@ class AZProfilesAPIFetcher extends Http {
    */
   protected $configFactory;
 
-  /**
-   * The secrets checker service (if available).
-   *
-   * @var \Drupal\az_secrets\Service\SecretsChecker|null
-   */
-  protected $secretsChecker;
-
   /**
    * {@inheritdoc}
    */
@@ -66,16 +59,6 @@ public static function create(ContainerInterface $container, array $configuratio
       $instance->httpClient = $container->get('http_client');
     }
     $instance->configFactory = $container->get('config.factory');
-
-    // Try to get the secrets checker service if available.
-    try {
-      $instance->secretsChecker = $container->get('az_secrets.checker');
-    }
-    catch (ServiceNotFoundException $e) {
-      // az_secrets module not enabled, will use config values.
-      $instance->secretsChecker = NULL;
-    }
-
     return $instance;
   }
 
@@ -84,17 +67,12 @@ public static function create(ContainerInterface $container, array $configuratio
    */
   public function getResponseContent(string $url): string {
     // Grab the profiles API settings from configuration.
+    // Note: If az_secrets is configured with key config overrides,
+    // these values will be automatically injected from secrets.
     $config = $this->configFactory->get('az_person_profiles_import.settings');
     $endpoint = $config->get('endpoint');
     $apikey = $config->get('apikey');
 
-    // Check if we should use secrets instead.
-    if ($this->secretsChecker &&
-        $this->secretsChecker->hasKeys(['az_profiles_api_endpoint', 'az_profiles_api_key'])) {
-      $endpoint = $this->secretsChecker->getKeyValue('az_profiles_api_endpoint');
-      $apikey = $this->secretsChecker->getKeyValue('az_profiles_api_key');
-    }
-
     // For this fetcher, the supplied URL is the netid.
     $netid = $url;
     // Construct the API call.
diff --git a/modules/custom/az_secrets/az_secrets.services.yml b/modules/custom/az_secrets/az_secrets.services.yml
deleted file mode 100644
index 4f0193ebda..0000000000
--- a/modules/custom/az_secrets/az_secrets.services.yml
+++ /dev/null
@@ -1,5 +0,0 @@
-services:
-  az_secrets.checker:
-    class: Drupal\az_secrets\Service\SecretsChecker
-    arguments:
-      - '@entity_type.manager'
diff --git a/modules/custom/az_secrets/src/Service/SecretsChecker.php b/modules/custom/az_secrets/src/Service/SecretsChecker.php
deleted file mode 100644
index b978a277fb..0000000000
--- a/modules/custom/az_secrets/src/Service/SecretsChecker.php
+++ /dev/null
@@ -1,98 +0,0 @@
-<?php
-
-namespace Drupal\az_secrets\Service;
-
-use Drupal\Core\Entity\EntityTypeManagerInterface;
-
-/**
- * Service to check if secrets are configured and have values.
- */
-class SecretsChecker {
-
-  /**
-   * The entity type manager.
-   *
-   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
-   */
-  protected $entityTypeManager;
-
-  /**
-   * Constructs a SecretsChecker object.
-   *
-   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
-   *   The entity type manager.
-   */
-  public function __construct(EntityTypeManagerInterface $entity_type_manager) {
-    $this->entityTypeManager = $entity_type_manager;
-  }
-
-  /**
-   * Check if a key is configured with a value.
-   *
-   * @param string $key_id
-   *   The key entity ID.
-   *
-   * @return bool
-   *   TRUE if the key exists and has a value, FALSE otherwise.
-   */
-  public function hasKey(string $key_id): bool {
-    try {
-      $key_storage = $this->entityTypeManager->getStorage('key');
-      $key = $key_storage->load($key_id);
-
-      if ($key && method_exists($key, 'getKeyValue')) {
-        $value = $key->getKeyValue();
-        return !empty($value);
-      }
-    }
-    catch (\Exception $e) {
-      // Key storage not available.
-    }
-
-    return FALSE;
-  }
-
-  /**
-   * Check if multiple keys are all configured with values.
-   *
-   * @param array $key_ids
-   *   Array of key entity IDs.
-   *
-   * @return bool
-   *   TRUE if all keys exist and have values, FALSE otherwise.
-   */
-  public function hasKeys(array $key_ids): bool {
-    foreach ($key_ids as $key_id) {
-      if (!$this->hasKey($key_id)) {
-        return FALSE;
-      }
-    }
-    return TRUE;
-  }
-
-  /**
-   * Get the value of a key if it exists.
-   *
-   * @param string $key_id
-   *   The key entity ID.
-   *
-   * @return string|null
-   *   The key value or NULL if not found.
-   */
-  public function getKeyValue(string $key_id): ?string {
-    try {
-      $key_storage = $this->entityTypeManager->getStorage('key');
-      $key = $key_storage->load($key_id);
-
-      if ($key && method_exists($key, 'getKeyValue')) {
-        return $key->getKeyValue();
-      }
-    }
-    catch (\Exception $e) {
-      // Key storage not available.
-    }
-
-    return NULL;
-  }
-
-}

From d3ad9601fd96e96029b1dd3b0bed0bb19f80d7ce Mon Sep 17 00:00:00 2001
From: Chris Green <chrisgreen@arizona.edu>
Date: Fri, 20 Mar 2026 10:06:44 -0700
Subject: [PATCH 3/3] Update
 modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php

Co-authored-by: Joe Parsons <471936+joeparsons@users.noreply.github.com>
---
 .../src/Form/AZPersonProfilesImportSettingsForm.php            | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
index 3dc9261c61..9e323c3a87 100644
--- a/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
+++ b/modules/custom/az_person/az_person_profiles_import/src/Form/AZPersonProfilesImportSettingsForm.php
@@ -50,7 +50,8 @@ protected function getEditableConfigNames(): array {
   public function buildForm(array $form, FormStateInterface $form_state): array {
     $config = $this->config('az_person_profiles_import.settings');
 
-    // Check if az_secrets integration is active by checking if keys exist and have values.
+    // Check if az_secrets integration is active by checking if keys exist and
+    // have values.
     $using_secrets = $this->hasSecrets(['az_profiles_api_endpoint', 'az_profiles_api_key']);
 
     if ($using_secrets) {