From 1bca082c7701cceedb4738f693623461d2172147 Mon Sep 17 00:00:00 2001
From: eding <edin.grech@gmail.com>
Date: Sun, 13 Sep 2026 11:47:20 +0200
Subject: [PATCH] fix: parse provisioned identity tokens

---
 internal/openbao/bootstrap.go      | 7 ++++---
 internal/openbao/bootstrap_test.go | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/internal/openbao/bootstrap.go b/internal/openbao/bootstrap.go
index d9b2c27..3cdaae9 100644
--- a/internal/openbao/bootstrap.go
+++ b/internal/openbao/bootstrap.go
@@ -447,8 +447,8 @@ path "secret/metadata/apps/` + app + `/E2E_PROBE" { capabilities = ["read", "del
 EOF
 bao policy write maidn-app-secret-admin /tmp/maidn-app-secret-admin.hcl >/dev/null
 bao policy write maidn-e2e-` + app + ` /tmp/maidn-e2e.hcl >/dev/null
-bao token create -orphan -policy=maidn-app-secret-admin -ttl=1h -explicit-max-ttl=1h -format=json
-bao token create -orphan -policy=maidn-e2e-` + app + ` -ttl=1h -explicit-max-ttl=1h -format=json
+bao token create -orphan -policy=maidn-app-secret-admin -ttl=1h -explicit-max-ttl=1h -format=json | base64 | tr -d '\n'; printf '\n'
+bao token create -orphan -policy=maidn-e2e-` + app + ` -ttl=1h -explicit-max-ttl=1h -format=json | base64 | tr -d '\n'; printf '\n'
 rm -f /tmp/maidn-app-secret-admin.hcl /tmp/maidn-e2e.hcl`
 	output, err := execInPodMutation(kubeconfig, []byte(material.RootToken+"\n"), "sh", "-ec", script)
 	if err != nil {
@@ -465,7 +465,8 @@ rm -f /tmp/maidn-app-secret-admin.hcl /tmp/maidn-e2e.hcl`
 				ClientToken string `json:"client_token"`
 			} `json:"auth"`
 		}
-		if err := json.Unmarshal(line, &response); err != nil || response.Auth.ClientToken == "" {
+		decoded, err := base64.StdEncoding.DecodeString(string(line))
+		if err != nil || json.Unmarshal(decoded, &response) != nil || response.Auth.ClientToken == "" {
 			return AppSecretIdentityTokens{}, errors.New("parse provisioned app-secret identity")
 		}
 		responses = append(responses, response)
diff --git a/internal/openbao/bootstrap_test.go b/internal/openbao/bootstrap_test.go
index abac690..9714f3d 100644
--- a/internal/openbao/bootstrap_test.go
+++ b/internal/openbao/bootstrap_test.go
@@ -194,7 +194,7 @@ func TestProvisionAppSecretIdentitiesScopesFixtureWithoutRootLeak(t *testing.T)
 		if string(input) != "root-token\n" || !strings.Contains(command, `secret/data/apps/maidn-e2e-web/E2E_PROBE`) || strings.Contains(command, `secret/data/apps/maidn-e2e-web/*`) {
 			t.Fatal("fixture identity policy scope is incorrect")
 		}
-		return []byte("{\"auth\":{\"client_token\":\"admin-token\"}}\n{\"auth\":{\"client_token\":\"e2e-token\"}}\n"), nil
+		return []byte("eyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImFkbWluLXRva2VuIn19\neyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImUyZS10b2tlbiJ9fQ==\n"), nil
 	}
 	tokens, err := ProvisionAppSecretIdentities("kubeconfig", "identity", "bundle", "maidn-e2e-web")
 	if err != nil || tokens.Admin != "admin-token" || tokens.E2E != "e2e-token" {