From 217f03d4bedc6653de91088406f7e109a75def35 Mon Sep 17 00:00:00 2001
From: eding <edin.grech@gmail.com>
Date: Sun, 13 Sep 2026 11:49:41 +0200
Subject: [PATCH] fix: use valid E2E probe secret path

---
 docs/secrets.md                    | 2 +-
 internal/openbao/bootstrap.go      | 4 ++--
 internal/openbao/bootstrap_test.go | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/secrets.md b/docs/secrets.md
index 11d2b6b..6ace215 100644
--- a/docs/secrets.md
+++ b/docs/secrets.md
@@ -25,7 +25,7 @@ The webhook-only path requires a complete delivery contract, an approved configu
 ## Automated app-secret identities
 
 Use `bootstrap --provision-app-secret-identities --e2e-app <app>` to create a
-short-lived non-root `admin` identity and an exact-path E2E probe identity.
+short-lived non-root `admin` identity and an exact-path `e2e-probe` identity.
 Bootstrap reads root recovery material only through its encrypted recovery
 bundle, writes the generated tokens only into encrypted operational state, and
 never prints either value. `app secret --identity admin` and
diff --git a/internal/openbao/bootstrap.go b/internal/openbao/bootstrap.go
index 3cdaae9..78c3e00 100644
--- a/internal/openbao/bootstrap.go
+++ b/internal/openbao/bootstrap.go
@@ -441,9 +441,9 @@ path "secret/data/shared/*" { capabilities = ["create", "update"] }
 path "secret/metadata/shared/*" { capabilities = ["list", "read", "delete"] }
 EOF
 cat >/tmp/maidn-e2e.hcl <<'EOF'
-path "secret/data/apps/` + app + `/E2E_PROBE" { capabilities = ["create", "update"] }
+path "secret/data/apps/` + app + `/e2e-probe" { capabilities = ["create", "update"] }
 path "secret/metadata/apps/` + app + `" { capabilities = ["list"] }
-path "secret/metadata/apps/` + app + `/E2E_PROBE" { capabilities = ["read", "delete"] }
+path "secret/metadata/apps/` + app + `/e2e-probe" { capabilities = ["read", "delete"] }
 EOF
 bao policy write maidn-app-secret-admin /tmp/maidn-app-secret-admin.hcl >/dev/null
 bao policy write maidn-e2e-` + app + ` /tmp/maidn-e2e.hcl >/dev/null
diff --git a/internal/openbao/bootstrap_test.go b/internal/openbao/bootstrap_test.go
index 9714f3d..b9f9870 100644
--- a/internal/openbao/bootstrap_test.go
+++ b/internal/openbao/bootstrap_test.go
@@ -191,7 +191,7 @@ func TestProvisionAppSecretIdentitiesScopesFixtureWithoutRootLeak(t *testing.T)
 	}
 	execInPodMutation = func(_ string, input []byte, args ...string) ([]byte, error) {
 		command := strings.Join(args, " ")
-		if string(input) != "root-token\n" || !strings.Contains(command, `secret/data/apps/maidn-e2e-web/E2E_PROBE`) || strings.Contains(command, `secret/data/apps/maidn-e2e-web/*`) {
+		if string(input) != "root-token\n" || !strings.Contains(command, `secret/data/apps/maidn-e2e-web/e2e-probe`) || strings.Contains(command, `secret/data/apps/maidn-e2e-web/*`) {
 			t.Fatal("fixture identity policy scope is incorrect")
 		}
 		return []byte("eyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImFkbWluLXRva2VuIn19\neyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImUyZS10b2tlbiJ9fQ==\n"), nil