From 7bddc0ab8bfb9890b05f1e8a5b9f18bae42cf402 Mon Sep 17 00:00:00 2001
From: libops-agent <115990865+libops-agent@users.noreply.github.com>
Date: Sat, 29 Aug 2026 11:18:50 +0000
Subject: [PATCH] Fix Vault audit response decoding

---
 main.go      | 16 +++++++++++++---
 main_test.go |  2 +-
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/main.go b/main.go
index 8f9acbf..ebafb8b 100644
--- a/main.go
+++ b/main.go
@@ -746,10 +746,20 @@ func readAuditDevices(rootToken string) (map[string]auditDevice, error) {
 		return nil, fmt.Errorf("unexpected status %d", status)
 	}
 	var devices map[string]auditDevice
-	if err := json.Unmarshal(body, &devices); err != nil {
-		return nil, fmt.Errorf("decode audit devices: %w", err)
+	directErr := json.Unmarshal(body, &devices)
+	if directErr == nil {
+		return devices, nil
 	}
-	return devices, nil
+	var response struct {
+		Data map[string]auditDevice `json:"data"`
+	}
+	if err := json.Unmarshal(body, &response); err != nil {
+		return nil, fmt.Errorf("decode audit devices response: %w", err)
+	}
+	if response.Data == nil {
+		return nil, fmt.Errorf("decode audit devices: %w", directErr)
+	}
+	return response.Data, nil
 }
 
 func validateStdoutAuditDevice(device auditDevice) error {
diff --git a/main_test.go b/main_test.go
index b47c075..7e932b3 100644
--- a/main_test.go
+++ b/main_test.go
@@ -684,7 +684,7 @@ func TestSecureBootstrapEnablesAuditBeforeRevokingRoot(t *testing.T) {
 				_, _ = response.Write([]byte(`{}`))
 				return
 			}
-			_, _ = response.Write([]byte(`{"cloudrun/":{"type":"file","options":{"file_path":"stdout","log_raw":"false"}}}`))
+			_, _ = response.Write([]byte(`{"request_id":"audit-list","lease_id":"","renewable":false,"lease_duration":0,"data":{"cloudrun/":{"type":"file","options":{"file_path":"stdout","log_raw":"false"}}},"wrap_info":null,"warnings":null,"auth":null,"mount_type":"system"}`))
 		case "POST /v1/sys/audit/cloudrun":
 			events = append(events, "audit")
 			auditEnabled = true