From e344df0bbddf2a0c0dc52f3b17715357842b10ff Mon Sep 17 00:00:00 2001
From: libops-agent <115990865+libops-agent@users.noreply.github.com>
Date: Sat, 29 Aug 2026 11:51:14 +0000
Subject: [PATCH] Fix Vault token accessor listing through Cloud Run

---
 main.go      | 2 +-
 main_test.go | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/main.go b/main.go
index ebafb8b..e5aa88b 100644
--- a/main.go
+++ b/main.go
@@ -1288,7 +1288,7 @@ func lookupSelfToken(rootToken string) (tokenData, error) {
 }
 
 func listTokenAccessors(rootToken string) ([]string, error) {
-	status, body, err := doRootVaultRequest("LIST", "/v1/auth/token/accessors", nil, rootToken)
+	status, body, err := doRootVaultRequest(http.MethodGet, "/v1/auth/token/accessors?list=true", nil, rootToken)
 	if err != nil {
 		return nil, fmt.Errorf("list token accessors: %w", err)
 	}
diff --git a/main_test.go b/main_test.go
index 7e932b3..25a1860 100644
--- a/main_test.go
+++ b/main_test.go
@@ -982,7 +982,10 @@ func TestResumeIncompleteKMSBootstrap(t *testing.T) {
 			writeJSON(response, map[string]any{"data": map[string]any{
 				"accessor": "repair-accessor", "policies": []string{"root"},
 			}})
-		case "LIST /v1/auth/token/accessors":
+		case "GET /v1/auth/token/accessors":
+			if request.URL.Query().Get("list") != "true" {
+				t.Fatalf("token accessor request omitted list=true: %s", request.URL.RawQuery)
+			}
 			accessors := []string{"repair-accessor", "application-accessor"}
 			if initialRootLive {
 				accessors = append(accessors, "initial-root-accessor")