From 971810433c0e3cb625f3f5f443913bfb6a91544b Mon Sep 17 00:00:00 2001
From: Sienna Meridian Satterwhite <sienna@sunbeam.pt>
Date: Sun, 5 Apr 2026 20:41:54 +0100
Subject: [PATCH] fix(openbao): fix init response field name for keys_base64

OpenBao returns `keys_base64` not `unseal_keys_b64`. Added serde
alias to accept both field names for compatibility.
---
 src/openbao.rs                           | 3 ++-
 src/workflows/seed/steps/openbao_init.rs | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/openbao.rs b/src/openbao.rs
index cdea8d98..630880bc 100644
--- a/src/openbao.rs
+++ b/src/openbao.rs
@@ -19,7 +19,8 @@ pub struct BaoClient {
 
 #[derive(Debug, Deserialize)]
 pub struct InitResponse {
-    pub unseal_keys_b64: Vec<String>,
+    #[serde(alias = "unseal_keys_b64")]
+    pub keys_base64: Vec<String>,
     pub root_token: String,
 }
 
diff --git a/src/workflows/seed/steps/openbao_init.rs b/src/workflows/seed/steps/openbao_init.rs
index fbf7b960..d59a2dba 100644
--- a/src/workflows/seed/steps/openbao_init.rs
+++ b/src/workflows/seed/steps/openbao_init.rs
@@ -181,7 +181,7 @@ impl StepBody for InitOrUnsealOpenBao {
             ok("Initializing OpenBao...");
             match bao.init(1, 1).await {
                 Ok(init) => {
-                    unseal_key = init.unseal_keys_b64[0].clone();
+                    unseal_key = init.keys_base64[0].clone();
                     root_token = init.root_token.clone();
                     let mut secret_data = HashMap::new();
                     secret_data.insert("key".to_string(), unseal_key.clone());