feat(vault,openbao): support base64 decode via decode=base64

[digiserg]

Adds a decode option to the Vault and OpenBao providers. When decode=base64 is set in the URI query, string values returned via GetString are base64-decoded before being substituted. Useful when storing binary payloads (certificates, keystores) as base64 strings in the secret backend.

Decoding is applied only to the specific key returned by GetString (e.g. with #/field usage); GetStringMap is left untouched so secrets containing mixed (non-base64) string fields are not broken.

[Copilot]

Pull request overview

Adds an encode query option to the Vault and OpenBao providers so returned secret string values can be base64-decoded before substitution, and documents the new parameter in the README.

Changes:

• Add encode configuration parsing (default raw) to Vault and OpenBao providers.
• Apply base64 decoding to string values returned by GetStringMap when encode=base64.
• Document the new encode option for both Vault and OpenBao in README.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
README.md	Documents the new encode option for Vault and OpenBao URIs.
pkg/providers/vault/vault.go	Adds encode handling and base64 decoding logic for Vault secret maps.
pkg/providers/openbao/openbao.go	Adds encode handling and base64 decoding logic for OpenBao secret maps.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (3)

pkg/providers/vault/vault.go:189

• There are existing integration tests for Vault expansion (vals_vault_test.go), but no coverage for the new decode=base64 behavior (success + invalid base64 error). Please add tests that write a base64 value to Vault and verify it is decoded when the query parameter is set.

	if err := p.applyDecode(res); err != nil {
		return nil, err
	}

pkg/providers/openbao/openbao.go:189

• There are existing integration tests for OpenBao expansion (vals_openbao_test.go), but no coverage for the new decode=base64 behavior (success + invalid base64 error). Please add tests that write a base64 value and verify it is decoded when the query parameter is set.

	if err := p.applyDecode(res); err != nil {
		return nil, err
	}

README.md:371

• PR metadata says the query parameter is encode=base64, but the documentation here introduces decode=base64. Please align the public interface (PR title/description, README, and provider config key) to use a single parameter name to avoid breaking/ confusing users.

* `role_id` defaults to the value of the `BAO_ROLE_ID` envvar.
* `secret_id` defaults to the value of the `BAO_SECRET_ID` envvar.
* `version` is the specific version of the secret to be obtained. Used when you want to get a previous content of the secret.
* `decode` controls how the retrieved value is transformed before being returned. Defaults to `raw` (no transformation). Set to `base64` to base64-decode the stored value (useful when binary data such as certificates is stored as a base64 string).