fix: correct field from bao

pkgs/helpers/tests/test_cli.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import importlib.util
 import sys
 import unittest
+from unittest import mock
 from pathlib import Path
 
 
@@ -45,6 +46,28 @@ class HelperCliTests(unittest.TestCase):
         self.assertIn('device = lib.mkDefault "/dev/vda";', rendered)
         self.assertIn('size = "8GiB";', rendered)
 
+    def test_bao_kv_get_uses_explicit_kv_mount(self) -> None:
+        completed = mock.Mock()
+        completed.stdout = '{"data": {"data": {"CLIENT_ID": "x"}}}'
+        with mock.patch.object(cli, "run_command", return_value=completed) as run_command:
+            data = cli.bao_kv_get("it", "kv", "tailscale")
+
+        self.assertEqual(data["data"]["data"]["CLIENT_ID"], "x")
+        command = run_command.call_args.args[0]
+        self.assertEqual(command, ["bao", "kv", "get", "-mount=kv", "-format=json", "tailscale"])
+        self.assertEqual(run_command.call_args.kwargs["env"], {"BAO_NAMESPACE": "it"})
+
+    def test_derive_openbao_policy_uses_explicit_kv_mount(self) -> None:
+        completed = mock.Mock()
+        completed.stdout = 'path "kv/data/tailscale" { capabilities = ["read"] }\n'
+        with mock.patch.object(cli, "run_command", return_value=completed) as run_command:
+            policy = cli.derive_openbao_policy("it", "kv", "tailscale")
+
+        self.assertIn('path "kv/data/tailscale"', policy)
+        command = run_command.call_args.args[0]
+        self.assertEqual(command, ["bao", "kv", "get", "-mount=kv", "-output-policy", "tailscale"])
+        self.assertEqual(run_command.call_args.kwargs["env"], {"BAO_NAMESPACE": "it"})
+
 
 if __name__ == "__main__":
     unittest.main()