passes tests now!

internal/vault/secrets.go

@@ -351,6 +351,7 @@ func (v *Vault) GetSecretVersion(name string, version string) ([]byte, error) {
 	)
 
 	// Get the version's value
+	secret.Debug("About to call secretVersion.GetValue", "version", version, "secret_name", name)
 	decryptedValue, err := secretVersion.GetValue(longTermIdentity)
 	if err != nil {
 		secret.Debug("Failed to decrypt version value", "error", err, "version", version, "secret_name", name)
@@ -364,6 +365,13 @@ func (v *Vault) GetSecretVersion(name string, version string) ([]byte, error) {
 		slog.Int("decrypted_length", len(decryptedValue)),
 	)
 
+	// Debug: Log metadata about the decrypted value without exposing the actual secret
+	secret.Debug("Vault secret decryption debug info",
+		"secret_name", name,
+		"version", version,
+		"decrypted_value_length", len(decryptedValue),
+		"is_empty", len(decryptedValue) == 0)
+
 	return decryptedValue, nil
 }