From 8613203b64d0e95d5cfc4083e9d22a75b2eb80fd Mon Sep 17 00:00:00 2001
From: Abhinav Raut <abhinavrautcs@gmail.com>
Date: Tue, 4 Aug 2026 14:06:40 +0530
Subject: [PATCH 1/2] Add CLI helper for decrypting crypto payloads

---
 scripts/decrypt-payload/main.go | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 scripts/decrypt-payload/main.go

diff --git a/scripts/decrypt-payload/main.go b/scripts/decrypt-payload/main.go
new file mode 100644
index 00000000..b63c7205
--- /dev/null
+++ b/scripts/decrypt-payload/main.go
@@ -0,0 +1,32 @@
+// Run with:
+//
+//	ENCRYPTION_KEY='32-character-key' go run ./scripts/decrypt-payload 'enc:...'
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/abhinavxd/libredesk/internal/crypto"
+)
+
+func main() {
+	if len(os.Args) != 2 {
+		fmt.Fprintln(os.Stderr, "usage: ENCRYPTION_KEY=<32-byte-key> go run ./scripts/decrypt-payload <encrypted-payload>")
+		os.Exit(2)
+	}
+
+	key, ok := os.LookupEnv("ENCRYPTION_KEY")
+	if !ok {
+		fmt.Fprintln(os.Stderr, "ENCRYPTION_KEY is required")
+		os.Exit(2)
+	}
+
+	plaintext, err := crypto.Decrypt(os.Args[1], key)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+
+	fmt.Print(plaintext)
+}

From 037956a0a96deac764dcf6e0caa7bc72f536b8de Mon Sep 17 00:00:00 2001
From: Abhinav Raut <abhinavrautcs@gmail.com>
Date: Tue, 4 Aug 2026 16:18:35 +0530
Subject: [PATCH 2/2] check encryption key length

---
 scripts/decrypt-payload/main.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/decrypt-payload/main.go b/scripts/decrypt-payload/main.go
index b63c7205..b67a8bfa 100644
--- a/scripts/decrypt-payload/main.go
+++ b/scripts/decrypt-payload/main.go
@@ -21,6 +21,10 @@ func main() {
 		fmt.Fprintln(os.Stderr, "ENCRYPTION_KEY is required")
 		os.Exit(2)
 	}
+	if len(key) != 32 {
+		fmt.Fprintln(os.Stderr, "ENCRYPTION_KEY must be exactly 32 bytes")
+		os.Exit(2)
+	}
 
 	plaintext, err := crypto.Decrypt(os.Args[1], key)
 	if err != nil {