open-event

Overview ¶

Command open-event verifies and decrypts one sealed AMQP event body using the go-bricks jose/sealed package's production OpenDocument path, so an operator can inspect what a queue is carrying without writing a Go program.

Install:

go install github.com/gaborage/go-bricks/cmd/open-event@latest

Usage:

open-event -sign-key-file sign.pub.der -encrypt-key-file enc.der \
  -sign-kid svc.payments.sign.v1 -encrypt-kid aud-core-encrypt-v1 \
  -subject card -event-type payment.authorized \
  -tenancy shared -tenant-id t1 body.txt

Each kid is a Generation: <family>.v<N> for a dotted family, <family>-v<N> for a family without '.', so -sign-kid svc-payments-sign-v1 still works (ADR-144). The JSON keys signKid, encKid and signFamily carry the values verbatim, dots included.

The sealed subject is NEVER printed by default: the document comes back with the subject member rendered as the string "<redacted>", so its place in the document stays visible and its size is not leaked. -print-subject is the fixture-only escape hatch.

There is no skip-verification mode (ADR-097): the CLI fails exactly where the consume door fails, with the same SEAL_* code. Both wire kids are required flags and are never peeked from the unauthenticated protected header.