Method Sign

internal/agentauth/signing.go:75–95

Sign issues an RS256 JWT carrying the given claims, with the kid in the header so verifiers can select the right JWKS entry. Returns ErrSigningDisabled when no key is configured.

(claims jwt.Claims, private map[string]interface{})

// header so verifiers can select the right JWKS entry. Returns
// ErrSigningDisabled when no key is configured.
func (s *Signer) Sign(claims jwt.Claims, private map[string]interface{}) (string, error) {
	if !s.Enabled() {
		return "", ErrSigningDisabled
	}
	sig, err := jose.NewSigner(
		jose.SigningKey{Algorithm: SigningAlg, Key: jose.JSONWebKey{Key: s.priv, KeyID: s.kid}},
		(&jose.SignerOptions{}).WithType("JWT"),
	)
	if err != nil {
		return "", fmt.Errorf("agentauth: build signer: %w", err)
	}
	builder := jwt.Signed(sig).Claims(claims)
	if len(private) > 0 {
		builder = builder.Claims(private)
	}
	out, err := builder.CompactSerialize()
	if err != nil {
		return "", fmt.Errorf("agentauth: serialize jwt: %w", err)
	}
	return out, nil
}

// PublicJWKS returns the public half as a JWK set for /.well-known/jwks.json.
// When disabled it returns an empty (non-nil) set so the endpoint always serves