Function generate_jwt_key

crates/openshell-bootstrap/src/jwt.rs:41–53

Generate a fresh Ed25519 JWT signing key. Output PEM is in the formats `jsonwebtoken` consumes via `EncodingKey::from_ed_pem` (signing) and `DecodingKey::from_ed_pem` (validation), so the gateway can round-trip its own tokens with no further conversion.

()

/// (validation), so the gateway can round-trip its own tokens with no
/// further conversion.
pub fn generate_jwt_key() -> Result<JwtKeyMaterial> {
    let keypair = KeyPair::generate_for(&PKCS_ED25519)
        .into_diagnostic()
        .wrap_err("failed to generate Ed25519 JWT signing key")?;
    let signing_key_pem = keypair.serialize_pem();
    let public_key_pem = keypair.public_key_pem();
    let kid = kid_from_public_key_der(&keypair.public_key_der());
    Ok(JwtKeyMaterial {
        signing_key_pem,
        public_key_pem,
        kid,
    })
}

/// Stable `kid` derived from the SHA-256 of the public-key DER.
///