Method mint

crates/openshell-server/src/auth/sandbox_jwt.rs:102–127

`tonic::Status` is the natural error here

(&self, sandbox_id: &str)

    /// Mint a fresh token for `sandbox_id`.
    #[allow(clippy::result_large_err)] // `tonic::Status` is the natural error here
    pub fn mint(&self, sandbox_id: &str) -> Result<MintedToken, Status> {
        let now = now_secs();
        let exp = if self.ttl.is_zero() {
            0
        } else {
            now.saturating_add(i64::try_from(self.ttl.as_secs()).unwrap_or(3_600))
        };
        let claims = SandboxJwtClaims {
            sub: format!("{SPIFFE_SUBJECT_PREFIX}{sandbox_id}"),
            iss: self.issuer.clone(),
            aud: self.audience.clone(),
            iat: now,
            exp,
            sandbox_id: sandbox_id.to_string(),
        };
        let mut header = Header::new(Algorithm::EdDSA);
        header.kid = Some(self.kid.clone());
        let token = encode(&header, &claims, &self.encoding_key).map_err(|e| {
            warn!(error = %e, "failed to mint sandbox JWT");
            Status::internal("failed to mint sandbox token")
        })?;
        Ok(MintedToken {
            token,
            expires_at_ms: exp.saturating_mul(1000),
        })
    }

    pub fn ttl(&self) -> Duration {
        self.ttl