Function mint_token

atomic-cli/src/commands/token.rs:122–197

(server: &str, identity: &Identity)

// ---------------------------------------------------------------------------

fn mint_token(server: &str, identity: &Identity) -> CliResult<String> {
    // The token is keyed by the signer's own public key — no server-assigned
    // identifier to look up. For an agent the signer is the agent itself.
    let public_key_b32 = identity.public_key_base32();

    // Load the keypair (needs the secret key to sign).
    let store = IdentityStore::open_default()
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to open identity store: {e}")))?;
    let keypair = store.load_keypair(&identity.id, None).map_err(|e| {
        CliError::Internal(anyhow::anyhow!(
            "Failed to load keypair for '{}': {e}",
            identity.name
        ))
    })?;

    // An agent acts on behalf of the human who delegated to it, so the subject
    // becomes the human and the agent moves into `act`. Resolving the
    // certificate here means an unusable delegation is reported before any
    // request is made, with the command that fixes it.
    let (sub, act, dlg) = if identity.identity_type.is_delegated() {
        let resolved = crate::commands::delegation::active_for(&store, identity, Some(server))?;
        let delegator_key = atomic_canonical::delegation::delegator_public_key(
            &resolved.delegation,
        )
        .map_err(|e| CliError::DelegationError {
            message: format!("Delegation for '{}' is malformed: {e}", identity.name),
        })?;
        (
            delegator_key.to_base32(),
            Some(Actor {
                sub: public_key_b32.clone(),
            }),
            Some(resolved.delegation.id.to_urn()),
        )
    } else {
        (public_key_b32.clone(), None, None)
    };

    let now = Utc::now();
    let claims = Claims {
        sub,
        iat: now.timestamp(),
        exp: (now + TOKEN_TTL).timestamp(),
        jti: Uuid::new_v4().to_string(),
        act,
        dlg,
    };

    let header = JwtHeader {
        alg: "EdDSA",
        typ: "JWT",
        kid: public_key_b32,
    };

    let header_json = serde_json::to_vec(&header)
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to encode JWT header: {e}")))?;
    let claims_json = serde_json::to_vec(&claims)
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to encode JWT claims: {e}")))?;