Function mint_token

atomic-cli/src/commands/token.rs:83–126

(_server: &str, identity: &Identity)

// ---------------------------------------------------------------------------

fn mint_token(_server: &str, identity: &Identity) -> CliResult<String> {
    // The token is keyed by the identity's own public key — no server-assigned
    // identifier to look up.
    let public_key_b32 = identity.public_key_base32();

    // Load the keypair (needs the secret key to sign).
    let store = IdentityStore::open_default()
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to open identity store: {e}")))?;
    let keypair = store.load_keypair(&identity.id, None).map_err(|e| {
        CliError::Internal(anyhow::anyhow!(
            "Failed to load keypair for '{}': {e}",
            identity.name
        ))
    })?;

    let now = Utc::now();
    let claims = Claims {
        sub: public_key_b32.clone(),
        iat: now.timestamp(),
        exp: (now + TOKEN_TTL).timestamp(),
        jti: Uuid::new_v4().to_string(),
    };

    let header = JwtHeader {
        alg: "EdDSA",
        typ: "JWT",
        kid: public_key_b32,
    };

    let header_json = serde_json::to_vec(&header)
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to encode JWT header: {e}")))?;
    let claims_json = serde_json::to_vec(&claims)
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to encode JWT claims: {e}")))?;

    let header_b64 = BASE64URL_NOPAD.encode(&header_json);
    let claims_b64 = BASE64URL_NOPAD.encode(&claims_json);
    let signing_input = format!("{header_b64}.{claims_b64}");

    let signature = keypair.sign(signing_input.as_bytes());
    let sig_b64 = BASE64URL_NOPAD.encode(&signature);

    log::debug!("Minted self-signed EdDSA JWT for '{}'", identity.name);
    Ok(format!("{signing_input}.{sig_b64}"))
}

#[cfg(test)]
mod tests {