Function CreateClientAssertion

internal/auth/auth.go:346–378

CreateClientAssertion creates a JWT token for client authentication with the specified lifetime.

(alg jwa.SignatureAlgorithm, signingKey, clientID, audience string)

// CreateClientAssertion creates a JWT token for client authentication with the specified lifetime.
func CreateClientAssertion(alg jwa.SignatureAlgorithm, signingKey, clientID, audience string) (string, error) {
	key, err := jwk.ParseKey([]byte(signingKey), jwk.WithPEM(true))
	if err != nil {
		return "", fmt.Errorf("failed to parse signing key: %w", err)
	}

	// Verify that the key type is compatible with the algorithm.
	if key.KeyType() != "RSA" {
		return "", fmt.Errorf("%s algorithm requires an RSA key, but got %s", alg, key.KeyType())
	}

	now := time.Now()

	token, err := jwt.NewBuilder().
		IssuedAt(now).
		NotBefore(now).
		Subject(clientID).
		JwtID(uuid.NewString()).
		Issuer(clientID).
		Audience([]string{audience}).
		Expiration(now.Add(2 * time.Minute)).
		Build()
	if err != nil {
		return "", fmt.Errorf("failed to build JWT: %w", err)
	}

	signedToken, err := jwt.Sign(token, jwt.WithKey(alg, key))
	if err != nil {
		return "", fmt.Errorf("failed to sign JWT: %w", err)
	}

	return string(signedToken), nil
}