Method Token

internal/auth/auth.go:290–329

Token generates a new token using Private Key JWT client authentication.

()

// Token generates a new token using Private Key JWT client authentication.
func (p PrivateKeyJwtTokenSource) Token() (*oauth2.Token, error) {
	alg, err := DetermineSigningAlgorithm(p.ClientAssertionSigningAlg)
	if err != nil {
		return nil, fmt.Errorf("invalid algorithm: %w", err)
	}

	baseURL, err := url.Parse(p.URI)
	if err != nil {
		return nil, fmt.Errorf("invalid URI: %w", err)
	}

	assertion, err := CreateClientAssertion(
		alg,
		p.ClientAssertionPrivateKey,
		p.ClientID,
		baseURL.JoinPath("/").String(),
	)

	if err != nil {
		return nil, fmt.Errorf("failed to create client assertion: %w", err)
	}

	cfg := &clientcredentials.Config{
		TokenURL:  p.URI + "/oauth/token",
		AuthStyle: oauth2.AuthStyleInParams,
		EndpointParams: url.Values{
			"audience":              []string{p.Audience},
			"client_assertion_type": []string{"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"},
			"client_assertion":      []string{assertion},
			"grant_type":            []string{"client_credentials"},
		},
	}

	token, err := cfg.Token(p.Ctx)
	if err != nil {
		return nil, fmt.Errorf("token request failed: %w", err)
	}

	return token, nil
}

// DetermineSigningAlgorithm returns the appropriate JWA signature algorithm based on the string representation.
func DetermineSigningAlgorithm(alg string) (jwa.SignatureAlgorithm, error) {