Skip to main content

issue

ppoppo_token::access_token

Function issue 

Source 
pub fn issue(
    req: &IssueRequest,
    cfg: &IssueConfig,
    key: &SigningKey,
    now: i64,
) -> Result<String, IssueError>
Expand description

Issue a signed Compact JWS for the given request + config + key.

Mirrors verify on the issuance side. Order of operations:

  1. kid match — fail-fast on a misconfigured pipeline before any encoding work. The KeyMismatch audit signal carries both kids so operators can diagnose without a debugger.
  2. clock sanity — refuse to emit if now() is before UNIX_EPOCH (cannot happen on a correctly configured machine; the check exists so the engine fails closed rather than emitting garbage timestamps).
  3. payload assembly via encode::IssuePayload::build.
  4. header construction — pin alg=EdDSA, typ=cfg.typ (at+jwt for access), kid=cfg.kid. Forbidden headers (jku/x5u/jwk/ x5c/crit/extras) are never set; the invariant test in tests/issue_invariants.rs::issue_emits_only_alg_typ_kid_in_header is the regression guard.
  5. encode via jsonwebtoken::encode — the only call site for jsonwebtoken::* on the issue path; the M51 “no jsonwebtoken outside engine/” lint accommodates this single use site.

issue stays sync (D-11): no I/O on the issuance path.