wrapAndSign method

FutureOr<Map<String, Object?>> wrapAndSign(
  1. Object? payload, {
  2. Object? toEncodable(
    1. Object? nonEncodable
    )?,
})

Create a json envelope around payload in a format that can be verified by verifyEnvelopeSignature.

payload must be a String or a json-encodable object. toEncodable is passed directly to jsonEncode. Read the jsonEncode docs to learn how to use it.

Implementation

FutureOr<Map<String, Object?>> wrapAndSign(
  Object? payload, {
  Object? Function(Object? nonEncodable)? toEncodable,
}) {
  Map<String, Object?> envelope = {'payload': payload};

  String signableText;
  try {
    signableText = _signableText(payload, toEncodable: toEncodable);
  } catch (e, st) {
    logger.severe(
      "Failed to encode payload for signing (you may need to pass "
      "toEncodable to wrapAndSign): $e, $st",
    );
    rethrow;
  }

  // Sign with the APKAM (PKAM) keypair: its public half is what
  // [ApkamSigning.publishPublicSigningKey] publishes, so verifiers can
  // check the signature against the per-enrollment _apsk key.
  // (AtSigningMode.data would sign with the atSign-wide encryption keypair,
  // which is NOT the published key.)
  final AtSigningInput signingInput = AtSigningInput(signableText)
    ..signingMode = AtSigningMode.pkam;
  final AtSigningResult sr = atClient.atChops!.sign(signingInput);

  envelope['signature'] = sr.result.toString();
  envelope['hashingAlgo'] = sr.atSigningMetaData.hashingAlgoType!.name;
  envelope['signingAlgo'] = sr.atSigningMetaData.signingAlgoType!.name;
  envelope['enrollmentId'] = enrollmentId;
  return envelope;
}