wcSignJwt function

String wcSignJwt({ required Uint8List seed32, required String sub, required String aud, required int iat, required int ttl, })

Sign a relay-auth JWT.

seed32 is the Ed25519 seed (the first 32 bytes of the stored secret key). iat is the issued-at unix timestamp in seconds; ttl is the lifetime in seconds (exp = iat + ttl). Returns the compact JWT header.payload.sig.

Implementation

String wcSignJwt({
  required Uint8List seed32,
  required String sub,
  required String aud,
  required int iat,
  required int ttl,
}) {
  final publicKey = ed25519PublicKeyFromSeed(seed32);
  final iss = wcEncodeIss(publicKey);
  final exp = iat + ttl;

  final header = _b64Url(utf8.encode(jsonEncode({
    'alg': 'EdDSA',
    'typ': 'JWT',
  })));
  // Key order matters: iss, sub, aud, iat, exp.
  final payload = _b64Url(utf8.encode(jsonEncode({
    'iss': iss,
    'sub': sub,
    'aud': aud,
    'iat': iat,
    'exp': exp,
  })));

  final data = '$header.$payload';
  final sig = ed25519Sign(seed32, Uint8List.fromList(utf8.encode(data)));
  return '$data.${_b64Url(sig)}';
}