修正协议处理并解耦可选遥测

internal/signing/jwt.go

@@ -2,15 +2,14 @@ package signing
 
 import (
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"strings"
 	"time"
-)
 
-var rawURLEncoding = base64.RawURLEncoding
+	"github.com/go-jose/go-jose/v4"
+)
 
 type RS256Signer interface {
 	ActiveKey(ctx context.Context) (SigningKey, error)
@@ -59,25 +58,49 @@ func (i *Issuer) Sign(ctx context.Context, claims Claims) (string, error) {
 		return "", errors.New("signer returned an invalid signing key")
 	}
 
-	header, err := json.Marshal(map[string]string{
-		"alg": "RS256",
-		"kid": key.ID,
-		"typ": "at+jwt",
-	})
-	if err != nil {
-		return "", fmt.Errorf("encode protected header: %w", err)
-	}
 	payload, err := json.Marshal(claims)
 	if err != nil {
 		return "", fmt.Errorf("encode claims: %w", err)
 	}
 
-	signingInput := rawURLEncoding.EncodeToString(header) + "." + rawURLEncoding.EncodeToString(payload)
-	signature, err := i.signer.SignRS256(ctx, key, []byte(signingInput))
+	opaque := &contextSigner{ctx: ctx, signer: i.signer, key: key}
+	options := (&jose.SignerOptions{}).
+		WithType(jose.ContentType("at+jwt")).
+		WithHeader(jose.HeaderKey("kid"), key.ID)
+	signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: opaque}, options)
+	if err != nil {
+		return "", fmt.Errorf("create JWT signer: %w", err)
+	}
+	jws, err := signer.Sign(payload)
 	if err != nil {
 		return "", fmt.Errorf("sign JWT: %w", err)
 	}
-	return signingInput + "." + rawURLEncoding.EncodeToString(signature), nil
+	compact, err := jws.CompactSerialize()
+	if err != nil {
+		return "", fmt.Errorf("serialize JWT: %w", err)
+	}
+	return compact, nil
+}
+
+type contextSigner struct {
+	ctx    context.Context
+	signer RS256Signer
+	key    SigningKey
+}
+
+func (*contextSigner) Public() *jose.JSONWebKey {
+	return nil
+}
+
+func (*contextSigner) Algs() []jose.SignatureAlgorithm {
+	return []jose.SignatureAlgorithm{jose.RS256}
+}
+
+func (s *contextSigner) SignPayload(payload []byte, algorithm jose.SignatureAlgorithm) ([]byte, error) {
+	if algorithm != jose.RS256 {
+		return nil, errors.New("unsupported signing algorithm")
+	}
+	return s.signer.SignRS256(s.ctx, s.key, payload)
 }
 
 func validateClaims(claims Claims, now time.Time) error {