API Token JWT Auth (auth/api_token_jwt.go)

Creates and validates HS256 JWTs that carry token, user, and role ids plus an expiry. Reuse when minting or checking PentAGI API bearer tokens.

// Source: https://github.com/vxcontrol/pentagi | License: MIT | Copyright 2025 PentAGI Development Team
// Provided via justclaw.it.com; keep this notice with the code.
package auth

import (
	"errors"
	"fmt"
	"time"

	"pentagi/pkg/server/models"

	"github.com/golang-jwt/jwt/v5"
)

func MakeAPIToken(globalSalt string, claims jwt.Claims) (string, error) {
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	tokenString, err := token.SignedString(MakeJWTSigningKey(globalSalt))
	if err != nil {
		return "", fmt.Errorf("failed to sign token: %w", err)
	}

	return tokenString, nil
}

func MakeAPITokenClaims(tokenID, uhash string, uid, rid, ttl uint64) jwt.Claims {
	now := time.Now()
	return models.APITokenClaims{
		TokenID: tokenID,
		RID:     rid,
		UID:     uid,
		UHASH:   uhash,
		R

... (truncated -- full source via MCP)