goat: Create service auth token via locally-held signing key

[DavidBuchanan314]

This is needed as part of the "adversarial PDS migration" flow, because the existing goat account service-auth command requires the origin PDS to create the token.

NAME:
   goat account service-auth-offline - create service auth token via locally-held signing key

USAGE:
   goat account service-auth-offline [command options] [arguments...]

OPTIONS:
   --atproto-signing-key value    private key used to sign the token (multibase syntax) [$ATPROTO_SIGNING_KEY]
   --iss value                    the DID of the account issuing the token
   --endpoint value, --lxm value  restrict token to API endpoint (NSID, optional)
   --audience value, --aud value  DID of service that will receive and validate token
   --duration-sec value           validity time window of token (seconds) (default: 0)
   --help, -h                     show help

[DavidBuchanan314]

I've tested this now (as part of a migration) so can confidently say that it works at least

Very much open to suggestions on renaming things or moving the subcommand to a different category, but I thought this made the most sense.

[bnewbold]

left some minor nit comments, but overall good! glad you found the auth signing package

[bnewbold]

My intuition is to bump this up to something between 120 to 300 seconds for folks doing this manually/locally? Though I guess this is basically the same with service-auth (fetched from PDS, but output locally) and consistency is good. And too-long a duration might be rejected by the audience. I'd probably bump to 120 but also fine leaving as-is, up to you.

[DavidBuchanan314]

Do you think it's likely for a too-long duration to be rejected by the audience outright, or just treated as if it were a shorter one?

I think I'll leave this as-is since it's nice to have a "safer" default (and enforces the convention that service auth tokens are intended to be short-lived in general), but in my writeup I set the duration to 3600

[bnewbold]

yay, glad you found this and that it can be used here!