fix(vcr/verifier): handle unparseable issuer DID instead of panicking

[reinkrul]

Problem

vcr/verifier/verifier.go discarded the error from did.ParseDID(issuer) on the signature-check path, then dereferenced the resulting nil pointer. An unparseable issuer DID — e.g. a did:x509 with trailing unsupported fields, as emitted by the AET ZORG-ID SDK — made ParseDID return (nil, err), so the dereference panicked and crashed the entire node:

runtime error: invalid memory address or nil pointer dereference

Reproducible by posting such a credential to /internal/vcr/v2/holder/{subject}/vc.

Fix

Capture the parse error and return a clean validation error:

issuerDID, err := did.ParseDID(credentialToVerify.Issuer.String())
if err != nil {
    return fmt.Errorf("could not parse issuer DID: %w", err)
}

Why the validator didn't catch it first

Credentials with an unrecognized type fall back to defaultCredentialValidator, which only checks the issuer is non-empty — it never parses it as a DID. So a malformed issuer reaches the signature-check path untouched.

Test

Added a regression test to TestVerifier_Verify using did:x509:0:sha256:abc::san:otherName:1.2.3.4#extra (valid URI, invalid DID). It asserts a could not parse issuer DID error; without the fix it panics.

Fixes #4235

Assisted by AI

[qltysh]

1 new issue

Tool	Category	Rule	Count
qlty	Structure	Function with many returns (count = 10): Verify	1

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (1)

Rating	File	% Diff	Uncovered Line #s
	vcr/verifier/verifier.go	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.