Fix validator not failing signature check if key is nil.

Author: echojc

validator.go

@@ -110,14 +110,17 @@ func (v *Validator) validateTokenV1(t *Token) (errs []error) {
 		// TODO retrieve?
 		errs = append(errs,
 			fmt.Errorf("%w: got '%s'", ErrUnknownPublicKey, keyID))
-	} else if key != nil {
+	} else if key == nil {
+		errs = append(errs,
+			fmt.Errorf("%w: key '%s' is nil", ErrUnknownPublicKey, keyID))
+	} else {
 		if !ecdsa.Verify(
 			key,
 			t.digest,
 			big.NewInt(0).SetBytes(t.Signature[:32]),
 			big.NewInt(0).SetBytes(t.Signature[32:])) {
 			errs = append(errs,
-				fmt.Errorf("%w: did not verify", ErrBadSignature))
+				fmt.Errorf("%w: failed verification", ErrBadSignature))
 		}
 	}
 

validator_test.go

@@ -25,6 +25,21 @@ func TestValidatorRejectsUnknownKey(t *testing.T) {
 	}
 }
 
+func TestValidatorRejectsNilKey(t *testing.T) {
+	tkn := tokenUntrusted(t)
+	v := nzcpv.NewValidator()
+	v.RegisterIssuer("did:web:nzcp.covid19.health.nz")
+	err := v.RegisterPublicKey("did:web:nzcp.covid19.health.nz#key-1", nil)
+	if err != nil {
+		t.Skipf("Could not register nil test key: %v\n", err)
+	}
+
+	expected := []error{nzcpv.ErrUnknownPublicKey}
+	if errs := v.ValidateToken(tkn); !checkErrors(expected, errs) {
+		t.Errorf("Expected %v but got %v", expected, errs)
+	}
+}
+
 func TestValidatorRejectsUntrustedIssuer(t *testing.T) {
 	tkn := tokenUntrusted(t)
 	v := nzcpv.NewValidator()