fix(identity): avoid nil notifier dereference in LocalMembership.Close

Close() only returned early when identityDB.Notifier() failed with the expected
storage.ErrNotSupported sentinel. For any other error it logged the failure and
then called UnsubscribeAll() on the nil notifier anyway, panicking on the
shutdown path — precisely when the storage backend is already unhealthy.

Return for every error instead, logging the unexpected ones, and only unsubscribe
when a notifier was actually obtained. Mirrors the handling already in
subscribeNotifier. Adds a regression test that panics without this change.

Fixes #2067

Signed-off-by: AkramBitar <akram@il.ibm.com>

Author: AkramBitar

docs/services/identity.md

@@ -222,6 +222,12 @@ core.TMSProvider.Update            (token/core/tms.go)
                     └── Role.Done() → LocalMembership.Close()
 ```
 
+`LocalMembership.Close()` is best-effort: it releases its key managers, then unsubscribes
+from the identity store's change notifier. If the store cannot supply a notifier — because
+it does not support one (`storage.ErrNotSupported`) or because it fails outright — the
+unsubscribe step is skipped and, in the failure case, logged. `Close()` returns no error and
+must never panic, since it runs on the shutdown path of an already-degraded node.
+
 `role.Registry.Done()` closes wallets through a local `interface{ Close() }` assertion
 rather than through `driver.Wallet`, so wallet types with nothing to release need not
 implement a no-op `Close()`. If you add a wallet type that owns a goroutine, a ticker or

token/services/identity/membership/lm.go

@@ -276,11 +276,11 @@ func (l *LocalMembership) Close() {
 
 		notifier, err := l.identityDB.Notifier()
 		if err != nil {
-			if errors.Is(err, storage.ErrNotSupported) {
-				// notithing to close
-				return
+			if !errors.Is(err, storage.ErrNotSupported) {
+				logger.Errorf("failed to get identity notifier: [%s]", err)
 			}
-			logger.Errorf("failed to get identity notifier: [%s]", err)
+			// no notifier, nothing to close
+			return
 		}
 		if err := notifier.UnsubscribeAll(); err != nil {
 			logger.Errorf("failed to unsubscribe [%s]: [%s]", l.IdentityType, err)

token/services/identity/membership/lm_discovery_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/LFDT-Panurus/panurus/token/services/identity/membership/mock"
 	"github.com/LFDT-Panurus/panurus/token/services/logging"
 	"github.com/LFDT-Panurus/panurus/token/services/storage"
+	"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/errors"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -392,3 +393,34 @@ func TestLocalMembership_Close(t *testing.T) {
 	// Should be safe to call multiple times
 	lm.Close()
 }
+
+// TestLocalMembership_Close_NotifierError checks that Close does not panic when the
+// identity store fails to return a notifier with an error other than storage.ErrNotSupported.
+// In that case the notifier is nil and must not be used.
+func TestLocalMembership_Close_NotifierError(t *testing.T) {
+	ip := &mock.IdentityProvider{}
+	des := &mock.SignerDeserializerManager{}
+	iss := &mock.IdentityStoreService{}
+	iss.NotifierReturns(nil, errors.New("backend unavailable"))
+
+	kmp := &mock.KeyManagerProvider{}
+
+	lm := membership.NewLocalMembership(
+		logging.MustGetLogger("test"),
+		&mock.Config{},
+		[]byte("netid"),
+		des,
+		iss,
+		"testType",
+		false,
+		ip,
+		kmp,
+	)
+
+	// Load is not called on purpose: a failing Notifier makes Load fail, so Close must be
+	// safe on its own. A nil notifier dereference would panic and fail the test.
+	assert.NotPanics(t, lm.Close)
+
+	// Should be safe to call multiple times
+	assert.NotPanics(t, lm.Close)
+}