fix: guard against nil panics in JWT and watermark paths (#787)

fix: guard against nil dereference in GenerateToken and watermark rejection

Move the ok check before any use of ud in JWT.GenerateToken to prevent
a nil dereference when GetUserData returns (nil, false). Also guard the
bare type assertion on msg.(request.WithWatermark) in the watermark
rejection metrics path, matching the safe pattern used a few lines below.

Author: jevonearth

pkg/middlewares/jwt.go

@@ -149,17 +149,19 @@ func (j *JWT) GenerateToken(user string, pass string) (string, error) {
 	claims := token.Claims.(jwt.MapClaims)
 	claims["user"] = user
 	ud, ok := j.GetUserData(user)
+	if !ok {
+		return "", fmt.Errorf("JWT: user not found")
+	}
 	if !constantTimeCompare(pass, ud.Password) {
 		ud = ud.NewData
 	}
-	if ok {
-		if ud.Exp == 0 {
-			ud.Exp = 60
-		}
-		claims["exp"] = time.Now().Add(time.Minute * time.Duration(ud.Exp)).Unix()
-	} else {
-		return "", fmt.Errorf("JWT: user not found")
+	if ud == nil {
+		return "", fmt.Errorf("JWT: invalid credentials")
+	}
+	if ud.Exp == 0 {
+		ud.Exp = 60
 	}
+	claims["exp"] = time.Now().Add(time.Minute * time.Duration(ud.Exp)).Unix()
 	token.Claims = claims
 	return token.SignedString([]byte(ud.Secret))
 }

pkg/middlewares/jwt_test.go

@@ -435,6 +435,20 @@ func TestAuthenticateWithCredentialRotation(t *testing.T) {
 	})
 }
 
+func TestGenerateTokenNonexistentUser(t *testing.T) {
+	j := &JWT{
+		Users: map[string]UserData{
+			"user": {
+				Password: "pass",
+				Secret:   secret,
+			},
+		},
+	}
+	_, err := j.GenerateToken("ghost", "pass")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "user not found")
+}
+
 func getToken(user string, au *JWTMiddleware) (string, error) {
 
 	req, err := http.NewRequest("GET", "/login", nil)

pkg/signatory/signatory.go

@@ -406,7 +406,11 @@ func (s *Signatory) Sign(ctx context.Context, req *SignRequest) (crypt.Signature
 
 		if wmErr != nil {
 			err = errors.Wrap(wmErr, http.StatusConflict)
-			metrics.WatermarkRejection(req.PublicKeyHash.String(), msg.SignRequestKind(), msg.(request.WithWatermark).GetChainID().String(), err.Error())
+			chainIDStr := ""
+			if m, ok := msg.(request.WithWatermark); ok {
+				chainIDStr = m.GetChainID().String()
+			}
+			metrics.WatermarkRejection(req.PublicKeyHash.String(), msg.SignRequestKind(), chainIDStr, wmErr.Error())
 			l.Error(err)
 			return nil, err
 		}