fix: add guard for undefined subject

Author: alanshaw

ucan/proof_chain.go

@@ -2,6 +2,7 @@ package ucanlib
 
 import (
 	"context"
+	"fmt"
 	"iter"
 	"slices"
 
@@ -75,6 +76,9 @@ func NewDelegationMatcher(listDelegations DelegationListerFunc) DelegationMatche
 // in strict sequence where the aud of the previous Delegation matches the iss
 // of the next Delegation.
 func ProofChain(ctx context.Context, matchDelegations DelegationMatcherFunc, aud did.DID, cmd ucan.Command, sub did.DID) ([]ucan.Delegation, []cid.Cid, error) {
+	if !sub.Defined() {
+		return nil, nil, fmt.Errorf("missing proof chain subject")
+	}
 	proofs, links, err := proofChain(ctx, matchDelegations, aud, cmd, sub)
 	if err != nil {
 		return nil, nil, err

ucan/proof_chain_test.go

@@ -180,6 +180,18 @@ func TestProofChain_UnrelatedCommandIgnored(t *testing.T) {
 	require.Empty(t, links)
 }
 
+func TestProofChain_MissingSubject(t *testing.T) {
+	alice := testutil.Alice
+	cmd := testutil.Must(command.Parse("/test/do"))(t)
+
+	matcher := ucanlib.NewDelegationMatcher((&memLister{}).List)
+	proofs, links, err := ucanlib.ProofChain(t.Context(), matcher, alice.DID(), cmd, did.Undef)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "subject")
+	require.Nil(t, proofs)
+	require.Nil(t, links)
+}
+
 func TestProofChain_FinderError(t *testing.T) {
 	space := testutil.RandomSigner(t)
 	alice := testutil.Alice