From 05a3665ab94b06d4ca884b77dd5acfb72c9a7e67 Mon Sep 17 00:00:00 2001
From: Scan <103391616+scanash00@users.noreply.github.com>
Date: Fri, 2 Jan 2026 12:52:38 -0900
Subject: [PATCH] fix: prevent nil pointer crash in ES256K token verification
 (#49)

---
 server/middleware.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/server/middleware.go b/server/middleware.go
index f379738..70e4ecf 100644
--- a/server/middleware.go
+++ b/server/middleware.go
@@ -123,6 +123,21 @@ func (s *Server) handleLegacySessionMiddleware(next echo.HandlerFunc) echo.Handl
 			rr, _ := secp256k1.NewScalarFromBytes((*[32]byte)(rBytes))
 			ss, _ := secp256k1.NewScalarFromBytes((*[32]byte)(sBytes))
 
+			if repo == nil {
+				sub, ok := claims["sub"].(string)
+				if !ok {
+					s.logger.Error("no sub claim in ES256K token and repo not set")
+					return helpers.InvalidTokenError(e)
+				}
+				maybeRepo, err := s.getRepoActorByDid(ctx, sub)
+				if err != nil {
+					s.logger.Error("error fetching repo for ES256K verification", "error", err)
+					return helpers.ServerError(e, nil)
+				}
+				repo = maybeRepo
+				did = sub
+			}
+
 			sk, err := secp256k1secec.NewPrivateKey(repo.SigningKey)
 			if err != nil {
 				s.logger.Error("can't load private key", "error", err)
-- 
2.51.2