[java-idp-plugin-vci] 01/01: Missing code should not cause NPE

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch bugs/CodeReuse
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/27d9e6202db263d718d36a1dacca3ce713c92ece

commit 27d9e6202db263d718d36a1dacca3ce713c92ece
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Tue Sep 22 12:57:00 2026 +0300

    Missing code should not cause NPE
---
 .../shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java    | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
index 4267987..78e7213 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
@@ -214,9 +214,16 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
             }
 
             try {
+                final CredentialOfferObject credentialOffer = credentialOfferCache.getCredentialOffer(code);
+                if (credentialOffer == null) {
+                    log.warn("{} No Credential Offer for the pre-authorized code, expired or already redeemed",
+                            getLogPrefix());
+                    ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
+                    return;
+                }
                 final TokenContext tokenContext = profileRequestContext.getInboundMessageContext()
                         .ensureSubcontext(TokenContext.class);
-                tokenContext.setCredentialOfferObject(credentialOfferCache.getCredentialOffer(code));
+                tokenContext.setCredentialOfferObject(credentialOffer);
                 setPotentialCredentials(tokenContext);
                 // Subject and auth time set for access token creation. TODO make sure what
                 // content to use.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.