fix: reject proof signed with non-attested key

[asserh]

Calling Flow.first() caused a NoSuchElementException when no matching attested key was found, resulting in a generic error message.

Use firstOrNull() and return an explicit InvalidProof instead.

[asserh]

Found this subtle issue when working on key attestations for a wallet implementation. The generic error message threw me off, but with this change it should be clearer when the proof validation fails in this exact way.

Really fantastic job on the project by the way! It has been extremely useful for our internal testing and development here at DIGG.

[babisRoutis]

Dear @asserh

Thank you for reporting this and for filling the PR.
Please give us some time, to evaluate the issue and the fix.

PS : I also want to thank you for your kind and supportive words. I am really happy to hear that you find it useful.

[babisRoutis]

Just a minor comment to consider
In any case, it looks good.

[vafeini]

@asserh Thanks for the PR, good catch :D
Can you move the unit test in WalletApiTest.kt. There is dedicated class there (WalletApiEncryptionOptionalKeyAttestationsRequiredTest) that is testing the key_attestation related proofs. There you can find convenient methods (keyAttestationJWT()) like the one you have created for generating key_attestation jwts.

[asserh]

Absolutely, I will move it over to WalletApiTest instead 👍 Did not even notice there already were existing methods for generating attestations. Will get back to you with an update

[asserh]

Thanks for the suggestion, it made a lot of sense to relocate the test. It was a lot easier there with the existing utility functions. Does this look better?

Let me know if you prefer me to squash my commits manually. Although it looks like you already use squash and merge in Github for PR:s.

[vafeini]

Thanks for the suggestion, it made a lot of sense to relocate the test. It was a lot easier there with the existing utility functions. Does this look better?

Let me know if you prefer me to squash my commits manually. Although it looks like you already use squash and merge in Github for PR:s.

@asserh Looks good, PR approved, will be merged in main. Thanks for the fix!