fix: guard nil client config and signer/verifier config misuse

Default nil ClientConfig in NewClient and return errors from sign/verify paths instead of panicking when Signer or Verifier config is unset.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: yaronf

client.go

@@ -21,7 +21,11 @@ type Client struct {
 }
 
 // NewClient constructs a new client, with the flexibility of including a custom http.Client.
+// config may be nil for a default configuration.
 func NewClient(client http.Client, config *ClientConfig) *Client {
+	if config == nil {
+		config = NewClientConfig()
+	}
 	return &Client{config: *config, client: client}
 }
 

client_test.go

@@ -302,3 +302,9 @@ func TestClient_PostForm(t *testing.T) {
 		})
 	}
 }
+
+func TestNewDefaultClientNilConfig(t *testing.T) {
+	c := NewDefaultClient(nil)
+	assert.NotNil(t, c)
+	assert.NoError(t, validateClient(c))
+}

signatures.go

@@ -417,6 +417,9 @@ func signRequestDebug(signatureName string, signer Signer, req *http.Request) (s
 	if signatureName == "" {
 		return "", "", "", fmt.Errorf("empty signature name")
 	}
+	if signer.config == nil {
+		return "", "", "", fmt.Errorf("nil signer config")
+	}
 	withTrailers, err := signer.fields.hasTrailerFields(false)
 	if err != nil {
 		return "", "", "", err
@@ -443,6 +446,9 @@ func signResponseDebug(signatureName string, signer Signer, res *http.Response,
 	if signatureName == "" {
 		return "", "", "", fmt.Errorf("empty signature name")
 	}
+	if signer.config == nil {
+		return "", "", "", fmt.Errorf("nil signer config")
+	}
 	resWithTrailers, err := signer.fields.hasTrailerFields(false)
 	if err != nil {
 		return "", "", "", err
@@ -480,6 +486,9 @@ func VerifyRequest(signatureName string, verifier Verifier, req *http.Request) e
 }
 
 func verifyRequestDebug(signatureName string, verifier Verifier, req *http.Request) (signatureBase string, err error) {
+	if verifier.config == nil {
+		return "", fmt.Errorf("nil verifier config")
+	}
 	config := NewMessageConfig().WithRequest(req)
 	if s := resolvedScheme(verifier.config.schemeFromRequest, req); s != "" {
 		config = config.WithScheme(s)
@@ -514,6 +523,9 @@ func verifyDebug(signatureName string, verifier Verifier, message *Message) (str
 	if signatureName == "" {
 		return "", nil, fmt.Errorf("empty signature name")
 	}
+	if verifier.config == nil {
+		return "", nil, fmt.Errorf("nil verifier config")
+	}
 
 	withTrailers, wantSigRaw, psiSig, err := extractSignatureFields(
 		signatureName, &verifier, message.headers, message.trailers, message.body, verifier.config.maxBodySize)
@@ -665,6 +677,9 @@ func VerifyResponse(signatureName string, verifier Verifier, res *http.Response,
 }
 
 func verifyResponseDebug(signatureName string, verifier Verifier, res *http.Response, req *http.Request) (signatureBase string, err error) {
+	if verifier.config == nil {
+		return "", fmt.Errorf("nil verifier config")
+	}
 	config := NewMessageConfig()
 	if s := resolvedScheme(verifier.config.schemeFromRequest, req); s != "" {
 		config = config.WithScheme(s)

signatures_test.go

@@ -923,6 +923,22 @@ func TestGetRawHeaderEmptyValues(t *testing.T) {
 	}
 }
 
+func TestSignRequestNilSignerConfig(t *testing.T) {
+	_, _, err := SignRequest("sig1", Signer{fields: *NewFields()}, readRequest(httpreq1))
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	assert.Contains(t, err.Error(), "nil signer config")
+}
+
+func TestVerifyRequestNilVerifierConfig(t *testing.T) {
+	err := VerifyRequest("sig1", Verifier{fields: *NewFields()}, readRequest(httpreq1))
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	assert.Contains(t, err.Error(), "nil verifier config")
+}
+
 // Same as TestCreated but using Message
 func TestMessageCreated(t *testing.T) {
 	testOnceWithConfig := func(t *testing.T, createdTime int64, verifyConfig *VerifyConfig, wantSuccess bool) {