Mimoto: Credentials-fetch API returns 500 Internal Server Error when DCQL query contains a null path segment #727

Mimoto: GET /wallets/{walletId}/presentations/{presentationId}/credentials returns 500 Internal Server Error when DCQL query contains a null path segment

Bug

Description

Short Summary of the Bug

The credentials-matching endpoint (GET /v1/mimoto/wallets/{walletId}/presentations/{presentationId}/credentials) throws a NullPointerException and returns HTTP 500 instead of the matching credentials list, when the verifier's DCQL query contains a claim with a null path segment (used as an array wildcard per the DCQL spec).

Description

When a DCQL claims query includes a path array with a null element (e.g. "path": ["gender", null, "value"], which per the DCQL spec means "match any array index"), mimoto crashes while building the JSON path used to resolve/match credential claims. Instead of handling the null segment, the code unconditionally calls .toString() on it, resulting in an unhandled NullPointerException that surfaces to the client as a generic 500 internal_server_error.

This breaks the entire credentials-fetch step of the presentation flow — no credentials (mandatory or optional) can be returned to Inji Web for that presentation request, since the request never gets past this crash.

Steps to Reproduce

1. Trigger a Verifiable Presentation request whose DCQL query includes a claim with a null path segment, e.g.:

   {
     "id": "mosip_verifiable_credential_id",
     "format": "ldp_vc",
     "claims": [
       {
         "id": "male_gender",
         "path": ["gender", null, "value"],
         "values": ["MLE"]
       }
     ]
   }

2. Complete the flow up to calling GET /v1/mimoto/wallets/{walletId}/presentations/{presentationId}/credentials.
3. Observe the response.

Actual result

{
  "errorCode": "internal_server_error",
  "errorMessage": "We are unable to process request now"
}

HTTP status: 500

Server-side stack trace:

java.lang.NullPointerException: Cannot invoke "Object.toString()" because "segment" is null
	at io.mosip.mimoto.util.DcqlClaimSetHelper.appendPathSegments(DcqlClaimSetHelper.java:63)
	at io.mosip.mimoto.util.DcqlClaimSetHelper.buildJsonPath(DcqlClaimSetHelper.java:43)
	at io.mosip.mimoto.util.DcqlClaimSetHelper.resolvePaths(DcqlClaimSetHelper.java:182)
	at io.mosip.mimoto.util.DcqlClaimSetHelper.resolveJsonPaths(DcqlClaimSetHelper.java:167)
	at io.mosip.mimoto.util.DcqlClaimSetHelper.pathsForClaimIds(DcqlClaimSetHelper.java:237)
	at io.mosip.mimoto.util.DcqlMatchingHelper.lambda$extractMissingClaimsFromQuery$1(DcqlMatchingHelper.java:109)
	at io.mosip.mimoto.service.impl.CredentialMatchingServiceImpl.matchWithDcqlQuery(CredentialMatchingServiceImpl.java:227)
	at io.mosip.mimoto.service.impl.CredentialMatchingServiceImpl.getMatchingCredentials(CredentialMatchingServiceImpl.java:94)
	at io.mosip.mimoto.service.impl.WalletPresentationServiceImpl.getMatchingCredentials(WalletPresentationServiceImpl.java:125)
	at io.mosip.mimoto.controller.WalletPresentationsController.getMatchingCredentials(WalletPresentationsController.java:148)

Automated test evidence (TC_Mimoto_GetCredentialsForPresentation_01):

Expected result

The endpoint should treat a null path segment as a valid wildcard per the DCQL spec (e.g. skip it / represent it appropriately when building the JSON path) and return the matching-credentials response (queryGroups/credentialSets or availableCredentials/missingClaims) instead of crashing with a 500.

Attachments / Evidence / Links

mosip-api-internal.qainji-mimoto-2026-09-24_16-01-full-report_T-357_P-319_S-0_F-1_I-33_KI-4.html