fix: construct missing-claims error before emitting event to avoid nil pointer panic

[waterWang]

Related issue

Closes #4585

What

On the JWT session-tokenization path, a Jsonnet claims mapper whose output has no object-valued claims field is supposed to produce a controlled ErrBadRequest. Instead, the success path of EvaluateAnonymousSnippet leaves err nil, and the missing-claims branch passes that nil error to NewJsonnetMappingFailed → attrErrorReason → reasonForError → err.Error() panics.

Fix

Construct the bad-request error before emitting the event and pass the (non-nil) error to NewJsonnetMappingFailed, returning the same error. This keeps the intended controlled 400 path intact.

Checklist

• I have read the contributing guidelines
• I have signed the CLA

Summary by CodeRabbit

• Bug Fixes
  • Improved error handling when tokenizer output is missing claims information.
  • Preserved the original error details for clearer and more accurate failure reporting.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b18464c2-140c-4c6d-bc6f-3f375ed41d7a

📥 Commits

Reviewing files that changed from the base of the PR and between b86338d and c2245e9.

📒 Files selected for processing (1)

• session/tokenizer.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The JWT tokenizer now constructs the missing-claims bad-request error before emitting the Jsonnet failure event. It returns that same error directly instead of wrapping it again.

Changes

Tokenizer error handling

Layer / File(s)	Summary
Missing claims validation session/tokenizer.go	The tokenizer creates a non-nil bad-request error before recording the failure event and returns the same error directly.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to c2245

This localized change prevents a nil-pointer panic and preserves the intended controlled 400 response for missing JWT claims. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: aeneasr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the fix for the missing-claims nil-pointer panic and the event-ordering change.
Description check	✅ Passed	The description explains the bug, expected behavior, fix, linked issue, and relevant implementation details, though several checklist items remain unchecked.
Linked Issues check	✅ Passed	The change constructs and propagates a non-nil ErrBadRequest, passes it to the telemetry event, and satisfies issue #4585.
Out of Scope Changes check	✅ Passed	The two-line change is limited to the JWT session-tokenization missing-claims error path described in issue #4585.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}