fix(consent): handle VCTMs without SVG templates in consent page

- SVGTemplateReply: guard against nil/empty SVG templates instead of
  panicking with index-out-of-range
- UserLookup: when VCTM claims lack svg_id, fall back to extracting
  values from document data by claim path name (recursive search handles
  nested structures from credential mappings)
- consent.js: make SVG template fetch optional — if it fails, display
  claims in table without the SVG card image
- consent.html: conditionally hide <img> when credential.svg is null

Author: leifj

internal/apigw/apiv1/handlers_users.go

@@ -205,16 +205,24 @@ func (c *Client) UserLookup(ctx context.Context, req *vcclient.UserLookupRequest
 		c.log.Debug("extracted claim values", "extracted_count", len(claimValues), "requested_count", len(jsonPaths.Displayable), "claims", claimValues)
 
 		for _, claim := range req.VCTM.Claims {
-			value, ok := claimValues[claim.SVGID].(string)
-			if !ok {
-				continue
-			}
-
 			if claim.SVGID != "" {
+				value, ok := claimValues[claim.SVGID].(string)
+				if !ok {
+					continue
+				}
 				svgTemplateClaims[claim.SVGID] = vcclient.SVGClaim{
 					Label: claim.Display[0].Label,
 					Value: value,
 				}
+			} else if len(claim.Display) > 0 {
+				// No svg_id — fall back to extracting claim value from document data by path
+				key := claim.JSONPath()
+				if value := findValueByName(doc.DocumentData, claim.Path); value != "" {
+					svgTemplateClaims[key] = vcclient.SVGClaim{
+						Label: claim.Display[0].Label,
+						Value: value,
+					}
+				}
 			}
 		}
 
@@ -265,16 +273,24 @@ func (c *Client) UserLookup(ctx context.Context, req *vcclient.UserLookupRequest
 			"claims", claimValues)
 
 		for _, claim := range req.VCTM.Claims {
-			value, ok := claimValues[claim.SVGID].(string)
-			if !ok {
-				continue
-			}
-
 			if claim.SVGID != "" {
+				value, ok := claimValues[claim.SVGID].(string)
+				if !ok {
+					continue
+				}
 				svgTemplateClaims[claim.SVGID] = vcclient.SVGClaim{
 					Label: claim.Display[0].Label,
 					Value: value,
 				}
+			} else if len(claim.Display) > 0 {
+				// No svg_id — fall back to extracting claim value from document data by path
+				key := claim.JSONPath()
+				if value := findValueByName(doc.DocumentData, claim.Path); value != "" {
+					svgTemplateClaims[key] = vcclient.SVGClaim{
+						Label: claim.Display[0].Label,
+						Value: value,
+					}
+				}
 			}
 		}
 
@@ -298,3 +314,53 @@ func (c *Client) UserLookup(ctx context.Context, req *vcclient.UserLookupRequest
 
 	return reply, nil
 }
+
+// findValueByName searches the document data for a claim value matching
+// the VCTM claim path. It first tries an exact JSONPath-style lookup,
+// then falls back to searching recursively by the leaf key name.
+func findValueByName(data map[string]any, path []*string) string {
+	if len(path) == 0 {
+		return ""
+	}
+
+	// Walk the path through nested maps
+	var current any = data
+	for _, p := range path {
+		if p == nil {
+			break
+		}
+		m, ok := current.(map[string]any)
+		if !ok {
+			break
+		}
+		current, ok = m[*p]
+		if !ok {
+			// Exact path failed — try recursive search by leaf key name
+			leafKey := *path[len(path)-1]
+			return findValueRecursive(data, leafKey)
+		}
+	}
+
+	if s, ok := current.(string); ok {
+		return s
+	}
+	return fmt.Sprintf("%v", current)
+}
+
+// findValueRecursive searches a nested map for the first string value matching key.
+func findValueRecursive(data map[string]any, key string) string {
+	if v, ok := data[key]; ok {
+		if s, ok := v.(string); ok {
+			return s
+		}
+		return fmt.Sprintf("%v", v)
+	}
+	for _, v := range data {
+		if nested, ok := v.(map[string]any); ok {
+			if result := findValueRecursive(nested, key); result != "" {
+				return result
+			}
+		}
+	}
+	return ""
+}

internal/apigw/apiv1/handlers_vctm.go

@@ -110,6 +110,11 @@ type SVGTemplateRequest struct {
 }
 
 func (c *Client) SVGTemplateReply(ctx context.Context, req *SVGTemplateRequest) (*vcclient.SVGTemplateReply, error) {
+	if len(req.VCTM.Display) == 0 || req.VCTM.Display[0].Rendering == nil ||
+		len(req.VCTM.Display[0].Rendering.SVGTemplates) == 0 {
+		return nil, fmt.Errorf("VCTM has no SVG templates")
+	}
+
 	svgTemplateURI := req.VCTM.Display[0].Rendering.SVGTemplates[0].URI
 
 	if cached, ok := c.cacheService.SVGTemplate.Get(ctx, svgTemplateURI); ok {

internal/apigw/staticembed/consent.html

@@ -134,7 +134,7 @@ <h1 class="text-3xl font-bold leading-tight tracking-tight text-gray-900 text-ce
                                     </div>
                                     <label :for="`credential:${index}`" class="vc-radio-label radio block cursor-pointer" :class="{ 'outline-3 outline-double outline-primary-light bg-primary-light bg-opacity-10': checked }">
                                         <div class="block">
-                                            <img class="vc-credential-card mb-2" width="829" height="504" :src="credential.svg" alt="">
+                                            <img x-show="credential.svg" class="vc-credential-card mb-2" width="829" height="504" :src="credential.svg" alt="">
                                             <table class="table-auto w-full">
                                                 <tbody>
                                                     <template x-for="[svg_id, claim] of Object.entries(credential.claims)">

internal/apigw/staticembed/consent.js

@@ -326,10 +326,14 @@ Alpine.data("app", () => ({
 
             this.redirectUrl = data.redirect_url;
 
-            const svg = await this.createCredentialSvgImageUri(
-                data.svg_template_claims,
-            );
-
+            let svg = null;
+            try {
+                svg = await this.createCredentialSvgImageUri(
+                    data.svg_template_claims,
+                );
+            } catch (_) {
+                // VCTM has no SVG template — display claims without card image
+            }
 
             this.credentials.push({
                 vct: "N/A",