Allow nil engines

authority/internal/constraints/constraints.go

@@ -65,7 +65,7 @@ func New(chain ...*x509.Certificate) *Engine {
 // Validate checks the given names with the name constraints defined in the
 // service.
 func (s *Engine) Validate(dnsNames []string, ipAddresses []net.IP, emailAddresses []string, uris []*url.URL) error {
-	if !s.hasNameConstraints {
+	if s == nil || !s.hasNameConstraints {
 		return nil
 	}
 

authority/internal/constraints/constraints_test.go

@@ -222,3 +222,10 @@ func Test_service_Validate(t *testing.T) {
 		})
 	}
 }
+
+func Test_service_Validate_nil(t *testing.T) {
+	var s *Engine
+	if err := s.Validate([]string{"www.example.com"}, nil, nil, nil); err != nil {
+		t.Errorf("service.Validate() error = %v, wantErr false", err)
+	}
+}