Samly.State.Store.get_assetion's typespec is get_assertion(Conn.t(), assertion_key(), opts()) :: Assertion.t() | nil
But here we supply the function with the result of get_session(conn, "samly_assertion_key") which will return nil if "samly_assertion_key" key is not set.
I think this happens for the very first login attempt and obviously results in an exception.