{"record":{"id":"30d4c96048ce9645","repo":"wavetermdev/waveterm","slug":"invalid-context-router-cannot-have-a-proc-route","errorCode":null,"errorMessage":"invalid context, router cannot have a proc-route","messagePattern":"invalid context, router cannot have a proc-route","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/wshutil/wshrouter_controlimpl.go","lineNumber":300,"sourceCode":"\t}\n\n\trouteId := MakeJobRouteId(data.JobId)\n\tlog.Printf(\"wshrouter authenticate-jobmanager success linkid=%d jobid=%q routeid=%q\", linkId, data.JobId, routeId)\n\timpl.Router.trustLink(linkId, LinkKind_Leaf)\n\timpl.Router.bindRoute(linkId, routeId, true)\n\n\treturn nil\n}\n\nfunc validateRpcContextFromAuth(newCtx *wshrpc.RpcContext) (string, error) {\n\tif newCtx == nil {\n\t\treturn \"\", fmt.Errorf(\"no context found in jwt token\")\n\t}\n\tif newCtx.IsRouter && newCtx.RouteId != \"\" {\n\t\treturn \"\", fmt.Errorf(\"invalid context, router cannot have a routeid\")\n\t}\n\tif newCtx.IsRouter && newCtx.ProcRoute {\n\t\treturn \"\", fmt.Errorf(\"invalid context, router cannot have a proc-route\")\n\t}\n\tif !newCtx.IsRouter && newCtx.RouteId == \"\" && !newCtx.ProcRoute {\n\t\treturn \"\", fmt.Errorf(\"invalid context, must have a routeid\")\n\t}\n\tif newCtx.IsRouter {\n\t\treturn \"\", nil\n\t}\n\treturn newCtx.GenerateRouteId(), nil\n}\n","sourceCodeStart":282,"sourceCodeEnd":310,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/wshutil/wshrouter_controlimpl.go#L282-L310","documentation":"Creation-time validation: a router context must not have a proc-route (process route) attached. Returned when the router context is constructed or validated while a proc-route is present, since proc-routes belong to endpoint contexts, not routers.","triggerScenarios":"Authenticating with a token whose RpcContext has IsRouter:true and ProcRoute:true.","commonSituations":"Building the auth context by merging flags from multiple sources; proc-route clients incorrectly marked as routers.","solutions":["Clear ProcRoute for router contexts (IsRouter implies no proc-route)","Fix token generation so router tokens set only IsRouter","Ensure proc-route clients are not marked IsRouter"],"exampleFix":"// before\nctx := wshrpc.RpcContext{IsRouter: true, ProcRoute: true}\n// after\nctx := wshrpc.RpcContext{IsRouter: true, ProcRoute: false}","handlingStrategy":"validation","validationCode":"if newCtx.IsRouter && newCtx.ProcRoute {\n    return fmt.Errorf(\"router token context must not set ProcRoute\")\n}","typeGuard":"func validRouterContext(c *wshrpc.RpcContext) bool {\n    return c.IsRouter && c.RouteId == \"\" && !c.ProcRoute\n}","tryCatchPattern":"if _, err := validateRpcContextFromAuth(newCtx); err != nil {\n    // re-mint token with ProcRoute cleared for router contexts\n}","preventionTips":["Keep ProcRoute exclusively for leaf proc-route clients","Validate RpcContext flags at token creation time","Add table tests covering valid flag combinations"],"tags":["wsh","jwt","validation"],"backgroundTag":"jwt-context-invalid","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}