{"record":{"id":"39766dac9c515780","repo":"juanfont/headscale","slug":"rejecting-auth-request-w","errorCode":null,"errorMessage":"rejecting auth request: %w","messagePattern":"rejecting auth request: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/headscale/cli/auth.go","lineNumber":90,"sourceCode":"\t\t}\n\n\t\tif resp.StatusCode() != http.StatusOK {\n\t\t\treturn apiError(resp.StatusCode(), resp.ApplicationproblemJSONDefault)\n\t\t}\n\n\t\treturn printOutput(cmd, resp.JSON200, \"Auth request approved\")\n\t}),\n}\n\nvar authRejectCmd = &cobra.Command{\n\tUse:   \"reject\",\n\tShort: \"Reject a pending authentication request\",\n\tRunE: clientRunE(func(ctx context.Context, client *clientv1.ClientWithResponses, cmd *cobra.Command, args []string) error {\n\t\tauthID, _ := cmd.Flags().GetString(\"auth-id\")\n\n\t\tresp, err := client.AuthRejectWithResponse(ctx, clientv1.AuthRejectJSONRequestBody{AuthId: &authID})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"rejecting auth request: %w\", err)\n\t\t}\n\n\t\tif resp.StatusCode() != http.StatusOK {\n\t\t\treturn apiError(resp.StatusCode(), resp.ApplicationproblemJSONDefault)\n\t\t}\n\n\t\treturn printOutput(cmd, resp.JSON200, \"Auth request rejected\")\n\t}),\n}\n","sourceCodeStart":72,"sourceCodeEnd":100,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/cmd/headscale/cli/auth.go#L72-L100","documentation":"Transport error from 'headscale auth reject': client.AuthRejectWithResponse failed before an HTTP response arrived. As with approve, this covers connection/TLS/timeout failures; a rejected-by-server scenario (e.g., unknown auth-id) surfaces as an HTTP error via apiError instead.","triggerScenarios":"'headscale auth reject --auth-id ...' with an unreachable server, cancelled context, or TLS mismatch.","commonSituations":"Cleanup scripts rejecting stale registrations after a server outage; wrong endpoint in the CLI config.","solutions":["Check server health and CLI address/TLS configuration","Retry the reject after connectivity is restored","If the auth request has already expired server-side, the reject is unnecessary — verify with the pending list"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if _, err := client.AuthRejectWithResponse(ctx, body); err != nil {\n\tif isTransportError(err) { /* check pending list first, then retry */ }\n}","preventionTips":["Reject is near-idempotent: verify the request still exists before retrying","Clean up stale auth requests on a schedule instead of ad hoc"],"tags":["network","http-client","cli","auth","go"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}