{"record":{"id":"d7fb6c8568b6f0ea","repo":"gravitational/teleport","slug":"proto-wrong-wiretype-d-for-field-devicetype","errorCode":null,"errorMessage":"proto: wrong wireType = %d for field DeviceType","messagePattern":"proto: wrong wireType = (.+?) for field DeviceType","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60545,"sourceCode":"\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tintStringLen := int(stringLen)\n\t\t\tif intStringLen < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tpostIndex := iNdEx + intStringLen\n\t\t\tif postIndex < 0 {\n\t\t\t\treturn ErrInvalidLengthAuthservice\n\t\t\t}\n\t\t\tif postIndex > l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tm.TokenID = string(dAtA[iNdEx:postIndex])\n\t\t\tiNdEx = postIndex\n\t\tcase 2:\n\t\t\tif wireType != 0 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field DeviceType\", wireType)\n\t\t\t}\n\t\t\tm.DeviceType = 0\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tm.DeviceType |= DeviceType(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\tcase 3:\n\t\t\tif wireType != 0 {","sourceCodeStart":60527,"sourceCodeEnd":60563,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60527-L60563","documentation":"This error is thrown by the gogoproto-generated Unmarshal code for a message in the Teleport Auth Service proto schema. Protobuf wire types encode each field's shape (0=varint, 1=64-bit, 2=length-delimited, 5=32-bit); field DeviceType (field number 2) is declared as a varint enum, so when the decoder reads a tag whose low 3 bits are not 0 it rejects the record rather than decoding garbage. It almost always means the byte stream was produced by a different schema version than the one parsing it.","triggerScenarios":"Calling any Auth Service RPC whose request/response carries a message with a DeviceType field (e.g. device enrollment/trust APIs) while the serialized payload encodes field 2 with a non-varint wire type — typically a payload generated by a newer/older .proto where DeviceType was a string or message.","commonSituations":"Mixed Teleport cluster versions during upgrade (auth server older than client), a stale generated pb.go after editing the .proto without regenerating, or corrupted/truncated cached protobuf data (e.g. in a backend or file) where field boundaries shifted.","solutions":["Align versions: upgrade or downgrade the Teleport client/plugin so client and auth server use the same api/client/proto schema version.","Regenerate the proto bindings (make proto or protoc with gogo) so the generated Unmarshal matches the current .proto.","Clear or re-create the corrupted serialized data (cache, backend key, audit export) that was produced with the mismatched schema.","If you hand-rolled marshaling, encode DeviceType as a varint (wire type 0), e.g. proto.EncodeVarint on the enum value."],"exampleFix":"// before: client built against schema where device_type is a string\nDeviceType: \" touchid\"\n// after: match server schema (enum/varint) or upgrade both sides to same version\nDeviceType: proto.DeviceType_DEVICE_TYPE_TOUCH_ID // and rebuild with matching api module","handlingStrategy":"try-catch","validationCode":"// Before calling the RPC, sanity-check the payload was built with matching bindings:\nif reflect.TypeOf(req).PkgPath() != path.Join(\"github.com/gravitational/teleport/api/client/proto\", version) { /* log version mismatch */ }","typeGuard":"func hasVarintDeviceType(data []byte) bool {\n  // field 2 key byte must be (2<<3)|0 = 0x10\n  for _, b := range data { _ = b }\n  return len(data) >= 1 && data[0] != 0x10\n}","tryCatchPattern":"var m proto.DeviceMetadata\nif err := proto.Unmarshal(data, &m); err != nil {\n  if strings.Contains(err.Error(), \"wrong wireType\") {\n    return fmt.Errorf(\"payload schema mismatch (client/server version skew): %w\", err)\n  }\n  return err\n}","preventionTips":["Pin the teleport/api Go module to the exact version of the deployed auth server.","Run `make proto` after every .proto edit and commit regenerated files.","Upgrade clients/plugins before or together with the auth server.","Add a smoke test that round-trips device messages across schema versions."],"tags":["protobuf","grpc","wire-format","version-skew","teleport"],"backgroundTag":"protobuf-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}