{"record":{"id":"f0eb370ce9617c24","repo":"kataras/iris","slug":"access-w","errorCode":null,"errorMessage":"access: %w","messagePattern":"access: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/auth.go","lineNumber":296,"sourceCode":"\n\tif refreshStdClaims.IssuedAt == 0 {\n\t\trefreshStdClaims.IssuedAt = iat\n\t}\n\n\tif refreshStdClaims.ID == \"\" {\n\t\trefreshStdClaims.ID = uuid.NewString()\n\t}\n\n\tif refreshStdClaims.OriginID == \"\" {\n\t\t// keep a reference of the access token the refresh token is created,\n\t\t// if that access token is invalidated then\n\t\t// its refresh token should be too so the user can force-login.\n\t\trefreshStdClaims.OriginID = accessStdClaims.ID\n\t}\n\n\taccessToken, err := s.keys.SignToken(KIDAccess, t, accessStdClaims)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"access: %w\", err)\n\t}\n\n\tvar refreshToken []byte\n\tif s.refreshEnabled {\n\t\trefreshToken, err = s.keys.SignToken(KIDRefresh, t, refreshStdClaims)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"refresh: %w\", err)\n\t\t}\n\t}\n\n\treturn accessToken, refreshToken, nil\n}\n\n// SignHandler generates and sends a pair of access and refresh token to the client\n// as JSON body of `SigninResponse` and cookie (if cookie setting was provided).\n// See `Signin` method for more.\nfunc (s *Auth[T]) SigninHandler(ctx *context.Context) {\n\t// No, let the developer decide it based on a middleware, e.g. iris.LimitRequestBodySize.","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/auth/auth.go#L278-L314","documentation":"The internal sign helper returns 'access: %w' when s.keys.SignToken(KIDAccess, ...) fails to create the access token. This wraps the keystore error so callers of Signin/Refresh see an 'access: ...' prefixed cause. The refresh token signing follows separately with its own wrap.","triggerScenarios":"SignToken for the KIDAccess key failing — missing key ID in the keystore, invalid private key, or a claims-encoding error during token generation, triggered from either Signin or Refresh.","commonSituations":"Access key not provisioned/rotated out of the keystore; corrupted or wrong-format PEM key; keyset updated (key rotation) while old KID is still referenced in configuration.","solutions":["Check the wrapped cause with errors.Unwrap/%v to see the keystore error","Ensure the KIDAccess key exists and is valid in the configured key set","Re-sync configuration after key rotation so the current KID is used","Fail fast: sign a test token during app startup"],"exampleFix":"// before\naccess, _, err := a.Signin(ctx, user, pass) // \"access: kid not found\"\n// after\nkeys.Add(KIDAccess, privateKey) // register the access signing key\naccess, _, err := a.Signin(ctx, user, pass)","handlingStrategy":"validation","validationCode":"if _, err := keys.Get(KIDAccess); err != nil {\n    return fmt.Errorf(\"access signing key unavailable: %w\", err)\n}","typeGuard":"func isAccessTokenSignErr(err error) bool { return err != nil && strings.HasPrefix(err.Error(), \"access: \") }","tryCatchPattern":"if _, _, err := a.Signin(ctx, user, pass); err != nil {\n    if strings.HasPrefix(err.Error(), \"access: \") {\n        cause := errors.Unwrap(err)\n        log.Printf(\"access token signing: %v\", cause)\n        return http.StatusInternalServerError\n    }\n    return http.StatusUnauthorized\n}","preventionTips":["Keep KIDAccess registered across key rotations","Validate PEM key format at load time, not at first signin","Sign a test access token during boot to fail fast","Monitor for 'access: ' wrapped errors to catch keystore regressions"],"tags":["auth","jwt","keystore"],"backgroundTag":"jwt-signing-failed","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}