{"record":{"id":"f44683b842a9d5f7","repo":"wavetermdev/waveterm","slug":"failed-to-generate-job-access-token-w","errorCode":null,"errorMessage":"failed to generate job access token: %w","messagePattern":"failed to generate job access token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/jobcontroller/jobcontroller.go","lineNumber":647,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"error checking connection status: %w\", err)\n\t}\n\tif !isConnected {\n\t\treturn \"\", fmt.Errorf(\"connection %q is not connected\", params.ConnName)\n\t}\n\n\tjobId := uuid.New().String()\n\tjobAuthToken, err := utilfn.RandomHexString(32)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate job auth token: %w\", err)\n\t}\n\n\tjobAccessClaims := &wavejwt.WaveJwtClaims{\n\t\tMainServer: true,\n\t\tJobId:      jobId,\n\t}\n\tjobAccessToken, err := wavejwt.Sign(jobAccessClaims)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate job access token: %w\", err)\n\t}\n\n\tjob := &waveobj.Job{\n\t\tOID:              jobId,\n\t\tConnection:       params.ConnName,\n\t\tJobKind:          params.JobKind,\n\t\tCmd:              params.Cmd,\n\t\tCmdArgs:          params.Args,\n\t\tCmdEnv:           params.Env,\n\t\tCmdTermSize:      *params.TermSize,\n\t\tJobAuthToken:     jobAuthToken,\n\t\tJobManagerStatus: JobManagerStatus_Init,\n\t\tAttachedBlockId:  params.BlockId,\n\t\tWaveVersion:      wavebase.WaveVersion,\n\t\tMeta:             make(waveobj.MetaMapType),\n\t}\n\n\terr = wstore.DBInsert(ctx, job)","sourceCodeStart":629,"sourceCodeEnd":665,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/jobcontroller/jobcontroller.go#L629-L665","documentation":"StartJob signs a WaveJwtClaims payload (MainServer=true, JobId) with wavejwt.Sign to mint the job access token; a signing failure is wrapped with this message. Signing depends on the server's JWT key material, so this usually means a key configuration/availability problem.","triggerScenarios":"wavejwt.Sign returns an error — typically missing or unloaded signing key, key parse failure, or unsupported signing method due to misconfiguration.","commonSituations":"First-run key generation failed, JWT secret/key file missing or corrupted, key format changed between Wave Terminal versions.","solutions":["Inspect the wrapped cause (%w) for the exact key/signing error.","Ensure the Wave JWT public/private key material exists and is loadable (restart the server to regenerate if corrupted).","Check file permissions on the key storage location so the server process can read it."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"jobId, err := jobcontroller.StartJob(ctx, params)\nif err != nil && strings.Contains(err.Error(), \"failed to generate job access token\") {\n    return fmt.Errorf(\"JWT signing unavailable; check Wave key configuration: %w\", err)\n}","preventionTips":["Ensure the Wave server has generated/loaded its JWT signing keys at startup and log key load status.","Protect the key storage path with correct permissions; verify after upgrades.","If keys are regenerated, restart cleanly so all components share the same key material."],"tags":["jwt","crypto","configuration"],"backgroundTag":"jwt-signing-failed","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}