wavetermdev/waveterm · error

not authenticated

Error message

not authenticated

What it means

StartJobCommand is an RPC handler that requires the connecting peer to have completed authentication (PeerAuthenticated). If the peer never called (or failed) AuthenticateToJobManagerCommand, the handler refuses with this sentinel error before delegating to the job manager.

Source

Thrown at pkg/jobmanager/mainserverconn.go:102

	}
	msc.PeerAuthenticated.Store(true)
	log.Printf("AuthenticateToJobManager: authentication successful for JobId=%s\n", claims.JobId)

	err = msc.authenticateSelfToServer(jobAuthToken)
	if err != nil {
		msc.PeerAuthenticated.Store(false)
		return err
	}

	WshCmdJobManager.SetAttachedClient(msc)
	return nil
}

func (msc *MainServerConn) StartJobCommand(ctx context.Context, data wshrpc.CommandStartJobData) (*wshrpc.CommandStartJobRtnData, error) {
	log.Printf("StartJobCommand: received command=%s args=%v", data.Cmd, data.Args)
	if !msc.PeerAuthenticated.Load() {
		log.Printf("StartJobCommand: not authenticated")
		return nil, fmt.Errorf("not authenticated")
	}
	return WshCmdJobManager.StartJob(msc, data)
}

func (msc *MainServerConn) JobPrepareConnectCommand(ctx context.Context, data wshrpc.CommandJobPrepareConnectData) (*wshrpc.CommandJobConnectRtnData, error) {
	if !msc.PeerAuthenticated.Load() {
		return nil, fmt.Errorf("peer not authenticated")
	}
	if !msc.SelfAuthenticated.Load() {
		return nil, fmt.Errorf("not authenticated to server")
	}
	return WshCmdJobManager.PrepareConnect(msc, data)
}

func (msc *MainServerConn) JobStartStreamCommand(ctx context.Context, data wshrpc.CommandJobStartStreamData) error {
	if !msc.PeerAuthenticated.Load() {
		return fmt.Errorf("not authenticated")
	}

View on GitHub (pinned to a4447c1563)

Solutions

1. Call AuthenticateToJobManagerCommand successfully before invoking StartJobCommand.
2. Check earlier authentication errors (token expiry/claims) and fix them, then re-authenticate.
3. Ensure ordering in client code: await auth completion (SelfAuthenticated/PeerAuthenticated) before sending job commands.

Example fix

// before
conn.StartJobCommand(ctx, data) // may fail: not authenticated
// after
if err := conn.AuthenticateToJobManagerCommand(ctx, authData); err != nil {
    return err
}
rtn, err := conn.StartJobCommand(ctx, data)

if !conn.peerAuthenticated() {
    return fmt.Errorf("authenticate before calling StartJob")
}

rtn, err := conn.StartJobCommand(ctx, data)
if err != nil {
    if err.Error() == "not authenticated" {
        if authErr := conn.AuthenticateToJobManagerCommand(ctx, authData); authErr != nil {
            return authErr
        }
        rtn, err = conn.StartJobCommand(ctx, data)
    }
    if err != nil { return err }
}

When it happens

Trigger: Calling StartJob over the WSH control route on a MainServerConn whose PeerAuthenticated atomic flag is still false — i.e. commands sent before or without successful peer authentication.

Common situations: Client code issuing job commands immediately after connect without awaiting authentication, authentication failing earlier (expired token, claim mismatch), or reconnecting without re-authenticating.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• peer not authenticated
• failed to authenticate to server: %w
• not authenticated to server
• error getting jwt public key: %v
• error authenticating with upstream: %v

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/71836b7f3590403a. Report an issue: GitHub.