wavetermdev/waveterm · error

peer not authenticated

Error message

peer not authenticated

What it means

JobPrepareConnectCommand performs two auth checks; this first one fails when PeerAuthenticated is false, meaning the remote peer never validated its JobAccessToken with this job manager. The command is rejected before any connection preparation occurs.

Solutions

1. Run the AuthenticateToJobManagerCommand handshake first and confirm it returns nil.
2. Check job-manager logs for the earlier auth failure reason (token/claims/JobId) and fix the root cause.
3. Re-establish the connection and perform auth before PrepareConnect.

Example fix

// before
conn.JobPrepareConnectCommand(ctx, prepData) // fails: peer not authenticated
// after
if err := conn.AuthenticateToJobManagerCommand(ctx, authData); err != nil {
    return err
}
rtn, err := conn.JobPrepareConnectCommand(ctx, prepData)

if !conn.peerAuthenticated() {
    return fmt.Errorf("run AuthenticateToJobManagerCommand before PrepareConnect")
}

rtn, err := conn.JobPrepareConnectCommand(ctx, data)
if err != nil {
    if err.Error() == "peer not authenticated" {
        if authErr := conn.AuthenticateToJobManagerCommand(ctx, authData); authErr != nil {
            return authErr
        }
        rtn, err = conn.JobPrepareConnectCommand(ctx, data)
    }
    if err != nil { return err }
}

When it happens

Trigger: Invoking JobPrepareConnectCommand on a MainServerConn where PeerAuthenticated.Load() == false — no successful AuthenticateToJobManagerCommand call in this session.

Common situations: New connections used directly for PrepareConnect without the auth handshake, authentication rejected earlier, or state lost after job-manager restart.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• not authenticated
• failed to authenticate to server
• not authenticated to server
• authenticatejobmanagerverify can only be called on root…
• authentication returned empty routeid

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/431612eff3089f21. Report an issue: GitHub.

Appendix: source

Thrown at pkg/jobmanager/mainserverconn.go:109

		return err
	}

	WshCmdJobManager.SetAttachedClient(msc)
	return nil
}

func (msc *MainServerConn) StartJobCommand(ctx context.Context, data wshrpc.CommandStartJobData) (*wshrpc.CommandStartJobRtnData, error) {
	log.Printf("StartJobCommand: received command=%s args=%v", data.Cmd, data.Args)
	if !msc.PeerAuthenticated.Load() {
		log.Printf("StartJobCommand: not authenticated")
		return nil, fmt.Errorf("not authenticated")
	}
	return WshCmdJobManager.StartJob(msc, data)
}

func (msc *MainServerConn) JobPrepareConnectCommand(ctx context.Context, data wshrpc.CommandJobPrepareConnectData) (*wshrpc.CommandJobConnectRtnData, error) {
	if !msc.PeerAuthenticated.Load() {
		return nil, fmt.Errorf("peer not authenticated")
	}
	if !msc.SelfAuthenticated.Load() {
		return nil, fmt.Errorf("not authenticated to server")
	}
	return WshCmdJobManager.PrepareConnect(msc, data)
}

func (msc *MainServerConn) JobStartStreamCommand(ctx context.Context, data wshrpc.CommandJobStartStreamData) error {
	if !msc.PeerAuthenticated.Load() {
		return fmt.Errorf("not authenticated")
	}
	return WshCmdJobManager.StartStream(msc)
}

func (msc *MainServerConn) JobInputCommand(ctx context.Context, data wshrpc.CommandJobInputData) error {
	if !msc.PeerAuthenticated.Load() {
		return fmt.Errorf("not authenticated")
	}

View on GitHub (pinned to a4447c1563)