{"record":{"id":"003147940eabed0e","repo":"nats-io/nats-server","slug":"cluster-import-allow-w","errorCode":null,"errorMessage":"cluster import allow: %w","messagePattern":"cluster import allow: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":3399,"sourceCode":"func setClusterPermissions(opts *ClusterOpts, perms *Permissions) {\n\t// Import is whether or not we will send a SUB for interest to the other side.\n\t// Export is whether or not we will accept a SUB from the remote for a given subject.\n\t// Both only effect interest registration.\n\t// The parsing sets Import into Publish and Export into Subscribe, convert\n\t// accordingly.\n\topts.Permissions = &RoutePermissions{\n\t\tImport: perms.Publish,\n\t\tExport: perms.Subscribe,\n\t}\n}\n\nfunc checkClusterPermissionSubjects(perms *Permissions) error {\n\tif perms == nil {\n\t\treturn nil\n\t}\n\tif perms.Publish != nil {\n\t\tif err := checkPermSubjectArray(perms.Publish.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster import allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(perms.Publish.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster import deny: %w\", err)\n\t\t}\n\t}\n\tif perms.Subscribe != nil {\n\t\tif err := checkPermSubjectArray(perms.Subscribe.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster export allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(perms.Subscribe.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster export deny: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// Temp structures to hold account import and export defintions since they need\n// to be processed after being parsed.","sourceCodeStart":3381,"sourceCodeEnd":3417,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L3381-L3417","documentation":"checkClusterPermissionSubjects() validates the Permissions block for cluster-scoped account imports/exports. When perms.Publish.Allow contains a subject that fails checkPermSubjectArray validation, the error is wrapped as 'cluster import allow: %w'. Note the wording is legacy/confusing: it reports the publish (subscribe-side) permissions even though it says 'import'.","triggerScenarios":"Configuring an account's Permissions.Publish.Allow array (in clustered/config-file contexts) with a subject that is not a valid NATS subject, e.g. containing ' ' or invalid wildcards.","commonSituations":"Typo in a publish permission subject such as a trailing dot, space, or invalid '>' placement; queue-qualified subjects used where they are not allowed (allowQueue=false here); machine-generated config inserting empty strings.","solutions":["Fix the offending subject in Permissions.Publish.Allow to a valid NATS subject (see wrapped inner error naming the subject)","Remove invalid wildcard usage (e.g. 'foo.>' is fine, 'foo.>.bar' is not)","Remove empty or whitespace subjects from the array","Run the config through nats-server's config validation before deployment"],"exampleFix":"// before\npublish: { allow: [\"foo.>.bar\"] }\n// after\npublish: { allow: [\"foo.>\"] }","handlingStrategy":"validation","validationCode":"for _, s := range perms.Publish.Allow {\n\tif !server.IsValidSubject(s) {\n\t\treturn fmt.Errorf(\"invalid publish allow subject %q\", s)\n\t}\n}","typeGuard":"func validSubjects(sa []string) bool {\n\tfor _, s := range sa {\n\t\tif !IsValidSubject(s) { return false }\n\t}\n\treturn true\n}","tryCatchPattern":"if err := opts.ProcessConfigFile(path); err != nil {\n\tlog.Fatalf(\"config error: %v\", err)\n}","preventionTips":["Validate all permission subjects at config-generation time","Quote YAML subject strings to avoid whitespace injection","Keep wildcards per NATS rules: '*' single token, '>' last token only"],"tags":["config","permissions","subjects"],"backgroundTag":"invalid-subject","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}