{"record":{"id":"34c4f2cc234c0ada","repo":"nats-io/nats-server","slug":"cluster-import-deny-w","errorCode":null,"errorMessage":"cluster import deny: %w","messagePattern":"cluster import deny: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":3402,"sourceCode":"\t// Both only effect interest registration.\n\t// The parsing sets Import into Publish and Export into Subscribe, convert\n\t// accordingly.\n\topts.Permissions = &RoutePermissions{\n\t\tImport: perms.Publish,\n\t\tExport: perms.Subscribe,\n\t}\n}\n\nfunc checkClusterPermissionSubjects(perms *Permissions) error {\n\tif perms == nil {\n\t\treturn nil\n\t}\n\tif perms.Publish != nil {\n\t\tif err := checkPermSubjectArray(perms.Publish.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster import allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(perms.Publish.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster import deny: %w\", err)\n\t\t}\n\t}\n\tif perms.Subscribe != nil {\n\t\tif err := checkPermSubjectArray(perms.Subscribe.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster export allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(perms.Subscribe.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster export deny: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// Temp structures to hold account import and export defintions since they need\n// to be processed after being parsed.\ntype export struct {\n\tacc  *Account\n\tsub  string","sourceCodeStart":3384,"sourceCodeEnd":3420,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L3384-L3420","documentation":"Same validator as the sibling errors: checkClusterPermissionSubjects() wraps failures from checkPermSubjectArray(perms.Publish.Deny, false) with 'cluster import deny: %w'. It means a subject in the Publish.Deny list of a permissions block is not a valid NATS subject.","triggerScenarios":"Permissions.Publish.Deny contains a subject that fails IsValidSubject, e.g. empty string, space-separated tokens without queue semantics, or malformed wildcard.","commonSituations":"Hand-edited deny lists with typos; templating tools leaving placeholders like \"{{subject}}\"; copy-pasting subjects with trailing whitespace.","solutions":["Fix the invalid subject listed in the wrapped inner error in Permissions.Publish.Deny","Remove empty/placeholder entries from the deny array","Validate subjects with a quick check (only tokens of [A-Za-z0-9_], '*' per token, '>' only last)","Regenerate config from templates and re-diff to catch placeholder leakage"],"exampleFix":"// before\npublish: { deny: [\"secret.>\", \"\"] }\n// after\npublish: { deny: [\"secret.>\"] }","handlingStrategy":"validation","validationCode":"for _, s := range perms.Publish.Deny {\n\tif !server.IsValidSubject(s) {\n\t\treturn fmt.Errorf(\"invalid publish deny subject %q\", s)\n\t}\n}","typeGuard":"func validSubjects(sa []string) bool {\n\tfor _, s := range sa {\n\t\tif !IsValidSubject(s) { return false }\n\t}\n\treturn true\n}","tryCatchPattern":"if err := opts.ProcessConfigFile(path); err != nil {\n\tlog.Fatalf(\"config error: %v\", err)\n}","preventionTips":["Trim whitespace on generated deny lists","Reject empty or placeholder template values before writing config","Run nats-server config validation in CI"],"tags":["config","permissions","subjects"],"backgroundTag":"invalid-subject","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}