{"record":{"id":"49cc01662ef97fab","repo":"nats-io/nats-server","slug":"cluster-export-allow-w","errorCode":null,"errorMessage":"cluster export allow: %w","messagePattern":"cluster export allow: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":3407,"sourceCode":"\t\tExport: perms.Subscribe,\n\t}\n}\n\nfunc checkClusterPermissionSubjects(perms *Permissions) error {\n\tif perms == nil {\n\t\treturn nil\n\t}\n\tif perms.Publish != nil {\n\t\tif err := checkPermSubjectArray(perms.Publish.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster import allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(perms.Publish.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster import deny: %w\", err)\n\t\t}\n\t}\n\tif perms.Subscribe != nil {\n\t\tif err := checkPermSubjectArray(perms.Subscribe.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster export allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(perms.Subscribe.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster export deny: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// Temp structures to hold account import and export defintions since they need\n// to be processed after being parsed.\ntype export struct {\n\tacc  *Account\n\tsub  string\n\taccs []string\n\trt   ServiceRespType\n\tlat  *serviceLatency\n\trthr time.Duration\n\ttPos uint","sourceCodeStart":3389,"sourceCodeEnd":3425,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L3389-L3425","documentation":"checkClusterPermissionSubjects() wraps failures from checkPermSubjectArray(perms.Subscribe.Allow, false) with 'cluster export allow: %w'. Despite the 'export' wording, it validates the Subscribe.Allow array of the permissions block; a subject there is not a valid NATS subject.","triggerScenarios":"Permissions.Subscribe.Allow contains a malformed subject (bad wildcard, empty entry, whitespace) during option/config validation.","commonSituations":"Misconfigured subscribe permissions in account/user config; accidentally including queue-group syntax in a non-queue context; typos like 'foo..bar'.","solutions":["Correct the subject identified by the wrapped inner error in Permissions.Subscribe.Allow","Remove duplicate/empty tokens ('foo..bar' -> 'foo.bar')","Move queue-qualified subjects (\"subj queue\") to contexts that allow them, or drop the queue part","Lint the NATS config file before restart"],"exampleFix":"// before\nsubscribe: { allow: [\"foo..bar\"] }\n// after\nsubscribe: { allow: [\"foo.bar\"] }","handlingStrategy":"validation","validationCode":"for _, s := range perms.Subscribe.Allow {\n\tif !server.IsValidSubject(s) {\n\t\treturn fmt.Errorf(\"invalid subscribe allow subject %q\", s)\n\t}\n}","typeGuard":"func validSubjects(sa []string) bool {\n\tfor _, s := range sa {\n\t\tif !IsValidSubject(s) { return false }\n\t}\n\treturn true\n}","tryCatchPattern":"if err := opts.ProcessConfigFile(path); err != nil {\n\tlog.Fatalf(\"config error: %v\", err)\n}","preventionTips":["Avoid double dots and malformed wildcards when composing subjects","Keep queue-qualified syntax out of non-queue permission arrays","Lint config files before restart"],"tags":["config","permissions","subjects"],"backgroundTag":"invalid-subject","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}