{"record":{"id":"54dd58345cb0becf","repo":"nats-io/nats-server","slug":"subscribe-allow-w","errorCode":null,"errorMessage":"subscribe allow: %w","messagePattern":"subscribe allow: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1743,"sourceCode":"\t}\n\treturn validateNoAuthUser(o, o.NoAuthUser)\n}\n\nfunc validatePermissionSubjects(p *Permissions) error {\n\tif p == nil {\n\t\treturn nil\n\t}\n\tif p.Publish != nil {\n\t\tif err := checkPermSubjectArray(p.Publish.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"publish allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(p.Publish.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"publish deny: %w\", err)\n\t\t}\n\t}\n\tif p.Subscribe != nil {\n\t\tif err := checkPermSubjectArray(p.Subscribe.Allow, true); err != nil {\n\t\t\treturn fmt.Errorf(\"subscribe allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(p.Subscribe.Deny, true); err != nil {\n\t\t\treturn fmt.Errorf(\"subscribe deny: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateAllowedConnectionTypes(m map[string]struct{}) error {\n\tfor ct := range m {\n\t\tctuc := strings.ToUpper(ct)\n\t\tswitch ctuc {\n\t\tcase jwt.ConnectionTypeStandard, jwt.ConnectionTypeWebsocket,\n\t\t\tjwt.ConnectionTypeLeafnode, jwt.ConnectionTypeLeafnodeWS,\n\t\t\tjwt.ConnectionTypeMqtt, jwt.ConnectionTypeMqttWS,\n\t\t\tjwt.ConnectionTypeInProcess:\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"unknown connection type %q\", ct)","sourceCodeStart":1725,"sourceCodeEnd":1761,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1725-L1761","documentation":"Validation of a permission's subscribe allow list failed. The library wraps the underlying checkPermSubjectArray error with 'subscribe allow' to identify that the ALLOWED subscribe subjects in the Subscribe permission block are invalid. It is thrown during server config validation for authorization blocks, users, or account permission structures.","triggerScenarios":"Calling validation with a Permissions struct whose Subscribe.Allow array contains malformed subjects — invalid wildcard placement, tokens with illegal characters, or empty entries — so checkPermSubjectArray(Subscribe.Allow, true) returns an error.","commonSituations":"Misconfigured nats_server.conf subscribe allow lists (e.g. 'foo.*.>' misuse or subjects like 'foo..bar'), programmatic user permission generation with bad inputs, or tooling that emits permissions from templates. Typically appears at startup or reload.","solutions":["Correct the invalid subject string in Subscribe.Allow; the wrapped error identifies which one.","Re-check wildcard syntax: '*' matches exactly one token, '>' must be the final token.","Strip empty strings and whitespace-only entries from the allow array.","Test the config with `nats-server -t -c config` before deploying."],"exampleFix":"// before\nSubscribe: {Allow: []string{\"foo..bar\"}}\n// after\nSubscribe: {Allow: []string{\"foo.*.bar\"}}","handlingStrategy":"validation","validationCode":"for i, s := range perm.Subscribe.Allow {\n    if s == \"\" { return fmt.Errorf(\"empty subscribe allow subject at %d\", i) }\n    if strings.Count(s, \">\") > 1 { return fmt.Errorf(\"multiple > in %q\", s) }\n}","typeGuard":"func validSubject(s string) bool {\n    if s == \"\" { return false }\n    parts := strings.Split(s, \".\")\n    for i, t := range parts {\n        if t == \"\" { return false }\n        if t == \">\" && i != len(parts)-1 { return false }\n    }\n    return true\n}","tryCatchPattern":"if err := validatePermissions(perms, true); err != nil {\n    if strings.HasPrefix(err.Error(), \"subscribe allow\") {\n        log.Fatalf(\"fix Subscribe.Allow subjects: %v\", err)\n    }\n}","preventionTips":["Run `nats-server -t -c config` in CI for config files","Validate subjects with nats.go's subject helpers before use","Ban multiple '>' tokens in generated permissions","Add tests covering allow-list templates"],"tags":["config","permissions","validation","nats"],"backgroundTag":"invalid-subject-permission","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}