{"record":{"id":"7b63dd4fb5c90161","repo":"nats-io/nats-server","slug":"cluster-export-deny-w","errorCode":null,"errorMessage":"cluster export deny: %w","messagePattern":"cluster export deny: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/opts.go","lineNumber":3410,"sourceCode":"\nfunc checkClusterPermissionSubjects(perms *Permissions) error {\n\tif perms == nil {\n\t\treturn nil\n\t}\n\tif perms.Publish != nil {\n\t\tif err := checkPermSubjectArray(perms.Publish.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster import allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(perms.Publish.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster import deny: %w\", err)\n\t\t}\n\t}\n\tif perms.Subscribe != nil {\n\t\tif err := checkPermSubjectArray(perms.Subscribe.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster export allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(perms.Subscribe.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"cluster export deny: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// Temp structures to hold account import and export defintions since they need\n// to be processed after being parsed.\ntype export struct {\n\tacc  *Account\n\tsub  string\n\taccs []string\n\trt   ServiceRespType\n\tlat  *serviceLatency\n\trthr time.Duration\n\ttPos uint\n\tatrc bool // allow_trace\n}\n","sourceCodeStart":3392,"sourceCodeEnd":3428,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/opts.go#L3392-L3428","documentation":"checkClusterPermissionSubjects() wraps failures from checkPermSubjectArray(perms.Subscribe.Deny, false) with 'cluster export deny: %w'. A subject in the Subscribe.Deny list is not a valid NATS subject, so option parsing rejects the configuration.","triggerScenarios":"Permissions.Subscribe.Deny contains a subject failing IsValidSubject during server option validation.","commonSituations":"Deny lists built programmatically with empty strings; subjects containing spaces or tabs; invalid wildcard sequences like '>.foo'.","solutions":["Fix the invalid subject named in the wrapped error in Permissions.Subscribe.Deny","Replace '>.foo' style wildcards with valid forms ('>' must be the last token)","Trim whitespace from all subjects in the deny list","Add config validation to CI to catch malformed subjects before deploy"],"exampleFix":"// before\nsubscribe: { deny: [\">.foo\"] }\n// after\nsubscribe: { deny: [\"foo.>\"] }","handlingStrategy":"validation","validationCode":"for _, s := range perms.Subscribe.Deny {\n\tif !server.IsValidSubject(s) {\n\t\treturn fmt.Errorf(\"invalid subscribe deny subject %q\", s)\n\t}\n}","typeGuard":"func validSubjects(sa []string) bool {\n\tfor _, s := range sa {\n\t\tif !IsValidSubject(s) { return false }\n\t}\n\treturn true\n}","tryCatchPattern":"if err := opts.ProcessConfigFile(path); err != nil {\n\tlog.Fatalf(\"config error: %v\", err)\n}","preventionTips":["Generate deny lists programmatically with subject validation","Ensure '>' appears only as the final token","Trim and filter empty strings before writing config"],"tags":["config","permissions","subjects"],"backgroundTag":"invalid-subject","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}