{"record":{"id":"bcf3cb9e8dfe8f87","repo":"nats-io/nats-server","slug":"generated-invalid-subject-q-q-is-not-defined","errorCode":null,"errorMessage":"generated invalid subject %q: %q is not defined","messagePattern":"generated invalid subject %q: %q is not defined","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":579,"sourceCode":"\t\t\t\t\tif match[0] == \"account-tag\" {\n\t\t\t\t\t\tacc.mu.RLock()\n\t\t\t\t\t\ttags = acc.tags\n\t\t\t\t\t\tacc.mu.RUnlock()\n\t\t\t\t\t} else {\n\t\t\t\t\t\ttags = ujwt.Tags\n\t\t\t\t\t}\n\t\t\t\t\ttagPrefix := fmt.Sprintf(\"%s:\", strings.ToLower(match[1]))\n\t\t\t\t\tvar valueList []string\n\t\t\t\t\tfor _, tag := range tags {\n\t\t\t\t\t\tif strings.HasPrefix(tag, tagPrefix) {\n\t\t\t\t\t\t\ttagValue := strings.TrimPrefix(tag, tagPrefix)\n\t\t\t\t\t\t\tvalueList = append(valueList, tagValue)\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tif len(valueList) != 0 {\n\t\t\t\t\t\tvalues[tokenNum] = valueList\n\t\t\t\t\t} else if failOnBadSubject {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\"generated invalid subject %q: %q is not defined\", list[i], match[1])\n\t\t\t\t\t} else {\n\t\t\t\t\t\t// generate an invalid subject?\n\t\t\t\t\t\tvalues[tokenNum] = []string{\" \"}\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\treturn nil, fmt.Errorf(\"template operation in %q: %q is not defined\", list[i], op)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif !hasTags {\n\t\t\t\tsubj := list[i]\n\t\t\t\tfor idx, m := range srcs {\n\t\t\t\t\tsubj = strings.Replace(subj, m, values[idx][0], -1)\n\t\t\t\t}\n\t\t\t\tif IsValidSubject(subj) {\n\t\t\t\t\temittedList = append(emittedList, subj)\n\t\t\t\t} else if failOnBadSubject {\n\t\t\t\t\treturn nil, fmt.Errorf(\"generated invalid subject\")\n\t\t\t\t}","sourceCodeStart":561,"sourceCodeEnd":597,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L561-L597","documentation":"A {{tag:name}} template in a permission subject resolved to no matching account tag (no tag with that prefix exists), and because failOnBadSubject is set the invalid generated subject is rejected instead of being silently dropped.","triggerScenarios":"Thrown at server/auth.go:579 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add the missing tag to the account claims so the template resolves","Remove or correct the template token in the permission subject","Ensure the signing account actually scopes the expected tags"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}