{"record":{"id":"d1bd45ba26ae9871","repo":"nats-io/nats-server","slug":"invalid-permissions-for-nkey-q-w","errorCode":null,"errorMessage":"invalid permissions for nkey %q: %w","messagePattern":"invalid permissions for nkey %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1723,"sourceCode":"\nfunc validateAuth(o *Options) error {\n\tif err := validatePinnedCerts(o.TLSPinnedCerts); err != nil {\n\t\treturn err\n\t}\n\tfor _, u := range o.Users {\n\t\tif err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := validatePermissionSubjects(u.Permissions); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid permissions for user %q: %w\", u.Username, err)\n\t\t}\n\t}\n\tfor _, u := range o.Nkeys {\n\t\tif err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := validatePermissionSubjects(u.Permissions); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid permissions for nkey %q: %w\", u.Nkey, err)\n\t\t}\n\t}\n\treturn validateNoAuthUser(o, o.NoAuthUser)\n}\n\nfunc validatePermissionSubjects(p *Permissions) error {\n\tif p == nil {\n\t\treturn nil\n\t}\n\tif p.Publish != nil {\n\t\tif err := checkPermSubjectArray(p.Publish.Allow, false); err != nil {\n\t\t\treturn fmt.Errorf(\"publish allow: %w\", err)\n\t\t}\n\t\tif err := checkPermSubjectArray(p.Publish.Deny, false); err != nil {\n\t\t\treturn fmt.Errorf(\"publish deny: %w\", err)\n\t\t}\n\t}\n\tif p.Subscribe != nil {","sourceCodeStart":1705,"sourceCodeEnd":1741,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1705-L1741","documentation":"Same options validation as for users, but for nkey entries in o.Nkeys: validatePermissionSubjects failed on the nkey's Permissions block and the error is wrapped with the nkey public key.","triggerScenarios":"Thrown at server/auth.go:1723 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the wrapped error for the failing subject","Correct invalid publish/subscribe subjects in the nkey's permissions","Regenerate config after fixing subject wildcards or tokens"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}