nats-io/nats-server · error

cluster export deny: %w

Error message

cluster export deny: %w

What it means

checkClusterPermissionSubjects() wraps failures from checkPermSubjectArray(perms.Subscribe.Deny, false) with 'cluster export deny: %w'. A subject in the Subscribe.Deny list is not a valid NATS subject, so option parsing rejects the configuration.

Source

Thrown at server/opts.go:3410

func checkClusterPermissionSubjects(perms *Permissions) error {
	if perms == nil {
		return nil
	}
	if perms.Publish != nil {
		if err := checkPermSubjectArray(perms.Publish.Allow, false); err != nil {
			return fmt.Errorf("cluster import allow: %w", err)
		}
		if err := checkPermSubjectArray(perms.Publish.Deny, false); err != nil {
			return fmt.Errorf("cluster import deny: %w", err)
		}
	}
	if perms.Subscribe != nil {
		if err := checkPermSubjectArray(perms.Subscribe.Allow, false); err != nil {
			return fmt.Errorf("cluster export allow: %w", err)
		}
		if err := checkPermSubjectArray(perms.Subscribe.Deny, false); err != nil {
			return fmt.Errorf("cluster export deny: %w", err)
		}
	}
	return nil
}

// Temp structures to hold account import and export defintions since they need
// to be processed after being parsed.
type export struct {
	acc  *Account
	sub  string
	accs []string
	rt   ServiceRespType
	lat  *serviceLatency
	rthr time.Duration
	tPos uint
	atrc bool // allow_trace
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Fix the invalid subject named in the wrapped error in Permissions.Subscribe.Deny
2. Replace '>.foo' style wildcards with valid forms ('>' must be the last token)
3. Trim whitespace from all subjects in the deny list
4. Add config validation to CI to catch malformed subjects before deploy

Example fix

// before
subscribe: { deny: [">.foo"] }
// after
subscribe: { deny: ["foo.>"] }

for _, s := range perms.Subscribe.Deny {
	if !server.IsValidSubject(s) {
		return fmt.Errorf("invalid subscribe deny subject %q", s)
	}
}

func validSubjects(sa []string) bool {
	for _, s := range sa {
		if !IsValidSubject(s) { return false }
	}
	return true
}

if err := opts.ProcessConfigFile(path); err != nil {
	log.Fatalf("config error: %v", err)
}

When it happens

Trigger: Permissions.Subscribe.Deny contains a subject failing IsValidSubject during server option validation.

Common situations: Deny lists built programmatically with empty strings; subjects containing spaces or tabs; invalid wildcard sequences like '>.foo'.

Related errors

• cluster import allow: %w
• cluster import deny: %w
• cluster export allow: %w
• subject %q is not a valid subject
• publish deny: %w

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/7b63dd4fb5c90161. Report an issue: GitHub.