nats-io/nats-server · error

cluster import deny: %w

Error message

cluster import deny: %w

What it means

Same validator as the sibling errors: checkClusterPermissionSubjects() wraps failures from checkPermSubjectArray(perms.Publish.Deny, false) with 'cluster import deny: %w'. It means a subject in the Publish.Deny list of a permissions block is not a valid NATS subject.

Source

Thrown at server/opts.go:3402

	// Both only effect interest registration.
	// The parsing sets Import into Publish and Export into Subscribe, convert
	// accordingly.
	opts.Permissions = &RoutePermissions{
		Import: perms.Publish,
		Export: perms.Subscribe,
	}
}

func checkClusterPermissionSubjects(perms *Permissions) error {
	if perms == nil {
		return nil
	}
	if perms.Publish != nil {
		if err := checkPermSubjectArray(perms.Publish.Allow, false); err != nil {
			return fmt.Errorf("cluster import allow: %w", err)
		}
		if err := checkPermSubjectArray(perms.Publish.Deny, false); err != nil {
			return fmt.Errorf("cluster import deny: %w", err)
		}
	}
	if perms.Subscribe != nil {
		if err := checkPermSubjectArray(perms.Subscribe.Allow, false); err != nil {
			return fmt.Errorf("cluster export allow: %w", err)
		}
		if err := checkPermSubjectArray(perms.Subscribe.Deny, false); err != nil {
			return fmt.Errorf("cluster export deny: %w", err)
		}
	}
	return nil
}

// Temp structures to hold account import and export defintions since they need
// to be processed after being parsed.
type export struct {
	acc  *Account
	sub  string

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Fix the invalid subject listed in the wrapped inner error in Permissions.Publish.Deny
2. Remove empty/placeholder entries from the deny array
3. Validate subjects with a quick check (only tokens of [A-Za-z0-9_], '*' per token, '>' only last)
4. Regenerate config from templates and re-diff to catch placeholder leakage

Example fix

// before
publish: { deny: ["secret.>", ""] }
// after
publish: { deny: ["secret.>"] }

for _, s := range perms.Publish.Deny {
	if !server.IsValidSubject(s) {
		return fmt.Errorf("invalid publish deny subject %q", s)
	}
}

func validSubjects(sa []string) bool {
	for _, s := range sa {
		if !IsValidSubject(s) { return false }
	}
	return true
}

if err := opts.ProcessConfigFile(path); err != nil {
	log.Fatalf("config error: %v", err)
}

When it happens

Trigger: Permissions.Publish.Deny contains a subject that fails IsValidSubject, e.g. empty string, space-separated tokens without queue semantics, or malformed wildcard.

Common situations: Hand-edited deny lists with typos; templating tools leaving placeholders like "{{subject}}"; copy-pasting subjects with trailing whitespace.

Related errors

• cluster import allow: %w
• cluster export allow: %w
• cluster export deny: %w
• subject %q is not a valid subject
• publish deny: %w

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/34c4f2cc234c0ada. Report an issue: GitHub.