nats-io/nats-server · error

template operation in %q: %q is not defined

Error message

template operation in %q: %q is not defined

What it means

A mustache-style template in a permission subject referenced an operation that is not recognized by the expander (only known operations like account-tag are supported), so the subject cannot be expanded at all.

Source

Thrown at server/auth.go:585

					}
					tagPrefix := fmt.Sprintf("%s:", strings.ToLower(match[1]))
					var valueList []string
					for _, tag := range tags {
						if strings.HasPrefix(tag, tagPrefix) {
							tagValue := strings.TrimPrefix(tag, tagPrefix)
							valueList = append(valueList, tagValue)
						}
					}
					if len(valueList) != 0 {
						values[tokenNum] = valueList
					} else if failOnBadSubject {
						return nil, fmt.Errorf("generated invalid subject %q: %q is not defined", list[i], match[1])
					} else {
						// generate an invalid subject?
						values[tokenNum] = []string{" "}
					}
				} else {
					return nil, fmt.Errorf("template operation in %q: %q is not defined", list[i], op)
				}
			}
			if !hasTags {
				subj := list[i]
				for idx, m := range srcs {
					subj = strings.Replace(subj, m, values[idx][0], -1)
				}
				if IsValidSubject(subj) {
					emittedList = append(emittedList, subj)
				} else if failOnBadSubject {
					return nil, fmt.Errorf("generated invalid subject")
				}
			} else {
				expCount := 1
				for _, v := range values {
					if len(v) == 0 {
						expCount = 0
						break

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use a supported template operation such as {{account-tag:name}}
2. Fix the typo in the template token
3. Remove unsupported template syntax from the permission subject

When it happens

Trigger: Thrown at server/auth.go:585 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/43f1e015a36db1e2. Report an issue: GitHub.