{"record":{"id":"007fcaedad9b7f55","repo":"theonedev/onedev","slug":"not-authorized-007fca","errorCode":null,"errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/PackResource.java","lineNumber":58,"sourceCode":"public class PackResource {\n\n\tprivate final PackService packService;\n\t\n\tprivate final AuditService auditService;\n\t\n\t@Inject\n\tpublic PackResource(PackService packService, AuditService auditService) {\n\t\tthis.packService = packService;\n\t\tthis.auditService = auditService;\n\t}\n\n\t@Api(order=100)\n\t@Path(\"/{packId}\")\n    @GET\n    public Pack getPack(@PathParam(\"packId\") Long packId) {\n\t\tPack pack = packService.load(packId);\n    \tif (!SecurityUtils.canReadPack(pack.getProject())) \n\t\t\tthrow new UnauthorizedException();\n    \treturn pack;\n    }\n\n\t@Api(order=150, description = \"Get list of <a href='/~help/api/io.onedev.server.rest.PackLabelResource'>labels</a>\")\n\t@Path(\"/{packId}/labels\")\n\t@GET\n\tpublic Collection<PackLabel> getLabels(@PathParam(\"packId\") Long packId) {\n\t\tPack pack = packService.load(packId);\n\t\tif (!SecurityUtils.canReadPack(pack.getProject()))\n\t\t\tthrow new UnauthorizedException();\n\t\treturn pack.getLabels();\n\t}\n\t\n\t@Api(order=300)\n\t@Path(\"/{packId}/blobs\")\n    @GET\n    public Collection<PackBlob> getBlobs(@PathParam(\"packId\") Long packId) {\n\t\tPack pack = packService.load(packId);","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/PackResource.java#L40-L76","documentation":"OneDev's REST API for packages throws UnauthorizedException (rendered as 'Not authorized') when the authenticated subject lacks read permission on the project owning the requested pack. getPack loads the pack by id first, then checks SecurityUtils.canReadPack(project); if the check fails, no pack data is returned. This is an intentional authorization gate, not a bug.","triggerScenarios":"GET /~api/packs/{packId} called by a user (or access token) that is not a member of the pack's project, lacks the 'Read Code'/'Read Packages' style permission, or calls the endpoint without authentication on a non-public project.","commonSituations":"Using a personal access token created without the right role; the pack id belongs to a different project than the user assumed; project membership or role was revoked; token expired and request falls back to anonymous access.","solutions":["Grant the calling user a project role that includes pack read permission (at least 'Read Code' in project security settings).","Verify the API request is authenticated (valid Authorization token for a non-public project).","Confirm the packId actually refers to a pack in the project you have access to.","If using an access token, regenerate it with sufficient scope and update the client."],"exampleFix":"// before: anonymous or under-privileged call\ncurl http://server/~api/packs/42\n// after: authenticate with a token of a user who can read the project\ncurl -H \"Authorization: Bearer <token>\" http://server/~api/packs/42","handlingStrategy":"validation","validationCode":"// Java client-side pre-check (using OneDev services)\nif (!SecurityUtils.canReadPack(pack.getProject()))\n    throw new IllegalStateException(\"Skip GET /packs/\" + packId + \": no read access to project \" + pack.getProject().getPath());","typeGuard":"boolean canCall = SecurityUtils.getSubject() != null && SecurityUtils.canReadPack(project);","tryCatchPattern":"try { pack = client.getPack(packId); } catch (ForbiddenException | ClientErrorException e) { log.warn(\"Not authorized to read pack {}\", packId); }","preventionTips":["Always send an Authorization header for private projects","Use a token whose user has at least read role on the target project","Check project membership before automating package API calls","Treat 401/403 on this endpoint as a permissions problem, not retryable"],"tags":["rest","authorization","packages","onedev"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}