{"record":{"id":"064d3dddf665a3ae","repo":"theonedev/onedev","slug":"unable-to-access-dependency-project-dependenc","errorCode":null,"errorMessage":"Unable to access dependency project '\" + dependency.getProjectPath() + \"': invalid access token","messagePattern":"Unable to access dependency project '\" \\+ dependency\\.getProjectPath\\(\\) \\+ \"': invalid access token","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/job/DefaultJobService.java","lineNumber":407,"sourceCode":"\t\t\t\t\tdependence.setDependent(build);\n\t\t\t\t\tdependence.setRequireSuccessful(interpolated.isRequireSuccessful());\n\t\t\t\t\tdependence.setArtifacts(interpolated.getArtifacts());\n\t\t\t\t\tdependence.setDestinationPath(interpolated.getDestinationPath());\n\t\t\t\t\tbuild.getDependencies().add(dependence);\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (ProjectDependency dependency : build.getJob().getProjectDependencies()) {\n\t\t\t\tdependency = interpolator.interpolateProperties(dependency);\n\t\t\t\tProject dependencyProject = projectService.findByPath(dependency.getProjectPath());\n\t\t\t\tif (dependencyProject == null)\n\t\t\t\t\tthrow new ExplicitException(\"Unable to find dependency project: \" + dependency.getProjectPath());\n\n\t\t\t\tSubject subject;\n\t\t\t\tif (dependency.getAccessTokenSecret() != null) {\n\t\t\t\t\tString secretValue = build.getJobAuthorizationContext().getSecretValue(dependency.getAccessTokenSecret());\n\t\t\t\t\tvar accessToken = accessTokenService.findByValue(secretValue);\n\t\t\t\t\tif (accessToken == null) {\n\t\t\t\t\t\tthrow new ExplicitException(\"Unable to access dependency project '\"\n\t\t\t\t\t\t\t\t+ dependency.getProjectPath() + \"': invalid access token\");\n\t\t\t\t\t}\n\t\t\t\t\tsubject = accessToken.asSubject();\n\t\t\t\t} else {\n\t\t\t\t\tsubject = SecurityUtils.asAnonymous();\n\t\t\t\t}\n\n\t\t\t\tBuild dependencyBuild = dependency.getBuildProvider().getBuild(dependencyProject);\n\t\t\t\tif (dependencyBuild == null) {\n\t\t\t\t\tString errorMessage = String.format(\"Unable to find dependency build in project '\"\n\t\t\t\t\t\t\t+ dependencyProject.getPath() + \"'\");\n\t\t\t\t\tthrow new ExplicitException(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tAccessProject projectPermission = new AccessProject();\n\t\t\t\tif (!dependencyProject.isPermittedByLoginUser(projectPermission)\n\t\t\t\t\t\t&& !subject.isPermitted(new ProjectPermission(dependencyProject, projectPermission))) {\n\t\t\t\t\tthrow new ExplicitException(\"Unable to access dependency build '\"","sourceCodeStart":389,"sourceCodeEnd":425,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/job/DefaultJobService.java#L389-L425","documentation":"When a build dependency specifies an access token (dependency.getAccessTokenSecret()), doSubmit resolves the secret's value and looks up a matching access token via accessTokenService.findByValue. If no token matches (deleted, rotated, or wrong secret), the dependency project cannot be accessed and an ExplicitException with 'invalid access token' is thrown.","triggerScenarios":"doSubmit on a build whose projectDependencies define accessTokenSecret pointing to a secret whose value does not correspond to any existing access token in the system.","commonSituations":"Access token deleted or regenerated by an admin; secret defined in one project but the token belongs to another; the job authorization context cannot decrypt/resolve the secret into a valid token; environment migration losing tokens.","solutions":["Generate a new access token with permission on the dependency project and update the referenced secret's value.","Verify the accessTokenSecret name matches an existing secret in the job authorization context.","If the token was rotated, update the build spec/secret store with the current token value.","If anonymous access suffices, remove the accessTokenSecret field so it falls back to anonymous subject."],"exampleFix":"// before\n- projectName: core-lib\n  accessTokenSecret: core-lib-token   # token deleted\n// after (after creating a new token and secret 'core-lib-token')\n- projectName: core-lib\n  accessTokenSecret: core-lib-token","handlingStrategy":"validation","validationCode":"String secretValue = jobAuthorizationContext.getSecretValue(dep.getAccessTokenSecret());\nif (secretValue == null || accessTokenService.findByValue(secretValue) == null)\n  throw new ValidationException(\"Access token for dependency \" + dep.getProjectPath() + \" is missing or invalid\");","typeGuard":null,"tryCatchPattern":"try { jobService.submit(...); } catch (ExplicitException e) { if (e.getMessage().contains(\"invalid access token\")) rotateTokenAndUpdateSecret(); throw e; }","preventionTips":["Regenerate tokens on a schedule and update secrets atomically","Grant tokens only the minimum project permissions needed","Verify secret names exist in the job authorization context before submitting"],"tags":["ci","access-token","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}