{"record":{"id":"0b42a8f881fc5b6b","repo":"theonedev/onedev","slug":"access-token-owner-should-have-permission-to-manag","errorCode":null,"errorMessage":"Access token owner should have permission to manage authorized project","messagePattern":"Access token owner should have permission to manage authorized project","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenAuthorizationResource.java","lineNumber":66,"sourceCode":"\t@Api(order=100, description = \"Get access token authorization of specified id\")\n\t@Path(\"/{authorizationId}\")\n\t@GET\n\tpublic AccessTokenAuthorization getAuthorization(@PathParam(\"authorizationId\") Long authorizationId) {\n\t\tvar authorization = accessTokenAuthorizationService.load(authorizationId);\n\t\tvar owner = authorization.getToken().getOwner();\n\t\tif (!isAdministrator() && !owner.equals(getAuthUser())) \n\t\t\tthrow new UnauthorizedException();\n\t\treturn authorization;\n\t}\n\t\n\t@Api(order=200, description=\"Create access token authorization. Access token owner should have permission to manage authorized project\")\n\t@POST\n\tpublic Long createAuthorization(@NotNull AccessTokenAuthorization authorization) {\n\t\tvar owner = authorization.getToken().getOwner();\n\t\tif (!isAdministrator() && !owner.equals(getAuthUser())) \n\t\t\tthrow new UnauthorizedException();\n\t\tif (!canManageProject(owner.asSubject(), authorization.getProject()))\n\t\t\tthrow new BadRequestException(\"Access token owner should have permission to manage authorized project\");\n\n\t\taccessTokenAuthorizationService.createOrUpdate(authorization);\n\t\tif (!getAuthUser().equals(owner)) {\n\t\t\tvar newAuditContent = VersionedXmlDoc.fromBean(authorization).toXML();\n\t\t\tauditService.audit(null, \"created access token authorization in account \\\"\" + owner.getName() + \"\\\" via RESTful API\", null, newAuditContent);\n\t\t}\n\t\treturn authorization.getId();\n\t}\n\n\t@Api(order=250, description=\"Update access authorization of specified id. Access token owner should have permission to manage authorized project\")\n\t@Path(\"/{authorizationId}\")\n\t@POST\n\tpublic Response updateAuthorization(@PathParam(\"authorizationId\") Long authorizationId, @NotNull AccessTokenAuthorization authorization) {\n\t\tvar owner = authorization.getToken().getOwner();\n\t\tif (!isAdministrator() && !owner.equals(getAuthUser())) \n\t\t\tthrow new UnauthorizedException();\n\t\tif (!canManageProject(owner.asSubject(), authorization.getProject()))\n\t\t\tthrow new BadRequestException(\"Access token owner should have permission to manage authorized project\");","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenAuthorizationResource.java#L48-L84","documentation":"In AccessTokenAuthorizationResource.createAuthorization, after the caller-vs-owner check, the endpoint requires that the access token's owner has manage permission on the project being authorized. If owner.asSubject() cannot manage authorization.getProject(), a BadRequestException with this message (HTTP 400) is thrown and nothing is persisted.","triggerScenarios":"POSTing an authorization that would grant a token access to a project its owner cannot manage — e.g. bob (plain project member) authorizing his token for project 'core' where he lacks the manage-project privilege. Even admins hit this if they authorize a non-privileged owner for a project.","commonSituations":"Automation granting project access to a token whose owner was recently demoted; typo'd project name in the payload; authorizing a private project the owner is not a member of.","solutions":["Grant the token owner the manage-project permission (Project Privileges.MANAGE) on the target project first","Correct the 'project' field in the payload to a project the owner can manage","Have a project admin add the owner with sufficient role, then retry","Verify the project name/path is spelled correctly"],"exampleFix":"// before\nPOST /rest/access-tokens-authorizations { \"token\": {\"owner\":\"bob\"}, \"project\": \"core\" } // bob cannot manage 'core' -> 400\n// after\n// project admin grants bob manage permission on 'core', then retry the same POST","handlingStrategy":"validation","validationCode":"// pre-check: does the token owner have manage permission on the project?\nconst projects = await fetch('/rest/projects', { headers }).then(r => r.json());\nconst canManage = projects.some(p => p.path === projectPath /* and you manage it */);\nif (!canManage) throw new Error(`Owner cannot manage project ${projectPath}`);","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch('/rest/access-tokens-authorizations', { method: 'POST', body: JSON.stringify(payload) });\n  if (res.status === 400 && (await res.text()).includes('should have permission to manage')) {\n    // request project manage permission for the token owner, then retry\n  }\n} catch (e) { /* handle */ }","preventionTips":["Grant the token owner manage permission on the target project before authorizing","Double-check the project name/path in the payload against /rest/projects","Re-verify owner permissions after any project role changes"],"tags":["rest","authorization","bad-request","project-permissions","access-token"],"backgroundTag":"insufficient-permissions","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}