{"record":{"id":"143404c8153d560b","repo":"theonedev/onedev","slug":"unable-to-access-dependency-build-dependencyb","errorCode":null,"errorMessage":"Unable to access dependency build '\" + dependencyBuild.getReference().toString(null) + \"': permission denied","messagePattern":"Unable to access dependency build '\" \\+ dependencyBuild\\.getReference\\(\\)\\.toString\\(null\\) \\+ \"': permission denied","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/job/DefaultJobService.java","lineNumber":425,"sourceCode":"\t\t\t\t\t\tthrow new ExplicitException(\"Unable to access dependency project '\"\n\t\t\t\t\t\t\t\t+ dependency.getProjectPath() + \"': invalid access token\");\n\t\t\t\t\t}\n\t\t\t\t\tsubject = accessToken.asSubject();\n\t\t\t\t} else {\n\t\t\t\t\tsubject = SecurityUtils.asAnonymous();\n\t\t\t\t}\n\n\t\t\t\tBuild dependencyBuild = dependency.getBuildProvider().getBuild(dependencyProject);\n\t\t\t\tif (dependencyBuild == null) {\n\t\t\t\t\tString errorMessage = String.format(\"Unable to find dependency build in project '\"\n\t\t\t\t\t\t\t+ dependencyProject.getPath() + \"'\");\n\t\t\t\t\tthrow new ExplicitException(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tAccessProject projectPermission = new AccessProject();\n\t\t\t\tif (!dependencyProject.isPermittedByLoginUser(projectPermission)\n\t\t\t\t\t\t&& !subject.isPermitted(new ProjectPermission(dependencyProject, projectPermission))) {\n\t\t\t\t\tthrow new ExplicitException(\"Unable to access dependency build '\"\n\t\t\t\t\t\t\t+ dependencyBuild.getReference().toString(null) + \"': permission denied\");\n\t\t\t\t}\n\t\t\t\t\n\t\t\t\tif (build.getDependencies().stream()\n\t\t\t\t\t\t.anyMatch(it -> it.getDependency().equals(dependencyBuild))) {\n\t\t\t\t\tthrow new ExplicitException(\"Duplicate dependency build '\"\n\t\t\t\t\t\t\t+ dependencyBuild.getReference().toString(null) + \"'\");\n\t\t\t\t}\n\n\t\t\t\tBuildDependence dependence = new BuildDependence();\n\t\t\t\tdependence.setDependency(dependencyBuild);\n\t\t\t\tdependence.setDependent(build);\n\t\t\t\tdependence.setArtifacts(dependency.getArtifacts());\n\t\t\t\tdependence.setDestinationPath(dependency.getDestinationPath());\n\t\t\t\tbuild.getDependencies().add(dependence);\n\t\t\t}\n\n\t\t\tbuildService.create(build);","sourceCodeStart":407,"sourceCodeEnd":443,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/job/DefaultJobService.java#L407-L443","documentation":"Thrown by DefaultJobService.doSubmit when a build declares a dependency build that the current login user is not permitted to access in the dependency's project (neither direct AccessProject permission on the dependency project nor an implied ProjectPermission via the authorization subject). OneDev requires the submitting user to be able to read every dependency build so agents and results cannot leak across projects. It surfaces as an ExplicitException attached to the build's failure message.","triggerScenarios":"Calling jobService.submit (or adding a dependency via dependencyBuild) for a build whose build spec declares a dependency on a build in another project, while the current user lacks Read/AccessProject permission on that dependency's project.","commonSituations":"CI pipelines that depend on artifacts from a library project the developer cannot see; permission tightened recently on the dependency project; depending on builds in a private/forked project; service accounts running pipelines without membership in the dependency project.","solutions":["Grant the submitting user (or the account running the pipeline) Read/Access permission on the project containing the dependency build.","Remove the dependency from the job spec if the dependency is not truly needed.","Reproduce the needed artifact within the same project or an accessible public project instead of cross-project dependency.","If a service account runs the pipeline, add it to a group with access to the dependency project."],"exampleFix":"// before (.onedev-buildspec.yml)\ndependencies:\n  - build: '@other-project@/builds/latest'\n\n// after: grant the user Read permission on other-project,\n// or remove the dependency:\ndependencies: []","handlingStrategy":"validation","validationCode":"// Java, before submitting\nAccessProject p = new AccessProject();\nif (!dependencyProject.isPermittedByLoginUser(p)\n        && !SecurityUtils.getSubject().isPermitted(new ProjectPermission(dependencyProject, p))) {\n    throw new ExplicitException(\"User cannot access dependency project \" + dependencyProject.getPath());\n}","typeGuard":null,"tryCatchPattern":"try {\n    jobService.submit(build);\n} catch (ExplicitException e) {\n    if (e.getMessage().contains(\"permission denied\")) {\n        // prompt user to request access to the dependency project\n    }\n}","preventionTips":["Check project permissions of every dependency project before defining cross-project dependencies","Use a dedicated CI service account with read access to all dependency projects","Keep dependency graphs within projects the whole team can read"],"tags":["permission-denied","ci-pipeline","build-dependency","authorization"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}