{"record":{"id":"15465e53ce101a13","repo":"theonedev/onedev","slug":"no-package-read-permission-for-project-project-15465e","errorCode":null,"errorMessage":"No package read permission for project: ${project.getPath()}","messagePattern":"No package read permission for project: (.+?)","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java","lineNumber":436,"sourceCode":"\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tresponse.setStatus(SC_CREATED);\n\t\t\t\t}));\n\t\t\t}\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\t\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement())\n\t\t\tthrow new HttpResponseAwareException(SC_NOT_ACCEPTABLE, \"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\telse if (needsToWrite && !SecurityUtils.canWritePack(project))\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\telse if (!needsToWrite && !SecurityUtils.canReadPack(project))\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\treturn project;\n\t}\n\t\n\tprivate String getName(String groupId, @Nullable String artifactId) {\n\t\tif (artifactId == null)\n\t\t\tartifactId = NONE;\n\t\treturn groupId + \":\" + artifactId;\n\t}\n\t\n\tprivate List<Pack> queryByGAWithV(Project project, String groupId, String artifactId) {\n\t\tvar criteria = EntityCriteria.of(Pack.class);\n\t\tcriteria.add(Restrictions.eq(PROP_PROJECT, project));\n\t\tcriteria.add(Restrictions.eq(PROP_TYPE, TYPE));\n\t\tcriteria.add(Restrictions.eq(PROP_NAME, getName(groupId, artifactId)));\n\t\tcriteria.add(Restrictions.not(Restrictions.eq(PROP_VERSION, NONE)));\n\t\treturn packService.query(criteria);\n\t}\n\t","sourceCodeStart":418,"sourceCodeEnd":454,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java#L418-L454","documentation":"checkProject(projectId, needsToWrite=false) throws UnauthorizedException when the current user lacks pack read permission (SecurityUtils.canReadPack(project) is false). Resolving/downloading Maven artifacts from the project's repository requires read access to its packages.","triggerScenarios":"mvn/gradle dependency resolution (GET requests through serveBlob) executed by an anonymous visitor or a user whose project role does not include pack read permission.","commonSituations":"Public builds depending on a private project's artifacts; developer not added to the project; anonymous access disabled for packages; dependency resolution running under a machine account without read grants.","solutions":["Grant the consuming user or CI account 'Read pack' permission on the project.","Provide credentials for dependency resolution (settings.xml server entry matching the repository id) instead of anonymous access.","If the artifact should be public, adjust project visibility/permissions to allow read access for the intended audience."],"exampleFix":"// before — anonymous resolution of private repo\n<repository><id>onedev</id><url>https://onedev.example.com/~maven/2</url></repository>\n// after — supply authorized credentials\n<repository>\n  <id>onedev</id>\n  <url>https://onedev.example.com/~maven/2</url>\n</repository>\n<!-- plus settings.xml server 'onedev' with a user having pack read role -->","handlingStrategy":"try-catch","validationCode":"# Probe read access before configuring dependency resolution\nSTATUS=$(curl -s -o /dev/null -w '%{http_code}' -u \"$USER:$TOKEN\" \"$BASE/~maven/1/com/acme/app/1.0.0/app-1.0.0.pom\")\n[ \"$STATUS\" = \"200\" ] || { echo \"no pack read permission (HTTP $STATUS)\"; exit 1; }","typeGuard":null,"tryCatchPattern":"try {\n  resolutionResult = project.dependencies.resolve(...)\n} catch (ResolveException e) {\n  if (e.cause?.message?.contains('No package read permission')) {\n    throw new IllegalStateException(\"Add credentials with pack read role to settings.xml for repo 'onedev'\", e)\n  }\n  throw e\n}","preventionTips":["Give CI and developer groups read-pack roles via group membership, not per-user grants.","Always ship a settings.xml server entry for private OneDev repositories.","Test dependency resolution in CI before merging repository configuration changes."],"tags":["maven","authorization","permissions","dependency-resolution"],"backgroundTag":"insufficient-permissions","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}