{"record":{"id":"1565be692308b2d4","repo":"theonedev/onedev","slug":"not-authorized-1565be","errorCode":null,"errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/PullRequestCommentResource.java","lineNumber":45,"sourceCode":"@Path(\"/pull-request-comments\")\n@Consumes(MediaType.APPLICATION_JSON)\n@Produces(MediaType.APPLICATION_JSON)\n@Singleton\npublic class PullRequestCommentResource {\n\n\t@Inject\n\tprivate Dao dao;\n\n\t@Inject\n\tprivate PullRequestCommentService commentService;\n\n\t@Api(order=100)\n\t@Path(\"/{commentId}\")\n\t@GET\n\tpublic PullRequestComment get(@PathParam(\"commentId\") Long commentId) {\n\t\tPullRequestComment comment = commentService.load(commentId);\n    \tif (!SecurityUtils.canReadCode(comment.getProject()))  \n\t\t\tthrow new UnauthorizedException();\n    \treturn comment;\n\t}\n\t\n\t@Api(order=200, description=\"Create new pull request comment\")\n\t@POST\n\tpublic Long create(@NotNull PullRequestComment comment) {\n    \tif (!SecurityUtils.canReadCode(comment.getProject()) \n\t\t\t\t|| !SecurityUtils.isAdministrator() && !comment.getUser().equals(SecurityUtils.getUser())) {\n\t\t\tthrow new UnauthorizedException();\n\t\t}\n\n\t\tcommentService.create(comment, new ArrayList<>());\n\t\t\n\t\treturn comment.getId();\n\t}\n\n\t@Api(order=250, description=\"Update pull request comment of specified id\")\n\t@Path(\"/{commentId}\")","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/PullRequestCommentResource.java#L27-L63","documentation":"UnauthorizedException thrown by PullRequestCommentResource.get when the authenticated user cannot read code of the project owning the pull request comment. Reading a comment requires Can Read Code on its project.","triggerScenarios":"GET /pull-request-comments/{commentId} by a user whose role on the comment's project does not include code-read access.","commonSituations":"Accessing comments on a private project's pull request with a public-only account; token from a user not added to the project; project visibility changed to private after the client cached the URL.","solutions":["Grant the user read access to the project (Can Read Code) or use a member account.","Verify the commentId belongs to a project the token's user can access.","Check project authorization settings / login state of the access token."],"exampleFix":"// before\ncurl -u outsider:token /api/pull-request-comments/1001  // private project\n// after\ncurl -u member:token /api/pull-request-comments/1001","handlingStrategy":"validation","validationCode":"PullRequestComment comment = commentService.load(commentId);\nif (!SecurityUtils.canReadCode(comment.getProject())) {\n    throw new SecurityException(\"No code-read access to project \" + comment.getProject().getPath());\n}","typeGuard":null,"tryCatchPattern":"try { getComment(commentId); } catch (UnauthorizedException e) { log.warn(\"Cannot read comment \" + commentId + \": access denied\"); }","preventionTips":["Only query comments on projects the token user can read","Check project visibility/membership before accessing nested resources","Update tokens after team membership changes"],"tags":["rest-api","authorization","pull-request"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}