{"record":{"id":"15c2bea616428082","repo":"theonedev/onedev","slug":"no-package-read-permission-for-project-projectp-15c2be","errorCode":null,"errorMessage":"No package read permission for project: ${projectPath}","messagePattern":"No package read permission for project: (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-pack-nuget/src/main/java/io/onedev/server/plugin/pack/nuget/NugetPackHandler.java","lineNumber":623,"sourceCode":"\t}\n\t\n\tprivate void sendResponse(HttpServletResponse response, Object value) {\n\t\ttry {\n\t\t\tresponse.getOutputStream().write(writeJson(value));\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement()) {\n\t\t\tlogger.warn(\"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE);\n\t\t} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\t} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\t}\n\t\treturn project;\n\t}\n\n\t@Override\n\tpublic String getApiKey(HttpServletRequest request) {\n\t\treturn request.getHeader(HEADER_API_KEY);\n\t}\n\t\n\t@Override\n\tpublic List<String> normalize(List<String> pathSegments) {\n\t\treturn pathSegments;\n\t}\n\n}\n","sourceCodeStart":605,"sourceCodeEnd":639,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-nuget/src/main/java/io/onedev/server/plugin/pack/nuget/NugetPackHandler.java#L605-L639","documentation":"checkProject(needsToWrite=false) throws UnauthorizedException when the authenticated user lacks package read permission on the project. Any NuGet pack query/download operation requires SecurityUtils.canReadPack(project).","triggerScenarios":"Searching, listing, or downloading NuGet packages from a project the user has no package read access to (anonymous request, or token of another user without pack read role).","commonSituations":"nuget restore in CI using a token that lacks read access to the dependency's project; a developer accessing a package from another team's restricted project; package source URL pointing at a project the user cannot see.","solutions":["Grant the user/CI token package read permission on the source project.","Update the nuget source URL/credentials in nuget.config to a project the current account can access.","Check that the request is actually authenticated (missing API key leads to anonymous evaluation, which fails on private projects)."],"exampleFix":"// before: nuget.config without credentials for private source\n// after: add credentials of an account with pack read permission, or grant read in OneDev UI","handlingStrategy":"validation","validationCode":"# ensure nuget.config includes credentials for a user with pack read access\nnuget sources list  # confirm source + credentials configured","typeGuard":null,"tryCatchPattern":"try { restore(); } catch (HttpRequestException e) when (e.StatusCode == HttpStatusCode.Unauthorized) {\n    log(\"Grant pack read permission or add credentials\");\n}","preventionTips":["Add package source credentials to nuget.config / CI secret store for private feeds.","Confirm restore jobs run with an authenticated account, not anonymous.","Verify read access when moving packages across projects."],"tags":["nuget","authorization","permissions","read-access"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}