{"record":{"id":"21a58e245965755a","repo":"theonedev/onedev","slug":"invalid-access-token-0","errorCode":null,"errorMessage":"Invalid access token: {0}","messagePattern":"Invalid access token: (.+?)","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/job/JobAuthorizationContext.java","lineNumber":67,"sourceCode":"\t\t\t\t\tJobMatchContext targetContext = new JobMatchContext(request.getTargetProject(), request.getTargetBranch(), null, null);\n\t\t\t\t\treturn jobMatch.matches(sourceContext) && jobMatch.matches(targetContext);\n\t\t\t\t} else {\n\t\t\t\t\treturn false;\t\t\t\t\t\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\treturn jobMatch.matches(new JobMatchContext(project, null, commitId, null));\n\t\t\t}\n\t\t} else {\n\t\t\treturn true;\n\t\t}\n\t}\n\t\n\tpublic Subject getSubject(@Nullable String accessTokenSecret) {\n\t\tif (accessTokenSecret != null) {\n\t\t\tString secretValue = getSecretValue(accessTokenSecret);\n\t\t\tvar accessToken = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue);\n\t\t\tif (accessToken == null)\n\t\t\t\tthrow new ExplicitException(MessageFormat.format(_T(\"Invalid access token: {0}\"), secretValue));\n\t\t\treturn accessToken.asSubject();\n\t\t} else {\n\t\t\treturn SecurityUtils.asAnonymous();\n\t\t}\n\t}\n\n\tpublic String getSecretValue(String secretName) {\n\t\tif (secretName.startsWith(SecretInput.LITERAL_VALUE_PREFIX)) {\n\t\t\treturn secretName.substring(SecretInput.LITERAL_VALUE_PREFIX.length());\n\t\t} else {\n\t\t\tfor (JobSecret secret: project.getHierarchyJobSecrets()) {\n\t\t\t\tif (secret.getName().equals(secretName)) {\n\t\t\t\t\tString authorization = secret.getAuthorization();\n\t\t\t\t\tif (authorization == null) {\n\t\t\t\t\t\treturn normalizeSecretValue(secret.getValue());\n\t\t\t\t\t} else {\n\t\t\t\t\t\tJobMatch jobMatch = JobMatch.parse(authorization, false, false);\n\t\t\t\t\t\tif (request != null) {","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/job/JobAuthorizationContext.java#L49-L85","documentation":"Thrown by JobAuthorizationContext.getSubject when an access token is supplied (as a job secret reference or literal) but AccessTokenService.findByValue finds no matching token in the database. The token secret resolved via getSecretValue does not correspond to any existing access token. Thrown as ExplicitException with the secret value embedded.","triggerScenarios":"A job uses a secret whose value is an access token, but the token was deleted, rotated, or mistyped — getSubject(accessTokenSecret) resolves the secret string and fails the DB lookup.","commonSituations":"Access token revoked/deleted by an admin while jobs still reference it; copy-paste error in a literal token value; token belongs to a different OneDev instance; token regenerated with a new value.","solutions":["Verify the access token still exists under user profile > Access Tokens and recreate it if deleted","Update the job secret value with the current token","Confirm the secret name in the job matches an existing project job secret","Check you are pointing at the correct OneDev instance (tokens are instance-local)"],"exampleFix":"// before: token deleted\n// secret value: \"old-token-abc\"\n// after: regenerate token and update secret\n// secret value: \"newly-generated-token-xyz\"\nvar token = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue);\nif (token == null) throw new ExplicitException(\"Configure a valid access token in job secrets\");","handlingStrategy":"validation","validationCode":"// before running the job, confirm the token exists\nvar token = OneDev.getInstance(AccessTokenService.class).findByValue(secretValue);\nif (token == null) throw new IllegalStateException(\"Access token referenced by job secret no longer exists\");","typeGuard":null,"tryCatchPattern":"try {\n    var subject = authContext.getSubject(accessTokenSecret);\n} catch (ExplicitException e) {\n    // prompt admin to regenerate token and update the secret\n}","preventionTips":["Audit access tokens referenced by job secrets when rotating them","Use named job secrets instead of inline literal tokens","Alert on token deletion when pipelines depend on it"],"tags":["authentication","access-token","secrets"],"backgroundTag":"invalid-access-token","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}