{"record":{"id":"2cf9b12cdcce55a5","repo":"theonedev/onedev","slug":"unauthorized-2cf9b1","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/BaseAuthorizationResource.java","lineNumber":48,"sourceCode":"public class BaseAuthorizationResource {\n\n\tprivate final BaseAuthorizationService authorizationService;\n\n\tprivate final AuditService auditService;\n\n\t@Inject\n\tpublic BaseAuthorizationResource(BaseAuthorizationService authorizationService, AuditService auditService) {\n\t\tthis.authorizationService = authorizationService;\n\t\tthis.auditService = auditService;\n\t}\n\n\t@Api(order=100, description = \"Get base authorization of specified id\")\n\t@Path(\"/{authorizationId}\")\n\t@GET\n\tpublic BaseAuthorization getAuthorization(@PathParam(\"authorizationId\") Long authorizationId) {\n\t\tvar authorization = authorizationService.load(authorizationId);\n\t\tif (!SecurityUtils.canManageProject(authorization.getProject()))\n\t\t\tthrow new UnauthorizedException();\n\t\treturn authorization;\n\t}\n\t\n\t@Api(order=200, description=\"Create base authorization\")\n\t@POST\n\tpublic Long createAuthorization(@NotNull BaseAuthorization authorization) {\n\t\tif (!SecurityUtils.canManageProject(authorization.getProject()))\n\t\t\tthrow new UnauthorizedException();\n\t\tauthorizationService.create(authorization);\n\t\tvar newAuditContent = VersionedXmlDoc.fromBean(authorization).toXML();\n\t\tauditService.audit(authorization.getProject(), \"created base authorization via RESTful API\", null, newAuditContent);\n\t\treturn authorization.getId();\n\t}\n\n\t@Api(order=300, description = \"Delete base authorization of specified id\")\n\t@Path(\"/{authorizationId}\")\n\t@DELETE\n\tpublic Response deleteAuthorization(@PathParam(\"authorizationId\") Long authorizationId) {","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/BaseAuthorizationResource.java#L30-L66","documentation":"Thrown by BaseAuthorizationResource.getAuthorization when the caller cannot manage the project that the requested base authorization belongs to. Viewing project authorizations is restricted to users with project management permission.","triggerScenarios":"GET /base-authorizations/{authorizationId} by a user without canManageProject on the authorization's project; anonymous request.","commonSituations":"Auditing project roles with a non-manager account; authorization id belongs to a project the user merely contributes to; project management rights recently revoked.","solutions":["Grant the user Project Management permission on the target project","Use credentials of a project manager or server administrator","Verify the authorizationId belongs to the intended project"],"exampleFix":"// before\n# user lacks manage permission on project\ncurl -u dev:token .../base-authorizations/7\n// after\ncurl -u manager:token .../base-authorizations/7","handlingStrategy":"try-catch","validationCode":"if (!canManageProject(tokenUser, projectIdOf(authId))) throw new Error('project management permission required');","typeGuard":"function canManageProject(u, projectId) { return u?.managedProjectIds?.includes(projectId); }","tryCatchPattern":"try { getAuthorization(id); } catch (e) { if (/Unauthorized/i.test(e.message)) { throw new Error('Use a project manager credential to view base authorizations'); } throw e; }","preventionTips":["Restrict authorization audit scripts to manager accounts","Map which tokens belong to project managers","Check the authorization's project before querying"],"tags":["rest","auth","authorization","project"],"backgroundTag":"insufficient-permissions","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}