{"record":{"id":"366fcd817a47cd5d","repo":"theonedev/onedev","slug":"no-permission-to-edit-pull-request","errorCode":null,"errorMessage":"No permission to edit pull request: ","messagePattern":"No permission to edit pull request: ","errorType":"http","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/ai/TodResource.java","lineNumber":1332,"sourceCode":"        }\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    @Path(\"/edit-pull-request\")\n    @POST\n    public Map<String, Object> editPullRequest(\n                @QueryParam(\"currentProject\") @NotNull String currentProjectPath,\n                @QueryParam(\"reference\") @NotNull String pullRequestReference, @NotNull Map<String, Serializable> data) {\n        var user = SecurityUtils.getUser();\n        if (user == null)\n            throw new UnauthenticatedException();\n\n        var currentProject = getProject(currentProjectPath);\n\n        var request = getPullRequest(currentProject, pullRequestReference);\n\n        if (!SecurityUtils.canModifyPullRequest(request))\n            throw new UnauthorizedException(\"No permission to edit pull request: \" + pullRequestReference);\n\n        normalizePullRequestData(data);\n\n        var title = (String) data.remove(\"title\");\n        if (title != null) \n            pullRequestChangeService.changeTitle(user, request, title);\n\n        if (data.containsKey(\"description\")) \n            pullRequestChangeService.changeDescription(user, request, (String) data.remove(\"description\"));\n\n        var labelNames = (List<String>) data.remove(\"labels\");\n        if (labelNames != null) {\n            try {\n                pullRequestLabelService.sync(request, labelNames);\n            } catch (EntityNotFoundException e) {\n                throw new NotFoundException(e.getMessage());\n            }\n        }","sourceCodeStart":1314,"sourceCodeEnd":1350,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/ai/TodResource.java#L1314-L1350","documentation":"After authentication and PR lookup, editPullRequest checks SecurityUtils.canModifyPullRequest(request). If the authenticated user lacks permission to modify the pull request, it throws a JAX-RS UnauthorizedException naming the pull request reference. Editing (title, description, reviewers, assignees, etc.) is limited to authorized users such as the submitter or project maintainers.","triggerScenarios":"POST to edit-pull-request with a valid reference for a PR the authenticated user is not allowed to modify (not submitter, not maintainer, lacks write/modify permission on the project).","commonSituations":"Service account trying to edit another user's PR; user has read-only role on the project; group permission change removed modify rights; editing PRs in a project managed by another team.","solutions":["Grant the user modify permission on the pull request's project (project > access control, e.g. 'Manage pull requests' / write role).","Have the PR submitter or a project maintainer perform the edit.","Authenticate as a user with maintainer rights on that project."],"exampleFix":"// before\n// read-only account calls edit endpoint -> 403\n// after\n// use a token from a user with \"Can manage pull requests\" on the project\ncurl -X POST -H \"Authorization: Bearer <maintainer-token>\" '.../edit-pull-request?reference=team-a/app#42' ...","handlingStrategy":"validation","validationCode":"var request = pullRequestService.find(ref.getProject(), ref.getNumber());\nif (!SecurityUtils.canModifyPullRequest(request))\n    throw new IllegalStateException(\"User \" + SecurityUtils.getUser().getName() + \" cannot modify \" + referenceString);","typeGuard":null,"tryCatchPattern":"try {\n    callEditEndpoint(reference, data);\n} catch (UnauthorizedException e) {\n    if (e.getMessage().startsWith(\"No permission to edit pull request\")) {\n        // escalate to a maintainer or re-authenticate with a privileged account\n    } else throw e;\n}","preventionTips":["Grant automation accounts the minimum roles that include PR-modify rights.","Check canModifyPullRequest client-side before attempting edits.","Restrict edit operations to the submitter or designated maintainers in your tooling."],"tags":["permissions","pull-request","authorization","onedev"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}