{"record":{"id":"3a7157e172a46f21","repo":"theonedev/onedev","slug":"no-permission-to-access-build-referencestring","errorCode":null,"errorMessage":"No permission to access build: ${referenceString}","messagePattern":"No permission to access build: (.+?)","errorType":"exception","errorClass":"org.apache.shiro.authz.UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/ai/TodResource.java","lineNumber":1804,"sourceCode":"            }\n            if (validationErrors.isEmpty()) {\n                return Response.ok(VersionedYamlDoc.fromBean(buildSpec).toYaml()).build();\n            } else {\n                return Response.status(NOT_ACCEPTABLE).entity(Joiner.on(\"\\n\").join(validationErrors) + schemaNotice).build();\n            }\n        } catch (Exception e) {\n            return Response.status(NOT_ACCEPTABLE).entity(Throwables.getStackTraceAsString(e) + schemaNotice).build();\n\t\t} finally {\n\t\t\tProject.pop();\n\t\t}\n    }\n\n    private Build getBuild(Project currentProject, String referenceString) {\n        var buildReference = BuildReference.of(referenceString, currentProject);\n        var build = buildService.find(buildReference.getProject(), buildReference.getNumber());\n        if (build != null) {\n            if (!SecurityUtils.canAccessProject(build.getProject()))\n                throw new UnauthorizedException(\"No permission to access build: \" + referenceString);\n            return build;\n        } else {\n            throw new NotFoundException(\"Build not found: \" + referenceString);\n        }\n    }\n    \n    private void normalizePullRequestData(Map<String, Serializable> data) {\n        for (var entry : data.entrySet()) {\n            if (entry.getValue() instanceof String)\n                entry.setValue(trimToNull((String) entry.getValue()));\n        }\n    }    \n\n    private static class ProjectContext {\n        \n        Project project;\n\n        Project currentProject;","sourceCodeStart":1786,"sourceCodeEnd":1822,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/ai/TodResource.java#L1786-L1822","documentation":"getBuild resolves a build reference (like '#123' or 'project/#123') and then checks SecurityUtils.canAccessProject on the build's project. If the build exists but the current user lacks access to that project, UnauthorizedException is thrown with the reference string embedded.","triggerScenarios":"Calling any TodResource tool that takes a build reference where the referenced build's project is not accessible to the authenticated user (private project, non-member, guest role without access).","commonSituations":"AI agents referencing builds in another project the user cannot see; users whose project membership was revoked; cross-project build references in shared chat sessions.","solutions":["Ask an administrator to grant the user appropriate access to the referenced build's project.","Use a build reference within a project the current user can access.","Check the user's project permissions in OneDev administration (Project -> Members/Roles) before retrying."],"exampleFix":"// before\nBuild b = getBuild(currentProject, \"other-secret-project/#42\"); // user has no access\n// after\nBuild b = getBuild(currentProject, currentProject.getPath() + \"/#42\"); // accessible project","handlingStrategy":"try-catch","validationCode":"// only reference builds in projects the user can access\nconst accessible = await listAccessibleProjects(user);\nif (!accessible.includes(refProject)) throw new Error(\"No permission to access project of build \" + ref);","typeGuard":null,"tryCatchPattern":"try { return getBuild(ref); } catch (e) { if (/No permission to access build/.test(e.message)) { notifyUser(\"Request access to the build's project first\"); } throw e; }","preventionTips":["Check project membership before referencing cross-project builds","Keep AI agents scoped to projects the invoking user can access","Document required roles for tools that resolve build references"],"tags":["authorization","permission","rest-api"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}