{"record":{"id":"40efee2e921f7af1","repo":"theonedev/onedev","slug":"not-authorized-40efee","errorCode":null,"errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenAuthorizationResource.java","lineNumber":55,"sourceCode":"\n\tprivate final AccessTokenAuthorizationService accessTokenAuthorizationService;\n\n\tprivate final AuditService auditService;\n\n\t@Inject\n\tpublic AccessTokenAuthorizationResource(AccessTokenAuthorizationService accessTokenAuthorizationService, AuditService auditService) {\n\t\tthis.accessTokenAuthorizationService = accessTokenAuthorizationService;\n\t\tthis.auditService = auditService;\n\t}\n\n\t@Api(order=100, description = \"Get access token authorization of specified id\")\n\t@Path(\"/{authorizationId}\")\n\t@GET\n\tpublic AccessTokenAuthorization getAuthorization(@PathParam(\"authorizationId\") Long authorizationId) {\n\t\tvar authorization = accessTokenAuthorizationService.load(authorizationId);\n\t\tvar owner = authorization.getToken().getOwner();\n\t\tif (!isAdministrator() && !owner.equals(getAuthUser())) \n\t\t\tthrow new UnauthorizedException();\n\t\treturn authorization;\n\t}\n\t\n\t@Api(order=200, description=\"Create access token authorization. Access token owner should have permission to manage authorized project\")\n\t@POST\n\tpublic Long createAuthorization(@NotNull AccessTokenAuthorization authorization) {\n\t\tvar owner = authorization.getToken().getOwner();\n\t\tif (!isAdministrator() && !owner.equals(getAuthUser())) \n\t\t\tthrow new UnauthorizedException();\n\t\tif (!canManageProject(owner.asSubject(), authorization.getProject()))\n\t\t\tthrow new BadRequestException(\"Access token owner should have permission to manage authorized project\");\n\n\t\taccessTokenAuthorizationService.createOrUpdate(authorization);\n\t\tif (!getAuthUser().equals(owner)) {\n\t\t\tvar newAuditContent = VersionedXmlDoc.fromBean(authorization).toXML();\n\t\t\tauditService.audit(null, \"created access token authorization in account \\\"\" + owner.getName() + \"\\\" via RESTful API\", null, newAuditContent);\n\t\t}\n\t\treturn authorization.getId();","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenAuthorizationResource.java#L37-L73","documentation":"GET AccessTokenAuthorizationResource.getAuthorization loads an access token authorization by ID and allows access only if the caller is a server administrator or the owner of the access token the authorization belongs to. Otherwise it throws UnauthorizedException ('Not authorized', HTTP 401).","triggerScenarios":"Fetching an access token authorization whose token owner differs from the authenticated user without administrator privileges — e.g. user 'alice' calling GET /rest/access-tokens-authorizations/42 where the authorization's token is owned by 'bob'.","commonSituations":"Using a personal access token created by a different account; enumerating other users' authorization IDs; CI config switched from an admin token to a non-admin token; an ID copied from a teammate's session.","solutions":["Authenticate with credentials of the token owner, or a user with server administrator role","Use an authorizationId that belongs to the authenticated token's owner","Have an administrator perform cross-user management calls","Check the token's owner before querying its authorizations"],"exampleFix":"// before\n// alice's token fetching bob's authorization id 42 -> 401\nGET /rest/access-tokens-authorizations/42\n// after\n// use bob's token for id 42, or list only your own authorizations\nGET /rest/access-tokens-authorizations","handlingStrategy":"try-catch","validationCode":"// before calling, confirm the authorization belongs to you or you are admin\n// skip IDs you don't own unless isAdmin is true","typeGuard":"function canAccess(authorizationOwner, authUser, isAdmin) {\n  return isAdmin || authorizationOwner === authUser;\n}","tryCatchPattern":"try {\n  const res = await fetch(`/rest/access-tokens-authorizations/${id}`, { headers });\n  if (res.status === 401) throw new UnauthorizedError('Not authorized to view this authorization');\n  return await res.json();\n} catch (e) {\n  if (e instanceof UnauthorizedError) { /* fall back to listing your own authorizations */ }\n}","preventionTips":["Only query authorization IDs returned by your own listing calls","Use an owner/admin token when administering other accounts' authorizations","Never hardcode authorization IDs shared between users"],"tags":["rest","authorization","http-401","access-token"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}