{"record":{"id":"428b7689f1be5f90","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-428b76","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/codecomment/MentionedMeCriteria.java","lineNumber":36,"sourceCode":"import io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class MentionedMeCriteria extends Criteria<CodeComment> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<CodeComment, CodeComment> from, CriteriaBuilder builder) {\n\t\tif (User.get() != null) {\n\t\t\tSubquery<CodeCommentMention> mentionQuery = query.subquery(CodeCommentMention.class);\n\t\t\tRoot<CodeCommentMention> mention = mentionQuery.from(CodeCommentMention.class);\n\t\t\tmentionQuery.select(mention);\n\t\t\tmentionQuery.where(builder.and(\n\t\t\t\t\tbuilder.equal(mention.get(CodeCommentMention.PROP_COMMENT), from),\n\t\t\t\t\tbuilder.equal(mention.get(CodeCommentMention.PROP_USER), User.get())));\n\t\t\treturn builder.exists(mentionQuery);\n\t\t} else {\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t\t}\n\t}\n\n\t@Override\n\tpublic boolean matches(CodeComment comment) {\n\t\tif (User.get() != null)\n\t\t\treturn comment.getMentions().stream().anyMatch(it->it.getUser().equals(User.get()));\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn CodeCommentQuery.getRuleName(CodeCommentQueryLexer.MentionedMe);\n\t}\n\n}\n","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/codecomment/MentionedMeCriteria.java#L18-L54","documentation":"MentionedMeCriteria.getPredicate() builds an EXISTS subquery over CodeCommentMention for comments mentioning the current user. When User.get() is null (no authenticated user), it throws NotAcceptableException \"Please login to perform this query\" because 'me' is unresolvable.","triggerScenarios":"Executing a code comment query containing MentionedMe while unauthenticated — anonymous REST/UI search requests, or server-side query evaluation with no security context.","commonSituations":"Shared/saved queries with MentionedMe run via unauthenticated API access; expired sessions; background services evaluating user-authored queries.","solutions":["Authenticate the request (login or valid API token) before executing the query.","Replace MentionedMe with Mentioned(\"<user name>\") in queries evaluated outside a user session.","Check SecurityUtils.getUser() != null before executing me-based queries and short-circuit with a login prompt.","Catch NotAcceptableException on the client and redirect to the login page."],"exampleFix":"// before\nvar query = CodeCommentQuery.parse(project, \"MentionedMe\", true);\n// executed anonymously -> 406\n// after\nif (SecurityUtils.getUser() == null)\n    throw new NotAcceptableException(\"Please login to perform this query\");\nvar query = CodeCommentQuery.parse(project, \"MentionedMe\", true);","handlingStrategy":"try-catch","validationCode":"// before executing a MentionedMe query\nif (SecurityUtils.getUser() == null)\n    throw new NotAcceptableException(\"Please login to perform this query\");","typeGuard":"static boolean hasCurrentUser() {\n    return User.get() != null;\n}","tryCatchPattern":"try {\n    var predicate = new MentionedMeCriteria().getPredicate(projectScope, query, from, builder);\n} catch (NotAcceptableException e) {\n    redirectToLogin(); // HTTP 406 -> prompt authentication\n}","preventionTips":["Authenticate API requests that execute saved queries containing MentionedMe.","Use Mentioned(\"<user name>\") for queries evaluated without a session.","Check User.get() before executing me-based criteria.","Handle 406 responses by re-authenticating on REST clients."],"tags":["authentication","search-query","http-406"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}