{"record":{"id":"498c3966f5ffb912","repo":"theonedev/onedev","slug":"no-package-write-permission-for-project-project","errorCode":null,"errorMessage":"No package write permission for project: ${projectPath}","messagePattern":"No package write permission for project: (.+?)","errorType":"http","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java","lineNumber":388,"sourceCode":"\tprivate void writeJson(HttpServletResponse response, Object object) {\n\t\tresponse.setContentType(MediaType.APPLICATION_JSON);\n\t\ttry {\n\t\t\tobjectMapper.writeValue(response.getOutputStream(), object);\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\n\tprivate String getLockName(Long projectId, String name) {\n\t\treturn \"update-pack:\" + projectId + \":\" + TYPE + \":\" + name;\n\t}\n\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement()) {\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\t} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\t} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\t}\n\t\treturn project;\n\t}\n\n\t@Override\n\tpublic String getApiKey(HttpServletRequest request) {\n\t\treturn request.getHeader(HttpHeaders.AUTHORIZATION);\n\t}\n\n\t@Override\n\tpublic List<String> normalize(List<String> pathSegments) {\n\t\treturn pathSegments;\n\t}\n\n\tprivate static class PublishBody {\n","sourceCodeStart":370,"sourceCodeEnd":406,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java#L370-L406","documentation":"Thrown by CargoPackHandler.checkProject when a write operation (publish, yank) is requested but SecurityUtils.canWritePack(project) is false for the current authenticated user. This is an authorization failure (UnauthorizedException), distinct from the feature-disabled check.","triggerScenarios":"Running `cargo publish` or yank with credentials of a user who has only read (or no) package write permission on the project; expired/insufficient access token used as password.","commonSituations":"Using a personal access token without package write scope; user not added to the project with write role; API key belonging to another account configured in cargo credentials.","solutions":["Grant the user package write permission (Project -> Roles / membership with write access)","Generate an access token with package write scope and update ~/.cargo/credentials","Verify cargo is authenticating as the intended user (check registry settings)","If publishing from CI, use a dedicated service account with write pack permission"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// verify token has package write access before publishing\n// ensure Project -> membership grants write, and token scope includes pack write\ncargo publish --dry-run || echo 'fix metadata first'","typeGuard":null,"tryCatchPattern":"try { execSync('cargo publish'); } catch (e) { if (/No package write permission/.test(e.message)) { /* request write access or fix credentials */ } }","preventionTips":["Use dedicated service accounts with correct scopes for CI","Update ~/.cargo/credentials after token rotation","Verify user roles before publishing","Avoid sharing personal tokens"],"tags":["cargo","authorization","permissions","publish"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}