{"record":{"id":"5086046d16373450","repo":"theonedev/onedev","slug":"no-package-write-permission-for-project-project-508604","errorCode":null,"errorMessage":"No package write permission for project: ${projectPath}","messagePattern":"No package write permission for project: (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-pack-nuget/src/main/java/io/onedev/server/plugin/pack/nuget/NugetPackHandler.java","lineNumber":621,"sourceCode":"\t\tversion = encodePath(version);\n\t\treturn baseUrl + \"/package/\" + name + \"/\" + version + \"/\" + name + \".\" + version + \".nupkg\";\n\t}\n\t\n\tprivate void sendResponse(HttpServletResponse response, Object value) {\n\t\ttry {\n\t\t\tresponse.getOutputStream().write(writeJson(value));\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement()) {\n\t\t\tlogger.warn(\"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE);\n\t\t} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\t} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\t}\n\t\treturn project;\n\t}\n\n\t@Override\n\tpublic String getApiKey(HttpServletRequest request) {\n\t\treturn request.getHeader(HEADER_API_KEY);\n\t}\n\t\n\t@Override\n\tpublic List<String> normalize(List<String> pathSegments) {\n\t\treturn pathSegments;\n\t}\n\n}\n","sourceCodeStart":603,"sourceCodeEnd":639,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-nuget/src/main/java/io/onedev/server/plugin/pack/nuget/NugetPackHandler.java#L603-L639","documentation":"checkProject(needsToWrite=true) throws UnauthorizedException when the authenticated user lacks package write permission on the project. The NuGet pack handler enforces SecurityUtils.canWritePack(project) before allowing publish/delete operations.","triggerScenarios":"Publishing (nuget push) or deleting a NuGet package via the pack endpoint while logged in as a user/CI token with only read access to the project's packages.","commonSituations":"CI job using a personal access token or job token without package write role; a contributor with read-only pack access attempting to publish; permission revoked after a role change.","solutions":["Grant the user (or the CI job token) package write permission in the project's access settings.","Use a service account or job token that has been explicitly given pack write access in the CI configuration.","Confirm you are authenticating as the intended account (check the token/API key being sent by nuget push), not a fallback anonymous/limited user."],"exampleFix":"// before: CI token without pack write\nnuget push pkg.nupkg -ApiKey <readOnlyToken>\n// after: grant 'Write' pack permission to the role/job token used by the publish step","handlingStrategy":"validation","validationCode":"# verify the token's user role has Pack Write permission before publish\n# OneDev UI: Project -> Access -> role permissions","typeGuard":null,"tryCatchPattern":"resp = requests.put(upload_url, ...)\nif resp.status_code == 401 and 'No package write permission' in resp.text:\n    fail('CI token lacks pack write permission')","preventionTips":["Grant pack write to the role/service account used by CI before first publish.","Use dedicated publish credentials, not personal tokens that can lose roles.","Audit permissions after role/permission refactors."],"tags":["nuget","authorization","permissions","pack"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}