{"record":{"id":"5cc863a42481f5af","repo":"theonedev/onedev","slug":"unauthorized-5cc863","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/GroupAuthorizationResource.java","lineNumber":47,"sourceCode":"public class GroupAuthorizationResource {\n\n\tprivate final GroupAuthorizationService authorizationService;\n\n\tprivate final AuditService auditService;\n\n\t@Inject\n\tpublic GroupAuthorizationResource(GroupAuthorizationService authorizationService, AuditService auditService) {\n\t\tthis.authorizationService = authorizationService;\n\t\tthis.auditService = auditService;\n\t}\n\n\t@Api(order=100, description = \"Get group authorization of specified id\")\n\t@Path(\"/{authorizationId}\")\n\t@GET\n\tpublic GroupAuthorization getAuthorization(@PathParam(\"authorizationId\") Long authorizationId) {\n\t\tvar authorization = authorizationService.load(authorizationId);\n\t\tif (!SecurityUtils.canManageProject(authorization.getProject()))\n\t\t\tthrow new UnauthorizedException();\n\t\treturn authorization;\n\t}\n\t\n\t@Api(order=200, description=\"Create new group authorization\")\n\t@POST\n\tpublic Long createAuthorization(@NotNull GroupAuthorization authorization) {\n\t\tif (!SecurityUtils.canManageProject(authorization.getProject()))\n\t\t\tthrow new UnauthorizedException();\n\t\tauthorizationService.createOrUpdate(authorization);\n\t\tvar newAuditContent = VersionedXmlDoc.fromBean(authorization).toXML();\n\t\tauditService.audit(authorization.getProject(), \"created group authorization via RESTful API\", null, newAuditContent);\n\t\treturn authorization.getId();\n\t}\n\n\t@Api(order=300, description = \"Delete group authorization of specified id\")\n\t@Path(\"/{authorizationId}\")\n\t@DELETE\n\tpublic Response deleteAuthorization(@PathParam(\"authorizationId\") Long authorizationId) {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/GroupAuthorizationResource.java#L29-L65","documentation":"GET /groupAuthorizations/{authorizationId} throws UnauthorizedException when the authenticated user cannot manage the project the group authorization belongs to. Reading project authorization details is restricted to users with project management permission (SecurityUtils.canManageProject), so ordinary project members get a 401/403.","triggerScenarios":"GET /~api/groupAuthorizations/{id} with a token whose user lacks manage permission (not project owner/maintainer or admin) for authorization.getProject().","commonSituations":"A developer token inspecting group access settings of a project they only have read access to; calling the endpoint after being demoted from project maintainer; wrong project/authorization id picked up from another project's config.","solutions":["Use a token of a user who can manage the project (project owner/maintainer) or an administrator.","Request the required role on the project before querying its authorizations.","Verify the authorizationId belongs to a project you manage — load it via a project-scoped endpoint you can access.","Query with an admin token if this is automation infrastructure."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// ensure caller can manage the project before reading its authorizations\nvar project = authorization.getProject();\nif (!securityUtils.canManageProject(project))\n    throw new IllegalStateException(\"need manage permission on \" + project.getName());","typeGuard":null,"tryCatchPattern":"try { return client.getGroupAuthorization(id); }\ncatch (UnauthorizedException e) { throw new SecurityException(\"token lacks manage permission for this project\", e); }","preventionTips":["Grant automation users the manage-project role for every project they inspect.","Verify role assignments after permission changes or user promotions/demotions.","Prefer admin tokens for read-only authorization audits."],"tags":["rest-api","authorization","project-permissions"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}