{"record":{"id":"676e674b36c6ec58","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-676e67","errorCode":null,"errorMessage":"\"Please login to perform this query\"","messagePattern":"\"Please login to perform this query\"","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/WatchedByMeCriteria.java","lineNumber":29,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.PullRequest;\nimport io.onedev.server.model.User;\nimport io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class WatchedByMeCriteria extends Criteria<PullRequest> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).getPredicate(projectScope, query, from, builder);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic boolean matches(PullRequest request) {\n\t\tvar user = User.get();\n\t\tif (user != null)\n\t\t\treturn getCriteria(user).matches(request);\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\t\n\tprivate Criteria<PullRequest> getCriteria(User user) {\n\t\treturn new WatchedByUserCriteria(user);\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn PullRequestQuery.getRuleName(WatchedByMe);","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/WatchedByMeCriteria.java#L11-L47","documentation":"WatchedByMeCriteria.getPredicate() builds the predicate for the \"watched by me\" pull request rule, resolving \"me\" via User.get(). When no user is authenticated, it throws NotAcceptableException(\"Please login to perform this query\") because watching is a per-user relationship.","triggerScenarios":"Executing a pull request query with the \"watched by me\" criterion through getPredicate() in an unauthenticated request or user-less thread.","commonSituations":"Anonymous API access; integration scripts running saved queries without tokens; auth proxy misconfiguration dropping identity headers.","solutions":["Authenticate the request (login or private access token) before querying.","Use \"watched by <user>\" (WatchedByUserCriteria) with an explicit user in the query.","Set a security context for background jobs that must run user-relative queries.","Fix proxy/SSO configuration so the user identity reaches OneDev."],"exampleFix":"// before\nquery = \"watched by me\"; // anonymous call fails\n\n// after\nquery = \"watched by john\"; // and/or send Authorization header","handlingStrategy":"validation","validationCode":"if (SecurityUtils.getUser() == null) throw new LoginRequiredException();","typeGuard":"var user = SecurityUtils.getUser();\nString query = user != null ? \"watched by me\" : \"watched by \" + explicitUser;","tryCatchPattern":"try { result = query(\"watched by me\"); }\ncatch (NotAcceptableException e) { reauthenticateAndRetry(); }","preventionTips":["Authenticate before running watch-related queries.","Use \"watched by <user>\" in scripts and CI jobs.","Impersonate a user for background query evaluation.","Fix auth-proxy configurations that strip identity headers."],"tags":["authentication","query","pull-request","watch"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}