{"record":{"id":"70471aa7b8efccac","repo":"theonedev/onedev","slug":"not-authorized-to-create-project-under-0","errorCode":null,"errorMessage":"Not authorized to create project under \"{0}\"","messagePattern":"Not authorized to create project under \"(.+?)\"","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/service/impl/DefaultProjectService.java","lineNumber":564,"sourceCode":"\t\tList<String> names = Splitter.on(\"/\").omitEmptyStrings().trimResults().splitToList(path);\n\t\tProject project = null;\n\t\tfor (String name : names) {\n\t\t\tProject child;\n\t\t\tif (project == null || !project.isNew()) {\n\t\t\t\t// Query database directly instead of calling findByName to fix issue \n\t\t\t\t// #923 - Multi level projects after import and 1dev upgrade are mingled\n\t\t\t\tEntityCriteria<Project> criteria = EntityCriteria.of(Project.class);\n\t\t\t\tif (project != null)\n\t\t\t\t\tcriteria.add(Restrictions.eq(Project.PROP_PARENT, project));\n\t\t\t\telse\n\t\t\t\t\tcriteria.add(Restrictions.isNull(Project.PROP_PARENT));\n\t\t\t\tcriteria.add(Restrictions.eq(Project.PROP_NAME, name));\n\t\t\t\tchild = find(criteria);\n\t\t\t\tif (child == null) {\n\t\t\t\t\tif (project == null && !SecurityUtils.canCreateRootProjects(subject))\n\t\t\t\t\t\tthrow new UnauthorizedException(_T(\"Not authorized to create root project\"));\n\t\t\t\t\tif (project != null && !SecurityUtils.canCreateChildren(subject, project))\n\t\t\t\t\t\tthrow new UnauthorizedException(MessageFormat.format(_T(\"Not authorized to create project under \\\"{0}\\\"\"), project.getPath()));\n\t\t\t\t\tchild = new Project();\n\t\t\t\t\tchild.setName(name);\n\t\t\t\t\tchild.setParent(project);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tchild = new Project();\n\t\t\t\tchild.setName(name);\n\t\t\t\tchild.setParent(project);\n\t\t\t}\n\t\t\tproject = child;\n\t\t}\n\n\t\tProject parent = project.getParent();\n\t\twhile (parent != null && parent.isNew()) {\n\t\t\tparent.setCodeManagement(false);\n\t\t\tparent.setIssueManagement(false);\n\t\t\tparent = parent.getParent();\n\t\t}","sourceCodeStart":546,"sourceCodeEnd":582,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/service/impl/DefaultProjectService.java#L546-L582","documentation":"OneDev throws this UnauthorizedException when a user attempts to create a child project under an existing parent project without the 'Create Children' permission on that parent. In DefaultProjectService.setup, when walking the path, if the parent project exists, the child name is not found, and SecurityUtils.canCreateChildren(subject, project) returns false, the error is thrown with the parent's path interpolated into the message.","triggerScenarios":"Calling ProjectService.setup with a path like 'parent/child' where 'parent' exists, 'child' does not, and the authenticated subject lacks 'Create Children' (manage) permission on the parent project.","commonSituations":"A user without maintainer/manage rights on a parent project tries to add a sub-project via REST API or UI; CI automation tokens lacking write access to the namespace try to create child projects; permission scope on the parent was narrowed (e.g. moved from a group with create rights).","solutions":["Ask the parent project's maintainer/admin to grant the user the 'Create Children' permission on that project.","Create the child project under a parent where the user already has the required permission.","Have an administrator create the child project and share it with the user.","If done via API/token, ensure the token's owner has the necessary permission on the parent."],"exampleFix":"// before\ncurl -X POST -u user:pass -H 'Content-Type: application/json' \\\n  -d '{\"name\":\"restricted-parent/child\"}' https://onedev.example.com/api/projects\n// after: user granted 'Create Children' on 'restricted-parent', same call succeeds","handlingStrategy":"try-catch","validationCode":"// Pre-check: does the caller have manage rights on the parent project?\nvar parentPath = projectName.substring(0, projectName.lastIndexOf('/'));\nvar parent = projectService.findByPath(parentPath);\nif (parent != null && !securityUtils.canCreateChildren(subject, parent)) {\n    throw new IllegalStateException(\"No 'Create Children' permission on \" + parentPath);\n}","typeGuard":"function canCreateChildrenIn(subject, parentProject) {\n  return parentProject != null &&\n    subject.getAuthorizedProjects().stream()\n      .anyMatch(a -> a.getProject().getId().equals(parentProject.getId())\n        && a.getRole().implies(ProjectPrivileges.MANAGE));\n}","tryCatchPattern":"try {\n    projectService.setup(subject, parentPath + \"/\" + childName);\n} catch (UnauthorizedException e) {\n    logger.warn(\"Cannot create child under {}: {}\", parentPath, e.getMessage());\n    // prompt user to request access or choose another parent\n}","preventionTips":["Verify maintainer/manage permission on the parent project before scripted child creation","Keep permission groups consistent when moving or renaming parent projects","Use tokens whose owner has the required parent-project permission","Check the project's access/permission page before bulk-creating sub-projects"],"tags":["authorization","permissions","project-creation","onedev"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}