{"record":{"id":"78046ba55573efef","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-78046b","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"exception","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/issue/MentionedMeCriteria.java","lineNumber":36,"sourceCode":"import io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class MentionedMeCriteria extends Criteria<Issue> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Issue, Issue> from, CriteriaBuilder builder) {\n\t\tif (User.get() != null) {\n\t\t\tSubquery<IssueMention> mentionQuery = query.subquery(IssueMention.class);\n\t\t\tRoot<IssueMention> mention = mentionQuery.from(IssueMention.class);\n\t\t\tmentionQuery.select(mention);\n\t\t\tmentionQuery.where(builder.and(\n\t\t\t\t\tbuilder.equal(mention.get(IssueMention.PROP_ISSUE), from),\n\t\t\t\t\tbuilder.equal(mention.get(IssueMention.PROP_USER), User.get())));\n\t\t\treturn builder.exists(mentionQuery);\n\t\t} else {\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t\t}\n\t}\n\n\t@Override\n\tpublic boolean matches(Issue issue) {\n\t\tif (User.get() != null)\n\t\t\treturn issue.getMentions().stream().anyMatch(it->it.getUser().equals(User.get()));\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn IssueQuery.getRuleName(IssueQueryLexer.MentionedMe);\n\t}\n\n}\n","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/issue/MentionedMeCriteria.java#L18-L54","documentation":"MentionedMeCriteria.getPredicate builds a JPA predicate matching issues where the current user was mentioned. When User.get() returns null (no authenticated user in the request context), it throws NotAcceptableException with 'Please login to perform this query' because the criterion is meaningless without a user.","triggerScenarios":"Executing/evaluating an issue query containing 'mentioned by me' (MentionedMe criteria) in a context with no logged-in user, e.g. anonymous REST query or a job without user context.","commonSituations":"Anonymous API calls to issue query endpoints using '~me' style criteria; scheduled jobs or webhooks running without an authenticated session executing saved queries containing mentioned-by-me.","solutions":["Authenticate the request (login or valid API session token) before running the query.","Send Authorization credentials on REST calls instead of calling anonymously.","Rewrite the saved query to use an explicit user instead of 'me' for unauthenticated contexts.","Catch NotAcceptableException and return 406 prompting login."],"exampleFix":"// before\ncurl http://server/api/issues?query=\"mentioned by me\"\n// after\ncurl -H \"Authorization: Bearer <token>\" http://server/api/issues?query=\"mentioned by me\"","handlingStrategy":"validation","validationCode":"// Ensure authenticated before running me-based queries\nif (SecurityUtils.getUser() == null)\n    throw new NotAcceptableException(\"Please login to perform this query\");","typeGuard":"// Narrow to authenticated user\nUser currentUser = User.get();\nif (currentUser == null) {\n    // cannot evaluate me-based criteria\n    return null;\n}","tryCatchPattern":"// catch on query execution\ntry {\n    List<Issue> issues = query.find();\n} catch (NotAcceptableException e) {\n    response.setStatus(406);\n    response.getWriter().write(\"Login required\");\n}","preventionTips":["Always send API tokens for REST issue queries using 'me' criteria.","Avoid '~me' style criteria in queries used by anonymous pages or jobs.","Redirect unauthenticated users to login before running me-based searches."],"tags":["authentication","query-context","issue-search"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}