{"record":{"id":"7a2b5837d37d3bea","repo":"theonedev/onedev","slug":"not-authorized-7a2b58","errorCode":null,"errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/PackLabelResource.java","lineNumber":34,"sourceCode":"@Api(name=\"Package Label\")\n@Path(\"/package-labels\")\n@Consumes(MediaType.APPLICATION_JSON)\n@Produces(MediaType.APPLICATION_JSON)\n@Singleton\npublic class PackLabelResource {\n\n\tprivate final PackLabelService packLabelService;\n\n\t@Inject\n\tpublic PackLabelResource(PackLabelService packLabelService) {\n\t\tthis.packLabelService = packLabelService;\n\t}\n\t\n\t@Api(order=200, description=\"Create package label\")\n\t@POST\n\tpublic Long createLabel(@NotNull PackLabel packLabel) {\n\t\tif (!SecurityUtils.canWritePack(packLabel.getPack().getProject()))\n\t\t\tthrow new UnauthorizedException();\n\t\tpackLabelService.create(packLabel);\n\t\treturn packLabel.getId();\n\t}\n\t\n\t@Api(order=300)\n\t@Path(\"/{packLabelId}\")\n\t@DELETE\n\tpublic Response deleteLabel(@PathParam(\"packLabelId\") Long packLabelId) {\n\t\tPackLabel buildLabel = packLabelService.load(packLabelId);\n\t\tif (!SecurityUtils.canWritePack(buildLabel.getPack().getProject()))\n\t\t\tthrow new UnauthorizedException();\n\t\tpackLabelService.delete(buildLabel);\n\t\treturn Response.ok().build();\n\t}\n\t\n}\n","sourceCodeStart":16,"sourceCodeEnd":51,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/PackLabelResource.java#L16-L51","documentation":"PackLabelResource.createLabel (POST /pack-labels) requires SecurityUtils.canWritePack(project) on the project owning the pack; otherwise it throws UnauthorizedException (HTTP 401). Creating package labels is a write operation on the project's package registry.","triggerScenarios":"POSTing a PackLabel for a pack whose project the authenticated user cannot write to (read-only user, anonymous request, wrong project in payload).","commonSituations":"Publishing pipelines with a read-only deploy token; user promoted to reader only; label automation pointing at the wrong project's packs.","solutions":["Grant the calling user Can Write/Can Manage packages permission on the project","Use a token from a user with write access to the project","Verify packLabel.pack points to a project where you actually have write access"],"exampleFix":"// before\ncurl -u reader:token -X POST -d '{...}' /~api/pack-labels -> 401 Not authorized\n// after\n// grant writer role, then:\ncurl -u writer:token -X POST -d '{...}' /~api/pack-labels -> 200","handlingStrategy":"validation","validationCode":"// verify write access on the pack's project before POSTing\nconst project = getProject(pack.projectId); // caller must hold write access\nif (!userCanWritePackages(user, project)) requestElevation();","typeGuard":null,"tryCatchPattern":"try { createPackLabel(label); } catch (WebApplicationException e) { if (e.getResponse().getStatus() == 401) switchToWriterCredential(); else throw e; }","preventionTips":["Use deploy tokens with package write scope in publish pipelines","Confirm the pack belongs to a project you can write to","Keep publishing credentials separate from read-only ones"],"tags":["rest","authorization","packages","permissions"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}