{"record":{"id":"8e7dff8e88fb3acc","repo":"theonedev/onedev","slug":"no-permission-to-access-issue","errorCode":null,"errorMessage":"No permission to access issue: ","messagePattern":"No permission to access issue: ","errorType":"http","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/ai/TodResource.java","lineNumber":768,"sourceCode":"    @Consumes(MediaType.TEXT_PLAIN)\n    @POST\n    public Map<String, Object> logWork(\n                @QueryParam(\"currentProject\") @NotNull String currentProjectPath, \n                @QueryParam(\"reference\") @NotNull String issueReference, \n                @QueryParam(\"spentHours\") int spentHours, String comment) {\n        if (SecurityUtils.getUser() == null)\n            throw new UnauthenticatedException();\n\n        var currentProject = getProject(currentProjectPath);\n\n        var issue = getIssue(currentProject, issueReference);\n\n        if (!subscriptionService.isSubscriptionActive())\n            throw new NotAcceptableException(\"An active subscription is required for this feature\");\n        if (!issue.getProject().isTimeTracking())\n            throw new NotAcceptableException(\"Time tracking needs to be enabled for the project\");\n        if (!SecurityUtils.canAccessIssue(issue))\n            throw new UnauthorizedException(\"No permission to access issue: \" + issueReference);\n\n        var work = new IssueWork();\n        work.setIssue(issue);\n        work.setUser(SecurityUtils.getUser());\n        work.setMinutes(spentHours * 60);\n        work.setNote(trimToNull(comment));\n        issueWorkService.createOrUpdate(work);\n\n        var workMap = new HashMap<String, Object>();\n        workMap.put(\"minutes\", spentHours * 60);\n        workMap.put(\"note\", comment);\n        workMap.put(\"user\", work.getUser().getName());\n        workMap.put(\"date\", work.getDate());\n        return workMap;\n    }\n\n    @Path(\"/query-pull-requests\")\n    @GET","sourceCodeStart":750,"sourceCodeEnd":786,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/ai/TodResource.java#L750-L786","documentation":"POST /log-work throws UnauthorizedException with 'No permission to access issue: {reference}' when SecurityUtils.canAccessIssue(issue) returns false. The authenticated user exists but lacks permission to view/modify the referenced issue (e.g. not authorized by issue confidentiality or project role).","triggerScenarios":"Calling log-work with a reference to an issue the caller cannot access: issue restricted to certain roles/groups, caller is a guest, or the issue lives in a private project the caller has no role in.","commonSituations":"AI agent acting as a user without project membership; issue marked confidential for a group the user is not in; typo causing the wrong project/issue to resolve; external contributors with limited roles.","solutions":["Grant the calling user a role with access to the project/issue (Project > Access Control)","Remove the confidentiality restriction on the issue or add the user/group to the issue's authorized list","Verify the issue reference and currentProject query params point to the intended issue","Use an access token of a user who has the needed permissions"],"exampleFix":"// before: user 'dev1' has no role in project 'secret'\n// after: Project secret > Access Control > add 'dev1' with Developer role (includes issue read/write)","handlingStrategy":"validation","validationCode":"const issue = await getIssue(project, reference); if (!issue) throw new Error(`Issue ${reference} not accessible by current user`);","typeGuard":null,"tryCatchPattern":"try { await logWork(params); } catch (e) { if (e.status === 403 || /no permission to access issue/i.test(e.message)) requestAccessOrEscalate(reference); else throw e; }","preventionTips":["Verify the calling user can view the issue before logging work","Check issue confidentiality settings against the caller's group membership","Ensure AI agents run under accounts with proper project roles","Double-check the issue reference/project path for typos"],"tags":["permissions","authorization","issues"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}