{"record":{"id":"915eec2bcc36d8f8","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-915eec","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/MentionedMeCriteria.java","lineNumber":28,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.PullRequest;\nimport io.onedev.server.model.User;\nimport io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class MentionedMeCriteria extends Criteria<PullRequest> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).getPredicate(projectScope, query, from, builder);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic boolean matches(PullRequest request) {\n\t\tvar user = User.get();\n\t\tif (user != null)\n\t\t\treturn getCriteria(user).matches(request);\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\t\n\tprivate Criteria<PullRequest> getCriteria(User user) {\n\t\treturn new MentionedUserCriteria(user);\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn PullRequestQuery.getRuleName(PullRequestQueryLexer.MentionedMe);","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/MentionedMeCriteria.java#L10-L46","documentation":"MentionedMeCriteria.getPredicate() builds a DB predicate for pull requests where the current user was mentioned via MentionedUserCriteria. Because 'mentioned me' is user-relative, anonymous requests (User.get() == null) throw NotAcceptableException 'Please login to perform this query'.","triggerScenarios":"Evaluating a pull request query containing 'mentioned me' on the DB/predicate path without an authenticated user.","commonSituations":"Anonymous REST calls, guests clicking a bookmarked query link with '~mentioned me', integrations that strip the session cookie.","solutions":["Add valid credentials (session or access token) to the request.","Replace 'me' with an explicit username in the query text.","For anonymous-capable pages, detect the guest state and swap in a user-independent query."],"exampleFix":"// before\nquery: \"mentioned\" is \"me\"   // 406 for guests\n// after\nquery: \"mentioned\" is \"bob\"","handlingStrategy":"validation","validationCode":"const isGuest = User.get() == null;\nconst q = isGuest ? 'mentioned is (\"bob\")' : 'mentioned is me';","typeGuard":"function requireAuthenticatedUser() { if (User.get() == null) throw new NotAcceptableException(\"login required\"); return User.get(); }","tryCatchPattern":"try { evaluateQuery(q); } catch (NotAcceptableException e) { swapToAnonymousQuery(); }","preventionTips":["Gate 'mentioned me' queries behind authenticated routes.","Escape user input when composing mention criteria.","Add integration tests that run queries both logged-in and anonymously."],"tags":["onedev","query","authentication","pull-request"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}