{"record":{"id":"95aa0afaf45db009","repo":"theonedev/onedev","slug":"unauthorized-95aa0a","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/BuildLabelResource.java","lineNumber":33,"sourceCode":"\n@Path(\"/build-labels\")\n@Consumes(MediaType.APPLICATION_JSON)\n@Produces(MediaType.APPLICATION_JSON)\n@Singleton\npublic class BuildLabelResource {\n\n\tprivate final BuildLabelService buildLabelService;\n\n\t@Inject\n\tpublic BuildLabelResource(BuildLabelService buildLabelService) {\n\t\tthis.buildLabelService = buildLabelService;\n\t}\n\t\n\t@Api(order=200, description=\"Create build label\")\n\t@POST\n\tpublic Long createLabel(@NotNull BuildLabel buildLabel) {\n\t\tif (!SecurityUtils.canManageBuild(buildLabel.getBuild()))\n\t\t\tthrow new UnauthorizedException();\n\t\tbuildLabelService.create(buildLabel);\n\t\treturn buildLabel.getId();\n\t}\n\t\n\t@Api(order=300)\n\t@Path(\"/{buildLabelId}\")\n\t@DELETE\n\tpublic Response deleteLabel(@PathParam(\"buildLabelId\") Long buildLabelId) {\n\t\tBuildLabel buildLabel = buildLabelService.load(buildLabelId);\n\t\tif (!SecurityUtils.canManageBuild(buildLabel.getBuild()))\n\t\t\tthrow new UnauthorizedException();\n\t\tbuildLabelService.delete(buildLabel);\n\t\treturn Response.ok().build();\n\t}\n\t\n}\n","sourceCodeStart":15,"sourceCodeEnd":50,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/BuildLabelResource.java#L15-L50","documentation":"OneDev's REST endpoint BuildLabelResource.createLabel throws UnauthorizedException when the authenticated user does not have permission to manage the build being labeled. The guard calls SecurityUtils.canManageBuild(buildLabel.getBuild()); if it returns false the request is rejected before any label is created. This is an authorization check, not an authentication failure.","triggerScenarios":"POST to /rest/builds/labels (the build label collection) with a BuildLabel body whose build the current user cannot manage — e.g. a user with only read access to the project, a non-admin without build-management rights, or an API token scoped to a role lacking the required permission.","commonSituations":"CI scripts using a personal access token with insufficient role; labeling builds in a project the user is only a guest of; org setups where only project admins may manage builds; calling the endpoint with an unauthenticated request after token expiry.","solutions":["Grant the user (or the API token's role) the project permission to manage builds, e.g. 'Manage Build' in the project's role settings.","Verify the request is authenticated with a valid token belonging to the intended user (Authorization header), not anonymous.","Check client code sends the correct build reference in the BuildLabel payload — a wrong build id may point at a project the user cannot manage.","As an admin, adjust the role definitions (Administration > Roles) so the required 'Manage build' privilege is included."],"exampleFix":"// client: check permission before creating a label\n// before: blindly POSTing the label\nrest.post(\"/rest/builds/labels\", label);\n// after: use an account/token whose role has 'Manage Build' on the project\n// or pre-check:\nif (!build.getPermissions().canManage()) {\n    throw new IllegalStateException(\"Need 'Manage Build' permission on project \" + projectKey);\n}","handlingStrategy":"validation","validationCode":"boolean canCreate = userRole.getPermissions().stream()\n    .anyMatch(p -> p.getName().equals(\"MANAGE_BUILD\") && p.getProjectPath().equals(build.getProject().getPath()));\nif (!canCreate) throw new IllegalStateException(\"User lacks Manage Build permission on \" + build.getProject().getPath());","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provision API tokens from accounts whose roles include build management on target projects.","Document required privileges for REST write endpoints in your automation README.","Test permission setup in a staging project before production automation runs.","Catch HTTP 401/403 in clients and log the project path to speed diagnosis."],"tags":["rest","authorization","unauthorized"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}