{"record":{"id":"95b083f6fba9921c","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-95b083","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/issue/FieldOperatorCriteria.java","lineNumber":57,"sourceCode":"\tpublic FieldOperatorCriteria(String name, int operator, boolean allowMultiple) {\n\t\tsuper(name);\n\t\tthis.operator = operator;\n\t\tthis.allowMultiple = allowMultiple;\n\t}\n\n\t@Override\n\tprotected Predicate getValuePredicate(From<Issue, Issue> issueFrom, From<IssueField, IssueField> fieldFrom, CriteriaBuilder builder) {\n\t\tPath<?> valueAttribute = fieldFrom.get(IssueField.PROP_VALUE);\n\t\tPath<?> projectAttribute = issueFrom.get(Issue.PROP_PROJECT);\t\t\n\t\tif (operator == IssueQueryLexer.IsEmpty) {\n\t\t\treturn null;\n\t\t} else if (operator == IssueQueryLexer.IsNotEmpty) {\n\t\t\treturn builder.isNotNull(fieldFrom.get(IssueField.PROP_VALUE));\n\t\t} else if (operator == IssueQueryLexer.IsMe) {\n\t\t\tif (User.get() != null) \n\t\t\t\treturn builder.equal(valueAttribute, User.get().getName());\n\t\t\telse \n\t\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t\t} else if (operator == IssueQueryLexer.IsNotMe) {\n\t\t\tif (User.get() != null) {\n\t\t\t\treturn builder.not(builder.equal(valueAttribute, User.get().getName()));\n\t\t\t} else {\n\t\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t\t\t}\n\t\t} else if (operator == IssueQueryLexer.IsCurrent) {\n\t\t\tif (getFieldSpec() instanceof BuildChoiceField) {\n\t\t\t\tBuild build = Build.get();\n\t\t\t\tif (build != null) { \n\t\t\t\t\treturn builder.and(\n\t\t\t\t\t\t\tbuilder.equal(projectAttribute, build.getProject()),\n\t\t\t\t\t\t\tbuilder.equal(valueAttribute, String.valueOf(build.getNumber())));\n\t\t\t\t} else {\n\t\t\t\t\tthrow new ExplicitException(_T(\"No current build in query context\"));\n\t\t\t\t}\n\t\t\t} else if (getFieldSpec() instanceof PullRequestChoiceField) {\n\t\t\t\tPullRequest request = PullRequest.get();","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/issue/FieldOperatorCriteria.java#L39-L75","documentation":"FieldOperatorCriteria.getValuePredicate() handles the '~is me~' operator on issue choice/user fields by comparing the field value to the current user's name. Because it is user-relative, it throws NotAcceptableException('Please login to perform this query') when User.get() is null at query translation time.","triggerScenarios":"Executing an issue query with '~<field> is me~' (e.g. '~assignees is me~', '~fields is me~') via the JPA predicate path while unauthenticated: anonymous REST/GraphQL request, background job, or service call without a user bound.","commonSituations":"Saved queries containing 'is me' executed by CI scripts without tokens; webhook/email integrations running user-authored queries anonymously; dashboards evaluated outside a session.","solutions":["Authenticate the request so User.get() is populated.","Run the query under a specific user context (impersonation/system user) in jobs.","Replace 'is me' with '~is \"username\"~' in queries intended for unauthenticated use.","Catch NotAcceptableException and return an authentication-required error to the client."],"exampleFix":"// before\nString query = \"~assignees is me~\"; // anonymous context -> throws\n\n// after\nString query = User.get() != null ? \"~assignees is me~\" : \"~assignees is \\\"john\\\"~\";","handlingStrategy":"validation","validationCode":"if (User.get() == null) throw new NotAcceptableException(\"Login required for '~is me~' query\");","typeGuard":"boolean canRun = User.get() != null;","tryCatchPattern":"try { issues = queryManager.find(null, query); } catch (NotAcceptableException e) { return Response.status(401).entity(e.getMessage()).build(); }","preventionTips":["Authenticate API clients before executing user-relative operators","Store saved queries with explicit usernames for service accounts","Guard query execution with a User.get() != null check"],"tags":["authentication","onedev","issue-query"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}