{"record":{"id":"9d1003f9e107b311","repo":"theonedev/onedev","slug":"no-permission-to-add-specified-link-for-specified-9d1003","errorCode":null,"errorMessage":"No permission to add specified link for specified issues","messagePattern":"No permission to add specified link for specified issues","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/IssueLinkResource.java","lineNumber":55,"sourceCode":"\n\t@Api(order=100)\n\t@Path(\"/{linkId}\")\n\t@GET\n\tpublic IssueLink getLink(@PathParam(\"linkId\") Long linkId) {\n\t\tvar link = linkService.load(linkId);\n\t\tif (!canAccessIssue(link.getTarget()) && !canAccessIssue(link.getSource()))\n\t\t\tthrow new UnauthorizedException();\n\t\treturn link;\n\t}\n\t\n\t@Api(order=200, description=\"Create new issue link\")\n\t@POST\n\tpublic Long createLink(@NotNull IssueLink link) {\n\t\tif (!canAccessIssue(link.getSource()) || !canAccessIssue(link.getTarget()))\n\t\t\tthrow new UnauthorizedException(\"No permission to access specified issues\");\n\t\tif (!canEditIssueLink(link.getSource().getProject(), link.getSpec())\n\t\t\t\t|| !canEditIssueLink(link.getTarget().getProject(), link.getSpec())) {\n\t\t\tthrow new UnauthorizedException(\"No permission to add specified link for specified issues\");\n\n\t\t}\n\t\tlink.validate();\n\t\t\t\t\t\t\n\t\tlinkService.create(link);\n\t\treturn link.getId();\n\t}\n\t\n\t@Api(order=300)\n\t@Path(\"/{linkId}\")\n\t@DELETE\n\tpublic Response deleteLink(@PathParam(\"linkId\") Long linkId) {\n\t\tvar link = linkService.load(linkId);\n\t\tif (!canEditIssueLink(link.getSource().getProject(), link.getSpec()) \n\t\t\t\t&& !canEditIssueLink(link.getTarget().getProject(), link.getSpec())) {\n\t\t\tthrow new UnauthorizedException();\n\t\t}\n\t\tlinkService.delete(link);","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/IssueLinkResource.java#L37-L73","documentation":"createLink separately checks that the user has permission to edit issue links (canEditIssueLink) on both the source and target issue's projects for the given link spec. If either check fails it throws UnauthorizedException(\"No permission to add specified link for specified issues\"). Access to the issues alone is not enough: editing links requires the project's 'Edit Issue Links' permission or link-spec authorization.","triggerScenarios":"POST /~api/issueLinks where both issues are readable but the authenticated user lacks the edit-issue-links permission on source.getProject() or target.getProject(), or the link spec restricts which projects/roles may create links of that type.","commonSituations":"Reporter-level users trying to link issues across projects they can only read; link specification (e.g. 'is duplicated by') restricted to certain roles; cross-project links where the user has manage rights on one project but not the other.","solutions":["Ask a project admin to grant your account the permission to edit issue links on both projects.","Create the link via the web UI as a user who has the permission.","Use an admin token for automation that links issues across projects.","Check the link spec's permitted operations — some link types restrict who can create them."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// require edit-issue-links permission on both projects\nif (!canEditIssueLink(sourceProject, spec) || !canEditIssueLink(targetProject, spec))\n    throw new IllegalStateException(\"token lacks edit-issue-links permission on both projects\");","typeGuard":null,"tryCatchPattern":"try { client.createIssueLink(link); }\ncatch (UnauthorizedException e) { throw new SecurityException(\"Ask admin for 'edit issue links' permission on \" + sourceProject + \" and \" + targetProject, e); }","preventionTips":["Grant the service account edit-issue-links rights on all projects involved in cross-project links.","Review the link spec's role restrictions in project settings.","Separate read-access errors from edit-permission errors by matching the exception message."],"tags":["rest-api","issues","authorization","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}