{"record":{"id":"9fc7a9dde7d1d859","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-9fc7a9","errorCode":null,"errorMessage":"\"Please login to perform this query\"","messagePattern":"\"Please login to perform this query\"","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/ToBeMergedByMeCriteria.java","lineNumber":28,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.PullRequest;\nimport io.onedev.server.model.User;\nimport io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class ToBeMergedByMeCriteria extends Criteria<PullRequest> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).getPredicate(projectScope, query, from, builder);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic boolean matches(PullRequest request) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).matches(request);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\t\n\tprivate Criteria<PullRequest> getCriteria(User user) {\n\t\treturn new ToBeMergedByUserCriteria(user);\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn PullRequestQuery.getRuleName(PullRequestQueryLexer.ToBeMergedByMe);","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/ToBeMergedByMeCriteria.java#L10-L46","documentation":"ToBeMergedByMeCriteria.getPredicate() translates the \"to be merged by me\" pull request rule into a JPA predicate. The rule is inherently user-relative; if User.get() is null (anonymous context) it throws NotAcceptableException(\"Please login to perform this query\") because there is no user to filter by.","triggerScenarios":"Executing a pull request query containing \"to be merged by me\" through getPredicate() while the request is unauthenticated or the thread lacks a user context.","commonSituations":"Anonymous dashboard/API queries; saved queries executed by integration scripts without tokens; proxies stripping authentication before OneDev.","solutions":["Authenticate the client (login or access token) before running the query.","Use the explicit \"to be merged by <user>\" rule (ToBeMergedByUserCriteria) instead of \"me\".","Set up an impersonated user context in server-side automation before query evaluation.","Verify auth configuration (SSO/session) so anonymous users cannot submit user-relative queries."],"exampleFix":"// before\nString query = \"to be merged by me\";\n\n// after (API, anonymous-safe)\nString query = \"to be merged by john\"; // or authenticate the request","handlingStrategy":"validation","validationCode":"if (SecurityUtils.getUser() == null) throw new LoginRequiredException(); // client-side pre-check","typeGuard":"var user = SecurityUtils.getUser();\nString query = user != null ? \"to be merged by me\" : \"to be merged by \" + fallbackUserName;","tryCatchPattern":"try { runQuery(\"to be merged by me\"); }\ncatch (NotAcceptableException e) { reauthenticate(); runQuery(\"to be merged by \" + currentUser.getName()); }","preventionTips":["Verify authentication before issuing user-relative queries.","Store queries with explicit usernames in automation, not \"me\".","Refresh expired sessions/tokens before scheduled query runs.","Ensure reverse proxies forward auth headers to OneDev."],"tags":["authentication","query","pull-request"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}