{"record":{"id":"a2bfa568e03b4ef4","repo":"theonedev/onedev","slug":"you-do-not-have-permission-to-push-to-this-project","errorCode":null,"errorMessage":"You do not have permission to push to this project.","messagePattern":"You do not have permission to push to this project\\.","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/git/GitFilter.java","lineNumber":277,"sourceCode":"\t}\n\t\n\tprivate void checkPullPermission(HttpServletRequest request, Project project) {\n\t\tif (!SecurityUtils.canReadCode(project)) {\n\t\t\tboolean isAuthorized = false;\n\t\t\tfor (CodePullAuthorizationSource source: codePullAuthorizationSources) {\n\t\t\t\tif (source.canPullCode(request, project)) {\n\t\t\t\t\tisAuthorized = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (!isAuthorized)\n\t\t\t\tthrow new UnauthorizedException(\"You do not have permission to pull from this project.\");\n\t\t}\n\t}\n\n\tprivate void checkPushPermission(HttpServletRequest request, Project project) {\n\t\tif (!SecurityUtils.canWriteCode(project)) \n\t\t\tthrow new UnauthorizedException(\"You do not have permission to push to this project.\");\n\t}\n\n\tprivate boolean canAccessProject(HttpServletRequest request, Project project) {\n\t\tif (!SecurityUtils.canAccessProject(project)) {\n\t\t\tfor (CodePullAuthorizationSource source: codePullAuthorizationSources) {\n\t\t\t\tif (source.canPullCode(request, project)) \n\t\t\t\t\treturn true;\n\t\t\t}\n\t\t\treturn false;\n\t\t} else {\n\t\t\treturn true;\n\t\t}\n\t}\n\t\n\tprotected void processRefs(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {\n\t\tString service = request.getParameter(\"service\");\n\t\tboolean upload = service.contains(\"upload\");\n\t\t","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/git/GitFilter.java#L259-L295","documentation":"checkPushPermission rejects git push (receive-pack) requests when SecurityUtils.canWriteCode(project) is false. Only users/identities with code write permission on the project may push refs over git HTTP; everyone else receives this UnauthorizedException.","triggerScenarios":"git push / git-receive-pack to a project where the authenticated identity lacks the 'Write code' (or admin) permission in the project's role configuration.","commonSituations":"Pushing with a read-only token; developer role lacks write permission after role changes; CI trying to push tags/commits with a pull-only credential; protected-branch configs aside, this fires before any ref-level checks.","solutions":["Have a project admin grant your role 'Write code' permission","Switch to an access token created from a user with write permission","If pushing from CI, use a job token/secret authorized to write code","Confirm you are pushing to the intended project and not a read-only mirror"],"exampleFix":"// before: read-only token\nremote.origin.url=https://oauth2:ro-token@onedev.example.com/myproject.git\n\n// after: token from user with 'Write code'\ngit remote set-url origin https://oauth2:<rw-token>@onedev.example.com/myproject.git","handlingStrategy":"try-catch","validationCode":"if (!userRoles.some(r => r.includes('Write code'))) {\n  throw new Error('Your role lacks code write permission; push will be rejected');\n}","typeGuard":null,"tryCatchPattern":"try {\n  git.push();\n} catch (UnauthorizedException e) {\n  if (e.getMessage().contains(\"permission to push\")) {\n    log.error('Insufficient write permission on project; request role change');\n  }\n}","preventionTips":["Confirm write permission before automated pushes (tags, releases)","Avoid read-only tokens for push operations","Audit role configurations after project permission changes"],"tags":["git","authorization","push","onedev"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}