{"record":{"id":"a5cc02e7dd118af2","repo":"theonedev/onedev","slug":"no-package-read-permission-for-project-project-a5cc02","errorCode":null,"errorMessage":"No package read permission for project: ${project.getPath()}","messagePattern":"No package read permission for project: (.+?)","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-plugin/server-plugin-pack-helm/src/main/java/io/onedev/server/plugin/pack/helm/HelmPackHandler.java","lineNumber":261,"sourceCode":"            }));\n        } else {\n            throw new ClientException(SC_METHOD_NOT_ALLOWED, \"Method not allowed\");\n        }\n    }\n\n    @Override\n    public String getApiKey(HttpServletRequest request) {\n        return null;\n    }\n\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement()) {\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\t} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\t} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\t}\n\t\treturn project;\n\t}\n\n\tprivate String getDownloadUrl(Pack pack) {\n\t\treturn String.format(\"/%s/~helm/%s-%s.tgz\",\n\t\t\t\tpack.getProject().getPath(), pack.getName(), pack.getVersion());\n\t}\n\n\t@Override\n\tpublic List<String> normalize(List<String> pathSegments) {\n        pathSegments = new ArrayList<>(pathSegments);\n        if (pathSegments.get(pathSegments.size() - 1).equals(\"charts\")) {\n            pathSegments.remove(pathSegments.size() - 1);\n            if (pathSegments.get(0).equals(\"api\")) \n                pathSegments.remove(0);\n        }        \n\t\treturn pathSegments;","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-helm/src/main/java/io/onedev/server/plugin/pack/helm/HelmPackHandler.java#L243-L279","documentation":"checkProject throws UnauthorizedException when a read operation (download/lookup) is requested and SecurityUtils.canReadPack(project) is false — the authenticated user cannot read packages in the project.","triggerScenarios":"GET/HEAD of a chart from /~helm by an anonymous or insufficiently-privileged user; helm/curl clients without credentials accessing a private project's packages.","commonSituations":"Pulling charts in CI without configuring credentials for a private registry, users removed from the project, or public reads attempted against a project with restricted pack read access.","solutions":["Configure the client with credentials of an account that can read the project's packages (e.g. helm repo add with username/password)","Grant the user read-pack permission via project roles","If the chart should be public, enable public/read access or move it to a project with public packages","Check that the CI job token has read access to the target project"],"exampleFix":"// before (anonymous)\nhelm repo add onedev https://server/my-project/~helm\n// after\nhelm repo add onedev https://server/my-project/~helm --username <user> --password <token>","handlingStrategy":"validation","validationCode":"// configure client credentials and verify read access first\nvar resp = GET /api/projects/{path} with basic auth\nif (resp.status == 401) throw new SecurityException(\"credentials lack pack read access\");","typeGuard":null,"tryCatchPattern":"try { pullChart(); } catch (UnauthorizedException e) { log.error(\"no pack read permission: {}\", e.getMessage()); configureCredentials(); }","preventionTips":["Always pass credentials when accessing private project packages","Grant consumers read-pack roles","Make packages public only deliberately"],"tags":["helm","authorization","permissions","download"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}