{"record":{"id":"a83651ae91e42af6","repo":"theonedev/onedev","slug":"no-package-write-permission-for-project-project-a83651","errorCode":null,"errorMessage":"No package write permission for project: ${project.getPath()}","messagePattern":"No package write permission for project: (.+?)","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java","lineNumber":434,"sourceCode":"\t\t\t\t\t\t\t\tpackBlobReferenceService.delete(blobReference);\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tresponse.setStatus(SC_CREATED);\n\t\t\t\t}));\n\t\t\t}\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\t\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement())\n\t\t\tthrow new HttpResponseAwareException(SC_NOT_ACCEPTABLE, \"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\telse if (needsToWrite && !SecurityUtils.canWritePack(project))\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\telse if (!needsToWrite && !SecurityUtils.canReadPack(project))\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\treturn project;\n\t}\n\t\n\tprivate String getName(String groupId, @Nullable String artifactId) {\n\t\tif (artifactId == null)\n\t\t\tartifactId = NONE;\n\t\treturn groupId + \":\" + artifactId;\n\t}\n\t\n\tprivate List<Pack> queryByGAWithV(Project project, String groupId, String artifactId) {\n\t\tvar criteria = EntityCriteria.of(Pack.class);\n\t\tcriteria.add(Restrictions.eq(PROP_PROJECT, project));\n\t\tcriteria.add(Restrictions.eq(PROP_TYPE, TYPE));\n\t\tcriteria.add(Restrictions.eq(PROP_NAME, getName(groupId, artifactId)));\n\t\tcriteria.add(Restrictions.not(Restrictions.eq(PROP_VERSION, NONE)));\n\t\treturn packService.query(criteria);","sourceCodeStart":416,"sourceCodeEnd":452,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java#L416-L452","documentation":"checkProject(projectId, needsToWrite=true) throws UnauthorizedException when the current user lacks pack write permission (SecurityUtils.canWritePack(project) is false). Uploading/publishing Maven artifacts requires write access to the project's packages.","triggerScenarios":"mvn deploy / gradle publish or any PUT to the Maven pack endpoint performed by an anonymous user or a user whose role in the project (or group) does not grant pack write permission.","commonSituations":"CI job token without write role; user added to project with read-only role; permission changes revoking pack write; wrong credentials configured in settings.xml/gradle.properties.","solutions":["Grant the user (or the CI job's account) 'Write pack' / 'Manage pack' permission in Project > Access Control / role assignment.","Verify credentials in ~/.m2/settings.xml (server id, username, password/token) belong to an account with write access.","For CI, use a job secret/token tied to a role that includes pack write permission."],"exampleFix":"// before (settings.xml) — no credentials for the OneDev server\n<server><id>onedev</id></server>\n// after\n<server>\n  <id>onedev</id>\n  <username>ci-bot</username>\n  <password>${env.ONEDEV_TOKEN}</password>\n</server>  <!-- ci-bot has pack write role -->","handlingStrategy":"try-catch","validationCode":"# Probe write access before a real deploy\nSTATUS=$(curl -s -o /dev/null -w '%{http_code}' -u \"$USER:$TOKEN\" \"$BASE/~maven/1/com/acme/probe/0.0.1/probe-0.0.1.jar.sha1\" -T /dev/null)\n[ \"$STATUS\" != \"401\" ] && [ \"$STATUS\" != \"403\" ] || { echo 'no pack write permission'; exit 1; }","typeGuard":null,"tryCatchPattern":"try {\n  mvn deploy -s settings.xml\n} catch (UnauthorizedException | MavenDeployException e) {\n  if (e.getMessage().contains(\"No package write permission\")) {\n    throw new IllegalStateException(\"CI account lacks pack write role on project; grant it or use a service account\", e);\n  }\n  throw e;\n}","preventionTips":["Create a dedicated CI service account with pack write role and rotate its token regularly.","Match the settings.xml server id to the repository id exactly.","Review role changes before revoking permissions used by pipelines."],"tags":["maven","authorization","permissions","upload"],"backgroundTag":"insufficient-permissions","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}