{"record":{"id":"ac925b4817f8315b","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-ac925b","errorCode":null,"errorMessage":"\"Please login to perform this query\"","messagePattern":"\"Please login to perform this query\"","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/ToBeChangedByMeCriteria.java","lineNumber":28,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.PullRequest;\nimport io.onedev.server.model.User;\nimport io.onedev.server.util.ProjectScope;\nimport io.onedev.server.util.criteria.Criteria;\n\npublic class ToBeChangedByMeCriteria extends Criteria<PullRequest> {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).getPredicate(projectScope, query, from, builder);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic boolean matches(PullRequest request) {\n\t\tvar user = User.get();\n\t\tif (user != null) \n\t\t\treturn getCriteria(user).matches(request);\n\t\telse \n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\t\n\tprivate Criteria<PullRequest> getCriteria(User user) {\n\t\treturn new ToBeChangedByUserCriteria(user);\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn PullRequestQuery.getRuleName(PullRequestQueryLexer.ToBeChangedByMe);","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/ToBeChangedByMeCriteria.java#L10-L46","documentation":"OneDev's ToBeChangedByMeCriteria builds a JPA predicate for the \"to be changed by me\" pull request query rule, which requires knowing the current user. When User.get() returns null (no authenticated user in context), the criteria cannot resolve \"me\" and throws NotAcceptableException with \"Please login to perform this query\". It is a guard against evaluating a user-relative query anonymously.","triggerScenarios":"Calling getPredicate() for a pull request query containing the \"to be changed by me\" criterion while no user is bound to the current request/thread context (User.get() == null), e.g. anonymous REST/GraphQL query requests or background threads without a security context.","commonSituations":"Anonymous API access to pull request query endpoints; a scheduled job or webhook handler executing a saved query string containing \"to be changed by me\" without an impersonated user; misconfigured reverse proxy dropping auth headers.","solutions":["Authenticate the request: log in via the web UI or send valid credentials (session cookie or private access token) with the API call.","Replace the \"to be changed by me\" rule in the query with the explicit \"to be changed by <user>\" (ToBeChangedByUser) form naming the user.","Ensure background/scheduled code sets a security context (e.g. run as a specific user) before evaluating the query.","Check server/proxy configuration so anonymous sessions are not presented for endpoints requiring auth."],"exampleFix":"// before: anonymous REST call with user-relative rule\nGET /~api/pull-requests?query=\"to be changed by me\"\n\n// after: explicit user in query or authenticated request\nGET /~api/pull-requests?query=\"to be changed by john\" -H \"Authorization: Bearer <pat>\"","handlingStrategy":"try-catch","validationCode":"if (SecurityUtils.getUser() == null) { throw new IllegalStateException(\"Login required for user-relative query\"); }","typeGuard":"User user = SecurityUtils.getUser();\nif (user == null) return Collections.emptyList();","tryCatchPattern":"try { result = queryPullRequests(\"to be changed by me\"); }\ncatch (NotAcceptableException e) { /* prompt for login / re-authenticate, then retry */ }","preventionTips":["Always send credentials (session cookie or access token) with API calls.","Prefer explicit-user query rules over \"me\" rules in scripts and automation.","Impersonate a user in background threads before running user-relative queries.","Handle session expiry by re-authenticating and retrying once."],"tags":["authentication","query","pull-request","rest"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}