{"record":{"id":"b5db35287b285959","repo":"theonedev/onedev","slug":"no-package-read-permission-for-project-projectp","errorCode":null,"errorMessage":"No package read permission for project: ${projectPath}","messagePattern":"No package read permission for project: (.+?)","errorType":"http","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java","lineNumber":390,"sourceCode":"\t\ttry {\n\t\t\tobjectMapper.writeValue(response.getOutputStream(), object);\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\n\tprivate String getLockName(Long projectId, String name) {\n\t\treturn \"update-pack:\" + projectId + \":\" + TYPE + \":\" + name;\n\t}\n\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement()) {\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\t} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\t} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\t}\n\t\treturn project;\n\t}\n\n\t@Override\n\tpublic String getApiKey(HttpServletRequest request) {\n\t\treturn request.getHeader(HttpHeaders.AUTHORIZATION);\n\t}\n\n\t@Override\n\tpublic List<String> normalize(List<String> pathSegments) {\n\t\treturn pathSegments;\n\t}\n\n\tprivate static class PublishBody {\n\n\t\tprivate final byte[] metadata;\n","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java#L372-L408","documentation":"Thrown by CargoPackHandler.checkProject when a read operation (download crate, fetch index) is requested but SecurityUtils.canReadPack(project) is false for the current user. An authorization failure raised before any package content is served.","triggerScenarios":"Running `cargo fetch`/build against the registry while logged in as a user lacking package read permission on the project, or anonymously on a private project.","commonSituations":"CI jobs using a token without read access; developer not added to the project; anonymous pulls against a project that requires login; wrong project path in the index URL giving access to a project the user can't read.","solutions":["Grant the user/team package read permission on the project","Configure credentials in ~/.cargo/credentials or the registry section of .cargo/config.toml","Ensure the CI token has read scope for packages","Verify the index URL points at the project you are authorized for"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// ensure authenticated user can read packs on the target project\n// check membership/role in OneDev UI or via API before cargo fetch","typeGuard":null,"tryCatchPattern":"try { execSync('cargo fetch'); } catch (e) { if (/No package read permission/.test(e.message)) { /* fix credentials or request access */ } }","preventionTips":["Configure registry credentials in .cargo/config.toml / credentials file","Grant CI tokens read package scope","Confirm anonymous access policy for the project","Verify the project path in index URL"],"tags":["cargo","authorization","permissions","registry"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}