{"record":{"id":"c121c3b997658c52","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-c121c3","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pack/PublishedByMeCriteria.java","lineNumber":29,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.Pack;\nimport io.onedev.server.model.User;\nimport io.onedev.server.security.SecurityUtils;\nimport io.onedev.server.util.ProjectScope;\n\npublic class PublishedByMeCriteria extends PublishedByCriteria {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Pack, Pack> from, CriteriaBuilder builder) {\n\t\tif (User.get() != null) {\n\t\t\tPath<User> attribute = from.get(Pack.PROP_USER);\n\t\t\treturn builder.equal(attribute, User.get());\n\t\t} else {\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t\t}\n\t}\n\n\t@Override\n\tpublic User getUser() {\n\t\treturn SecurityUtils.getUser();\n\t}\n\n\t@Override\n\tpublic boolean matches(Pack pack) {\n\t\tif (User.get() != null)\n\t\t\treturn User.get().equals(pack.getUser());\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pack/PublishedByMeCriteria.java#L11-L47","documentation":"PublishedByMeCriteria.getPredicate builds a JPA predicate matching packs published by the current user. If User.get() returns null (no authenticated user in context), it throws NotAcceptableException('Please login to perform this query') because the criterion is inherently user-relative.","triggerScenarios":"Executing a pack query containing 'published by me' while the request is anonymous — no session, expired login, missing API token, or evaluation on a thread without a bound user.","commonSituations":"Anonymous REST access to pack queries; expired browser sessions; CI scripts calling the API without tokens; background jobs running user-relative queries.","solutions":["Authenticate (login or API token) before running the query","Rewrite the criterion as 'published by <specific user>' to avoid current-user dependency","Ensure API clients send Authorization headers on every request","Impersonate/bind a user when evaluating queries in background threads"],"exampleFix":"// before\ncurl http://onedev/api/query/packs?query=\"published by me\"\n// after\ncurl -H \"Authorization: Bearer <token>\" 'http://onedev/api/query/packs?query=published%20by%20me'","handlingStrategy":"type-guard","validationCode":"if (User.get() == null) throw new AuthRequiredError(\"login required for 'published by me' pack query\");","typeGuard":"function isAuthenticated(): boolean { return io.onedev.server.model.User.get() != null; }","tryCatchPattern":"try { runPackQuery(q); } catch (NotAcceptableException e) { if (e.getMessage().contains(\"Please login\")) { reauthenticate(); retry(); } else throw e; }","preventionTips":["Send auth tokens with every pack query API call","Replace 'published by me' with explicit user criteria in scripts","Restore sessions before re-running saved queries"],"tags":["authentication","query","onedev"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}