{"record":{"id":"c3197a4f3e9b8873","repo":"theonedev/onedev","slug":"not-authorized-to-create-project-under-parent-p","errorCode":null,"errorMessage":"Not authorized to create project under '${parent.path}'","messagePattern":"Not authorized to create project under '(.+?)'","errorType":"http","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/ProjectResource.java","lineNumber":357,"sourceCode":"\n\t\tif (!Objects.equals(oldParentId, Project.idOf(parent)))\n\t\t\tcheckProjectCreationPermission(subject, parent);\n\n\t\tif (parent != null && project.isSelfOrAncestorOf(parent))\n\t\t\tthrow new ExplicitException(\"Cannot use current or descendant project as parent\");\n\n\t\tcheckProjectNameDuplication(project);\n\n\t\tprojectService.update(project);\n\t\tauditService.audit(project, \"changed project via RESTful API\", oldAuditContent,\n\t\t\t\tVersionedXmlDoc.fromBean(ProjectData.from(project)).toXML());\n\n\t\treturn Response.ok().build();\n\t}\n\t\n\tprivate void checkProjectCreationPermission(Subject subject, @Nullable Project parent) {\n\t\tif (parent != null && !SecurityUtils.canCreateChildren(subject, parent))\n\t\t\tthrow new UnauthorizedException(\"Not authorized to create project under '\" + parent.getPath() + \"'\");\n\t\tif (parent == null && !SecurityUtils.canCreateRootProjects(subject))\n\t\t\tthrow new UnauthorizedException(\"Not authorized to create root project\");\n\t}\n\t\n\tprivate void checkProjectNameDuplication(Project project) {\n\t\tProject parent = project.getParent();\n\t\tProject projectWithSameName = projectService.find(parent, project.getName());\n\t\tif (projectWithSameName != null && !projectWithSameName.equals(project)) {\n\t\t\tif (parent != null) {\n\t\t\t\tthrow new ExplicitException(\"Name '\" + project.getName() + \"' is already used by another project under '\"\n\t\t\t\t\t\t+ parent.getPath() + \"'\");\n\t\t\t} else {\n\t\t\t\tthrow new ExplicitException(\"Name '\" + project.getName() + \"' is already used by another root project\");\n\t\t\t}\n\t\t}\n\t}\n\t\n\t@Api(order=900, description=\"Update project settings\")","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/ProjectResource.java#L339-L375","documentation":"checkProjectCreationPermission throws UnauthorizedException 'Not authorized to create project under <path>' when a parent is supplied but the subject lacks canCreateChildren on that parent. Both createProject and updateProject (on parent change) route through this check.","triggerScenarios":"POST /rest/projects with parent set, or POST /rest/projects/{id} changing data.parentId, where the user cannot create child projects under the specified parent project.","commonSituations":"Non-member or guest trying to create a subproject in a team area; automation account whose child-creation permission was scoped away; group permission changes after setup.","solutions":["Grant the account permission to create child projects under the parent (project manage/owner or appropriate role)","Create the project under a parent the account is allowed to use","Use null parent with root-project creation rights if a root project suffices"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before creating under a parent, confirm child-creation rights\nif (parentId != null) {\n  const parent = await api.get(`/rest/projects/${parentId}`);\n  if (!userCanCreateChildren(currentUser, parent)) {\n    throw new Error('not allowed to create children under ' + parent.path);\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.post('/rest/projects', payload);\n} catch (e) {\n  if (e.status === 401 && /create project under/.test(e.message)) {\n    // request child-creation grant or choose another parent\n  } else throw e;\n}","preventionTips":["Confirm the account's roles on the parent project before automation","Prefer creating under parents where the account is owner","Re-validate grants after group permission changes","Keep creation targets explicit in configuration, not inferred"],"tags":["rest","authorization","project-hierarchy"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}