{"record":{"id":"c457f572a9c9be14","repo":"theonedev/onedev","slug":"please-login-to-perform-this-query-c457f5","errorCode":null,"errorMessage":"Please login to perform this query","messagePattern":"Please login to perform this query","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/project/OwnedByMeCriteria.java","lineNumber":27,"sourceCode":"\nimport org.jspecify.annotations.Nullable;\n\nimport io.onedev.server.exception.NotAcceptableException;\nimport io.onedev.server.model.Project;\nimport io.onedev.server.model.User;\nimport io.onedev.server.security.SecurityUtils;\nimport io.onedev.server.util.ProjectScope;\n\npublic class OwnedByMeCriteria extends OwnedByCriteria {\n\n\tprivate static final long serialVersionUID = 1L;\n\n\t@Override\n\tpublic Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Project, Project> from, CriteriaBuilder builder) {\n\t\tif (User.get() != null)\n\t\t\treturn new OwnedByUserCriteria(User.get()).getPredicate(projectScope, query, from, builder);\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic User getUser() {\n\t\treturn SecurityUtils.getUser();\n\t}\n\n\t@Override\n\tpublic boolean matches(Project project) {\n\t\tif (User.get() != null)\n\t\t\treturn new OwnedByUserCriteria(User.get()).matches(project);\n\t\telse\n\t\t\tthrow new NotAcceptableException(_T(\"Please login to perform this query\"));\n\t}\n\n\t@Override\n\tpublic String toStringWithoutParens() {\n\t\treturn ProjectQuery.getRuleName(ProjectQueryLexer.OwnedByMe);","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/project/OwnedByMeCriteria.java#L9-L45","documentation":"OneDev's 'owned by me' project search criterion requires an authenticated user to resolve 'me'. When the criterion is evaluated on a server thread with no user bound to the security context (User.get() returns null), it throws a NotAcceptableException with a localized 'Please login to perform this query' message instead of producing an empty or null predicate.","triggerScenarios":"Calling getPredicate on OwnedByMeCriteria (e.g. evaluating a project query containing 'owned by me') from an unauthenticated context such as an anonymous REST/GraphQL call, a scheduled job, or a non-web thread where User.get() is null.","commonSituations":"Anonymous API clients querying with 'owned by me'; integrations calling the query endpoint without session/auth headers; code invoking search outside a request scope (build/CI hooks, background tasks) where the security context is not populated.","solutions":["Authenticate the request (valid session cookie or access token) before issuing a query containing 'owned by me'.","Replace the query criterion with 'owned by \"<username>\"' (OwnedByUserCriteria) when running in a non-interactive context.","In server-side code, run the query within a User.revert/impersonate block so User.get() is non-null.","Catch NotAcceptableException (HTTP 406) and surface a login-required message to the client."],"exampleFix":"// before (unauthenticated client)\nGET /~api/projects?query=owned by me\n// after\nGET /~api/projects?query=owned by \"john\" -H \"Authorization: Bearer <token>\"","handlingStrategy":"try-catch","validationCode":"if (SecurityUtils.getUser() == null && queryText.contains(\"owned by me\")) throw new LoginRequiredException();","typeGuard":"boolean canUseMeCriteria() { return SecurityUtils.getUser() != null; }","tryCatchPattern":"try { projects = projectQueryService.query(...); } catch (NotAcceptableException e) { promptLogin(); }","preventionTips":["Always attach auth (session or access token) to query API calls","Prefer user-explicit criteria like owned by \"user\" in headless code","Check User.get()/SecurityUtils.getUser() before user-relative criteria in server code","Set a test user when unit-testing criteria"],"tags":["authentication","search","http"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}