{"record":{"id":"c8aca9d2f7ad9489","repo":"theonedev/onedev","slug":"no-permission-to-access-report","errorCode":null,"errorMessage":"No permission to access report: ","messagePattern":"No permission to access report: ","errorType":"http","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/ai/TodResource.java","lineNumber":879,"sourceCode":"        var build = getBuild(currentProject, buildReference);\n        return BuildHelper.getDetail(currentProject, build);\n    }\n\n    @Path(\"/get-build-code-problems\")\n    @GET\n    public List<Map<String, Object>> getBuildCodeProblems(\n                @QueryParam(\"currentProject\") @NotNull String currentProjectPath, \n                @QueryParam(\"reference\") @NotNull String buildReference, \n                @QueryParam(\"reportName\") @NotNull String reportName, \n                @QueryParam(\"severityLevel\") @NotNull CodeProblem.Severity severityLevel) {\n        if (SecurityUtils.getUser() == null)\n            throw new UnauthenticatedException();\n\n        var currentProject = getProject(currentProjectPath);\n        var build = getBuild(currentProject, buildReference);\n\n        if (!SecurityUtils.canAccessReport(build, reportName))\n            throw new UnauthorizedException(\"No permission to access report: \" + reportName);\n\n        var report = ProblemReport.readFrom(build, reportName);\n        if (report == null)\n            throw new NotFoundException(\"Code problem report not found: \" + reportName);\n\n        var problems = new ArrayList<Map<String, Object>>();\n        for (var problem: report.getProblems()) {\n            if (problem.getSeverity().ordinal() <= severityLevel.ordinal()) {\n                var problemMap = new HashMap<String, Object>();\n                problemMap.put(\"severity\", problem.getSeverity().name());\n                problemMap.put(\"message\", problem.getMessage());\n                if (problem.getTarget() instanceof BlobTarget blobTarget) {\n                    problemMap.put(\"file\", blobTarget.getGroupKey().getName());\n                    if (blobTarget.getLocation() != null) {\n                        problemMap.put(\"beginLine\", blobTarget.getLocation().getFromRow() + 1);\n                        problemMap.put(\"endLine\", blobTarget.getLocation().getToRow() + 1);\n                    }\n                } else if (problem.getTarget() instanceof ContainerTarget containerTarget) {","sourceCodeStart":861,"sourceCodeEnd":897,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/ai/TodResource.java#L861-L897","documentation":"GET /get-build-code-problems in TodResource throws UnauthorizedException ('No permission to access report: {name}') when SecurityUtils.canAccessReport(build, reportName) is false. The authenticated user can see the build but not this specific report, or lacks permission to the build's reports altogether.","triggerScenarios":"Calling get-build-code-problems with a reportName the user has no report access to, e.g. reports published with restricted authorization, or the user has no permission on the project containing the build.","commonSituations":"AI agent using a low-privileged account; report published with a report authorization config limiting it to certain roles; accessing another project's build via reference; security setting changed after report publication.","solutions":["Grant the user access to the report: adjust the report's authorization (job/report config) or the user's project role","Publish the report without restrictive authorization if it should be visible to all project members","Verify currentProject/reference/reportName resolve to the build and report you intend","Use a token of a user with sufficient permissions on the project"],"exampleFix":"// before: CI job publishes report with authorization limited to Project Owners\n// after: job yaml\npublishReport: 'code-problems/**: !ReportAuthorization\n  # or grant Developer role access to the report'","handlingStrategy":"validation","validationCode":"const reports = await listBuildReports(buildId); if (!reports.some(r => r.name === reportName)) throw new Error(`Report '${reportName}' not accessible on build ${buildId}`);","typeGuard":null,"tryCatchPattern":"try { await getBuildCodeProblems(params); } catch (e) { if (e.status === 403 || /no permission to access report/i.test(e.message)) escalatePermissions(reportName); else throw e; }","preventionTips":["Check report authorization settings in CI job publishReport specs","Verify the agent's user role covers report access on the project","Confirm the build reference belongs to a project the user can access"],"tags":["permissions","reports","authorization"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}