{"record":{"id":"d7522622f8708505","repo":"theonedev/onedev","slug":"no-permission-to-access-pull-request","errorCode":null,"errorMessage":"No permission to access pull request: ","messagePattern":"No permission to access pull request: ","errorType":"http","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/ai/TodResource.java","lineNumber":1310,"sourceCode":"\n        var target = new ProjectAndBranch(targetProject, targetBranch);\n        var source = new ProjectAndBranch(sourceProject, sourceBranch);\n\n        var info = new CreatePullRequestEssentialInfo();\n        info.currentProject = currentProject;\n        info.target = target;\n        info.source = source;\n        info.submitter = user;\n\n        return info;\n    }    \n\n    private PullRequest getPullRequest(Project currentProject, String referenceString) {\n        var requestReference = PullRequestReference.of(referenceString, currentProject);\n        var request = pullRequestService.find(requestReference.getProject(), requestReference.getNumber());\n        if (request != null) {\n            if (!SecurityUtils.canReadCode(request.getProject()))\n                throw new UnauthorizedException(\"No permission to access pull request: \" + referenceString);\n            return request;\n        } else {\n            throw new NotFoundException(\"Pull request not found: \" + referenceString);\n        }\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    @Path(\"/edit-pull-request\")\n    @POST\n    public Map<String, Object> editPullRequest(\n                @QueryParam(\"currentProject\") @NotNull String currentProjectPath,\n                @QueryParam(\"reference\") @NotNull String pullRequestReference, @NotNull Map<String, Serializable> data) {\n        var user = SecurityUtils.getUser();\n        if (user == null)\n            throw new UnauthenticatedException();\n\n        var currentProject = getProject(currentProjectPath);\n","sourceCodeStart":1292,"sourceCodeEnd":1328,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/ai/TodResource.java#L1292-L1328","documentation":"The getPullRequest helper resolves a pull request reference (e.g. '#123' or 'project/#123') and, if found, verifies SecurityUtils.canReadCode(request.getProject()). If the user cannot read code in the pull request's project, it throws a JAX-RS UnauthorizedException naming the reference — hiding the PR's existence from unauthorized users.","triggerScenarios":"Any TOD endpoint call (e.g. edit-pull-request) with a reference parameter resolving to an existing pull request whose project the authenticated user cannot read code in.","commonSituations":"Token/user scoped to one project referencing a PR in another; project permission revoked; AI plan referencing PRs from a sibling project.","solutions":["Grant the user 'Read code' permission on the pull request's project.","Reference a pull request within a project the account can access.","Use fully-qualified references only for projects you can read."],"exampleFix":"// before\nvar ref = \"team-b/app#42\"; // no access to team-b/app\n// after\nvar ref = \"team-a/app#17\"; // PR in accessible project","handlingStrategy":"validation","validationCode":"var ref = PullRequestReference.of(referenceString, currentProject);\nvar request = pullRequestService.find(ref.getProject(), ref.getNumber());\nif (request != null && !SecurityUtils.canReadCode(request.getProject()))\n    throw new IllegalStateException(\"No access to \" + ref.getProject().getPath());","typeGuard":null,"tryCatchPattern":"try {\n    var pr = callTodEndpoint(reference);\n} catch (UnauthorizedException e) {\n    if (e.getMessage().startsWith(\"No permission to access pull request\")) {\n        // request project access or skip this PR\n    } else throw e;\n}","preventionTips":["Only reference PRs in projects the account can read code in.","Use fully-qualified references to avoid resolving numbers against the wrong project.","Re-check permissions after role or team changes."],"tags":["permissions","pull-request","authorization","onedev"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}