{"record":{"id":"dbc73b89eec2f144","repo":"theonedev/onedev","slug":"no-package-read-permission-for-project-project","errorCode":null,"errorMessage":"No package read permission for project: ${project.path}","messagePattern":"No package read permission for project: (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-pack-container/src/main/java/io/onedev/server/plugin/pack/container/ContainerServlet.java","lineNumber":522,"sourceCode":"\tprivate Digest parseDigest(String digestString) {\n\t\tif (digestString.startsWith(\"sha256:\")) {\n\t\t\treturn new Digest(SHA256, digestString.substring(\"sha256:\".length()));\n\t\t} else {\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, ErrorCode.UNSUPPORTED, \n\t\t\t\t\t\"Unsupported digest: \" + digestString);\n\t\t}\n\t}\n\t\n\tprivate Project checkProject(String projectPath, boolean needsToPush) {\n\t\tvar project = projectService.findByPath(projectPath);\n\t\tif (project == null) \n\t\t\tthrow new NotFoundException(ErrorCode.NAME_UNKNOWN, \"Unknown project: \" + projectPath);\n\t\telse if (!project.isPackManagement())\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, ErrorCode.DENIED, \"Package management not enabled for project: \" + projectPath);\n\t\telse if (needsToPush && !SecurityUtils.canWritePack(project))\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\telse if (!needsToPush && !SecurityUtils.canReadPack(project))\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\telse\n\t\t\treturn project;\n\t}\n\n\tprivate String getChallenge() {\n\t\tvar serverUrl = settingService.getSystemSetting().getServerUrl();\n\t\treturn \"Bearer realm=\\\"\" + serverUrl + \"/v2/token\\\",service=\\\"onedev\\\",scope=\\\"*\\\"\";\n\t}\n\t\n}\n","sourceCodeStart":504,"sourceCodeEnd":533,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-container/src/main/java/io/onedev/server/plugin/pack/container/ContainerServlet.java#L504-L533","documentation":"When the registry operation requires pull rights and the authenticated user lacks pack read permission, checkProject throws UnauthorizedException. This blocks docker pull and any read-only registry API access for accounts without pack read access.","triggerScenarios":"docker pull / manifest or blob GET requests where the user is authenticated but has no pack read permission on the project.","commonSituations":"Anonymous or low-privilege CI token pulling from a private project's registry; user removed from the project; pulling from another user's private project; expired membership/role change.","solutions":["Grant the user pack read permission on the project.","If the project is meant to be public, enable public pack read access in project settings.","Re-login with credentials for an account that has read access."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// confirm read access before pulling\nif (!userCanReadPack(projectPath)) { requestAccess(projectPath); }","typeGuard":null,"tryCatchPattern":"try { pull() } catch (e) { if (e instanceof UnauthorizedException && /read permission/.test(e.message)) { requestPackReadAccess(); } else { throw e; } }","preventionTips":["Grant pack read to the roles/groups that need to pull (e.g. CI readers, deploy groups).","Keep project membership current when people change teams.","Use shared deploy credentials for pipelines that only pull."],"tags":["container-registry","authorization","permissions"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}