{"record":{"id":"f0dadaa5565ad92d","repo":"theonedev/onedev","slug":"authentication-required","errorCode":null,"errorMessage":"Authentication required","messagePattern":"Authentication required","errorType":"exception","errorClass":"UnauthenticatedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/ai/CodeCommentHelper.java","lineNumber":32,"sourceCode":"import org.jspecify.annotations.Nullable;\n\nimport com.fasterxml.jackson.core.type.TypeReference;\nimport com.fasterxml.jackson.databind.ObjectMapper;\n\nimport io.onedev.server.OneDev;\nimport io.onedev.server.model.CodeComment;\nimport io.onedev.server.model.CodeCommentReply;\nimport io.onedev.server.model.CodeCommentStatusChange;\nimport io.onedev.server.security.SecurityUtils;\nimport io.onedev.server.service.CodeCommentReplyService;\nimport io.onedev.server.service.CodeCommentStatusChangeService;\n\npublic class CodeCommentHelper {\n    \n    public static Map<String, Object> addReply(Subject subject, CodeComment comment, String content) {\n        var user = SecurityUtils.getUser(subject);\n        if (user == null)\n            throw new UnauthenticatedException();\n\n        if (!SecurityUtils.canReadCode(subject, comment.getProject()))\n            throw new UnauthorizedException();\n\n        var reply = new CodeCommentReply();\n        reply.setComment(comment);\n        reply.setContent(content);\n        reply.setUser(user);\n        reply.setDate(new Date());\n        reply.setCompareContext(comment.getCompareContext());\n        getCodeCommentReplyService().create(reply);\n\n        return getDetail(reply);\n    }\n\n    public static Map<String, Object> changeStatus(Subject subject, CodeComment comment, \n                boolean resolved, @Nullable String note) {\n        if (!SecurityUtils.canChangeStatus(subject, comment))","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/ai/CodeCommentHelper.java#L14-L50","documentation":"CodeCommentHelper.addReply lets authenticated users reply to code comments via the AI/tool API. If the provided Subject carries no authenticated user, UnauthenticatedException ('Authentication required') is thrown before any reply is created.","triggerScenarios":"Calling addReply with a Subject that has no associated user — e.g. an unauthenticated REST/GraphQL call, a missing/expired access token, or an anonymous session.","commonSituations":"API clients forgetting the Authorization/access token header, expired personal access tokens, or invoking the tool integration without a logged-in session.","solutions":["Authenticate the request: add a valid access token (personal access token) to the API call.","Log in via the web session if using browser-based access, then retry.","Check token expiry and regenerate if it has expired or was revoked."],"exampleFix":"// before\ncurl -X POST https://onedev/api/... # no auth\n// after\ncurl -X POST -H \"Authorization: Bearer <access-token>\" https://onedev/api/...","handlingStrategy":"validation","validationCode":"if (SecurityUtils.getUser(subject) == null)\n    throw new IllegalStateException(\"Authenticate before calling addReply\");","typeGuard":null,"tryCatchPattern":"try {\n    CodeCommentHelper.addReply(subject, comment, content);\n} catch (UnauthenticatedException e) {\n    // prompt for login or refresh/attach an access token, then retry\n}","preventionTips":["Always send a valid access token with API calls.","Refresh tokens before expiry.","Verify the session is authenticated in tool integrations."],"tags":["authentication","security","api"],"backgroundTag":"authentication-required","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}