{"record":{"id":"f4d0b9db1fe2b699","repo":"theonedev/onedev","slug":"no-package-read-permission-for-project-projectp-f4d0b9","errorCode":null,"errorMessage":"No package read permission for project: ${projectPath}","messagePattern":"No package read permission for project: (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-pack-pypi/src/main/java/io/onedev/server/plugin/pack/pypi/PypiPackHandler.java","lineNumber":305,"sourceCode":"\t\treturn null;\n\t}\n\t\n\tprivate void sendResponse(HttpServletResponse response, String content) {\n\t\ttry {\n\t\t\tresponse.getOutputStream().print(content);\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement()) {\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\t} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\t} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\t}\n\t\treturn project;\n\t}\n\n\t@Override\n\tpublic List<String> normalize(List<String> pathSegments) {\n\t\treturn pathSegments;\n\t}\n\n}\n","sourceCodeStart":287,"sourceCodeEnd":316,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-pypi/src/main/java/io/onedev/server/plugin/pack/pypi/PypiPackHandler.java#L287-L316","documentation":"checkProject throws UnauthorizedException when a read operation is requested but the current user lacks ReadPack permission on the project. pip installs from the OneDev PyPI index fail with this error.","triggerScenarios":"Any needsToWrite=false endpoint (pip install from the project's ~pypi/simple index, package listing) by a user failing SecurityUtils.canReadPack.","commonSituations":"Anonymous or low-privilege user installing a private package; CI job in another project without cross-project pack read access; credentials not passed to pip.","solutions":["Grant the user 'Read Pack' permission on the project","Include valid OneDev credentials in pip config (index-url with user:password or keyring)","If the package should be public, enable anonymous pack read for unauthenticated projects"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"var project = projectService.load(projectId);\nif (!SecurityUtils.canReadPack(project)) throw new IllegalStateException('Missing pack read permission on ' + project.getPath());","typeGuard":null,"tryCatchPattern":"try { pipInstall(); } catch (UnauthorizedException e) { configureCredentialsOrRequestAccess(); }","preventionTips":["Configure pip credentials (index-url with user:token or keyring) for private packages","Verify cross-project read access for CI jobs in other projects","Enable anonymous read only when the package is meant to be public"],"tags":["authorization","permissions","pypi"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}