{"record":{"id":"f7e529c21f9fb01e","repo":"theonedev/onedev","slug":"no-package-write-permission-for-project-project-f7e529","errorCode":null,"errorMessage":"No package write permission for project: ${project.path}","messagePattern":"No package write permission for project: (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-pack-gem/src/main/java/io/onedev/server/plugin/pack/gem/GemPackHandler.java","lineNumber":495,"sourceCode":"\t\t}\n\t\treturn null;\n\t}\n\n\t@Override\n\tpublic String getApiKey(HttpServletRequest request) {\n\t\tvar authzHeader = request.getHeader(HttpHeaders.AUTHORIZATION);\n\t\tif (authzHeader != null&& authzHeader.toLowerCase().startsWith(\"bearer \"))\n\t\t\treturn StringUtils.substringAfter(authzHeader, \" \");\n\t\telse\n\t\t\treturn null;\n\t}\n\t\n\tprivate Project checkProject(Long projectId, boolean needsToWrite) {\n\t\tvar project = projectService.load(projectId);\n\t\tif (!project.isPackManagement()) {\n\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Package management not enabled for project '\" + project.getPath() + \"'\");\n\t\t} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package write permission for project: \" + project.getPath());\n\t\t} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {\n\t\t\tthrow new UnauthorizedException(\"No package read permission for project: \" + project.getPath());\n\t\t}\n\t\treturn project;\n\t}\n\n\tprivate UserMarshal getGemVersion(String version) {\n\t\treturn new UserMarshal(\"Gem::Version\", newArrayList(version));\n\t}\n\t\n\tprivate UserMarshal getGemRequirement(Map<String, UserMarshal> requiredVersions) {\n\t\tvar requirements = new ArrayList<>();\n\t\tfor (var entry: requiredVersions.entrySet()) \n\t\t\trequirements.add(newArrayList(entry.getKey(), entry.getValue()));\n\t\tvar value = new ArrayList<>();\n\t\tvalue.add(requirements);\n\t\treturn new UserMarshal(\"Gem::Requirement\", value);\t\n\t}","sourceCodeStart":477,"sourceCodeEnd":513,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-gem/src/main/java/io/onedev/server/plugin/pack/gem/GemPackHandler.java#L477-L513","documentation":"checkProject throws UnauthorizedException when the request needs write access (needsToWrite=true, e.g. publishing a gem) but SecurityUtils.canWritePack(project) is false for the current user. This is an authorization failure, not a feature toggle issue (that is error 1231).","triggerScenarios":"gem push / publish request to GemPackHandler where the authenticated user lacks Pack Write permission on the project: they have read-only or no explicit package role.","commonSituations":"CI job using a job token without pack write scope; developer account added to project with default read-only access; personal access token missing package permissions; wrong project targeted (one you can read but not write).","solutions":["Ask a project admin to grant your user/group 'Write Package' permission under Project -> Permissions.","If pushing from CI, use a job secret/token from a role with pack write access.","Regenerate the personal access token ensuring package write permission is included.","Verify the publish URL targets the project you actually have write access to."],"exampleFix":"// server side: Project -> Permissions -> role -> enable 'Write Package'\n# client side: ensure credentials used by gem push belong to that role\ngem push --host https://user:token@onedev.example.com/~project/gem mygem-1.0.0.gem","handlingStrategy":"validation","validationCode":"// verify effective permission before publishing\n// OneDev UI: Project -> Permissions -> your role has 'Write Package'\n// or use the REST API to list project roles for the current user","typeGuard":null,"tryCatchPattern":"try {\n    gemPush(host, token, gemFile);\n} catch (UnauthorizedException e) {\n    if (String(e).contains('write permission')) throw new SecurityException(\"Request Pack Write permission on the project\", e);\n    throw e;\n}","preventionTips":["Grant CI service accounts dedicated roles with pack write permission.","Use scoped tokens and rotate them before expiry.","Double-check the target project path in publish configs (staging vs production)."],"tags":["package-management","authorization","permissions"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}