theonedev/onedev · error · UnauthorizedException

Access denied

Error message

Access denied

What it means

addReply throws UnauthorizedException ('Access denied') when the authenticated user exists but lacks read access to the code of the project the comment belongs to. This is an authorization check, not authentication.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/CodeCommentHelper.java:35

import com.fasterxml.jackson.databind.ObjectMapper;

import io.onedev.server.OneDev;
import io.onedev.server.model.CodeComment;
import io.onedev.server.model.CodeCommentReply;
import io.onedev.server.model.CodeCommentStatusChange;
import io.onedev.server.security.SecurityUtils;
import io.onedev.server.service.CodeCommentReplyService;
import io.onedev.server.service.CodeCommentStatusChangeService;

public class CodeCommentHelper {
    
    public static Map<String, Object> addReply(Subject subject, CodeComment comment, String content) {
        var user = SecurityUtils.getUser(subject);
        if (user == null)
            throw new UnauthenticatedException();

        if (!SecurityUtils.canReadCode(subject, comment.getProject()))
            throw new UnauthorizedException();

        var reply = new CodeCommentReply();
        reply.setComment(comment);
        reply.setContent(content);
        reply.setUser(user);
        reply.setDate(new Date());
        reply.setCompareContext(comment.getCompareContext());
        getCodeCommentReplyService().create(reply);

        return getDetail(reply);
    }

    public static Map<String, Object> changeStatus(Subject subject, CodeComment comment, 
                boolean resolved, @Nullable String note) {
        if (!SecurityUtils.canChangeStatus(subject, comment))
            throw new UnauthorizedException();
            
        if (comment.isResolved() != resolved) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user at least code-read permission on the project (project role/permission settings).
2. Verify the comment's project and use an account/token with access to that project.
3. If the project is public-expected, check project visibility settings.

if (!SecurityUtils.canReadCode(subject, comment.getProject()))
    throw new IllegalStateException("User lacks code read access to project " + comment.getProject().getPath());

try {
    CodeCommentHelper.addReply(subject, comment, content);
} catch (UnauthorizedException e) {
    // request project access or use an account with code-read permission
}

When it happens

Trigger: Calling addReply as a valid user who cannot read the target project's code (SecurityUtils.canReadCode returns false), e.g. non-member or guest role without code read permission.

Common situations: Users replying to comments in private projects they are not members of, role changes that removed code-read permission, or using a token scoped to a different project.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• No permission to update issue title

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/f153af8763aae142. Report an issue: GitHub.