theonedev/onedev · error · BadRequestException

Access token owner should have permission to manage authoriz

Error message

Access token owner should have permission to manage authorized project

What it means

In AccessTokenAuthorizationResource.createAuthorization, after the caller-vs-owner check, the endpoint requires that the access token's owner has manage permission on the project being authorized. If owner.asSubject() cannot manage authorization.getProject(), a BadRequestException with this message (HTTP 400) is thrown and nothing is persisted.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenAuthorizationResource.java:66

	@Api(order=100, description = "Get access token authorization of specified id")
	@Path("/{authorizationId}")
	@GET
	public AccessTokenAuthorization getAuthorization(@PathParam("authorizationId") Long authorizationId) {
		var authorization = accessTokenAuthorizationService.load(authorizationId);
		var owner = authorization.getToken().getOwner();
		if (!isAdministrator() && !owner.equals(getAuthUser())) 
			throw new UnauthorizedException();
		return authorization;
	}
	
	@Api(order=200, description="Create access token authorization. Access token owner should have permission to manage authorized project")
	@POST
	public Long createAuthorization(@NotNull AccessTokenAuthorization authorization) {
		var owner = authorization.getToken().getOwner();
		if (!isAdministrator() && !owner.equals(getAuthUser())) 
			throw new UnauthorizedException();
		if (!canManageProject(owner.asSubject(), authorization.getProject()))
			throw new BadRequestException("Access token owner should have permission to manage authorized project");

		accessTokenAuthorizationService.createOrUpdate(authorization);
		if (!getAuthUser().equals(owner)) {
			var newAuditContent = VersionedXmlDoc.fromBean(authorization).toXML();
			auditService.audit(null, "created access token authorization in account \"" + owner.getName() + "\" via RESTful API", null, newAuditContent);
		}
		return authorization.getId();
	}

	@Api(order=250, description="Update access authorization of specified id. Access token owner should have permission to manage authorized project")
	@Path("/{authorizationId}")
	@POST
	public Response updateAuthorization(@PathParam("authorizationId") Long authorizationId, @NotNull AccessTokenAuthorization authorization) {
		var owner = authorization.getToken().getOwner();
		if (!isAdministrator() && !owner.equals(getAuthUser())) 
			throw new UnauthorizedException();
		if (!canManageProject(owner.asSubject(), authorization.getProject()))
			throw new BadRequestException("Access token owner should have permission to manage authorized project");

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the token owner the manage-project permission (Project Privileges.MANAGE) on the target project first
2. Correct the 'project' field in the payload to a project the owner can manage
3. Have a project admin add the owner with sufficient role, then retry
4. Verify the project name/path is spelled correctly

Example fix

// before
POST /rest/access-tokens-authorizations { "token": {"owner":"bob"}, "project": "core" } // bob cannot manage 'core' -> 400
// after
// project admin grants bob manage permission on 'core', then retry the same POST

// pre-check: does the token owner have manage permission on the project?
const projects = await fetch('/rest/projects', { headers }).then(r => r.json());
const canManage = projects.some(p => p.path === projectPath /* and you manage it */);
if (!canManage) throw new Error(`Owner cannot manage project ${projectPath}`);

try {
  const res = await fetch('/rest/access-tokens-authorizations', { method: 'POST', body: JSON.stringify(payload) });
  if (res.status === 400 && (await res.text()).includes('should have permission to manage')) {
    // request project manage permission for the token owner, then retry
  }
} catch (e) { /* handle */ }

When it happens

Trigger: POSTing an authorization that would grant a token access to a project its owner cannot manage — e.g. bob (plain project member) authorizing his token for project 'core' where he lacks the manage-project privilege. Even admins hit this if they authorize a non-privileged owner for a project.

Common situations: Automation granting project access to a token whose owner was recently demoted; typo'd project name in the payload; authorizing a private project the owner is not a member of.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Not authorized
• Not authorized
• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• Code write permission is required to edit auto merge

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/0b42a8f881fc5b6b. Report an issue: GitHub.