theonedev/onedev · error · UnauthenticatedException

Authentication required

Error message

Authentication required

What it means

CodeCommentHelper.addReply lets authenticated users reply to code comments via the AI/tool API. If the provided Subject carries no authenticated user, UnauthenticatedException ('Authentication required') is thrown before any reply is created.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/CodeCommentHelper.java:32

import org.jspecify.annotations.Nullable;

import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;

import io.onedev.server.OneDev;
import io.onedev.server.model.CodeComment;
import io.onedev.server.model.CodeCommentReply;
import io.onedev.server.model.CodeCommentStatusChange;
import io.onedev.server.security.SecurityUtils;
import io.onedev.server.service.CodeCommentReplyService;
import io.onedev.server.service.CodeCommentStatusChangeService;

public class CodeCommentHelper {
    
    public static Map<String, Object> addReply(Subject subject, CodeComment comment, String content) {
        var user = SecurityUtils.getUser(subject);
        if (user == null)
            throw new UnauthenticatedException();

        if (!SecurityUtils.canReadCode(subject, comment.getProject()))
            throw new UnauthorizedException();

        var reply = new CodeCommentReply();
        reply.setComment(comment);
        reply.setContent(content);
        reply.setUser(user);
        reply.setDate(new Date());
        reply.setCompareContext(comment.getCompareContext());
        getCodeCommentReplyService().create(reply);

        return getDetail(reply);
    }

    public static Map<String, Object> changeStatus(Subject subject, CodeComment comment, 
                boolean resolved, @Nullable String note) {
        if (!SecurityUtils.canChangeStatus(subject, comment))

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate the request: add a valid access token (personal access token) to the API call.
2. Log in via the web session if using browser-based access, then retry.
3. Check token expiry and regenerate if it has expired or was revoked.

Example fix

// before
curl -X POST https://onedev/api/... # no auth
// after
curl -X POST -H "Authorization: Bearer <access-token>" https://onedev/api/...

if (SecurityUtils.getUser(subject) == null)
    throw new IllegalStateException("Authenticate before calling addReply");

try {
    CodeCommentHelper.addReply(subject, comment, content);
} catch (UnauthenticatedException e) {
    // prompt for login or refresh/attach an access token, then retry
}

When it happens

Trigger: Calling addReply with a Subject that has no associated user — e.g. an unauthenticated REST/GraphQL call, a missing/expired access token, or an anonymous session.

Common situations: API clients forgetting the Authorization/access token header, expired personal access tokens, or invoking the tool integration without a logged-in session.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• This api can only be accessed via cluster credential
• Not authenticated
• Invalid or expired access token
• Account is disabled
• Two-factor authentication not enabled

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/f0dadaa5565ad92d. Report an issue: GitHub.