theonedev/onedev · error · UnauthorizedException

Import target already exists. You need to have project manag

Error message

Import target already exists. You need to have project management privilege over it

What it means

Thrown after getProjectService().setup(...) resolves (and possibly creates) the target project: if the project already existed and the current user does not have management privilege over it, the importer refuses to overwrite/import into it via UnauthorizedException. It protects existing projects from being clobbered by an import by users who merely have read/commit access.

Source

Thrown at server-plugin/server-plugin-import-url/src/main/java/io/onedev/server/plugin/imports/url/ImportServer.java:113

	
	TaskResult importProject(@Nullable String parentProjectPath, boolean dryRun, TaskLogger logger) {
		return OneDev.getInstance(TransactionService.class).call(() -> {
			try {
				String projectPath = getProject();
				if (projectPath == null)
					projectPath = deriveProjectPath(getUrl());
				if (projectPath == null)
					throw new ExplicitException("Invalid url: " + getUrl());
				
				if (parentProjectPath != null)
					projectPath = parentProjectPath + "/" + projectPath;

				logger.log("Importing from '" + getUrl() + "' to '" + projectPath + "'...");

				Project project = getProjectService().setup(SecurityUtils.getSubject(), projectPath);

				if (!project.isNew() && !SecurityUtils.canManageProject(project)) {
					throw new UnauthorizedException("Import target already exists. " +
							"You need to have project management privilege over it");
				}

				if (project.isNew() || project.getDefaultBranch() == null) {
					logger.log("Cloning code...");

					URIBuilder builder = new URIBuilder(getUrl());
					if (authentication != null)
						builder.setUserInfo(authentication.getUserName(), authentication.getPassword());

					SecretMasker.push(text -> {
						if (authentication != null)
							return Strings.CS.replace(text, authentication.getPassword(), "******");
						else
							return text;
					});
					try {
						if (dryRun) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Ask a OneDev administrator to grant you Manage privilege on the target project.
2. Choose a different (non-existing) project path for the import.
3. Delete the existing project if it is unused and you have authority to do so.
4. Import under your own namespace where you automatically have management rights.

// pre-check before import
Project project = OneDev.getInstance(ProjectService.class).findByPath(projectPath);
if (project != null && !SecurityUtils.canManageProject(project))
    throw new IllegalStateException("You lack manage privilege over existing project " + projectPath);

try { importServer.importProject(...); } catch (UnauthorizedException e) { logger.error("Import blocked: {}", e.getMessage()); }

When it happens

Trigger: Importing a URL into a project path that already exists in OneDev, where the authenticated user is not a project manager of that existing project. Also occurs when SecurityUtils.canManageProject returns false due to group/role restrictions on the target path.

Common situations: A non-admin tries to import into a team project someone else created; import form auto-derived a project path that collides with an existing project; user's manage permission was revoked after a previous import.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Code read permission is required to import build spec (impor
• Import target already exists. You need to have project manag
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/58aa5ffb67df85f4. Report an issue: GitHub.