theonedev/onedev · error · UnauthorizedException

No package read permission for project: ${project.getPath()}

Error message

No package read permission for project: ${project.getPath()}

What it means

checkProject(projectId, needsToWrite=false) throws UnauthorizedException when the current user lacks pack read permission (SecurityUtils.canReadPack(project) is false). Resolving/downloading Maven artifacts from the project's repository requires read access to its packages.

Source

Thrown at server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java:436

							}
						}
					}
					response.setStatus(SC_CREATED);
				}));
			}
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}
	
	private Project checkProject(Long projectId, boolean needsToWrite) {
		var project = projectService.load(projectId);
		if (!project.isPackManagement())
			throw new HttpResponseAwareException(SC_NOT_ACCEPTABLE, "Package management not enabled for project '" + project.getPath() + "'");
		else if (needsToWrite && !SecurityUtils.canWritePack(project))
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		else if (!needsToWrite && !SecurityUtils.canReadPack(project))
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		return project;
	}
	
	private String getName(String groupId, @Nullable String artifactId) {
		if (artifactId == null)
			artifactId = NONE;
		return groupId + ":" + artifactId;
	}
	
	private List<Pack> queryByGAWithV(Project project, String groupId, String artifactId) {
		var criteria = EntityCriteria.of(Pack.class);
		criteria.add(Restrictions.eq(PROP_PROJECT, project));
		criteria.add(Restrictions.eq(PROP_TYPE, TYPE));
		criteria.add(Restrictions.eq(PROP_NAME, getName(groupId, artifactId)));
		criteria.add(Restrictions.not(Restrictions.eq(PROP_VERSION, NONE)));
		return packService.query(criteria);
	}
	

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the consuming user or CI account 'Read pack' permission on the project.
2. Provide credentials for dependency resolution (settings.xml server entry matching the repository id) instead of anonymous access.
3. If the artifact should be public, adjust project visibility/permissions to allow read access for the intended audience.

Example fix

// before — anonymous resolution of private repo
<repository><id>onedev</id><url>https://onedev.example.com/~maven/2</url></repository>
// after — supply authorized credentials
<repository>
  <id>onedev</id>
  <url>https://onedev.example.com/~maven/2</url>
</repository>
<!-- plus settings.xml server 'onedev' with a user having pack read role -->

# Probe read access before configuring dependency resolution
STATUS=$(curl -s -o /dev/null -w '%{http_code}' -u "$USER:$TOKEN" "$BASE/~maven/1/com/acme/app/1.0.0/app-1.0.0.pom")
[ "$STATUS" = "200" ] || { echo "no pack read permission (HTTP $STATUS)"; exit 1; }

try {
  resolutionResult = project.dependencies.resolve(...)
} catch (ResolveException e) {
  if (e.cause?.message?.contains('No package read permission')) {
    throw new IllegalStateException("Add credentials with pack read role to settings.xml for repo 'onedev'", e)
  }
  throw e
}

When it happens

Trigger: mvn/gradle dependency resolution (GET requests through serveBlob) executed by an anonymous visitor or a user whose project role does not include pack read permission.

Common situations: Public builds depending on a private project's artifacts; developer not added to the project; anonymous access disabled for packages; dependency resolution running under a machine account without read grants.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• No package write permission for project: ${project.getPath()
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• No permission to access issue: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/15465e53ce101a13. Report an issue: GitHub.