theonedev/onedev · error · UnauthorizedException

No package read permission for project: ${project.path}

Error message

No package read permission for project: ${project.path}

What it means

When the registry operation requires pull rights and the authenticated user lacks pack read permission, checkProject throws UnauthorizedException. This blocks docker pull and any read-only registry API access for accounts without pack read access.

Source

Thrown at server-plugin/server-plugin-pack-container/src/main/java/io/onedev/server/plugin/pack/container/ContainerServlet.java:522

	private Digest parseDigest(String digestString) {
		if (digestString.startsWith("sha256:")) {
			return new Digest(SHA256, digestString.substring("sha256:".length()));
		} else {
			throw new ClientException(SC_NOT_ACCEPTABLE, ErrorCode.UNSUPPORTED, 
					"Unsupported digest: " + digestString);
		}
	}
	
	private Project checkProject(String projectPath, boolean needsToPush) {
		var project = projectService.findByPath(projectPath);
		if (project == null) 
			throw new NotFoundException(ErrorCode.NAME_UNKNOWN, "Unknown project: " + projectPath);
		else if (!project.isPackManagement())
			throw new ClientException(SC_NOT_ACCEPTABLE, ErrorCode.DENIED, "Package management not enabled for project: " + projectPath);
		else if (needsToPush && !SecurityUtils.canWritePack(project))
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		else if (!needsToPush && !SecurityUtils.canReadPack(project))
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		else
			return project;
	}

	private String getChallenge() {
		var serverUrl = settingService.getSystemSetting().getServerUrl();
		return "Bearer realm=\"" + serverUrl + "/v2/token\",service=\"onedev\",scope=\"*\"";
	}
	
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user pack read permission on the project.
2. If the project is meant to be public, enable public pack read access in project settings.
3. Re-login with credentials for an account that has read access.

// confirm read access before pulling
if (!userCanReadPack(projectPath)) { requestAccess(projectPath); }

try { pull() } catch (e) { if (e instanceof UnauthorizedException && /read permission/.test(e.message)) { requestPackReadAccess(); } else { throw e; } }

When it happens

Trigger: docker pull / manifest or blob GET requests where the user is authenticated but has no pack read permission on the project.

Common situations: Anonymous or low-privilege CI token pulling from a private project's registry; user removed from the project; pulling from another user's private project; expired membership/role change.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No package write permission for project: ${project.path}
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• No permission to access issue: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/dbc73b89eec2f144. Report an issue: GitHub.