theonedev/onedev · error · UnauthorizedException

No package read permission for project: ${projectPath}

Error message

No package read permission for project: ${projectPath}

What it means

checkProject(needsToWrite=false) throws UnauthorizedException when the authenticated user lacks package read permission on the project. Any NuGet pack query/download operation requires SecurityUtils.canReadPack(project).

Source

Thrown at server-plugin/server-plugin-pack-nuget/src/main/java/io/onedev/server/plugin/pack/nuget/NugetPackHandler.java:623

	}
	
	private void sendResponse(HttpServletResponse response, Object value) {
		try {
			response.getOutputStream().write(writeJson(value));
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}

	private Project checkProject(Long projectId, boolean needsToWrite) {
		var project = projectService.load(projectId);
		if (!project.isPackManagement()) {
			logger.warn("Package management not enabled for project '" + project.getPath() + "'");
			throw new ClientException(SC_NOT_ACCEPTABLE);
		} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		}
		return project;
	}

	@Override
	public String getApiKey(HttpServletRequest request) {
		return request.getHeader(HEADER_API_KEY);
	}
	
	@Override
	public List<String> normalize(List<String> pathSegments) {
		return pathSegments;
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user/CI token package read permission on the source project.
2. Update the nuget source URL/credentials in nuget.config to a project the current account can access.
3. Check that the request is actually authenticated (missing API key leads to anonymous evaluation, which fails on private projects).

Example fix

// before: nuget.config without credentials for private source
// after: add credentials of an account with pack read permission, or grant read in OneDev UI

# ensure nuget.config includes credentials for a user with pack read access
nuget sources list  # confirm source + credentials configured

try { restore(); } catch (HttpRequestException e) when (e.StatusCode == HttpStatusCode.Unauthorized) {
    log("Grant pack read permission or add credentials");
}

When it happens

Trigger: Searching, listing, or downloading NuGet packages from a project the user has no package read access to (anonymous request, or token of another user without pack read role).

Common situations: nuget restore in CI using a token that lacks read access to the dependency's project; a developer accessing a package from another team's restricted project; package source URL pointing at a project the user cannot see.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No package write permission for project: ${projectPath}
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• No permission to access issue: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/15c2bea616428082. Report an issue: GitHub.