theonedev/onedev · error · UnauthorizedException

No package read permission for project:

Error message

No package read permission for project: 

What it means

Thrown by checkProject when a read operation (npm metadata fetch or tarball download) is attempted by a user who lacks pack read permission on the project. It raises UnauthorizedException, surfaced as HTTP 401 to the npm client.

Source

Thrown at server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java:585

	}

	@Override
	public String getApiKey(HttpServletRequest request) {
		var authzHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
		if (authzHeader != null&& authzHeader.toLowerCase().startsWith("bearer ")) 
			return StringUtils.substringAfter(authzHeader, " ");
		else
			return null;
	}

	private Project checkProject(Long projectId, boolean needsToWrite) {
		var project = projectService.load(projectId);
		if (!project.isPackManagement())
			throw new ClientException(SC_NOT_ACCEPTABLE, "Package management not enabled for project '" + project.getPath() + "'");
		else if (needsToWrite && !SecurityUtils.canWritePack(project))
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		else if (!needsToWrite && !SecurityUtils.canReadPack(project))
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		return project;
	}
	
	@Override
	public List<String> normalize(List<String> pathSegments) {
		return pathSegments;
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Add a read-capable access token to .npmrc for the OneDev host.
2. Grant the user or job's role at least Pack Read permission on the project.
3. Verify the token is valid and not expired (User Profile -> Access Tokens).
4. If packages should be public, enable public read access for the project in its settings.

Example fix

// before — no token, private project
registry=https://onedev.example.com/npm/proj/
// after
registry=https://onedev.example.com/npm/proj/
//onedev.example.com/:_authToken=<token-with-pack-read>

// Pre-check read access before install
const resp = await fetch(`${registryUrl}/${pkgName}`, { headers: { Authorization: `Bearer ${token}` } });
if (resp.status === 401) throw new Error('No pack read permission: configure a valid access token in .npmrc');

try {
  await npmInstall();
} catch (e) {
  if (e.code === 'E401') {
    console.error('Install unauthorized: add //onedev.example.com/:_authToken=<token-with-pack-read> to .npmrc');
  } else throw e;
}

When it happens

Trigger: GET metadata or tarball where SecurityUtils.canReadPack(project) is false — no/invalid Bearer token, or the token's user has no read access to the project's packages.

Common situations: Anonymous npm install from a private project; expired or revoked access token in .npmrc; CI job token from a different project trying to read packages of another project; public access disabled on the project.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No package write permission for project:
• Not authorized
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/05c226481816f45d. Report an issue: GitHub.