theonedev/onedev · error · UnauthorizedException

No package write permission for project: ${projectPath}

Error message

No package write permission for project: ${projectPath}

What it means

checkProject(needsToWrite=true) throws UnauthorizedException when the authenticated user lacks package write permission on the project. The NuGet pack handler enforces SecurityUtils.canWritePack(project) before allowing publish/delete operations.

Source

Thrown at server-plugin/server-plugin-pack-nuget/src/main/java/io/onedev/server/plugin/pack/nuget/NugetPackHandler.java:621

		version = encodePath(version);
		return baseUrl + "/package/" + name + "/" + version + "/" + name + "." + version + ".nupkg";
	}
	
	private void sendResponse(HttpServletResponse response, Object value) {
		try {
			response.getOutputStream().write(writeJson(value));
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}

	private Project checkProject(Long projectId, boolean needsToWrite) {
		var project = projectService.load(projectId);
		if (!project.isPackManagement()) {
			logger.warn("Package management not enabled for project '" + project.getPath() + "'");
			throw new ClientException(SC_NOT_ACCEPTABLE);
		} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		}
		return project;
	}

	@Override
	public String getApiKey(HttpServletRequest request) {
		return request.getHeader(HEADER_API_KEY);
	}
	
	@Override
	public List<String> normalize(List<String> pathSegments) {
		return pathSegments;
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user (or the CI job token) package write permission in the project's access settings.
2. Use a service account or job token that has been explicitly given pack write access in the CI configuration.
3. Confirm you are authenticating as the intended account (check the token/API key being sent by nuget push), not a fallback anonymous/limited user.

Example fix

// before: CI token without pack write
nuget push pkg.nupkg -ApiKey <readOnlyToken>
// after: grant 'Write' pack permission to the role/job token used by the publish step

# verify the token's user role has Pack Write permission before publish
# OneDev UI: Project -> Access -> role permissions

resp = requests.put(upload_url, ...)
if resp.status_code == 401 and 'No package write permission' in resp.text:
    fail('CI token lacks pack write permission')

When it happens

Trigger: Publishing (nuget push) or deleting a NuGet package via the pack endpoint while logged in as a user/CI token with only read access to the project's packages.

Common situations: CI job using a personal access token or job token without package write role; a contributor with read-only pack access attempting to publish; permission revoked after a role change.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No package read permission for project: ${projectPath}
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• No permission to access issue: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/5086046d16373450. Report an issue: GitHub.