theonedev/onedev · error · UnauthorizedException

No package write permission for project: ${project.getPath()

Error message

No package write permission for project: ${project.getPath()}

What it means

checkProject(projectId, needsToWrite=true) throws UnauthorizedException when the current user lacks pack write permission (SecurityUtils.canWritePack(project) is false). Uploading/publishing Maven artifacts requires write access to the project's packages.

Source

Thrown at server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java:434

								packBlobReferenceService.delete(blobReference);
								break;
							}
						}
					}
					response.setStatus(SC_CREATED);
				}));
			}
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}
	
	private Project checkProject(Long projectId, boolean needsToWrite) {
		var project = projectService.load(projectId);
		if (!project.isPackManagement())
			throw new HttpResponseAwareException(SC_NOT_ACCEPTABLE, "Package management not enabled for project '" + project.getPath() + "'");
		else if (needsToWrite && !SecurityUtils.canWritePack(project))
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		else if (!needsToWrite && !SecurityUtils.canReadPack(project))
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		return project;
	}
	
	private String getName(String groupId, @Nullable String artifactId) {
		if (artifactId == null)
			artifactId = NONE;
		return groupId + ":" + artifactId;
	}
	
	private List<Pack> queryByGAWithV(Project project, String groupId, String artifactId) {
		var criteria = EntityCriteria.of(Pack.class);
		criteria.add(Restrictions.eq(PROP_PROJECT, project));
		criteria.add(Restrictions.eq(PROP_TYPE, TYPE));
		criteria.add(Restrictions.eq(PROP_NAME, getName(groupId, artifactId)));
		criteria.add(Restrictions.not(Restrictions.eq(PROP_VERSION, NONE)));
		return packService.query(criteria);

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user (or the CI job's account) 'Write pack' / 'Manage pack' permission in Project > Access Control / role assignment.
2. Verify credentials in ~/.m2/settings.xml (server id, username, password/token) belong to an account with write access.
3. For CI, use a job secret/token tied to a role that includes pack write permission.

Example fix

// before (settings.xml) — no credentials for the OneDev server
<server><id>onedev</id></server>
// after
<server>
  <id>onedev</id>
  <username>ci-bot</username>
  <password>${env.ONEDEV_TOKEN}</password>
</server>  <!-- ci-bot has pack write role -->

# Probe write access before a real deploy
STATUS=$(curl -s -o /dev/null -w '%{http_code}' -u "$USER:$TOKEN" "$BASE/~maven/1/com/acme/probe/0.0.1/probe-0.0.1.jar.sha1" -T /dev/null)
[ "$STATUS" != "401" ] && [ "$STATUS" != "403" ] || { echo 'no pack write permission'; exit 1; }

try {
  mvn deploy -s settings.xml
} catch (UnauthorizedException | MavenDeployException e) {
  if (e.getMessage().contains("No package write permission")) {
    throw new IllegalStateException("CI account lacks pack write role on project; grant it or use a service account", e);
  }
  throw e;
}

When it happens

Trigger: mvn deploy / gradle publish or any PUT to the Maven pack endpoint performed by an anonymous user or a user whose role in the project (or group) does not grant pack write permission.

Common situations: CI job token without write role; user added to project with read-only role; permission changes revoking pack write; wrong credentials configured in settings.xml/gradle.properties.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• No package read permission for project: ${project.getPath()}
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• No permission to access issue: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/a83651ae91e42af6. Report an issue: GitHub.