theonedev/onedev · error · UnauthorizedException

No package write permission for project: ${projectPath}

Error message

No package write permission for project: ${projectPath}

What it means

checkProject throws UnauthorizedException when a write operation is requested but the current user lacks WritePack permission on the project. Twine uploads and other mutating PyPI operations are rejected.

Source

Thrown at server-plugin/server-plugin-pack-pypi/src/main/java/io/onedev/server/plugin/pack/pypi/PypiPackHandler.java:303

	@Override
	public String getApiKey(HttpServletRequest request) {
		return null;
	}
	
	private void sendResponse(HttpServletResponse response, String content) {
		try {
			response.getOutputStream().print(content);
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}

	private Project checkProject(Long projectId, boolean needsToWrite) {
		var project = projectService.load(projectId);
		if (!project.isPackManagement()) {
			throw new ClientException(SC_NOT_ACCEPTABLE, "Package management not enabled for project '" + project.getPath() + "'");
		} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		}
		return project;
	}

	@Override
	public List<String> normalize(List<String> pathSegments) {
		return pathSegments;
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user (or the CI job role) 'Write Pack' permission in project permissions settings
2. If uploading from a job, ensure the job token has package write permission (e.g. appropriate role/secret)
3. Verify you are operating against the correct project path

Example fix

null

var project = projectService.load(projectId);
if (!SecurityUtils.canWritePack(project)) throw new IllegalStateException('Missing pack write permission on ' + project.getPath());

try { twineUpload(); } catch (UnauthorizedException e) { grantPackWriteAndRetry(project); }

When it happens

Trigger: Twine upload (or any needsToWrite=true endpoint) executed by a user whose effective permission on the project does not include SecurityUtils.canWritePack — e.g. only Read Pack or job-read rights.

Common situations: CI job token lacking pack write permission; user added to project with read-only role; permissions changed after a pipeline was set up.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No package read permission for project: ${projectPath}
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• No permission to access issue: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/d822d73d56c2e9e0. Report an issue: GitHub.