theonedev/onedev · error · UnauthorizedException

No package write permission for project: ${projectPath}

Error message

No package write permission for project: ${projectPath}

What it means

Thrown by CargoPackHandler.checkProject when a write operation (publish, yank) is requested but SecurityUtils.canWritePack(project) is false for the current authenticated user. This is an authorization failure (UnauthorizedException), distinct from the feature-disabled check.

Source

Thrown at server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java:388

	private void writeJson(HttpServletResponse response, Object object) {
		response.setContentType(MediaType.APPLICATION_JSON);
		try {
			objectMapper.writeValue(response.getOutputStream(), object);
		} catch (IOException e) {
			throw new RuntimeException(e);
		}
	}

	private String getLockName(Long projectId, String name) {
		return "update-pack:" + projectId + ":" + TYPE + ":" + name;
	}

	private Project checkProject(Long projectId, boolean needsToWrite) {
		var project = projectService.load(projectId);
		if (!project.isPackManagement()) {
			throw new ClientException(SC_NOT_ACCEPTABLE, "Package management not enabled for project '" + project.getPath() + "'");
		} else if (needsToWrite && !SecurityUtils.canWritePack(project)) {
			throw new UnauthorizedException("No package write permission for project: " + project.getPath());
		} else if (!needsToWrite && !SecurityUtils.canReadPack(project)) {
			throw new UnauthorizedException("No package read permission for project: " + project.getPath());
		}
		return project;
	}

	@Override
	public String getApiKey(HttpServletRequest request) {
		return request.getHeader(HttpHeaders.AUTHORIZATION);
	}

	@Override
	public List<String> normalize(List<String> pathSegments) {
		return pathSegments;
	}

	private static class PublishBody {

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user package write permission (Project -> Roles / membership with write access)
2. Generate an access token with package write scope and update ~/.cargo/credentials
3. Verify cargo is authenticating as the intended user (check registry settings)
4. If publishing from CI, use a dedicated service account with write pack permission

// verify token has package write access before publishing
// ensure Project -> membership grants write, and token scope includes pack write
cargo publish --dry-run || echo 'fix metadata first'

try { execSync('cargo publish'); } catch (e) { if (/No package write permission/.test(e.message)) { /* request write access or fix credentials */ } }

When it happens

Trigger: Running `cargo publish` or yank with credentials of a user who has only read (or no) package write permission on the project; expired/insufficient access token used as password.

Common situations: Using a personal access token without package write scope; user not added to the project with write role; API key belonging to another account configured in cargo credentials.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No package read permission for project: ${projectPath}
• No package write permission for project: ${project.getPath()
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/498c3966f5ffb912. Report an issue: GitHub.