theonedev/onedev · error · UnauthorizedException

No permission to access issue:

Error message

No permission to access issue: 

What it means

POST /log-work throws UnauthorizedException with 'No permission to access issue: {reference}' when SecurityUtils.canAccessIssue(issue) returns false. The authenticated user exists but lacks permission to view/modify the referenced issue (e.g. not authorized by issue confidentiality or project role).

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:768

    @Consumes(MediaType.TEXT_PLAIN)
    @POST
    public Map<String, Object> logWork(
                @QueryParam("currentProject") @NotNull String currentProjectPath, 
                @QueryParam("reference") @NotNull String issueReference, 
                @QueryParam("spentHours") int spentHours, String comment) {
        if (SecurityUtils.getUser() == null)
            throw new UnauthenticatedException();

        var currentProject = getProject(currentProjectPath);

        var issue = getIssue(currentProject, issueReference);

        if (!subscriptionService.isSubscriptionActive())
            throw new NotAcceptableException("An active subscription is required for this feature");
        if (!issue.getProject().isTimeTracking())
            throw new NotAcceptableException("Time tracking needs to be enabled for the project");
        if (!SecurityUtils.canAccessIssue(issue))
            throw new UnauthorizedException("No permission to access issue: " + issueReference);

        var work = new IssueWork();
        work.setIssue(issue);
        work.setUser(SecurityUtils.getUser());
        work.setMinutes(spentHours * 60);
        work.setNote(trimToNull(comment));
        issueWorkService.createOrUpdate(work);

        var workMap = new HashMap<String, Object>();
        workMap.put("minutes", spentHours * 60);
        workMap.put("note", comment);
        workMap.put("user", work.getUser().getName());
        workMap.put("date", work.getDate());
        return workMap;
    }

    @Path("/query-pull-requests")
    @GET

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the calling user a role with access to the project/issue (Project > Access Control)
2. Remove the confidentiality restriction on the issue or add the user/group to the issue's authorized list
3. Verify the issue reference and currentProject query params point to the intended issue
4. Use an access token of a user who has the needed permissions

Example fix

// before: user 'dev1' has no role in project 'secret'
// after: Project secret > Access Control > add 'dev1' with Developer role (includes issue read/write)

const issue = await getIssue(project, reference); if (!issue) throw new Error(`Issue ${reference} not accessible by current user`);

try { await logWork(params); } catch (e) { if (e.status === 403 || /no permission to access issue/i.test(e.message)) requestAccessOrEscalate(reference); else throw e; }

When it happens

Trigger: Calling log-work with a reference to an issue the caller cannot access: issue restricted to certain roles/groups, caller is a guest, or the issue lives in a private project the caller has no role in.

Common situations: AI agent acting as a user without project membership; issue marked confidential for a group the user is not in; typo causing the wrong project/issue to resolve; external contributors with limited roles.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Issue schedule permission required to set iterations
• No permission to add specified link for specified issues
• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/8e7dff8e88fb3acc. Report an issue: GitHub.