theonedev/onedev · error · UnauthorizedException

No permission to access pull request:

Error message

No permission to access pull request: 

What it means

The getPullRequest helper resolves a pull request reference (e.g. '#123' or 'project/#123') and, if found, verifies SecurityUtils.canReadCode(request.getProject()). If the user cannot read code in the pull request's project, it throws a JAX-RS UnauthorizedException naming the reference — hiding the PR's existence from unauthorized users.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:1310

        var target = new ProjectAndBranch(targetProject, targetBranch);
        var source = new ProjectAndBranch(sourceProject, sourceBranch);

        var info = new CreatePullRequestEssentialInfo();
        info.currentProject = currentProject;
        info.target = target;
        info.source = source;
        info.submitter = user;

        return info;
    }    

    private PullRequest getPullRequest(Project currentProject, String referenceString) {
        var requestReference = PullRequestReference.of(referenceString, currentProject);
        var request = pullRequestService.find(requestReference.getProject(), requestReference.getNumber());
        if (request != null) {
            if (!SecurityUtils.canReadCode(request.getProject()))
                throw new UnauthorizedException("No permission to access pull request: " + referenceString);
            return request;
        } else {
            throw new NotFoundException("Pull request not found: " + referenceString);
        }
    }

    @SuppressWarnings("unchecked")
    @Path("/edit-pull-request")
    @POST
    public Map<String, Object> editPullRequest(
                @QueryParam("currentProject") @NotNull String currentProjectPath,
                @QueryParam("reference") @NotNull String pullRequestReference, @NotNull Map<String, Serializable> data) {
        var user = SecurityUtils.getUser();
        if (user == null)
            throw new UnauthenticatedException();

        var currentProject = getProject(currentProjectPath);

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user 'Read code' permission on the pull request's project.
2. Reference a pull request within a project the account can access.
3. Use fully-qualified references only for projects you can read.

Example fix

// before
var ref = "team-b/app#42"; // no access to team-b/app
// after
var ref = "team-a/app#17"; // PR in accessible project

var ref = PullRequestReference.of(referenceString, currentProject);
var request = pullRequestService.find(ref.getProject(), ref.getNumber());
if (request != null && !SecurityUtils.canReadCode(request.getProject()))
    throw new IllegalStateException("No access to " + ref.getProject().getPath());

try {
    var pr = callTodEndpoint(reference);
} catch (UnauthorizedException e) {
    if (e.getMessage().startsWith("No permission to access pull request")) {
        // request project access or skip this PR
    } else throw e;
}

When it happens

Trigger: Any TOD endpoint call (e.g. edit-pull-request) with a reference parameter resolving to an existing pull request whose project the authenticated user cannot read code in.

Common situations: Token/user scoped to one project referencing a PR in another; project permission revoked; AI plan referencing PRs from a sibling project.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to read code of source project:
• No permission to read code of target project:
• No permission to edit pull request:
• Issue schedule permission required to set iterations
• No permission to update issue fields

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/d7522622f8708505. Report an issue: GitHub.