theonedev/onedev · error · UnauthorizedException

No permission to edit pull request:

Error message

No permission to edit pull request: 

What it means

After authentication and PR lookup, editPullRequest checks SecurityUtils.canModifyPullRequest(request). If the authenticated user lacks permission to modify the pull request, it throws a JAX-RS UnauthorizedException naming the pull request reference. Editing (title, description, reviewers, assignees, etc.) is limited to authorized users such as the submitter or project maintainers.

Solutions

1. Grant the user modify permission on the pull request's project (project > access control, e.g. 'Manage pull requests' / write role).
2. Have the PR submitter or a project maintainer perform the edit.
3. Authenticate as a user with maintainer rights on that project.

Example fix

// before
// read-only account calls edit endpoint -> 403
// after
// use a token from a user with "Can manage pull requests" on the project
curl -X POST -H "Authorization: Bearer <maintainer-token>" '.../edit-pull-request?reference=team-a/app#42' ...

var request = pullRequestService.find(ref.getProject(), ref.getNumber());
if (!SecurityUtils.canModifyPullRequest(request))
    throw new IllegalStateException("User " + SecurityUtils.getUser().getName() + " cannot modify " + referenceString);

try {
    callEditEndpoint(reference, data);
} catch (UnauthorizedException e) {
    if (e.getMessage().startsWith("No permission to edit pull request")) {
        // escalate to a maintainer or re-authenticate with a privileged account
    } else throw e;
}

When it happens

Trigger: POST to edit-pull-request with a valid reference for a PR the authenticated user is not allowed to modify (not submitter, not maintainer, lacks write/modify permission on the project).

Common situations: Service account trying to edit another user's PR; user has read-only role on the project; group permission change removed modify rights; editing PRs in a project managed by another team.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to access pull request:
• No permission to read code of source project:
• No permission to read code of target project:
• Code read permission required for project
• Issue schedule permission required to set iterations

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/366fcd817a47cd5d. Report an issue: GitHub.

Appendix: source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:1332

        }
    }

    @SuppressWarnings("unchecked")
    @Path("/edit-pull-request")
    @POST
    public Map<String, Object> editPullRequest(
                @QueryParam("currentProject") @NotNull String currentProjectPath,
                @QueryParam("reference") @NotNull String pullRequestReference, @NotNull Map<String, Serializable> data) {
        var user = SecurityUtils.getUser();
        if (user == null)
            throw new UnauthenticatedException();

        var currentProject = getProject(currentProjectPath);

        var request = getPullRequest(currentProject, pullRequestReference);

        if (!SecurityUtils.canModifyPullRequest(request))
            throw new UnauthorizedException("No permission to edit pull request: " + pullRequestReference);

        normalizePullRequestData(data);

        var title = (String) data.remove("title");
        if (title != null) 
            pullRequestChangeService.changeTitle(user, request, title);

        if (data.containsKey("description")) 
            pullRequestChangeService.changeDescription(user, request, (String) data.remove("description"));

        var labelNames = (List<String>) data.remove("labels");
        if (labelNames != null) {
            try {
                pullRequestLabelService.sync(request, labelNames);
            } catch (EntityNotFoundException e) {
                throw new NotFoundException(e.getMessage());
            }
        }

View on GitHub (pinned to d44925c47c)