theonedev/onedev · error · UnauthorizedException

No permission to edit pull request:

Error message

No permission to edit pull request: 

What it means

After authentication and PR lookup, editPullRequest checks SecurityUtils.canModifyPullRequest(request). If the authenticated user lacks permission to modify the pull request, it throws a JAX-RS UnauthorizedException naming the pull request reference. Editing (title, description, reviewers, assignees, etc.) is limited to authorized users such as the submitter or project maintainers.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:1332

        }
    }

    @SuppressWarnings("unchecked")
    @Path("/edit-pull-request")
    @POST
    public Map<String, Object> editPullRequest(
                @QueryParam("currentProject") @NotNull String currentProjectPath,
                @QueryParam("reference") @NotNull String pullRequestReference, @NotNull Map<String, Serializable> data) {
        var user = SecurityUtils.getUser();
        if (user == null)
            throw new UnauthenticatedException();

        var currentProject = getProject(currentProjectPath);

        var request = getPullRequest(currentProject, pullRequestReference);

        if (!SecurityUtils.canModifyPullRequest(request))
            throw new UnauthorizedException("No permission to edit pull request: " + pullRequestReference);

        normalizePullRequestData(data);

        var title = (String) data.remove("title");
        if (title != null) 
            pullRequestChangeService.changeTitle(user, request, title);

        if (data.containsKey("description")) 
            pullRequestChangeService.changeDescription(user, request, (String) data.remove("description"));

        var labelNames = (List<String>) data.remove("labels");
        if (labelNames != null) {
            try {
                pullRequestLabelService.sync(request, labelNames);
            } catch (EntityNotFoundException e) {
                throw new NotFoundException(e.getMessage());
            }
        }

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user modify permission on the pull request's project (project > access control, e.g. 'Manage pull requests' / write role).
2. Have the PR submitter or a project maintainer perform the edit.
3. Authenticate as a user with maintainer rights on that project.

Example fix

// before
// read-only account calls edit endpoint -> 403
// after
// use a token from a user with "Can manage pull requests" on the project
curl -X POST -H "Authorization: Bearer <maintainer-token>" '.../edit-pull-request?reference=team-a/app#42' ...

var request = pullRequestService.find(ref.getProject(), ref.getNumber());
if (!SecurityUtils.canModifyPullRequest(request))
    throw new IllegalStateException("User " + SecurityUtils.getUser().getName() + " cannot modify " + referenceString);

try {
    callEditEndpoint(reference, data);
} catch (UnauthorizedException e) {
    if (e.getMessage().startsWith("No permission to edit pull request")) {
        // escalate to a maintainer or re-authenticate with a privileged account
    } else throw e;
}

When it happens

Trigger: POST to edit-pull-request with a valid reference for a PR the authenticated user is not allowed to modify (not submitter, not maintainer, lacks write/modify permission on the project).

Common situations: Service account trying to edit another user's PR; user has read-only role on the project; group permission change removed modify rights; editing PRs in a project managed by another team.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to read code of source project:
• No permission to read code of target project:
• No permission to access pull request:
• Issue schedule permission required to set iterations
• No permission to update issue fields

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/366fcd817a47cd5d. Report an issue: GitHub.