theonedev/onedev · error · UnauthorizedException

No permission to read code of source project:

Error message

No permission to read code of source project: 

What it means

When creating a pull request via the TOD endpoint, OneDev checks SecurityUtils.canReadCode(sourceProject) for the resolved source project (either currentProject or the project at sourceProjectPath). If the current user lacks code-read permission, it throws a JAX-RS UnauthorizedException (HTTP 401/403) naming the source project path.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:1275

                String currentProjectPath, 
                @Nullable String targetProjectPath, 
                @Nullable String sourceProjectPath,
                @Nullable String targetBranch, 
                String sourceBranch) {
        var user = SecurityUtils.getUser();
        if (user == null)
            throw new UnauthenticatedException();
        
        var currentProject = getProject(currentProjectPath);

        Project sourceProject;
        if (sourceProjectPath == null)
            sourceProject = currentProject;
        else
            sourceProject = getProject(sourceProjectPath);

        if (!SecurityUtils.canReadCode(sourceProject))
            throw new UnauthorizedException("No permission to read code of source project: " + sourceProjectPath);

        Project targetProject;
        if (targetProjectPath != null) {
            targetProject = getProject(targetProjectPath);
        } else {
            targetProject = sourceProject.getForkedFrom();
            if (targetProject == null)
                targetProject = sourceProject;
        }
        if (!SecurityUtils.canReadCode(targetProject))
            throw new UnauthorizedException("No permission to read code of target project: " + targetProjectPath);

        if (targetBranch == null)
            targetBranch = targetProject.getDefaultBranch();
        if (targetBranch == null)
            throw new NotAcceptableException("No code in target project: " + targetProject.getPath());

        var target = new ProjectAndBranch(targetProject, targetBranch);

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user (or their group) 'Read code' permission on the source project in project > access control.
2. Use a source project the account can actually read.
3. Authenticate as a user/token with sufficient privileges.

Example fix

// before
var params = "currentProject=team-a/app&sourceProjectPath=team-b/lib";
// after — grant user Read code on team-b/lib, or use an accessible project
var params = "currentProject=team-a/app";

Project sourceProject = sourceProjectPath != null ? getProject(sourceProjectPath) : currentProject;
if (!SecurityUtils.canReadCode(sourceProject))
    throw new IllegalStateException("Current user cannot read code in " + sourceProject.getPath());

try {
    callCreatePullRequest(params);
} catch (UnauthorizedException e) {
    if (e.getMessage().startsWith("No permission to read code of source project")) {
        // surface an actionable message: request access to the project
    } else throw e;
}

When it happens

Trigger: POST to the create-pull-request endpoint with a sourceProjectPath the authenticated user cannot read code in, or when the user has no code access to currentProject.

Common situations: API token/account missing project-level 'Read code' permission; referencing another team's project as source; project visibility changed recently.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to read code of target project:
• No permission to access pull request:
• No permission to edit pull request:
• Issue schedule permission required to set iterations
• No permission to update issue fields

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/7309e04afea92a8c. Report an issue: GitHub.