theonedev/onedev · error · UnauthorizedException

No permission to read code of target project:

Error message

No permission to read code of target project: 

What it means

The TOD create-pull-request endpoint checks SecurityUtils.canReadCode(targetProject) for the target project (explicit targetProjectPath, or the source project's fork parent). Without code-read permission it throws a JAX-RS UnauthorizedException naming the target project path.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:1286

        Project sourceProject;
        if (sourceProjectPath == null)
            sourceProject = currentProject;
        else
            sourceProject = getProject(sourceProjectPath);

        if (!SecurityUtils.canReadCode(sourceProject))
            throw new UnauthorizedException("No permission to read code of source project: " + sourceProjectPath);

        Project targetProject;
        if (targetProjectPath != null) {
            targetProject = getProject(targetProjectPath);
        } else {
            targetProject = sourceProject.getForkedFrom();
            if (targetProject == null)
                targetProject = sourceProject;
        }
        if (!SecurityUtils.canReadCode(targetProject))
            throw new UnauthorizedException("No permission to read code of target project: " + targetProjectPath);

        if (targetBranch == null)
            targetBranch = targetProject.getDefaultBranch();
        if (targetBranch == null)
            throw new NotAcceptableException("No code in target project: " + targetProject.getPath());

        var target = new ProjectAndBranch(targetProject, targetBranch);
        var source = new ProjectAndBranch(sourceProject, sourceBranch);

        var info = new CreatePullRequestEssentialInfo();
        info.currentProject = currentProject;
        info.target = target;
        info.source = source;
        info.submitter = user;

        return info;
    }    

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant 'Read code' permission on the target project to the calling user/group.
2. Explicitly pass a targetProjectPath you are allowed to read instead of relying on fork resolution.
3. Verify the fork relationship: target defaults to the forked-from project.

Example fix

// before
// no targetProjectPath; fork parent team-b/lib not readable
// after
params.put("targetProjectPath", "team-a/forked-lib"); // readable target

Project targetProject = targetProjectPath != null ? getProject(targetProjectPath)
        : (sourceProject.getForkedFrom() != null ? sourceProject.getForkedFrom() : sourceProject);
if (!SecurityUtils.canReadCode(targetProject))
    throw new IllegalStateException("Current user cannot read code in " + targetProject.getPath());

try {
    callCreatePullRequest(params);
} catch (UnauthorizedException e) {
    if (e.getMessage().startsWith("No permission to read code of target project")) {
        // fall back to a readable fork/target or request access
    } else throw e;
}

When it happens

Trigger: POST to create-pull-request where targetProjectPath points to a project the user cannot read code in, or where targetProjectPath is omitted and the fork parent (sourceProject.getForkedFrom()) is inaccessible.

Common situations: Cross-fork PR where user can read the fork but not the upstream project; typo in target project path resolving to a restricted project; missing group permissions after team change.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to read code of source project:
• No permission to access pull request:
• No permission to edit pull request:
• Issue schedule permission required to set iterations
• No permission to update issue fields

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/2eeb092502923449. Report an issue: GitHub.