theonedev/onedev · error · UnauthorizedException

No permission to update issue description

Error message

No permission to update issue description

What it means

editIssue guards the "description" field with the same canModifyIssue check; if it fails, UnauthorizedException("No permission to update issue description") is thrown. The user is authenticated but not authorized to modify this issue.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:610

        if (user == null)
            throw new UnauthenticatedException();

        var currentProject = getProject(currentProjectPath);

        var issue = getIssue(currentProject, issueReference);

        IssueHelper.normalizeData(data);

        var title = (String) data.remove("title");
        if (title != null) { 
            if (!SecurityUtils.canModifyIssue(subject, issue))
                throw new UnauthorizedException("No permission to update issue title");
            issueChangeService.changeTitle(user, issue, title);
        }

        if (data.containsKey("description")) {
            if (!SecurityUtils.canModifyIssue(subject, issue))
                throw new UnauthorizedException("No permission to update issue description");
            issueChangeService.changeDescription(user, issue, (String) data.remove("description"));
        }

        var confidential = (Boolean) data.remove("confidential");
        if (confidential != null) {
            if (!SecurityUtils.canModifyIssue(subject, issue))
                throw new UnauthorizedException("No permission to update issue confidential");
            issueChangeService.changeConfidential(user, issue, confidential);
        }

        Integer ownEstimatedTime = (Integer) data.remove("ownEstimatedTime");
        if (ownEstimatedTime != null) {
            if (!subscriptionService.isSubscriptionActive())
                throw new NotAcceptableException("An active subscription is required for this feature");
            if (!issue.getProject().isTimeTracking())
                throw new NotAcceptableException("Time tracking needs to be enabled for the project");
            if (!SecurityUtils.canScheduleIssues(subject, issue.getProject()))
                throw new UnauthorizedException("Issue schedule permission required to set own estimated time");

View on GitHub (pinned to d44925c47c)

Solutions

1. Confirm the user can edit the issue in the OneDev UI; if not, obtain Edit Issue permission for the project.
2. Exclude the "description" key when the user lacks permission, splitting the update into permitted fields.
3. For confidential issues, have an admin grant access or use an authorized account/token.
4. Pre-check permissions by fetching issue detail and only including fields the caller may modify.

Example fix

// before
editIssue(project, ref, {description: "Updated"}) // 403
// after
if (canEdit) editIssue(project, ref, {description: "Updated"})

if ('description' in payload && !canModifyIssue) delete payload.description;
if (!canModifyIssue && Object.keys(payload).length) throw new Error('No permission to modify this issue');

try { await editIssue(project, ref, payload); } catch (e) { if (e.status === 403 && /description/.test(e.message)) { log('Permission denied for description update'); return partialUpdate(); } throw e; }

When it happens

Trigger: Sending {"description": ...} in the edit-issue data map while the user lacks issue-modify permission on the target issue/project, or the issue is confidential to them.

Common situations: Bulk-update scripts iterating issues across projects with differing permissions; token owners whose role downgraded; AI tools updating issues in projects the user can only read.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• No permission to update issue title
• No permission to update issue confidential
• Issue schedule permission required to set own estimated time
• Access denied
• Issue schedule permission required to set own estimated time

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/fe39205f6b4b513f. Report an issue: GitHub.