theonedev/onedev · error · UnauthenticatedException

Not authenticated

Error message

Not authenticated

What it means

The editPullRequest endpoint first calls SecurityUtils.getUser(); if there is no authenticated user in the current session/context, it throws OneDev's UnauthenticatedException (mapped to HTTP 401). The endpoint requires an authenticated identity before any project or permission checks.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:1325

        var request = pullRequestService.find(requestReference.getProject(), requestReference.getNumber());
        if (request != null) {
            if (!SecurityUtils.canReadCode(request.getProject()))
                throw new UnauthorizedException("No permission to access pull request: " + referenceString);
            return request;
        } else {
            throw new NotFoundException("Pull request not found: " + referenceString);
        }
    }

    @SuppressWarnings("unchecked")
    @Path("/edit-pull-request")
    @POST
    public Map<String, Object> editPullRequest(
                @QueryParam("currentProject") @NotNull String currentProjectPath,
                @QueryParam("reference") @NotNull String pullRequestReference, @NotNull Map<String, Serializable> data) {
        var user = SecurityUtils.getUser();
        if (user == null)
            throw new UnauthenticatedException();

        var currentProject = getProject(currentProjectPath);

        var request = getPullRequest(currentProject, pullRequestReference);

        if (!SecurityUtils.canModifyPullRequest(request))
            throw new UnauthorizedException("No permission to edit pull request: " + pullRequestReference);

        normalizePullRequestData(data);

        var title = (String) data.remove("title");
        if (title != null) 
            pullRequestChangeService.changeTitle(user, request, title);

        if (data.containsKey("description")) 
            pullRequestChangeService.changeDescription(user, request, (String) data.remove("description"));

        var labelNames = (List<String>) data.remove("labels");

View on GitHub (pinned to d44925c47c)

Solutions

1. Send valid credentials (login session or API access token) with the request.
2. Generate a new access token in user profile > access tokens if the old one expired.
3. Log in to OneDev in the client session before invoking the endpoint.

Example fix

// before
curl -X POST 'https://onedev/api/tod/edit-pull-request?...'
// after
curl -X POST -H "Authorization: Bearer <access-token>" 'https://onedev/api/tod/edit-pull-request?...'

if (SecurityUtils.getUser() == null)
    throw new IllegalStateException("Authentication required before calling the TOD endpoint");

try {
    callEditEndpoint(params);
} catch (UnauthenticatedException e) {
    // refresh credentials / obtain a new access token, then retry once
}

When it happens

Trigger: POST to the edit-pull-request endpoint without valid authentication — e.g. no session cookie, missing/expired API token, or anonymous access to the AI TOD REST resource.

Common situations: Missing Authorization header when calling the REST API; expired or revoked access token; calling from a script without SSO login; cookie lost after server restart.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid access token
• Reviewer not found:
• Assignee not found:
• Invalid access token
• Authentication required

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/c054ab995ac1e400. Report an issue: GitHub.