theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

OneDev's REST API for packages throws UnauthorizedException (rendered as 'Not authorized') when the authenticated subject lacks read permission on the project owning the requested pack. getPack loads the pack by id first, then checks SecurityUtils.canReadPack(project); if the check fails, no pack data is returned. This is an intentional authorization gate, not a bug.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/PackResource.java:58

public class PackResource {

	private final PackService packService;
	
	private final AuditService auditService;
	
	@Inject
	public PackResource(PackService packService, AuditService auditService) {
		this.packService = packService;
		this.auditService = auditService;
	}

	@Api(order=100)
	@Path("/{packId}")
    @GET
    public Pack getPack(@PathParam("packId") Long packId) {
		Pack pack = packService.load(packId);
    	if (!SecurityUtils.canReadPack(pack.getProject())) 
			throw new UnauthorizedException();
    	return pack;
    }

	@Api(order=150, description = "Get list of <a href='/~help/api/io.onedev.server.rest.PackLabelResource'>labels</a>")
	@Path("/{packId}/labels")
	@GET
	public Collection<PackLabel> getLabels(@PathParam("packId") Long packId) {
		Pack pack = packService.load(packId);
		if (!SecurityUtils.canReadPack(pack.getProject()))
			throw new UnauthorizedException();
		return pack.getLabels();
	}
	
	@Api(order=300)
	@Path("/{packId}/blobs")
    @GET
    public Collection<PackBlob> getBlobs(@PathParam("packId") Long packId) {
		Pack pack = packService.load(packId);

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the calling user a project role that includes pack read permission (at least 'Read Code' in project security settings).
2. Verify the API request is authenticated (valid Authorization token for a non-public project).
3. Confirm the packId actually refers to a pack in the project you have access to.
4. If using an access token, regenerate it with sufficient scope and update the client.

Example fix

// before: anonymous or under-privileged call
curl http://server/~api/packs/42
// after: authenticate with a token of a user who can read the project
curl -H "Authorization: Bearer <token>" http://server/~api/packs/42

// Java client-side pre-check (using OneDev services)
if (!SecurityUtils.canReadPack(pack.getProject()))
    throw new IllegalStateException("Skip GET /packs/" + packId + ": no read access to project " + pack.getProject().getPath());

boolean canCall = SecurityUtils.getSubject() != null && SecurityUtils.canReadPack(project);

try { pack = client.getPack(packId); } catch (ForbiddenException | ClientErrorException e) { log.warn("Not authorized to read pack {}", packId); }

When it happens

Trigger: GET /~api/packs/{packId} called by a user (or access token) that is not a member of the pack's project, lacks the 'Read Code'/'Read Packages' style permission, or calls the endpoint without authentication on a non-public project.

Common situations: Using a personal access token created without the right role; the pack id belongs to a different project than the user assumed; project membership or role was revoked; token expired and request falls back to anonymous access.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized
• Not authorized
• Not authorized
• Not authorized
• No permission to access issue: ${referenceString}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/007fcaedad9b7f55. Report an issue: GitHub.