theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

UnauthorizedException thrown by PullRequestCommentResource.get when the authenticated user cannot read code of the project owning the pull request comment. Reading a comment requires Can Read Code on its project.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/PullRequestCommentResource.java:45

@Path("/pull-request-comments")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Singleton
public class PullRequestCommentResource {

	@Inject
	private Dao dao;

	@Inject
	private PullRequestCommentService commentService;

	@Api(order=100)
	@Path("/{commentId}")
	@GET
	public PullRequestComment get(@PathParam("commentId") Long commentId) {
		PullRequestComment comment = commentService.load(commentId);
    	if (!SecurityUtils.canReadCode(comment.getProject()))  
			throw new UnauthorizedException();
    	return comment;
	}
	
	@Api(order=200, description="Create new pull request comment")
	@POST
	public Long create(@NotNull PullRequestComment comment) {
    	if (!SecurityUtils.canReadCode(comment.getProject()) 
				|| !SecurityUtils.isAdministrator() && !comment.getUser().equals(SecurityUtils.getUser())) {
			throw new UnauthorizedException();
		}

		commentService.create(comment, new ArrayList<>());
		
		return comment.getId();
	}

	@Api(order=250, description="Update pull request comment of specified id")
	@Path("/{commentId}")

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user read access to the project (Can Read Code) or use a member account.
2. Verify the commentId belongs to a project the token's user can access.
3. Check project authorization settings / login state of the access token.

Example fix

// before
curl -u outsider:token /api/pull-request-comments/1001  // private project
// after
curl -u member:token /api/pull-request-comments/1001

PullRequestComment comment = commentService.load(commentId);
if (!SecurityUtils.canReadCode(comment.getProject())) {
    throw new SecurityException("No code-read access to project " + comment.getProject().getPath());
}

try { getComment(commentId); } catch (UnauthorizedException e) { log.warn("Cannot read comment " + commentId + ": access denied"); }

When it happens

Trigger: GET /pull-request-comments/{commentId} by a user whose role on the comment's project does not include code-read access.

Common situations: Accessing comments on a private project's pull request with a public-only account; token from a user not added to the project; project visibility changed to private after the client cached the URL.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Reviewer not found:
• Assignee not found:
• No permission to read code of source project:
• No permission to read code of target project:
• No permission to access pull request:

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/1565be692308b2d4. Report an issue: GitHub.