theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

addLabel (POST on ProjectLabelResource) creates a label on a project but only if the caller can manage that project (SecurityUtils.canManageProject). Otherwise UnauthorizedException ('Not authorized') is thrown and no label is created. Managing labels requires project management rights, not just write access.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/ProjectLabelResource.java:43

@Produces(MediaType.APPLICATION_JSON)
@Singleton
public class ProjectLabelResource {

	private final ProjectLabelService projectLabelService;

	private final AuditService auditService;

	@Inject
	public ProjectLabelResource(ProjectLabelService projectLabelService, AuditService auditService) {
		this.projectLabelService = projectLabelService;
		this.auditService = auditService;
	}
	
	@Api(order=200, description="Add project label")
	@POST
	public Long addLabel(@NotNull ProjectLabel projectLabel) {
		if (!SecurityUtils.canManageProject(projectLabel.getProject()))
			throw new UnauthorizedException();
		projectLabelService.create(projectLabel);
		auditService.audit(projectLabel.getProject(), "added label \"" + projectLabel.getSpec().getName() + "\" via RESTful API", null, null);
		return projectLabel.getId();
	}
	
	@Api(order=300)
	@Path("/{projectLabelId}")
	@DELETE
	public Response removeLabel(@PathParam("projectLabelId") Long projectLabelId) {
		ProjectLabel projectLabel = projectLabelService.load(projectLabelId);
		if (!SecurityUtils.canManageProject(projectLabel.getProject()))
			throw new UnauthorizedException();
		projectLabelService.delete(projectLabel);
		auditService.audit(projectLabel.getProject(), "removed label \"" + projectLabel.getSpec().getName() + "\" via RESTful API", null, null);
		return Response.ok().build();
	}
	
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the caller the project 'Manage' role (or make them project owner/admin).
2. Ensure the request is authenticated with a token of a user who can manage the target project.
3. Verify the ProjectLabel body references the intended project.
4. Perform the change via the UI as a project admin if API rights cannot be extended.

Example fix

// before: ordinary member token
POST /~api/projects/1/labels  -> 401 Not authorized
// after: use/manage role
curl -X POST -H "Authorization: Bearer <manager-token>" -H "Content-Type: application/json" -d '{...}' http://server/~api/projects/1/labels

if (!SecurityUtils.canManageProject(project)) throw new AccessDeniedException("Manage permission required to add labels to " + project.getPath());

boolean canAddLabel = SecurityUtils.canManageProject(projectLabel.getProject());

try { client.addProjectLabel(label); } catch (NotAuthorizedException e) { log.error("Need Manage role on project to add labels"); }

When it happens

Trigger: POST /~api/label-requests or the project label endpoint with a ProjectLabel body whose project is one the caller cannot manage; unauthenticated POST; token of a plain member without manage role.

Common situations: Developer with write access assumes they can add labels but manage permission is a higher tier; wrong project referenced in the request body; automation using a non-admin service token.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not found
• Not authorized
• Not authorized
• No permission to access issue: ${referenceString}
• No permission to write code in issue project

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/200f2abca078fd95. Report an issue: GitHub.