theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

getProject returns ProjectData for a project id but first checks SecurityUtils.canAccessProject; users without any access to the (typically private) project receive UnauthorizedException ('Not authorized'). Even loading the project's public REST representation requires explicit access permission.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/ProjectResource.java:109

	@Inject
	private CommitInfoService commitInfoService;
	
	@Inject
	private UrlService urlService;

	@Inject
	private AuditService auditService;

	@Inject
	private Validator validator;
		
	@Api(order=100)
	@Path("/{projectId}")
    @GET
    public ProjectData getProject(@PathParam("projectId") Long projectId) {
    	Project project = projectService.load(projectId);
    	if (!SecurityUtils.canAccessProject(project))
			throw new UnauthorizedException();
     	return ProjectData.from(project);
    }

	@Api(order=125)
	@Path("/ids/{path:.*}")
	@GET
	public Long getProjectId(@PathParam("path") String path) {
		var project = projectService.findByPath(path);
		if (project != null) {
			if (!SecurityUtils.canAccessProject(project))
				throw new NotFoundException("Project not found or inaccessible: " + path);
			return project.getId();
		} else {
			throw new NotFoundException("Project not found or inaccessible: " + path);
		}
	}
	
	@Api(order=150)

View on GitHub (pinned to d44925c47c)

Solutions

1. Add the calling user to the project with at least a role granting access (e.g. Read).
2. Authenticate the request with a valid token of a member.
3. If the project should be publicly readable, change its visibility to public in project settings.
4. Verify the projectId is the intended one.

Example fix

// before: anonymous access to private project
curl http://server/~api/projects/5  -> Not authorized
// after
curl -H "Authorization: Bearer <member-token>" http://server/~api/projects/5

Project project = projectService.load(projectId);
if (!SecurityUtils.canAccessProject(project)) throw new AccessDeniedException("No access to project " + project.getPath());

boolean canRead = SecurityUtils.canAccessProject(project);

try { project = client.getProject(projectId); } catch (NotAuthorizedException e) { log.warn("Project {} not accessible with current credentials", projectId); }

When it happens

Trigger: GET /~api/projects/{projectId} by an anonymous user on a private project, a logged-in user who is not a member, or a token lacking access to that project.

Common situations: Automation using a token of a user never added to the project; project visibility switched from public to private breaking existing integrations; wrong projectId; guest users hitting endpoints of restricted projects.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Unauthorized
• Not authorized
• Not authorized
• Project not found or inaccessible: ${path}
• Access denied

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/218ad9ac0e988a78. Report an issue: GitHub.