theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

GET AccessTokenAuthorizationResource.getAuthorization loads an access token authorization by ID and allows access only if the caller is a server administrator or the owner of the access token the authorization belongs to. Otherwise it throws UnauthorizedException ('Not authorized', HTTP 401).

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/AccessTokenAuthorizationResource.java:55

	private final AccessTokenAuthorizationService accessTokenAuthorizationService;

	private final AuditService auditService;

	@Inject
	public AccessTokenAuthorizationResource(AccessTokenAuthorizationService accessTokenAuthorizationService, AuditService auditService) {
		this.accessTokenAuthorizationService = accessTokenAuthorizationService;
		this.auditService = auditService;
	}

	@Api(order=100, description = "Get access token authorization of specified id")
	@Path("/{authorizationId}")
	@GET
	public AccessTokenAuthorization getAuthorization(@PathParam("authorizationId") Long authorizationId) {
		var authorization = accessTokenAuthorizationService.load(authorizationId);
		var owner = authorization.getToken().getOwner();
		if (!isAdministrator() && !owner.equals(getAuthUser())) 
			throw new UnauthorizedException();
		return authorization;
	}
	
	@Api(order=200, description="Create access token authorization. Access token owner should have permission to manage authorized project")
	@POST
	public Long createAuthorization(@NotNull AccessTokenAuthorization authorization) {
		var owner = authorization.getToken().getOwner();
		if (!isAdministrator() && !owner.equals(getAuthUser())) 
			throw new UnauthorizedException();
		if (!canManageProject(owner.asSubject(), authorization.getProject()))
			throw new BadRequestException("Access token owner should have permission to manage authorized project");

		accessTokenAuthorizationService.createOrUpdate(authorization);
		if (!getAuthUser().equals(owner)) {
			var newAuditContent = VersionedXmlDoc.fromBean(authorization).toXML();
			auditService.audit(null, "created access token authorization in account \"" + owner.getName() + "\" via RESTful API", null, newAuditContent);
		}
		return authorization.getId();

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate with credentials of the token owner, or a user with server administrator role
2. Use an authorizationId that belongs to the authenticated token's owner
3. Have an administrator perform cross-user management calls
4. Check the token's owner before querying its authorizations

Example fix

// before
// alice's token fetching bob's authorization id 42 -> 401
GET /rest/access-tokens-authorizations/42
// after
// use bob's token for id 42, or list only your own authorizations
GET /rest/access-tokens-authorizations

// before calling, confirm the authorization belongs to you or you are admin
// skip IDs you don't own unless isAdmin is true

function canAccess(authorizationOwner, authUser, isAdmin) {
  return isAdmin || authorizationOwner === authUser;
}

try {
  const res = await fetch(`/rest/access-tokens-authorizations/${id}`, { headers });
  if (res.status === 401) throw new UnauthorizedError('Not authorized to view this authorization');
  return await res.json();
} catch (e) {
  if (e instanceof UnauthorizedError) { /* fall back to listing your own authorizations */ }
}

When it happens

Trigger: Fetching an access token authorization whose token owner differs from the authenticated user without administrator privileges — e.g. user 'alice' calling GET /rest/access-tokens-authorizations/42 where the authorization's token is owned by 'bob'.

Common situations: Using a personal access token created by a different account; enumerating other users' authorization IDs; CI config switched from an admin token to a non-admin token; an ID copied from a teammate's session.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Access token owner should have permission to manage authoriz
• Not authorized
• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• Code write permission is required to edit auto merge

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/40efee2e921f7af1. Report an issue: GitHub.