theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

PackLabelResource.createLabel (POST /pack-labels) requires SecurityUtils.canWritePack(project) on the project owning the pack; otherwise it throws UnauthorizedException (HTTP 401). Creating package labels is a write operation on the project's package registry.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/PackLabelResource.java:34

@Api(name="Package Label")
@Path("/package-labels")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Singleton
public class PackLabelResource {

	private final PackLabelService packLabelService;

	@Inject
	public PackLabelResource(PackLabelService packLabelService) {
		this.packLabelService = packLabelService;
	}
	
	@Api(order=200, description="Create package label")
	@POST
	public Long createLabel(@NotNull PackLabel packLabel) {
		if (!SecurityUtils.canWritePack(packLabel.getPack().getProject()))
			throw new UnauthorizedException();
		packLabelService.create(packLabel);
		return packLabel.getId();
	}
	
	@Api(order=300)
	@Path("/{packLabelId}")
	@DELETE
	public Response deleteLabel(@PathParam("packLabelId") Long packLabelId) {
		PackLabel buildLabel = packLabelService.load(packLabelId);
		if (!SecurityUtils.canWritePack(buildLabel.getPack().getProject()))
			throw new UnauthorizedException();
		packLabelService.delete(buildLabel);
		return Response.ok().build();
	}
	
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the calling user Can Write/Can Manage packages permission on the project
2. Use a token from a user with write access to the project
3. Verify packLabel.pack points to a project where you actually have write access

Example fix

// before
curl -u reader:token -X POST -d '{...}' /~api/pack-labels -> 401 Not authorized
// after
// grant writer role, then:
curl -u writer:token -X POST -d '{...}' /~api/pack-labels -> 200

// verify write access on the pack's project before POSTing
const project = getProject(pack.projectId); // caller must hold write access
if (!userCanWritePackages(user, project)) requestElevation();

try { createPackLabel(label); } catch (WebApplicationException e) { if (e.getResponse().getStatus() == 401) switchToWriterCredential(); else throw e; }

When it happens

Trigger: POSTing a PackLabel for a pack whose project the authenticated user cannot write to (read-only user, anonymous request, wrong project in payload).

Common situations: Publishing pipelines with a read-only deploy token; user promoted to reader only; label automation pointing at the wrong project's packs.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized
• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• Code write permission is required to edit auto merge
• Not authorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/7a2b5837d37d3bea. Report an issue: GitHub.