theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

PackBlobResource.downloadBlob (GET /pack-blobs/{id}/content) checks SecurityUtils.canReadPack(project) before streaming the blob and throws UnauthorizedException (HTTP 401) when the authenticated user cannot read the project's packages. Package access follows project read permissions.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/PackBlobResource.java:54

	@Api(order=100, description = "Find package blob by project id and hash")
	@GET
	public PackBlob findByHash(@QueryParam("projectId") Long projectId, @QueryParam("hash") String hash) {
		var packBlob = packBlobService.findBySha256Hash(projectId, hash);
		if (packBlob != null) 
			return packBlob;			
		else 
			return null;			
	}
	
	@Api(order=100, description = "Download package blob")
	@Path("/{packBlobId}/content")
	@GET
	@Produces(APPLICATION_OCTET_STREAM)
	public StreamingOutput downloadBlob(@PathParam("packBlobId") Long packBlobId) {
		var packBlob = packBlobService.load(packBlobId);
		if (!SecurityUtils.canReadPack(packBlob.getProject()))
			throw new UnauthorizedException();
		
		var projectId = packBlob.getProject().getId();
		var hash = packBlob.getSha256Hash();
		return os -> {
			packBlobService.downloadBlob(projectId, hash, os);
		};
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the calling user/group read access to the project (Project > Access/Permission settings)
2. Use an access token belonging to a user with Can Read permission on the project
3. For CI, configure job token/secret with access to the required project's packages

Example fix

// before
curl /~api/pack-blobs/17/content  # anonymous -> 401 Not authorized
// after
curl -H "Authorization: Bearer <token-with-read-access>" /~api/pack-blobs/17/content

// preflight: check read access via a cheap authorized endpoint
GET /~api/projects/{projectPath} with same credentials; 403/404 => do not attempt blob download

try { downloadBlob(id); } catch (WebApplicationException e) { if (e.getResponse().getStatus() == 401) fixCredentialsOrPermissions(); else throw e; }

When it happens

Trigger: Downloading a package blob without read permission on the project that owns the pack (anonymous request, unauthenticated CI job, token of a user outside the project).

Common situations: CI job using a token lacking access to a private project's registry; anonymous pull from a private package repository; project permissions changed and broke existing pipelines.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized
• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• Code write permission is required to edit auto merge
• Not authorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/f843fd46aec7ddef. Report an issue: GitHub.