theonedev/onedev · error · UnauthorizedException

Not authorized to create project under "{0}"

Error message

Not authorized to create project under "{0}"

What it means

OneDev throws this UnauthorizedException when a user attempts to create a child project under an existing parent project without the 'Create Children' permission on that parent. In DefaultProjectService.setup, when walking the path, if the parent project exists, the child name is not found, and SecurityUtils.canCreateChildren(subject, project) returns false, the error is thrown with the parent's path interpolated into the message.

Source

Thrown at server-core/src/main/java/io/onedev/server/service/impl/DefaultProjectService.java:564

		List<String> names = Splitter.on("/").omitEmptyStrings().trimResults().splitToList(path);
		Project project = null;
		for (String name : names) {
			Project child;
			if (project == null || !project.isNew()) {
				// Query database directly instead of calling findByName to fix issue 
				// #923 - Multi level projects after import and 1dev upgrade are mingled
				EntityCriteria<Project> criteria = EntityCriteria.of(Project.class);
				if (project != null)
					criteria.add(Restrictions.eq(Project.PROP_PARENT, project));
				else
					criteria.add(Restrictions.isNull(Project.PROP_PARENT));
				criteria.add(Restrictions.eq(Project.PROP_NAME, name));
				child = find(criteria);
				if (child == null) {
					if (project == null && !SecurityUtils.canCreateRootProjects(subject))
						throw new UnauthorizedException(_T("Not authorized to create root project"));
					if (project != null && !SecurityUtils.canCreateChildren(subject, project))
						throw new UnauthorizedException(MessageFormat.format(_T("Not authorized to create project under \"{0}\""), project.getPath()));
					child = new Project();
					child.setName(name);
					child.setParent(project);
				}
			} else {
				child = new Project();
				child.setName(name);
				child.setParent(project);
			}
			project = child;
		}

		Project parent = project.getParent();
		while (parent != null && parent.isNew()) {
			parent.setCodeManagement(false);
			parent.setIssueManagement(false);
			parent = parent.getParent();
		}

View on GitHub (pinned to d44925c47c)

Solutions

1. Ask the parent project's maintainer/admin to grant the user the 'Create Children' permission on that project.
2. Create the child project under a parent where the user already has the required permission.
3. Have an administrator create the child project and share it with the user.
4. If done via API/token, ensure the token's owner has the necessary permission on the parent.

Example fix

// before
curl -X POST -u user:pass -H 'Content-Type: application/json' \
  -d '{"name":"restricted-parent/child"}' https://onedev.example.com/api/projects
// after: user granted 'Create Children' on 'restricted-parent', same call succeeds

// Pre-check: does the caller have manage rights on the parent project?
var parentPath = projectName.substring(0, projectName.lastIndexOf('/'));
var parent = projectService.findByPath(parentPath);
if (parent != null && !securityUtils.canCreateChildren(subject, parent)) {
    throw new IllegalStateException("No 'Create Children' permission on " + parentPath);
}

function canCreateChildrenIn(subject, parentProject) {
  return parentProject != null &&
    subject.getAuthorizedProjects().stream()
      .anyMatch(a -> a.getProject().getId().equals(parentProject.getId())
        && a.getRole().implies(ProjectPrivileges.MANAGE));
}

try {
    projectService.setup(subject, parentPath + "/" + childName);
} catch (UnauthorizedException e) {
    logger.warn("Cannot create child under {}: {}", parentPath, e.getMessage());
    // prompt user to request access or choose another parent
}

When it happens

Trigger: Calling ProjectService.setup with a path like 'parent/child' where 'parent' exists, 'child' does not, and the authenticated subject lacks 'Create Children' (manage) permission on the parent project.

Common situations: A user without maintainer/manage rights on a parent project tries to add a sub-project via REST API or UI; CI automation tokens lacking write access to the namespace try to create child projects; permission scope on the parent was narrowed (e.g. moved from a group with create rights).

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized to create root project
• Issue schedule permission required to set iterations
• No permission to update issue fields
• No permission to add specified link for specified issues
• No permission to read code of source project:

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/70471aa7b8efccac. Report an issue: GitHub.