theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

OneDev's WatchedByMeCriteria resolves the issue watch list of the 'current user' at query build time via User.get(). When no user is bound to the current request/session (anonymous context), the criteria cannot evaluate, so it throws NotAcceptableException with 'Please login to perform this query'. This is a guard against using self-referencing query criteria without an authenticated identity.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/issue/WatchedByMeCriteria.java:29

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.Issue;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class WatchedByMeCriteria extends Criteria<Issue> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Issue, Issue> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(Issue issue) {
		var user = User.get();
		if (user != null)
			return getCriteria(user).matches(issue);
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<Issue> getCriteria(User user) {
		return new WatchedByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return IssueQuery.getRuleName(WatchedByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Log in (or supply an Authorization token / session cookie) before running the query
  2. Replace 'watched by me' with an explicit user criteria such as 'watched by <user>' so no current-user context is needed
  3. For API/automation, configure a personal access token for the client and pass it on every request
  4. If triggered in a background thread, run the query in a user context (e.g. with User set via the appropriate context holder)

Example fix

// before (anonymous REST call)
curl http://onedev/api/query/issues?query="watched by me"
// after
curl -H "Authorization: Bearer <token>" 'http://onedev/api/query/issues?query=watched%20by%20me'
Defensive patterns

Strategy: type-guard

Validate before calling

if (OneDevCurrentUser.get() == null) { throw new AuthRequiredError("login required for 'watched by me' query"); }

Type guard

function hasUser(): boolean { return io.onedev.server.model.User.get() != null; }

Try / catch

try { runIssueQuery(query); } catch (NotAcceptableException e) { if (e.getMessage().contains("Please login")) { reauthenticate(); retryQuery(); } else { throw e; } }

Prevention

When it happens

Trigger: Executing an issue query containing the 'watched by me' criteria (e.g. REST/GraphQL query endpoint or saved query evaluation) while the HTTP request has no authenticated session — anonymous access, expired session, or calling query evaluation from a non-web thread without a User bound.

Common situations: Users whose login session expired then retry a saved issue query; API clients calling issue query endpoints without an auth token; scripts using OneDev REST API anonymously; jobs executing queries in background threads without user context.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/19a9f399eaa035d4. Report an issue: GitHub.