theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

CommentedByMeCriteria.getPredicate() builds a JPA EXISTS subquery checking whether the current user commented on an issue. Since 'me' depends on the authenticated user, it throws NotAcceptableException('Please login to perform this query') when User.get() is null.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/issue/CommentedByMeCriteria.java:36

import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class CommentedByMeCriteria extends Criteria<Issue> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Issue, Issue> from, CriteriaBuilder builder) {
		if (User.get() != null) {
			Subquery<IssueComment> commentQuery = query.subquery(IssueComment.class);
			Root<IssueComment> comment = commentQuery.from(IssueComment.class);
			commentQuery.select(comment);
			commentQuery.where(builder.and(
					builder.equal(comment.get(IssueComment.PROP_ISSUE), from),
					builder.equal(comment.get(IssueComment.PROP_USER), User.get())));
			return builder.exists(commentQuery);
		} else {
			throw new NotAcceptableException(_T("Please login to perform this query"));
		}
	}

	@Override
	public boolean matches(Issue issue) {
		if (User.get() != null)
			return issue.getComments().stream().anyMatch(it->it.getUser().equals(User.get()));
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public String toStringWithoutParens() {
		return IssueQuery.getRuleName(IssueQueryLexer.CommentedByMe);
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate the request (session or personal access token) before running the query.
2. Set a user context for system-driven query execution.
3. Use '~commented by "username"~' instead of the user-relative operator when unauthenticated.
4. Catch NotAcceptableException and respond with an authentication prompt.

Example fix

// before
List<Issue> issues = issueQueryManager.find(null, "~commented by me~");

// after
if (User.get() == null)
    throw new NotAcceptableException("Please login to perform this query");
List<Issue> issues = issueQueryManager.find(null, "~commented by me~");

if (User.get() == null) throw new NotAcceptableException("Please login to perform this query");

boolean ready = User.get() != null;

try { issues = issueQueryManager.find(null, query); } catch (NotAcceptableException e) { throw new UnauthorizedException(e.getMessage()); }

When it happens

Trigger: Executing an issue query containing '~commented by me~' through the DB predicate path with no authenticated user: anonymous REST/GraphQL call, background process, or server-side evaluation without a user bound.

Common situations: Integrations calling issue search without tokens; CI scripts querying issues anonymously; email/webhook handlers that forgot to set user context.

Related errors

• Please login to perform this query
• Not authenticated
• Invalid access token
• Authentication required
• Invalid access token

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/35dbbea415252203. Report an issue: GitHub.