theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

ApprovedByMeCriteria.getPredicate resolves 'me' via User.get(); on an unauthenticated or non-web thread it throws NotAcceptableException('Please login to perform this query') instead of building a JPA predicate for the pull-request query.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/ApprovedByMeCriteria.java:34

import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class ApprovedByMeCriteria extends ApprovedByCriteria {

	private static final long serialVersionUID = 1L;

	@Override
	public User getUser() {
		return SecurityUtils.getUser();
	}

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).matches(request);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new ApprovedByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(PullRequestQueryLexer.ApprovedByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate the call (login session or access token) before running the query.
  2. Use 'approved by "<username>"' (ApprovedByUserCriteria) for headless contexts.
  3. Wrap evaluation in a block that establishes the intended user context.
  4. Catch NotAcceptableException and prompt the client to log in.

Example fix

// before
query = "approved by me" // anonymous -> 406
// after
query = "approved by \"alice\"" with Authorization header
Defensive patterns

Strategy: try-catch

Validate before calling

if (SecurityUtils.getUser() == null && queryText.contains("approved by me")) promptLogin();

Type guard

User u = User.get(); if (u != null) { /* safe */ }

Try / catch

try { requests = pullRequestQueryService.query(...); } catch (NotAcceptableException e) { requireAuth(); }

Prevention

When it happens

Trigger: Evaluating a pull-request query containing 'approved by me' (getPredicate) while anonymous: unauthenticated REST/GraphQL calls, scheduled jobs, or message handlers without a bound user.

Common situations: CI scripts querying pull requests with 'approved by me' using no token; webhooks/background processing evaluating user-relative queries; tests missing user setup.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/35e13bda0a553b39. Report an issue: GitHub.