theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

MentionedMeCriteria.getPredicate() builds an EXISTS subquery over CodeCommentMention for comments mentioning the current user. When User.get() is null (no authenticated user), it throws NotAcceptableException "Please login to perform this query" because 'me' is unresolvable.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/codecomment/MentionedMeCriteria.java:36

import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class MentionedMeCriteria extends Criteria<CodeComment> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<CodeComment, CodeComment> from, CriteriaBuilder builder) {
		if (User.get() != null) {
			Subquery<CodeCommentMention> mentionQuery = query.subquery(CodeCommentMention.class);
			Root<CodeCommentMention> mention = mentionQuery.from(CodeCommentMention.class);
			mentionQuery.select(mention);
			mentionQuery.where(builder.and(
					builder.equal(mention.get(CodeCommentMention.PROP_COMMENT), from),
					builder.equal(mention.get(CodeCommentMention.PROP_USER), User.get())));
			return builder.exists(mentionQuery);
		} else {
			throw new NotAcceptableException(_T("Please login to perform this query"));
		}
	}

	@Override
	public boolean matches(CodeComment comment) {
		if (User.get() != null)
			return comment.getMentions().stream().anyMatch(it->it.getUser().equals(User.get()));
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public String toStringWithoutParens() {
		return CodeCommentQuery.getRuleName(CodeCommentQueryLexer.MentionedMe);
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate the request (login or valid API token) before executing the query.
2. Replace MentionedMe with Mentioned("<user name>") in queries evaluated outside a user session.
3. Check SecurityUtils.getUser() != null before executing me-based queries and short-circuit with a login prompt.
4. Catch NotAcceptableException on the client and redirect to the login page.

Example fix

// before
var query = CodeCommentQuery.parse(project, "MentionedMe", true);
// executed anonymously -> 406
// after
if (SecurityUtils.getUser() == null)
    throw new NotAcceptableException("Please login to perform this query");
var query = CodeCommentQuery.parse(project, "MentionedMe", true);

// before executing a MentionedMe query
if (SecurityUtils.getUser() == null)
    throw new NotAcceptableException("Please login to perform this query");

static boolean hasCurrentUser() {
    return User.get() != null;
}

try {
    var predicate = new MentionedMeCriteria().getPredicate(projectScope, query, from, builder);
} catch (NotAcceptableException e) {
    redirectToLogin(); // HTTP 406 -> prompt authentication
}

When it happens

Trigger: Executing a code comment query containing MentionedMe while unauthenticated — anonymous REST/UI search requests, or server-side query evaluation with no security context.

Common situations: Shared/saved queries with MentionedMe run via unauthenticated API access; expired sessions; background services evaluating user-authored queries.

Related errors

• Please login to perform this query
• Please login to perform this query
• Authentication required
• Unauthenticated
• ${e.getMessage()}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/428b7689f1be5f90. Report an issue: GitHub.