theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

CommentedByMeCriteria.getPredicate() builds a JPA predicate for pull requests the current user commented on. Because 'commented by me' is user-relative, an anonymous session (User.get() == null) makes the criteria throw NotAcceptableException 'Please login to perform this query' instead of producing a predicate.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/CommentedByMeCriteria.java:28

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class CommentedByMeCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null)
			return getCriteria(user).matches(request);
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new CommentedByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(PullRequestQueryLexer.CommentedByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Log in before running the query (valid session or personal access token).
  2. Replace 'me' with an explicit username criterion in the query string.
  3. Guard the UI/API caller to fall back to a non-user-relative default query for anonymous users.

Example fix

// before
query = 'commented by me'; // throws for guests
// after
query = user != null ? 'commented by me' : 'commented by ("alice")';
Defensive patterns

Strategy: validation

Validate before calling

boolean canRunUserQuery = User.get() != null || !queryString.contains("commented by me");

Type guard

function isAuthenticated() { return User.get() !== null; }

Try / catch

try { runQuery(q); } catch (NotAcceptableException e) { fallbackToAnonymousDefaultQuery(); }

Prevention

When it happens

Trigger: Evaluating a pull request query containing 'commented by me' against the database (getPredicate path) while the request has no authenticated user.

Common situations: Anonymous visitors opening a page whose default/URL-supplied query uses '~commented by me', REST query calls without auth headers, embedded query widgets rendered for guests.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/4d6eccbb4cb16df6. Report an issue: GitHub.