theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

CreatedByMeCriteria.getPredicate() builds a JPA predicate matching comments created by the current user. If there is no authenticated user (User.get() == null), it throws NotAcceptableException with the localized message "Please login to perform this query". The criteria fundamentally requires a user context to resolve 'me'.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/codecomment/CreatedByMeCriteria.java:29

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.CodeComment;
import io.onedev.server.model.User;
import io.onedev.server.security.SecurityUtils;
import io.onedev.server.util.ProjectScope;

public class CreatedByMeCriteria extends CreatedByCriteria {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<CodeComment, CodeComment> from, CriteriaBuilder builder) {
		if (User.get() != null) {
			Path<?> attribute = from.get(CodeComment.PROP_USER);
			return builder.equal(attribute, User.get());
		} else {
			throw new NotAcceptableException(_T("Please login to perform this query"));
		}
	}

	@Override
	public User getUser() {
		return SecurityUtils.getUser();
	}

	@Override
	public boolean matches(CodeComment comment) {
		if (User.get() != null)
			return User.get().equals(comment.getUser());
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public String toStringWithoutParens() {

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate before running the query (log in via UI or supply valid credentials/API token for REST calls).
2. Replace CreatedByMe with CreatedBy("<user name>") in queries evaluated without a user session.
3. Guard the search flow: check SecurityUtils.getUser() != null before parsing/executing me-based queries.
4. Catch NotAcceptableException (HTTP 406) on the client and redirect to login.

Example fix

// before
var query = CodeCommentQuery.parse(project, "CreatedByMe", true);
var result = query.getPredicate(...); // anonymous -> 406
// after
if (SecurityUtils.getUser() == null)
    throw new NotAcceptableException("Please login to perform this query");
var query = CodeCommentQuery.parse(project, "CreatedByMe", true);

// before executing a me-based query
if (SecurityUtils.getUser() == null)
    throw new NotAcceptableException("Please login to perform this query");

static boolean hasCurrentUser() {
    return User.get() != null;
}

try {
    var predicate = new CreatedByMeCriteria().getPredicate(projectScope, query, from, builder);
} catch (NotAcceptableException e) {
    redirectToLogin(); // HTTP 406 -> prompt authentication
}

When it happens

Trigger: Executing a query containing the CreatedByMe criterion while unauthenticated — e.g. an anonymous HTTP request hitting a search endpoint, or server-side evaluation with no security context bound.

Common situations: Saved/shared query containing CreatedByMe executed via API without credentials; session expiry before running the search; calling the search from a scheduled job or webhook where no user is logged in.

Related errors

• Please login to perform this query
• Please login to perform this query
• Authentication required
• Unauthenticated
• ${e.getMessage()}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/5ca6c440e5826b70. Report an issue: GitHub.