theonedev/onedev · error · NotAcceptableException

"Please login to perform this query"

Error message

"Please login to perform this query"

What it means

RequestedForChangesByMeCriteria builds a JPA predicate from the current thread-bound user (User.get()). When there is no authenticated user (anonymous), it cannot resolve 'me' and throws NotAcceptableException with a localized 'Please login to perform this query' message during query evaluation.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/RequestedForChangesByMeCriteria.java:28

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class RequestedForChangesByMeCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null)
			return getCriteria(user).matches(request);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new RequestedForChangesByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(PullRequestQueryLexer.RequestedForChangesByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate the request (login session or personal access token) before running the query.
  2. Replace 'requested for changes by me' with 'requested for changes by <username>' in queries executed anonymously or by services.
  3. Hide/remove *ByMe queries from dashboards accessible to anonymous users.
  4. For REST calls, add the Authorization header with a valid OneDev access token.

Example fix

// before
GET /~api/query?query=requested for changes by me   // no auth -> 405
// after
curl -H "Authorization: Bearer <token>" '/~api/query?query=requested for changes by me'
Defensive patterns

Strategy: try-catch

Validate before calling

if (SecurityUtils.getUser() == null && query.contains("requested for changes by me"))
    throw new NotAcceptableException("Login required for 'by me' queries");

Type guard

boolean canEvaluateByMeCriteria() { return SecurityUtils.getUser() != null; }

Try / catch

try {
    result = queryService.query(query);
} catch (NotAcceptableException e) {
    if (e.getMessage().contains("Please login"))
        promptAuthentication(); // or rewrite query with explicit user
    else throw e;
}

Prevention

When it happens

Trigger: Executing/evaluating a pull request query containing 'requested for changes by me' while unauthenticated — e.g. REST/GraphQL query calls without a session or access token, or rendering a saved query for anonymous visitors.

Common situations: API scripts missing authorization headers; saved queries shared with anonymous users; expired sessions where the UI still submits a *ByMe query.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/66fc858263f904e7. Report an issue: GitHub.