theonedev/onedev · error · NotAcceptableException

"Please login to perform this query"

Error message

"Please login to perform this query"

What it means

WatchedByMeCriteria.getPredicate() builds the predicate for the "watched by me" pull request rule, resolving "me" via User.get(). When no user is authenticated, it throws NotAcceptableException("Please login to perform this query") because watching is a per-user relationship.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/WatchedByMeCriteria.java:29

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class WatchedByMeCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null)
			return getCriteria(user).matches(request);
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new WatchedByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(WatchedByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate the request (login or private access token) before querying.
  2. Use "watched by <user>" (WatchedByUserCriteria) with an explicit user in the query.
  3. Set a security context for background jobs that must run user-relative queries.
  4. Fix proxy/SSO configuration so the user identity reaches OneDev.

Example fix

// before
query = "watched by me"; // anonymous call fails

// after
query = "watched by john"; // and/or send Authorization header
Defensive patterns

Strategy: validation

Validate before calling

if (SecurityUtils.getUser() == null) throw new LoginRequiredException();

Type guard

var user = SecurityUtils.getUser();
String query = user != null ? "watched by me" : "watched by " + explicitUser;

Try / catch

try { result = query("watched by me"); }
catch (NotAcceptableException e) { reauthenticateAndRetry(); }

Prevention

When it happens

Trigger: Executing a pull request query with the "watched by me" criterion through getPredicate() in an unauthenticated request or user-less thread.

Common situations: Anonymous API access; integration scripts running saved queries without tokens; auth proxy misconfiguration dropping identity headers.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/676e674b36c6ec58. Report an issue: GitHub.