theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

MentionedMeCriteria.getPredicate builds a JPA predicate matching issues where the current user was mentioned. When User.get() returns null (no authenticated user in the request context), it throws NotAcceptableException with 'Please login to perform this query' because the criterion is meaningless without a user.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/issue/MentionedMeCriteria.java:36

import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class MentionedMeCriteria extends Criteria<Issue> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Issue, Issue> from, CriteriaBuilder builder) {
		if (User.get() != null) {
			Subquery<IssueMention> mentionQuery = query.subquery(IssueMention.class);
			Root<IssueMention> mention = mentionQuery.from(IssueMention.class);
			mentionQuery.select(mention);
			mentionQuery.where(builder.and(
					builder.equal(mention.get(IssueMention.PROP_ISSUE), from),
					builder.equal(mention.get(IssueMention.PROP_USER), User.get())));
			return builder.exists(mentionQuery);
		} else {
			throw new NotAcceptableException(_T("Please login to perform this query"));
		}
	}

	@Override
	public boolean matches(Issue issue) {
		if (User.get() != null)
			return issue.getMentions().stream().anyMatch(it->it.getUser().equals(User.get()));
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public String toStringWithoutParens() {
		return IssueQuery.getRuleName(IssueQueryLexer.MentionedMe);
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate the request (login or valid API session token) before running the query.
2. Send Authorization credentials on REST calls instead of calling anonymously.
3. Rewrite the saved query to use an explicit user instead of 'me' for unauthenticated contexts.
4. Catch NotAcceptableException and return 406 prompting login.

Example fix

// before
curl http://server/api/issues?query="mentioned by me"
// after
curl -H "Authorization: Bearer <token>" http://server/api/issues?query="mentioned by me"

// Ensure authenticated before running me-based queries
if (SecurityUtils.getUser() == null)
    throw new NotAcceptableException("Please login to perform this query");

// Narrow to authenticated user
User currentUser = User.get();
if (currentUser == null) {
    // cannot evaluate me-based criteria
    return null;
}

// catch on query execution
try {
    List<Issue> issues = query.find();
} catch (NotAcceptableException e) {
    response.setStatus(406);
    response.getWriter().write("Login required");
}

When it happens

Trigger: Executing/evaluating an issue query containing 'mentioned by me' (MentionedMe criteria) in a context with no logged-in user, e.g. anonymous REST query or a job without user context.

Common situations: Anonymous API calls to issue query endpoints using '~me' style criteria; scheduled jobs or webhooks running without an authenticated session executing saved queries containing mentioned-by-me.

Related errors

• Please login to perform this query
• No project in query context
• No branch in query context
• Authentication required
• Unauthenticated

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/78046ba55573efef. Report an issue: GitHub.