theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

MentionedMeCriteria.getPredicate() builds a DB predicate for pull requests where the current user was mentioned via MentionedUserCriteria. Because 'mentioned me' is user-relative, anonymous requests (User.get() == null) throw NotAcceptableException 'Please login to perform this query'.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/MentionedMeCriteria.java:28

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class MentionedMeCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null)
			return getCriteria(user).matches(request);
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new MentionedUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(PullRequestQueryLexer.MentionedMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Add valid credentials (session or access token) to the request.
  2. Replace 'me' with an explicit username in the query text.
  3. For anonymous-capable pages, detect the guest state and swap in a user-independent query.

Example fix

// before
query: "mentioned" is "me"   // 406 for guests
// after
query: "mentioned" is "bob"
Defensive patterns

Strategy: validation

Validate before calling

const isGuest = User.get() == null;
const q = isGuest ? 'mentioned is ("bob")' : 'mentioned is me';

Type guard

function requireAuthenticatedUser() { if (User.get() == null) throw new NotAcceptableException("login required"); return User.get(); }

Try / catch

try { evaluateQuery(q); } catch (NotAcceptableException e) { swapToAnonymousQuery(); }

Prevention

When it happens

Trigger: Evaluating a pull request query containing 'mentioned me' on the DB/predicate path without an authenticated user.

Common situations: Anonymous REST calls, guests clicking a bookmarked query link with '~mentioned me', integrations that strip the session cookie.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/915eec2bcc36d8f8. Report an issue: GitHub.