theonedev/onedev · error · NotAcceptableException

"Please login to perform this query"

Error message

"Please login to perform this query"

What it means

ToBeMergedByMeCriteria.getPredicate() translates the "to be merged by me" pull request rule into a JPA predicate. The rule is inherently user-relative; if User.get() is null (anonymous context) it throws NotAcceptableException("Please login to perform this query") because there is no user to filter by.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/ToBeMergedByMeCriteria.java:28

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class ToBeMergedByMeCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).matches(request);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new ToBeMergedByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(PullRequestQueryLexer.ToBeMergedByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate the client (login or access token) before running the query.
  2. Use the explicit "to be merged by <user>" rule (ToBeMergedByUserCriteria) instead of "me".
  3. Set up an impersonated user context in server-side automation before query evaluation.
  4. Verify auth configuration (SSO/session) so anonymous users cannot submit user-relative queries.

Example fix

// before
String query = "to be merged by me";

// after (API, anonymous-safe)
String query = "to be merged by john"; // or authenticate the request
Defensive patterns

Strategy: validation

Validate before calling

if (SecurityUtils.getUser() == null) throw new LoginRequiredException(); // client-side pre-check

Type guard

var user = SecurityUtils.getUser();
String query = user != null ? "to be merged by me" : "to be merged by " + fallbackUserName;

Try / catch

try { runQuery("to be merged by me"); }
catch (NotAcceptableException e) { reauthenticate(); runQuery("to be merged by " + currentUser.getName()); }

Prevention

When it happens

Trigger: Executing a pull request query containing "to be merged by me" through getPredicate() while the request is unauthenticated or the thread lacks a user context.

Common situations: Anonymous dashboard/API queries; saved queries executed by integration scripts without tokens; proxies stripping authentication before OneDev.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/9fc7a9dde7d1d859. Report an issue: GitHub.