theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

NeedMyActionCriteria.getPredicate() builds a DB predicate via NeedUserActionCriteria for the current user (pull requests awaiting the user's action). With no authenticated user, User.get() is null and the criteria throws NotAcceptableException 'Please login to perform this query'.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/NeedMyActionCriteria.java:28

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class NeedMyActionCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null)
			return getCriteria(user).matches(request);
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	private Criteria<PullRequest> getCriteria(User user) {
		return new NeedUserActionCriteria(user);
	}
	
	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(PullRequestQueryLexer.NeedMyAction);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate the request (login or token) before running the query.
  2. Rewrite the query to reference a specific user instead of 'me'.
  3. Redirect anonymous users to the login page when the query contains user-relative criteria.

Example fix

// before
curl https://onedev/~api/pull-requests?query="wait for" is "me"
// after
curl -H "Authorization: Bearer <token>" https://onedev/~api/pull-requests?query="wait for" is "me"
Defensive patterns

Strategy: validation

Validate before calling

if (!isAuthenticated()) redirect('/login'); // before querying 'need my action'

Type guard

function isLoggedIn() { return User.get() != null; }

Try / catch

try { prs = query("need my action"); } catch (NotAcceptableException e) { promptLogin(); }

Prevention

When it happens

Trigger: Executing a pull request query containing 'need my action' (or similar wait-for-me criterion) on the DB evaluation path while unauthenticated.

Common situations: Anonymous visitors landing on 'my waiting' dashboards, REST clients missing auth tokens, shared query URLs containing user-relative criteria.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/9fcba4754c020f7f. Report an issue: GitHub.