theonedev/onedev · error · NotAcceptableException

"Please login to perform this query"

Error message

"Please login to perform this query"

What it means

ToBeReviewedByMeCriteria.getPredicate() builds the database predicate for the "to be reviewed by me" pull request rule. Because the rule depends on the current user, an anonymous context (User.get() == null) triggers NotAcceptableException("Please login to perform this query") rather than returning an empty result.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/ToBeReviewedByMeCriteria.java:28

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class ToBeReviewedByMeCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).matches(request);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new ToBeReviewedByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(PullRequestQueryLexer.ToBeReviewedByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Re-authenticate and retry the query with valid credentials.
  2. Replace "to be reviewed by me" with "to be reviewed by <user>" in the query string.
  3. Ensure scheduled/CI jobs impersonate a user (e.g. via access token) when running such queries.
  4. Check SSO/session configuration so authenticated requests retain their user context.

Example fix

// before
GET /~api/pull-requests?query="to be reviewed by me"

// after
GET /~api/pull-requests?query="to be reviewed by john" \
  -H "Authorization: Bearer <pat>"
Defensive patterns

Strategy: try-catch

Validate before calling

if (SecurityUtils.getUser() == null) { authenticateFirst(); }

Type guard

var user = SecurityUtils.getUser();
String rule = user != null ? "to be reviewed by me" : "to be reviewed by " + explicitUser;

Try / catch

try { result = query("to be reviewed by me"); }
catch (NotAcceptableException e) { throw new LoginRequiredException("Authenticate to use 'me' query rules"); }

Prevention

When it happens

Trigger: Running a pull request query with the "to be reviewed by me" criterion via getPredicate() while unauthenticated or in a thread without a bound user.

Common situations: Anonymous REST/GraphQL queries; automation executing stored queries without credentials; session expiry mid-request leading to a null user.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/a8a304541cd6478f. Report an issue: GitHub.