theonedev/onedev · error · NotAcceptableException

"Please login to perform this query"

Error message

"Please login to perform this query"

What it means

OneDev's ToBeChangedByMeCriteria builds a JPA predicate for the "to be changed by me" pull request query rule, which requires knowing the current user. When User.get() returns null (no authenticated user in context), the criteria cannot resolve "me" and throws NotAcceptableException with "Please login to perform this query". It is a guard against evaluating a user-relative query anonymously.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pullrequest/ToBeChangedByMeCriteria.java:28

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.PullRequest;
import io.onedev.server.model.User;
import io.onedev.server.util.ProjectScope;
import io.onedev.server.util.criteria.Criteria;

public class ToBeChangedByMeCriteria extends Criteria<PullRequest> {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<PullRequest, PullRequest> from, CriteriaBuilder builder) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).getPredicate(projectScope, query, from, builder);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public boolean matches(PullRequest request) {
		var user = User.get();
		if (user != null) 
			return getCriteria(user).matches(request);
		else 
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}
	
	private Criteria<PullRequest> getCriteria(User user) {
		return new ToBeChangedByUserCriteria(user);
	}

	@Override
	public String toStringWithoutParens() {
		return PullRequestQuery.getRuleName(PullRequestQueryLexer.ToBeChangedByMe);

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate the request: log in via the web UI or send valid credentials (session cookie or private access token) with the API call.
  2. Replace the "to be changed by me" rule in the query with the explicit "to be changed by <user>" (ToBeChangedByUser) form naming the user.
  3. Ensure background/scheduled code sets a security context (e.g. run as a specific user) before evaluating the query.
  4. Check server/proxy configuration so anonymous sessions are not presented for endpoints requiring auth.

Example fix

// before: anonymous REST call with user-relative rule
GET /~api/pull-requests?query="to be changed by me"

// after: explicit user in query or authenticated request
GET /~api/pull-requests?query="to be changed by john" -H "Authorization: Bearer <pat>"
Defensive patterns

Strategy: try-catch

Validate before calling

if (SecurityUtils.getUser() == null) { throw new IllegalStateException("Login required for user-relative query"); }

Type guard

User user = SecurityUtils.getUser();
if (user == null) return Collections.emptyList();

Try / catch

try { result = queryPullRequests("to be changed by me"); }
catch (NotAcceptableException e) { /* prompt for login / re-authenticate, then retry */ }

Prevention

When it happens

Trigger: Calling getPredicate() for a pull request query containing the "to be changed by me" criterion while no user is bound to the current request/thread context (User.get() == null), e.g. anonymous REST/GraphQL query requests or background threads without a security context.

Common situations: Anonymous API access to pull request query endpoints; a scheduled job or webhook handler executing a saved query string containing "to be changed by me" without an impersonated user; misconfigured reverse proxy dropping auth headers.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/ac925b4817f8315b. Report an issue: GitHub.