theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

PublishedByMeCriteria.getPredicate builds a JPA predicate matching packs published by the current user. If User.get() returns null (no authenticated user in context), it throws NotAcceptableException('Please login to perform this query') because the criterion is inherently user-relative.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/pack/PublishedByMeCriteria.java:29

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.Pack;
import io.onedev.server.model.User;
import io.onedev.server.security.SecurityUtils;
import io.onedev.server.util.ProjectScope;

public class PublishedByMeCriteria extends PublishedByCriteria {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Pack, Pack> from, CriteriaBuilder builder) {
		if (User.get() != null) {
			Path<User> attribute = from.get(Pack.PROP_USER);
			return builder.equal(attribute, User.get());
		} else {
			throw new NotAcceptableException(_T("Please login to perform this query"));
		}
	}

	@Override
	public User getUser() {
		return SecurityUtils.getUser();
	}

	@Override
	public boolean matches(Pack pack) {
		if (User.get() != null)
			return User.get().equals(pack.getUser());
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public String toStringWithoutParens() {

View on GitHub (pinned to d44925c47c)

Solutions

  1. Authenticate (login or API token) before running the query
  2. Rewrite the criterion as 'published by <specific user>' to avoid current-user dependency
  3. Ensure API clients send Authorization headers on every request
  4. Impersonate/bind a user when evaluating queries in background threads

Example fix

// before
curl http://onedev/api/query/packs?query="published by me"
// after
curl -H "Authorization: Bearer <token>" 'http://onedev/api/query/packs?query=published%20by%20me'
Defensive patterns

Strategy: type-guard

Validate before calling

if (User.get() == null) throw new AuthRequiredError("login required for 'published by me' pack query");

Type guard

function isAuthenticated(): boolean { return io.onedev.server.model.User.get() != null; }

Try / catch

try { runPackQuery(q); } catch (NotAcceptableException e) { if (e.getMessage().contains("Please login")) { reauthenticate(); retry(); } else throw e; }

Prevention

When it happens

Trigger: Executing a pack query containing 'published by me' while the request is anonymous — no session, expired login, missing API token, or evaluation on a thread without a bound user.

Common situations: Anonymous REST access to pack queries; expired browser sessions; CI scripts calling the API without tokens; background jobs running user-relative queries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/c121c3b997658c52. Report an issue: GitHub.