theonedev/onedev · error · NotAcceptableException

Please login to perform this query

Error message

Please login to perform this query

What it means

OneDev's 'owned by me' project search criterion requires an authenticated user to resolve 'me'. When the criterion is evaluated on a server thread with no user bound to the security context (User.get() returns null), it throws a NotAcceptableException with a localized 'Please login to perform this query' message instead of producing an empty or null predicate.

Source

Thrown at server-core/src/main/java/io/onedev/server/search/entity/project/OwnedByMeCriteria.java:27

import org.jspecify.annotations.Nullable;

import io.onedev.server.exception.NotAcceptableException;
import io.onedev.server.model.Project;
import io.onedev.server.model.User;
import io.onedev.server.security.SecurityUtils;
import io.onedev.server.util.ProjectScope;

public class OwnedByMeCriteria extends OwnedByCriteria {

	private static final long serialVersionUID = 1L;

	@Override
	public Predicate getPredicate(@Nullable ProjectScope projectScope, CriteriaQuery<?> query, From<Project, Project> from, CriteriaBuilder builder) {
		if (User.get() != null)
			return new OwnedByUserCriteria(User.get()).getPredicate(projectScope, query, from, builder);
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public User getUser() {
		return SecurityUtils.getUser();
	}

	@Override
	public boolean matches(Project project) {
		if (User.get() != null)
			return new OwnedByUserCriteria(User.get()).matches(project);
		else
			throw new NotAcceptableException(_T("Please login to perform this query"));
	}

	@Override
	public String toStringWithoutParens() {
		return ProjectQuery.getRuleName(ProjectQueryLexer.OwnedByMe);

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate the request (valid session cookie or access token) before issuing a query containing 'owned by me'.
2. Replace the query criterion with 'owned by "<username>"' (OwnedByUserCriteria) when running in a non-interactive context.
3. In server-side code, run the query within a User.revert/impersonate block so User.get() is non-null.
4. Catch NotAcceptableException (HTTP 406) and surface a login-required message to the client.

Example fix

// before (unauthenticated client)
GET /~api/projects?query=owned by me
// after
GET /~api/projects?query=owned by "john" -H "Authorization: Bearer <token>"

if (SecurityUtils.getUser() == null && queryText.contains("owned by me")) throw new LoginRequiredException();

boolean canUseMeCriteria() { return SecurityUtils.getUser() != null; }

try { projects = projectQueryService.query(...); } catch (NotAcceptableException e) { promptLogin(); }

When it happens

Trigger: Calling getPredicate on OwnedByMeCriteria (e.g. evaluating a project query containing 'owned by me') from an unauthenticated context such as an anonymous REST/GraphQL call, a scheduled job, or a non-web thread where User.get() is null.

Common situations: Anonymous API clients querying with 'owned by me'; integrations calling the query endpoint without session/auth headers; code invoking search outside a request scope (build/CI hooks, background tasks) where the security context is not populated.

Related errors

• Unauthenticated
• Authentication required
• Please login to perform this query
• Please login to perform this query
• Authentication required

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/c457f572a9c9be14. Report an issue: GitHub.