theonedev/onedev · error · UnauthorizedException

Unauthorized

Error message

Unauthorized

What it means

Thrown by BaseAuthorizationResource.getAuthorization when the caller cannot manage the project that the requested base authorization belongs to. Viewing project authorizations is restricted to users with project management permission.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/BaseAuthorizationResource.java:48

public class BaseAuthorizationResource {

	private final BaseAuthorizationService authorizationService;

	private final AuditService auditService;

	@Inject
	public BaseAuthorizationResource(BaseAuthorizationService authorizationService, AuditService auditService) {
		this.authorizationService = authorizationService;
		this.auditService = auditService;
	}

	@Api(order=100, description = "Get base authorization of specified id")
	@Path("/{authorizationId}")
	@GET
	public BaseAuthorization getAuthorization(@PathParam("authorizationId") Long authorizationId) {
		var authorization = authorizationService.load(authorizationId);
		if (!SecurityUtils.canManageProject(authorization.getProject()))
			throw new UnauthorizedException();
		return authorization;
	}
	
	@Api(order=200, description="Create base authorization")
	@POST
	public Long createAuthorization(@NotNull BaseAuthorization authorization) {
		if (!SecurityUtils.canManageProject(authorization.getProject()))
			throw new UnauthorizedException();
		authorizationService.create(authorization);
		var newAuditContent = VersionedXmlDoc.fromBean(authorization).toXML();
		auditService.audit(authorization.getProject(), "created base authorization via RESTful API", null, newAuditContent);
		return authorization.getId();
	}

	@Api(order=300, description = "Delete base authorization of specified id")
	@Path("/{authorizationId}")
	@DELETE
	public Response deleteAuthorization(@PathParam("authorizationId") Long authorizationId) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user Project Management permission on the target project
2. Use credentials of a project manager or server administrator
3. Verify the authorizationId belongs to the intended project

Example fix

// before
# user lacks manage permission on project
curl -u dev:token .../base-authorizations/7
// after
curl -u manager:token .../base-authorizations/7

if (!canManageProject(tokenUser, projectIdOf(authId))) throw new Error('project management permission required');

function canManageProject(u, projectId) { return u?.managedProjectIds?.includes(projectId); }

try { getAuthorization(id); } catch (e) { if (/Unauthorized/i.test(e.message)) { throw new Error('Use a project manager credential to view base authorizations'); } throw e; }

When it happens

Trigger: GET /base-authorizations/{authorizationId} by a user without canManageProject on the authorization's project; anonymous request.

Common situations: Auditing project roles with a non-manager account; authorization id belongs to a project the user merely contributes to; project management rights recently revoked.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Not authorized
• Access denied
• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• Code write permission is required to edit auto merge

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/2cf9b12cdcce55a5. Report an issue: GitHub.