theonedev/onedev · error · UnauthorizedException

Unauthorized

Error message

Unauthorized

What it means

GET /groupAuthorizations/{authorizationId} throws UnauthorizedException when the authenticated user cannot manage the project the group authorization belongs to. Reading project authorization details is restricted to users with project management permission (SecurityUtils.canManageProject), so ordinary project members get a 401/403.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/GroupAuthorizationResource.java:47

public class GroupAuthorizationResource {

	private final GroupAuthorizationService authorizationService;

	private final AuditService auditService;

	@Inject
	public GroupAuthorizationResource(GroupAuthorizationService authorizationService, AuditService auditService) {
		this.authorizationService = authorizationService;
		this.auditService = auditService;
	}

	@Api(order=100, description = "Get group authorization of specified id")
	@Path("/{authorizationId}")
	@GET
	public GroupAuthorization getAuthorization(@PathParam("authorizationId") Long authorizationId) {
		var authorization = authorizationService.load(authorizationId);
		if (!SecurityUtils.canManageProject(authorization.getProject()))
			throw new UnauthorizedException();
		return authorization;
	}
	
	@Api(order=200, description="Create new group authorization")
	@POST
	public Long createAuthorization(@NotNull GroupAuthorization authorization) {
		if (!SecurityUtils.canManageProject(authorization.getProject()))
			throw new UnauthorizedException();
		authorizationService.createOrUpdate(authorization);
		var newAuditContent = VersionedXmlDoc.fromBean(authorization).toXML();
		auditService.audit(authorization.getProject(), "created group authorization via RESTful API", null, newAuditContent);
		return authorization.getId();
	}

	@Api(order=300, description = "Delete group authorization of specified id")
	@Path("/{authorizationId}")
	@DELETE
	public Response deleteAuthorization(@PathParam("authorizationId") Long authorizationId) {

View on GitHub (pinned to d44925c47c)

Solutions

1. Use a token of a user who can manage the project (project owner/maintainer) or an administrator.
2. Request the required role on the project before querying its authorizations.
3. Verify the authorizationId belongs to a project you manage — load it via a project-scoped endpoint you can access.
4. Query with an admin token if this is automation infrastructure.

// ensure caller can manage the project before reading its authorizations
var project = authorization.getProject();
if (!securityUtils.canManageProject(project))
    throw new IllegalStateException("need manage permission on " + project.getName());

try { return client.getGroupAuthorization(id); }
catch (UnauthorizedException e) { throw new SecurityException("token lacks manage permission for this project", e); }

When it happens

Trigger: GET /~api/groupAuthorizations/{id} with a token whose user lacks manage permission (not project owner/maintainer or admin) for authorization.getProject().

Common situations: A developer token inspecting group access settings of a project they only have read access to; calling the endpoint after being demoted from project maintainer; wrong project/authorization id picked up from another project's config.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No permission to access build: ${referenceString}
• Access token owner should have permission to manage authoriz
• Not authorized
• Not authorized
• Unauthorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/5cc863a42481f5af. Report an issue: GitHub.