theonedev/onedev · error · UnauthorizedException

Unauthorized

Error message

Unauthorized

What it means

OneDev's CodeCommentResource.getComment throws UnauthorizedException when the authenticated caller is not allowed to read code in the project that owns the code comment (SecurityUtils.canReadCode(comment.getProject())). The REST endpoint refuses to return the comment, surfacing HTTP 401/403 with message "Unauthorized".

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/CodeCommentResource.java:45

public class CodeCommentResource {

	private final CodeCommentService commentService;

	private final AuditService auditService;

	@Inject
	public CodeCommentResource(CodeCommentService commentService, AuditService auditService) {
		this.commentService = commentService;
		this.auditService = auditService;
	}

	@Api(order=100)
	@Path("/{commentId}")
	@GET
	public CodeComment getComment(@PathParam("commentId") Long commentId) {
		var comment = commentService.load(commentId);
    	if (!SecurityUtils.canReadCode(comment.getProject()))  
			throw new UnauthorizedException();
    	return comment;
	}
	
	@Api(order=200)
	@Path("/{commentId}")
	@DELETE
	public Response deleteComment(@PathParam("commentId") Long commentId) {
		var comment = commentService.load(commentId);
    	if (!SecurityUtils.canModifyOrDelete(comment)) 
			throw new UnauthorizedException();
		commentService.delete(comment);
		var oldAuditContent = VersionedXmlDoc.fromBean(comment).toXML();
		auditService.audit(comment.getProject(), "deleted code comment on file \"" + comment.getMark().getPath() + "\" via RESTful API", oldAuditContent, null);
		return Response.ok().build();
	}
	
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Add the token's user to the project (or a group with at least Read Code permission) via Project -> Access Management.
2. Make the project readable if appropriate (public project or grant Read access to the relevant group).
3. Use an access token belonging to a member with read access instead.
4. Verify the commentId belongs to the project the user can access; a wrong ID pointing at a private project's comment is a common mix-up.

Example fix

// before: request with token of non-member user
GET /~api/code-comments/456 (user: guest, no project membership) -> 401 Unauthorized

// after: grant 'Read Code' to guest's role in the project, then retry
GET /~api/code-comments/456 -> 200

// ensure the authenticated user has read access before fetching the comment
const hasAccess = project.isPublic || project.memberships.some(m => m.user.id === currentUserId);
if (!hasAccess) return null; // skip fetch entirely

function canRead(project, user) {
  return !!project && (project.isPublic || (project.members ?? []).some(m => m.userId === user?.id));
}

try {
  const resp = await fetch(`/~api/code-comments/${commentId}`, {headers:authHeaders});
  if (resp.status === 401 || resp.status === 403) return null; // treat as unreadable
  return await resp.json();
} catch (e) {
  console.warn('Failed to load code comment', commentId, e);
  return null;
}

When it happens

Trigger: Calling GET /~api/code-comments/{commentId} with a token of a user who has no read access (e.g. not a project member, project is private) to the project containing the commented file; using an access token whose user was removed from the project; querying a comment in a public project while the effective security context is anonymous with anonymous access disabled.

Common situations: Scripts listing code comments with a personal token of a user outside the project; linking a comment ID to a teammate who lacks project access; after project visibility changed from public to private, previously working integrations start failing.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized
• Not authorized
• Not authorized
• Issue schedule permission required to set iterations
• No permission to update issue fields

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/5cd40cc1972ecf17. Report an issue: GitHub.