theonedev/onedev · error · UnauthorizedException

Unauthorized

Error message

Unauthorized

What it means

OneDev's REST endpoint BuildLabelResource.createLabel throws UnauthorizedException when the authenticated user does not have permission to manage the build being labeled. The guard calls SecurityUtils.canManageBuild(buildLabel.getBuild()); if it returns false the request is rejected before any label is created. This is an authorization check, not an authentication failure.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/BuildLabelResource.java:33

@Path("/build-labels")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Singleton
public class BuildLabelResource {

	private final BuildLabelService buildLabelService;

	@Inject
	public BuildLabelResource(BuildLabelService buildLabelService) {
		this.buildLabelService = buildLabelService;
	}
	
	@Api(order=200, description="Create build label")
	@POST
	public Long createLabel(@NotNull BuildLabel buildLabel) {
		if (!SecurityUtils.canManageBuild(buildLabel.getBuild()))
			throw new UnauthorizedException();
		buildLabelService.create(buildLabel);
		return buildLabel.getId();
	}
	
	@Api(order=300)
	@Path("/{buildLabelId}")
	@DELETE
	public Response deleteLabel(@PathParam("buildLabelId") Long buildLabelId) {
		BuildLabel buildLabel = buildLabelService.load(buildLabelId);
		if (!SecurityUtils.canManageBuild(buildLabel.getBuild()))
			throw new UnauthorizedException();
		buildLabelService.delete(buildLabel);
		return Response.ok().build();
	}
	
}

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user (or the API token's role) the project permission to manage builds, e.g. 'Manage Build' in the project's role settings.
2. Verify the request is authenticated with a valid token belonging to the intended user (Authorization header), not anonymous.
3. Check client code sends the correct build reference in the BuildLabel payload — a wrong build id may point at a project the user cannot manage.
4. As an admin, adjust the role definitions (Administration > Roles) so the required 'Manage build' privilege is included.

Example fix

// client: check permission before creating a label
// before: blindly POSTing the label
rest.post("/rest/builds/labels", label);
// after: use an account/token whose role has 'Manage Build' on the project
// or pre-check:
if (!build.getPermissions().canManage()) {
    throw new IllegalStateException("Need 'Manage Build' permission on project " + projectKey);
}

boolean canCreate = userRole.getPermissions().stream()
    .anyMatch(p -> p.getName().equals("MANAGE_BUILD") && p.getProjectPath().equals(build.getProject().getPath()));
if (!canCreate) throw new IllegalStateException("User lacks Manage Build permission on " + build.getProject().getPath());

When it happens

Trigger: POST to /rest/builds/labels (the build label collection) with a BuildLabel body whose build the current user cannot manage — e.g. a user with only read access to the project, a non-admin without build-management rights, or an API token scoped to a role lacking the required permission.

Common situations: CI scripts using a personal access token with insufficient role; labeling builds in a project the user is only a guest of; org setups where only project admins may manage builds; calling the endpoint with an unauthenticated request after token expiry.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No permission to access issue: ${referenceString}
• No permission to write code in issue project
• Code write permission is required to edit auto merge
• Not authorized
• Access token owner should have permission to manage authoriz

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/95aa0afaf45db009. Report an issue: GitHub.