theonedev/onedev · error · UnauthorizedException

Unauthorized

Error message

Unauthorized

What it means

AgentLogResource streams an agent's log file and is restricted to server administrators. newResourceResponse first checks SecurityUtils.isAdministrator() and throws UnauthorizedException for anyone else, so only admins may download agent logs via this resource.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/resource/AgentLogResource.java:36

import com.google.common.base.Joiner;

import io.onedev.commons.utils.ExplicitException;
import io.onedev.server.OneDev;
import io.onedev.server.service.AgentService;
import io.onedev.server.model.Agent;
import io.onedev.server.security.SecurityUtils;

public class AgentLogResource extends AbstractResource {

	private static final long serialVersionUID = 1L;

	private static final String PARAM_AGENT = "agent";
	
	@Override
	protected ResourceResponse newResourceResponse(Attributes attributes) {
		if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();

		String agentName = attributes.getParameters().get(PARAM_AGENT).toString();
		Agent agent = OneDev.getInstance(AgentService.class).findByName(agentName);
		if (agent == null)
			throw new EntityNotFoundException("Unable to find agent: " + agentName);
		
		if (!agent.isOnline())
			throw new ExplicitException("Unable to read log: agent is offline");
		
		ResourceResponse response = new ResourceResponse();
		response.setContentType(MimeTypes.OCTET_STREAM);
		
		response.disableCaching();
		
		try {
			response.setFileName(URLEncoder.encode("agent-log.txt", StandardCharsets.UTF_8.name()));
		} catch (UnsupportedEncodingException e) {
			throw new RuntimeException(e);

View on GitHub (pinned to d44925c47c)

Solutions

1. Log in or use credentials of a user with OneDev administrator role.
2. Grant the 'Administrator' role to the account the request runs under (Admin > Users > role), if appropriate.
3. Instead of scraping the resource, view agent logs through the admin UI (Admin > Agents > agent > Logs).

Example fix

// before: non-admin token
curl -u developer:xxx https://onedev/~agentlog/build-1

// after: admin credential
curl -u admin:yyy https://onedev/~agentlog/build-1

// Ensure the credential used is an administrator before calling
if (!currentUser.isAdmin())
    throw new SecurityException("agent log endpoint requires administrator role");

try {
    downloadAgentLog(agent);
} catch (UnauthorizedException e) {
    // fall back to admin credential or direct user to Admin > Agents > Logs
}

When it happens

Trigger: An authenticated non-admin user (or anonymous request) requests the agent log resource for any agent name.

Common situations: A CI/automation script calling the log endpoint with a non-admin API credential; a regular user opening an agent log URL shared by an admin; missing login session leading to anonymous access.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access denied
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations
• No permission to access issue: ${referenceString}
• No permission to write code in issue project

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/b02552611b3e1bca. Report an issue: GitHub.