theonedev/onedev · error · UnauthorizedException

Unauthorized

Error message

Unauthorized

What it means

Authorization guard in getCommitMessageRequirement: a user is authenticated but lacks permission to read the requested project/branch context (e.g. cannot read code), so the commit message requirement is withheld with an authorization error. Fix: use an account with read access to the target project.

Source

Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:251

        var fieldProperties = new HashMap<>(IssueHelper.getFieldProperties(field));
        fieldProperties.put("description", escapeHtml5((String) fieldProperties.get("description")));
        return fieldProperties;
    }

    @Api(description = "Get commit message requirement")
    @Path("/get-commit-message-requirement")
    @GET
    @Nullable
    public String getCommitMessageRequirement(
                @QueryParam("project") @NotNull String projectPath, 
                @QueryParam("branch") @NotNull String branch) {
        var user = SecurityUtils.getUser();
        if (user == null)
            throw new UnauthenticatedException();

        var project = getProject(projectPath);
        if (!SecurityUtils.canWriteCode(project))
            throw new UnauthorizedException();
            
        return getCommitMessageRequirement(user, project, branch);
    }

    @Nullable
    private String getCommitMessageRequirement(User user, Project project, String branch) {            
        var requirementBuilder = new StringBuilder();
        var branchProtection = project.getBranchProtection(branch, user);
        if (branchProtection.getCommitMessageChecker() instanceof ConventionalCommitChecker checker) {
            requirementBuilder.append("Commit messages should use Conventional Commits format: ")
                    .append("<type>[optional (scope)][!]: <description>. Git revert messages are also allowed.");
            if (!checker.getCommitTypes().isEmpty()) {
                requirementBuilder.append("\nAllowed commit types: ")
                        .append(String.join(", ", checker.getCommitTypes()));
            }
            if (!checker.getCommitScopes().isEmpty()) {
                requirementBuilder.append("\nAllowed commit scopes: ")
                        .append(String.join(", ", checker.getCommitScopes()));

View on GitHub (pinned to d44925c47c)

Solutions

1. Provide valid authentication for the tod API call.
2. Check that the access token has not expired or been revoked.

When it happens

Trigger: Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:251 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/052e99b2632463bf. Report an issue: GitHub.