theonedev/onedev · error · UnauthorizedException

You do not have permission to push to this project.

Error message

You do not have permission to push to this project.

What it means

checkPushPermission rejects git push (receive-pack) requests when SecurityUtils.canWriteCode(project) is false. Only users/identities with code write permission on the project may push refs over git HTTP; everyone else receives this UnauthorizedException.

Source

Thrown at server-core/src/main/java/io/onedev/server/git/GitFilter.java:277

	}
	
	private void checkPullPermission(HttpServletRequest request, Project project) {
		if (!SecurityUtils.canReadCode(project)) {
			boolean isAuthorized = false;
			for (CodePullAuthorizationSource source: codePullAuthorizationSources) {
				if (source.canPullCode(request, project)) {
					isAuthorized = true;
					break;
				}
			}
			if (!isAuthorized)
				throw new UnauthorizedException("You do not have permission to pull from this project.");
		}
	}

	private void checkPushPermission(HttpServletRequest request, Project project) {
		if (!SecurityUtils.canWriteCode(project)) 
			throw new UnauthorizedException("You do not have permission to push to this project.");
	}

	private boolean canAccessProject(HttpServletRequest request, Project project) {
		if (!SecurityUtils.canAccessProject(project)) {
			for (CodePullAuthorizationSource source: codePullAuthorizationSources) {
				if (source.canPullCode(request, project)) 
					return true;
			}
			return false;
		} else {
			return true;
		}
	}
	
	protected void processRefs(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		String service = request.getParameter("service");
		boolean upload = service.contains("upload");
		

View on GitHub (pinned to d44925c47c)

Solutions

1. Have a project admin grant your role 'Write code' permission
2. Switch to an access token created from a user with write permission
3. If pushing from CI, use a job token/secret authorized to write code
4. Confirm you are pushing to the intended project and not a read-only mirror

Example fix

// before: read-only token
remote.origin.url=https://oauth2:ro-token@onedev.example.com/myproject.git

// after: token from user with 'Write code'
git remote set-url origin https://oauth2:<rw-token>@onedev.example.com/myproject.git

if (!userRoles.some(r => r.includes('Write code'))) {
  throw new Error('Your role lacks code write permission; push will be rejected');
}

try {
  git.push();
} catch (UnauthorizedException e) {
  if (e.getMessage().contains("permission to push")) {
    log.error('Insufficient write permission on project; request role change');
  }
}

When it happens

Trigger: git push / git-receive-pack to a project where the authenticated identity lacks the 'Write code' (or admin) permission in the project's role configuration.

Common situations: Pushing with a read-only token; developer role lacks write permission after role changes; CI trying to push tags/commits with a pull-only credential; protected-branch configs aside, this fires before any ref-level checks.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• You do not have permission to pull from this project.
• Unauthorized
• Issue schedule permission required to set iterations
• No permission to update issue fields
• No applicable manual transition spec found for current user

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/a2bfa568e03b4ef4. Report an issue: GitHub.