{"record":{"id":"00e6e3bcb921bb4a","repo":"instructure/canvas-lms","slug":"insufficient-permissions-set-override-status","errorCode":null,"errorMessage":"Insufficient permissions","messagePattern":"Insufficient permissions","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/set_override_status.rb","lineNumber":32,"sourceCode":"# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more\n# details.\n#\n# You should have received a copy of the GNU Affero General Public License along\n# with this program. If not, see <http://www.gnu.org/licenses/>.\n#\nmodule Mutations\n  class SetOverrideStatus < BaseMutation\n    argument :custom_grade_status_id, ID, required: false, default_value: nil\n    argument :enrollment_id, ID, required: true\n    argument :grading_period_id, ID, required: false, default_value: nil\n    field :grades, Types::GradesType, null: true\n\n    def resolve(input:)\n      raise GraphQL::ExecutionError, \"custom gradebook statuses feature flag is disabled\" unless Account.site_admin.feature_enabled?(:custom_gradebook_statuses)\n\n      score = score(input:)\n      unless score.grants_right?(current_user, session, :update_custom_status)\n        raise GraphQL::ExecutionError, I18n.t(\"Insufficient permissions\")\n      end\n\n      enrollment = Enrollment.find_by(id: input[:enrollment_id])\n      custom_grade_status = get_custom_grade_status(input:)\n      grading_period_id = input[:grading_period_id]\n\n      updated_score = enrollment.update_override_status(custom_grade_status:, grading_period_id:)\n      InstStatsd::Statsd.distributed_increment(\"custom_grade_status.applied_to.final_grade\")\n      { grades: updated_score }\n    rescue ActiveRecord::RecordNotFound => e\n      raise GraphQL::ExecutionError, \"#{e.model} not found\"\n    rescue ActiveRecord::RecordInvalid => e\n      errors_for(e.record)\n    end\n\n    private\n\n    def score(input:)","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/set_override_status.rb#L14-L50","documentation":"After loading the Score, resolve checks score.grants_right?(current_user, session, :update_custom_status). If the acting user lacks that permission on the score (e.g. not a teacher/admin in the course), an \"Insufficient permissions\" ExecutionError is raised.","triggerScenarios":"A student or observer calls setOverrideStatus on their own/another enrollment; a teacher without update_custom_status rights (permission turned off at the account/sub-account role level) attempts to set a custom status.","commonSituations":"Role customization in Account > Permissions removed update_custom_status from the Teacher role; client accidentally uses a non-teacher token; cross-course enrollment id passed in.","solutions":["Act as a user with the update_custom_status permission (teacher/admin) in the course","Re-enable update_custom_status for the relevant role under Account Permissions","Confirm the enrollment_id belongs to a course where the acting user has grading rights"],"exampleFix":"// before\ncustomGradeStatus(enrollmentId: 12, customGradeStatusId: 3) # with a student token\n// after\nif enrollment.score.grants_right?(current_user, session, :update_custom_status)\n  customGradeStatus(enrollmentId: 12, customGradeStatusId: 3)\nend","handlingStrategy":"try-catch","validationCode":"// Ruby\nallowed = enrollment.score&.grants_right?(current_user, session, :update_custom_status)","typeGuard":null,"tryCatchPattern":"// Ruby\nbegin\n  mutation\nrescue GraphQL::ExecutionError => e\n  show_permission_notice if e.message == \"Insufficient permissions\"\nend","preventionTips":["Audit role permissions for update_custom_status after account permission changes","Use a token/user with teaching rights when applying custom statuses","Verify the enrollment belongs to a course where the user grades"],"tags":["graphql","ruby","permissions","gradebook"],"backgroundTag":"insufficient-permissions","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}