{"record":{"id":"1a09c6cb7137f95a","repo":"instructure/canvas-lms","slug":"not-authorized-update-institutional-tag-archived-state","errorCode":null,"errorMessage":"not authorized","messagePattern":"not authorized","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/update_institutional_tag_archived_state.rb","lineNumber":36,"sourceCode":"# with this program. If not, see <http://www.gnu.org/licenses/>.\n#\n\n# NOTE: Depends on InstitutionalTag and InstitutionalTagAssociation models\n\nmodule Mutations\n  class UpdateInstitutionalTagArchivedState < BaseMutation\n    argument :archived, Boolean, required: true\n    argument :id,\n             ID,\n             required: true,\n             prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func(\"InstitutionalTag\")\n\n    field :institutional_tag, Types::InstitutionalTagType, null: true\n\n    def resolve(input:)\n      root_account = context[:domain_root_account]\n      raise GraphQL::ExecutionError, \"feature flag is disabled\" unless root_account.feature_enabled?(:institutional_tags)\n      raise GraphQL::ExecutionError, \"not authorized\" unless root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)\n\n      tag = InstitutionalTag.where(root_account_id: root_account.id).find_by(id: input[:id])\n      raise GraphQL::ExecutionError, \"not found\" unless tag\n\n      input[:archived] ? tag.destroy : tag.undestroy\n\n      { institutional_tag: tag }\n    rescue ActiveRecord::RecordInvalid\n      errors_for(tag)\n    rescue ActiveRecord::RecordNotFound\n      raise GraphQL::ExecutionError, \"not found\"\n    end\n  end\nend\n","sourceCodeStart":18,"sourceCodeEnd":51,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/update_institutional_tag_archived_state.rb#L18-L51","documentation":"After the feature-flag check, updateInstitutionalTagArchivedState verifies the acting user holds :manage_institutional_tags_edit on the root account; otherwise it raises \"not authorized\". The archive/restore action never runs without this right.","triggerScenarios":"Calling the mutation as a user without the manage_institutional_tags_edit permission (students, teachers, or admin roles where the right was disabled), or with an unauthenticated/invalid session so no qualifying user is present.","commonSituations":"Custom account roles missing the granular permission; API tokens minted for a user who is not an institutional-tags manager; assuming site admin status grants the right on every account.","solutions":["Assign the user an account role that includes :manage_institutional_tags_edit (Account > Permissions).","Verify with root_account.grants_right?(user, session, :manage_institutional_tags_edit) in console.","Ensure requests carry a valid authenticated session/token for that user.","Conditionally render archive controls based on the user's permissions in the UI."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// verify the permission before archiving\nconst perms = await fetchMyPermissions(rootAccountId)\nif (!perms.includes('manage_institutional_tags_edit')) throw new Error('not authorized to archive tags')","typeGuard":null,"tryCatchPattern":"try {\n  await updateInstitutionalTagArchivedState(input)\n} catch (e) {\n  if (e.graphQLErrors?.some(g => g.message === 'not authorized')) {\n    showAccessDeniedNotice()\n  } else { throw e }\n}","preventionTips":["Grant manage_institutional_tags_edit to roles that need archive/restore.","Render archive controls only for permissioned users.","Ensure tokens/sessions belong to the permissioned admin, not a service identity."],"tags":["graphql","authorization","permissions","canvas-lms"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}