{"record":{"id":"2d1ed87afa0e991b","repo":"instructure/canvas-lms","slug":"insufficient-permissions-to-create-group-set","errorCode":null,"errorMessage":"Insufficient permissions to create group set","messagePattern":"Insufficient permissions to create group set","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/create_group_set.rb","lineNumber":56,"sourceCode":"      options = {\n        name: input[:name],\n        self_signup: input[:self_signup],\n        auto_leader_type: input[:auto_leader_type],\n        group_limit: input[:group_limit],\n        non_collaborative: input[:non_collaborative],\n        create_group_count: get_group_count(input[:create_group_count]),\n        create_group_member_count: input[:create_group_member_count],\n        group_by_section: input[:group_by_section],\n        enable_auto_leader: input[:enable_auto_leader],\n        enable_self_signup: input[:enable_self_signup],\n        restrict_self_signup: input[:restrict_self_signup],\n        assign_async: input[:assign_async],\n        assign_unassigned_members: input[:assign_unassigned_members],\n      }\n\n      populate_group_category(options)\n    else\n      raise GraphQL::ExecutionError, \"Insufficient permissions to create group set\"\n    end\n\n    { group_set: @group_category }\n  end\n\n  # Private\n  def populate_group_category(options)\n    @group_category = GroupCategories::ParamsPolicy.new(@group_category, @context).populate_with(options)\n\n    SubmissionLifecycleManager.with_executing_user(@current_user) do\n      unless @group_category.save\n        raise GraphQL::ExecutionError, \"Unable to create group set\"\n      end\n    end\n  end\n\n  def get_group_count(count)\n    if count && count > 0","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/create_group_set.rb#L38-L74","documentation":"The CreateGroupSet GraphQL mutation raises this when check_group_context_rights fails: the current user lacks the required 'add' rights (adjusted for collaborative/non-collaborative group sets) on the target course or group context. No GroupCategory is built; the mutation aborts with this GraphQL::ExecutionError before any save is attempted.","triggerScenarios":"Calling mutation createGroupSet with a course/group context where the current user does not hold permission to add group sets — e.g. a student or teacher in a course where only admins may create group sets, or a user lacking rights for the non_collaborative variant requested.","commonSituations":"API integrations calling the mutation with a token of a low-privileged user; enrolling users without the 'add group sets' role entitlement; testing against a context where group creation is admin-restricted; passing non_collaborative when the user only has collaborative-creation rights (or vice versa).","solutions":["Log in / issue the request as a user with group-set creation rights on the target course or group (teacher, designer, or admin as configured).","Grant the role the required permission (course/group 'add' group categories) via Account > Permissions or a custom role.","Verify the context passed in the mutation is the intended one; the user may have rights on a different course/group.","Check whether check_group_context_rights differentiates collaborative vs non_collaborative and request the variant the user is allowed to create.","If the user should have rights, inspect GroupPermissionHelper logic and the context's role overrides for why rights are denied."],"exampleFix":"// before\nmutation {\n  createGroupSet(input: {contextId: \"123\", contextType: \"Course\", name: \"Projects\"}) { ... }\n}\n// after — ensure the acting user has permission, e.g. run as admin token or grant role first\nPOST /api/graphql with access token of a teacher/admin user on course 123","handlingStrategy":"validation","validationCode":"# before calling the mutation, client-side/admin-side check\nrights = course.grants_right?(user, session, :create_group_sets) ||\n         group.grants_right?(user, session, :create_group_sets)\nraise 'user cannot create group sets in this context' unless rights","typeGuard":"def can_create_group_set?(context, user, non_collaborative: false)\n  context.present? && user.present? &&\n    GroupPermissionHelper.check_group_context_rights(\n      context: context, current_user: user,\n      action_category: :add, non_collaborative: non_collaborative\n    )\nend","tryCatchPattern":"begin\n  result = Mutations::CreateGroupSet.graphql_definition; # execute mutation\nrescue GraphQL::ExecutionError => e\n  handle_permission_denied if e.message == 'Insufficient permissions to create group set'\nend","preventionTips":["Check the acting user's role permissions on the exact course/group before invoking the mutation","Use admin-scoped tokens for provisioning scripts","Confirm collaborative vs non_collaborative rights for the requested variant","Add automated specs covering denied users to catch permission regressions"],"tags":["graphql","permissions","ruby","canvas"],"backgroundTag":"insufficient-permissions","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}