{"record":{"id":"31f0ec660af85979","repo":"instructure/canvas-lms","slug":"not-authorized-to-delete-submissioncomment","errorCode":null,"errorMessage":"Not authorized to delete SubmissionComment","messagePattern":"Not authorized to delete SubmissionComment","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"warning","filePath":"app/graphql/mutations/delete_submission_comment.rb","lineNumber":38,"sourceCode":"\nclass Mutations::DeleteSubmissionComment < Mutations::BaseMutation\n  graphql_name \"DeleteSubmissionComment\"\n\n  argument :submission_comment_id, ID, required: true, prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func(\"SubmissionComment\")\n\n  field :submission_comment, Types::SubmissionCommentType, null: true\n\n  def resolve(input:)\n    submission_comment = SubmissionComment.find_by(id: input[:submission_comment_id])\n\n    response = {}\n    if submission_comment&.grants_right?(current_user, :delete)\n      submission_comment.updating_user = @current_user\n      submission_comment.destroy\n\n      response[:submission_comment] = submission_comment\n    else\n      raise GraphQL::ExecutionError, \"Not authorized to delete SubmissionComment\"\n    end\n\n    response\n  end\nend\n","sourceCodeStart":20,"sourceCodeEnd":44,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/delete_submission_comment.rb#L20-L44","documentation":"The deleteSubmissionComment mutation raises \"Not authorized to delete SubmissionComment\" when submission_comment is nil or grants_right?(current_user, :delete) is false. The user either referenced a nonexistent comment or lacks delete rights on it.","triggerScenarios":"Calling deleteSubmissionComment with an id the user cannot see (nil result upstream), a student trying to delete their own comment after the submission was graded, a user deleting another student's comment, or a teacher without :delete on the comment.","commonSituations":"Students attempting to edit/delete comments after grading (Canvas typically locks this), cross-course comment ids, or deleted comments still cached client-side.","solutions":["Confirm the comment exists and is visible to the caller via a SubmissionComment query","Check the user has :delete right on the comment (own ungraded comment or teacher/admin)","Use a teacher/admin token when deleting others' comments","Verify the submission is not yet graded if the deleter is the comment author"],"exampleFix":"// before\nraise GraphQL::ExecutionError, \"Not authorized to delete SubmissionComment\"\n// after\nif submission_comment.nil?\n  raise GraphQL::ExecutionError, \"SubmissionComment not found\"\nelsif submission_comment.grants_right?(current_user, :delete)\n  submission_comment.destroy\nelse\n  raise GraphQL::ExecutionError, \"Not authorized to delete SubmissionComment\"\nend","handlingStrategy":"try-catch","validationCode":"const comment = await query(submissionComment, { id });\nif (!comment?.permissions?.delete) throw new Forbidden();","typeGuard":"function canDeleteComment(c) {\n  return c != null && c.permissions?.delete === true;\n}","tryCatchPattern":"try {\n  await client.mutate(DELETE_SUBMISSION_COMMENT, { id });\n} catch (e) {\n  if (e.message === \"Not authorized to delete SubmissionComment\") {\n    notifyUser(\"You cannot delete this comment.\");\n  } else throw e;\n}","preventionTips":["Only show delete buttons on comments the user can delete","Remember students generally cannot delete comments after grading","Verify the comment belongs to the caller's course","Refresh comments list after grading state changes"],"tags":["graphql","authorization","submission-comment","permissions"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}