{"record":{"id":"5127b57d66bb4797","repo":"instructure/canvas-lms","slug":"file-access-denied","errorCode":null,"errorMessage":"File access denied","messagePattern":"File access denied","errorType":"validation","errorClass":"ContentUnavailable","httpStatus":null,"severity":"error","filePath":"app/services/study_assist.rb","lineNumber":172,"sourceCode":"    end\n\n    def resolve_page(page_id)\n      page = @course.wiki_pages.not_deleted.find_by(url: page_id)\n      raise ContentUnavailable, \"Page not found\" if page.nil?\n      raise ContentUnavailable, \"Page access denied\" unless page.grants_right?(@user, :read)\n\n      shard_safe_key = shard_safe_cache_key_for(page)\n      text = Rails.cache.fetch(text_cache_key_for(:page, shard_safe_key), expires_in: TEXT_CACHE_TTL) do\n        html_to_text(page.body.to_s)\n      end\n\n      Content.new(kind: :page, id: page.id, cache_key_with_version: shard_safe_key, text:)\n    end\n\n    def resolve_file(file_id)\n      attachment = @course.attachments.find_by(id: file_id)\n      raise ContentUnavailable, \"File not found\" if attachment.nil? || attachment.deleted?\n      raise ContentUnavailable, \"File access denied\" unless attachment.grants_right?(@user, :read)\n      raise ContentUnavailable, \"File is locked\" if attachment.locked_for?(@user, check_policies: true)\n      raise UnsupportedContentType unless supported_attachment?(attachment)\n      raise ContentTooLarge, \"File exceeds #{MAX_FILE_BYTES} byte limit\" if attachment.size && attachment.size > MAX_FILE_BYTES\n\n      shard_safe_key = shard_safe_cache_key_for(attachment)\n      text = Rails.cache.fetch(text_cache_key_for(:file, shard_safe_key), expires_in: TEXT_CACHE_TTL) do\n        extract_attachment_text(attachment)\n      end\n\n      raise ContentUnavailable, \"No text available for file\" if text.blank?\n\n      Content.new(kind: :file, id: attachment.id, cache_key_with_version: shard_safe_key, text:)\n    end\n\n    def supported_attachment?(attachment)\n      return true if attachment.content_type&.start_with?(\"text/\")\n\n      ACCEPTED_FILE_MIMETYPES.include?(attachment.content_type)","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/services/study_assist.rb#L154-L190","documentation":"StudyAssist::ContentUnavailable with 'File access denied' is raised by resolve_file when the attachment exists but attachment.grants_right?(@user, :read) is false. The service checks per-user read permission on the file before extracting text.","triggerScenarios":"Calling #call with a valid file_id but a @user lacking :read on the attachment (hidden/restricted file, folder-level permissions, non-enrolled user, or files locked to certain roles).","commonSituations":"Restricted or hidden course files; user enrollment missing or concluded; file visibility limited to specific sections/roles; using a different user token than the file owner intended.","solutions":["Verify @user has :read on the attachment (attachment.grants_right?(user, :read))","Fix enrollment/permissions for the user in the course","Unhide the file or adjust folder permissions if it should be readable","Rescue StudyAssist::ContentUnavailable and return a 403-style response to the client"],"exampleFix":"// before\nStudyAssist.new(course: @course, user: @user, prompt:, file_id: file_id).call\n// after\natt = @course.attachments.find(file_id)\nunless att.grants_right?(@user, :read)\n  return render json: { error: 'file unavailable' }, status: :forbidden\nend\nStudyAssist.new(course: @course, user: @user, prompt:, file_id: file_id).call","handlingStrategy":"validation","validationCode":"att = course.attachments.find_by(id: file_id)\nreturn nil unless att&.grants_right?(user, :read)","typeGuard":"null","tryCatchPattern":"begin\n  StudyAssist.new(course:, user:, prompt:, file_id:).call\nrescue StudyAssist::ContentUnavailable\n  render json: { error: 'file not available' }, status: :forbidden\nend","preventionTips":["Check grants_right?(user, :read) on attachments pre-call","Review folder/hiding permissions","Confirm user enrollment status"],"tags":["ruby","study-assist","permissions","attachment"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}