{"record":{"id":"5223c94b1b0dd531","repo":"instructure/canvas-lms","slug":"insufficient-permissions-set-rubric-self-assessment","errorCode":null,"errorMessage":"Insufficient permissions","messagePattern":"Insufficient permissions","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/set_rubric_self_assessment.rb","lineNumber":38,"sourceCode":"module Mutations\n  class SetRubricSelfAssessment < BaseMutation\n    argument :assignment_id, ID, required: true\n    argument :rubric_self_assessment_enabled, Boolean, required: true\n\n    def resolve(input:)\n      assignment = Assignment.find(input[:assignment_id])\n      rubric_association = assignment.rubric_association\n\n      unless Rubric.rubric_self_assessment_enabled?(assignment.course)\n        raise GraphQL::ExecutionError, \"enhanced_rubrics, rubric_self_assesment and assignments_2_student must be enabled\"\n      end\n\n      unless assignment.active_rubric_association?\n        raise GraphQL::ExecutionError, I18n.t(\"Rubric Association not found\")\n      end\n\n      unless rubric_association.grants_right?(current_user, session, :update)\n        raise GraphQL::ExecutionError, I18n.t(\"Insufficient permissions\")\n      end\n\n      if assignment.has_group_category?\n        raise GraphQL::ExecutionError, I18n.t(\"Cannot set rubric self assessment for group assignments\")\n      end\n\n      if assignment.quiz_lti? || assignment.quiz?\n        raise GraphQL::ExecutionError, I18n.t(\"Cannot set rubric self assessment for quiz assignments\")\n      end\n\n      if assignment.discussion_topic?\n        raise GraphQL::ExecutionError, I18n.t(\"Cannot set rubric self assessment for discussion assignments\")\n      end\n\n      unless assignment.can_update_rubric_self_assessment?\n        raise GraphQL::ExecutionError, I18n.t(\"Assignment has self assessments or due date has passed\")\n      end\n","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/set_rubric_self_assessment.rb#L20-L56","documentation":"SetRubricSelfAssessment raises this GraphQL::ExecutionError when the loaded rubric_association does not grant the current user the :update right (app/graphql/mutations/set_rubric_self_assessment.rb:38). It is Canvas's way of rejecting a mutation whose caller is not allowed to modify that rubric association. It is a deliberate authorization guard, not an unexpected failure.","triggerScenarios":"Calling the setRubricSelfAssessment GraphQL mutation when assignment.active_rubric_association? is truthy but rubric_association.grants_right?(current_user, session, :update) returns false — e.g. a student or grading assistant without edit rights on the rubric association attempts to toggle rubric self assessment.","commonSituations":"A non-teacher (student, TA without manage-rights, or observer) invokes the mutation; the user's enrollment role changed after the association was created; a token/session on behalf of a user lacking course-level permission; requesting with a user who only has :read on the association.","solutions":["Call the mutation as a user with the :update right on the rubric association (typically a teacher or admin in the course).","Verify the rubric association's permissions for the acting user via grants_right? before invoking.","Check the course/account role overrides to confirm the intended role can update rubric associations.","If the frontend should hide the control, gate the UI on the same :update permission check."],"exampleFix":"// before: any user calls mutation\nclient.mutate({ mutation: SET_RUBRIC_SELF_ASSESSMENT, variables: { id } })\n// after: check permission first\nif (permissions.canUpdateRubricAssociation) {\n  client.mutate({ mutation: SET_RUBRIC_SELF_ASSESSMENT, variables: { id } })\n}","handlingStrategy":"validation","validationCode":"// fetch user permissions via GraphQL first\nconst perms = await client.query({ query: GET_RUBRIC_ASSOCIATION_PERMISSIONS, variables: { assignmentId } })\nif (!perms.data.assignment.rubricAssociation.canUpdate) throw new SkipMutation('lacks :update right')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Gate the UI toggle on the same :update permission the server checks.","Query permissions via GraphQL before any permission-sensitive mutation.","Re-check permissions after role or enrollment changes."],"tags":["graphql","authorization","rubric-association","canvas"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}