{"record":{"id":"57ae2166546e302f","repo":"instructure/canvas-lms","slug":"insufficient-permissions-to-create-non-collaborative-groups","errorCode":null,"errorMessage":"insufficient permissions to create non-collaborative groups","messagePattern":"insufficient permissions to create non-collaborative groups","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/create_group_in_set.rb","lineNumber":38,"sourceCode":"\nclass Mutations::CreateGroupInSet < Mutations::BaseMutation\n  graphql_name \"CreateGroupInSet\"\n\n  argument :group_set_id, ID, required: true, prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func(\"GroupSet\")\n  argument :name, String, required: true\n  argument :non_collaborative, Boolean, required: false, default_value: false\n\n  field :group, Types::GroupType, null: true\n\n  def resolve(input:)\n    category_id = GraphQLHelpers.parse_relay_or_legacy_id(input[:group_set_id], \"GroupSet\")\n    set = GroupCategory.find(category_id)\n    account = (set.context_type == \"Account\") ? set.context : set.context&.account\n    verify_authorized_action!(set.context, :manage_groups_add)\n\n    if input[:non_collaborative]\n      if account&.allow_assign_to_differentiation_tags?\n        raise GraphQL::ExecutionError, \"insufficient permissions to create non-collaborative groups\" unless set.context&.grants_right?(current_user, session, :manage_tags_add)\n      else\n        raise GraphQL::ExecutionError, \"cannot create non-collaborative groups when the differentiation tags feature flag is disabled\"\n      end\n    elsif set.non_collaborative\n      raise GraphQL::ExecutionError, \"cannot create collaborative groups in a non-collaborative group set\"\n    end\n\n    group = set.groups.build(name: input[:name], context: set.context, non_collaborative: input[:non_collaborative])\n\n    if group.save\n      { group: }\n    else\n      errors_for(group)\n    end\n  rescue ActiveRecord::RecordNotFound\n    raise GraphQL::ExecutionError, \"not found\"\n  end\nend","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/create_group_in_set.rb#L20-L56","documentation":"CreateGroupInSet#resolve raises this ExecutionError when input[:non_collaborative] is true and the differentiation-tags feature is enabled on the account, but the set's context does not grant :manage_tags_add to the current user. Creating a differentiation-tag (non-collaborative) group requires tag-management rights in addition to :manage_groups_add.","triggerScenarios":"Mutation createGroupInSet with non_collaborative: true executed by a teacher/admin lacking manage_tags_add on the course/account; account has allow_assign_to_differentiation_tags enabled so the permission check applies.","commonSituations":"Differentiation tags rollout: admins enabled the account flag but did not update role overrides to grant manage_tags_add to teachers; custom roles built before the feature lack the new permission.","solutions":["Grant :manage_tags_add to the user's role on the course/account (RoleOverrides / permissions UI).","Verify account.allow_assign_to_differentiation_tags? is actually intended; if not, the flag state is the issue.","Have a user with tag-management rights create the non-collaborative group instead.","In the UI, hide the 'non-collaborative' option when the user lacks manage_tags_add."],"exampleFix":"// before: create with non_collaborative always\ncreateGroupInSet({groupSetId, name, non_collaborative: true})\n\n// after\nconst allowed = groupSet.permissions.manageTagsAdd\ncreateGroupInSet({groupSetId, name, non_collaborative: allowed ? true : false})","handlingStrategy":"validation","validationCode":"if (nonCollaborative && !groupSet.permissions?.manageTagsAdd) {\n  disableTagGroupOption()\n}","typeGuard":"const canCreateTagGroup = (set, user) => Boolean(set?.permissions?.manageTagsAdd)","tryCatchPattern":null,"preventionTips":["Audit role permissions after enabling differentiation tags.","Hide non-collaborative options for users lacking manage_tags_add.","Document required permissions in admin runbooks."],"tags":["graphql","permissions","groups","differentiation-tags"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}