{"record":{"id":"71913dcea6bb327d","repo":"instructure/canvas-lms","slug":"not-authorized-update-institutional-tag-category","errorCode":null,"errorMessage":"not authorized","messagePattern":"not authorized","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/update_institutional_tag_category.rb","lineNumber":37,"sourceCode":"#\n\n# NOTE: Depends on InstitutionalTagCategory model (app/models/institutional_tag_category.rb)\n\nmodule Mutations\n  class UpdateInstitutionalTagCategory < BaseMutation\n    argument :description, String, required: false\n    argument :id,\n             ID,\n             required: true,\n             prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func(\"InstitutionalTagCategory\")\n    argument :name, String, required: false\n\n    field :institutional_tag_category, Types::InstitutionalTagCategoryType, null: true\n\n    def resolve(input:)\n      root_account = context[:domain_root_account]\n      raise GraphQL::ExecutionError, \"feature flag is disabled\" unless root_account.feature_enabled?(:institutional_tags)\n      raise GraphQL::ExecutionError, \"not authorized\" unless root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)\n\n      category = root_account.institutional_tag_categories.where(workflow_state: \"active\").find_by(id: input[:id])\n      raise GraphQL::ExecutionError, \"not found\" unless category\n\n      attrs = {}\n      attrs[:name] = input[:name] if input.key?(:name)\n      attrs[:description] = input[:description] if input.key?(:description)\n\n      if category.update(attrs)\n        { institutional_tag_category: category }\n      else\n        errors_for(category)\n      end\n    rescue ActiveRecord::RecordInvalid\n      errors_for(category)\n    rescue ActiveRecord::RecordNotFound\n      raise GraphQL::ExecutionError, \"not found\"\n    end","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/update_institutional_tag_category.rb#L19-L55","documentation":"Raised by updateInstitutionalTagCategory when the current user lacks the :manage_institutional_tags_edit permission on the domain root account (root_account.grants_right?(current_user, session, :manage_institutional_tags_edit) is false). The mutation requires an explicitly granted institutional-tag management right; ordinary account admins without it are rejected.","triggerScenarios":"Any call to updateInstitutionalTagCategory where the authenticated user's role does not grant manage_institutional_tags_edit on the root account — e.g. a plain Teacher/Enrollment user token, an admin role missing the custom right, or an unauthenticated/expired session so current_user is nil.","commonSituations":"Using a personal access token from a user who isn't a root-account admin with the institutional-tags right, running queries as a masqueraded or API user with reduced roles, or a custom admin role created without this permission checked.","solutions":["Grant the right: use a role with :manage_institutional_tags_edit (root account admin) or add the permission to the user's role via RoleOverride/custom admin role permissions.","Verify with a Rails console check: root_account.grants_right?(user, session, :manage_institutional_tags_edit).","Re-authenticate as an appropriately privileged user; ensure the token/session is valid so current_user is populated."],"exampleFix":"// Rails console\n# before: user lacks right\naccount.account_users.create!(user: user, role: account.roles.where(name: 'AccountAdmin').take)\n# after: user now granted via AccountAdmin role which includes manage_institutional_tags_edit","handlingStrategy":"validation","validationCode":"// Rails console pre-check\nraise 'no right' unless root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)","typeGuard":"function hasManageRight(viewer) { return viewer?.permissions?.includes('manage_institutional_tags_edit') ?? false }","tryCatchPattern":null,"preventionTips":["Use credentials from a root-account admin role that grants manage_institutional_tags_edit","Check viewer permissions query before enabling mutation UI","Audit custom admin roles to include the institutional-tags right","Avoid masquerading/API contexts that drop the required session rights"],"tags":["graphql","authorization","permissions"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}