{"record":{"id":"71ea9defa162a969","repo":"instructure/canvas-lms","slug":"not-authorized","errorCode":null,"errorMessage":"not authorized","messagePattern":"not authorized","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/apply_institutional_tag.rb","lineNumber":39,"sourceCode":"# NOTE: Depends on InstitutionalTag, InstitutionalTagAssociation models\n\nmodule Mutations\n  class ApplyInstitutionalTag < BaseMutation\n    argument :tag_id,\n             ID,\n             required: true,\n             prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func(\"InstitutionalTag\")\n    argument :user_id,\n             ID,\n             required: true,\n             prepare: GraphQLHelpers.relay_or_legacy_id_prepare_func(\"User\")\n\n    field :institutional_tag_association, Types::InstitutionalTagAssociationType, null: true\n\n    def resolve(input:) # rubocop:disable GraphQL/UnusedArgument\n      root_account = context[:domain_root_account]\n      raise GraphQL::ExecutionError, \"feature flag is disabled\" unless root_account.feature_enabled?(:institutional_tags)\n      raise GraphQL::ExecutionError, \"not authorized\" unless root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)\n\n      tag = InstitutionalTag.where(root_account_id: root_account.id, workflow_state: \"active\").find_by(id: input[:tag_id])\n      raise GraphQL::ExecutionError, \"not found\" unless tag\n\n      user = root_account.all_users.find_by(id: input[:user_id])\n      raise GraphQL::ExecutionError, \"not found\" unless user\n\n      assoc = InstitutionalTagAssociation.find_or_initialize_by(\n        institutional_tag: tag,\n        context: user,\n        root_account:\n      )\n      assoc.workflow_state = \"active\"\n\n      if assoc.save\n        { institutional_tag_association: assoc }\n      else\n        errors_for(assoc)","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/apply_institutional_tag.rb#L21-L57","documentation":"Raised when the current user does not have the `manage_institutional_tags_edit` right on the root account. The mutation checks permissions via `root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)` before touching any data.","triggerScenarios":"Calling applyInstitutionalTag as a student, teacher, or admin whose role lacks :manage_institutional_tags_edit; an unauthenticated request (current_user nil); session expired so grants_right? evaluates against nil user.","commonSituations":"Custom role without the institutional-tag permission enabled; user logged into a different account/shard; API token belonging to a non-admin user; testing as a user who was recently demoted and cached rights are stale.","solutions":["Grant the managing user the `manage_institutional_tags_edit` right via the account's role permissions (Admin > Permissions).","Confirm you are authenticated as the intended admin (check current_user/context in the GraphQL request).","If testing, create an account admin: `account.account_users.create!(user:)` or stub `grants_right?`.","Verify the custom role on that specific root account includes the institutional tag permissions."],"exampleFix":"// before\n# mutation called as a user without the right -> 'not authorized'\n\n// after: ensure caller has the permission\naccount.account_users.create!(user: admin_user)\nRoleOverride.create!(role: admin_role, permission: 'manage_institutional_tags_edit', enabled: true)","handlingStrategy":"validation","validationCode":"unless root_account.grants_right?(current_user, session, :manage_institutional_tags_edit)\n  raise 'caller lacks manage_institutional_tags_edit'\nend\n","typeGuard":null,"tryCatchPattern":"begin\n  result = apply_tag(input)\nrescue GraphQL::ExecutionError => e\n  handle_unauthorized if e.message == 'not authorized'\nend","preventionTips":["Audit role permissions before granting UI access","Verify token owner has admin rights","Keep cached rights short-lived or reload user"],"tags":["graphql","permissions","authorization","canvas-lms"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}