{"record":{"id":"780d098dc4bbae01","repo":"instructure/canvas-lms","slug":"not-importing-academic-benchmark-data-because-user-with-id","errorCode":null,"errorMessage":"Not importing academic benchmark data because user with ID '#{user.id}' isn't allowed to edit global outcomes","messagePattern":"Not importing academic benchmark data because user with ID '#(.+?)' isn't allowed to edit global outcomes","errorType":"exception","errorClass":"Canvas::Migration::Error","httpStatus":null,"severity":"error","filePath":"gems/plugins/academic_benchmark/lib/academic_benchmark.rb","lineNumber":229,"sourceCode":"    unless uid.present?\n      raise Canvas::Migration::Error,\n            \"Not importing academic benchmark data because no user id set\"\n    end\n    uid\n  end\n\n  def self.ensure_real_user(user_id:)\n    u = User.find_by(id: user_id)\n    unless u\n      raise Canvas::Migration::Error,\n            \"Not importing academic benchmark data because no user found matching id '#{user_id}'\"\n    end\n    u\n  end\n\n  def self.check_for_import_rights(user:)\n    unless Account.site_admin.grants_right?(user, :manage_global_outcomes)\n      raise Canvas::Migration::Error,\n            \"Not importing academic benchmark data because user with ID \" \\\n            \"'#{user.id}' isn't allowed to edit global outcomes\"\n    end\n    user\n  end\nend\n","sourceCodeStart":211,"sourceCodeEnd":236,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/gems/plugins/academic_benchmark/lib/academic_benchmark.rb#L211-L236","documentation":"Canvas::Migration::Error raised by AcademicBenchmark.check_for_import_rights when the resolved user lacks the :manage_global_outcomes right on Account.site_admin. Global outcomes are account-level records, so only site admins with that permission may import academic benchmark data.","triggerScenarios":"Running an academic benchmark import where the content_migration's user is a normal teacher/account admin who does not hold manage_global_outcomes on the site-admin account.","commonSituations":"Admins importing standards without site-admin role; permission changes removing manage_global_outcomes between job enqueue and execution; misconfigured role overrides.","solutions":["Grant the user manage_global_outcomes: Account.site_admin.role_overrides or assign a site-admin role with that permission.","Re-run the import as a user who holds the permission.","Check permission state: Account.site_admin.grants_right?(user, :manage_global_outcomes) before launching the import.","If using a role override, ensure it is enabled for the user's role on the site admin account."],"exampleFix":"// before\nAcademicBenchmark.import(user_id: current_user.id)\n// after\nunless Account.site_admin.grants_right?(current_user, :manage_global_outcomes)\n  raise ArgumentError, 'user lacks manage_global_outcomes'\nend\nAcademicBenchmark.import(user_id: current_user.id)","handlingStrategy":"validation","validationCode":"return unless Account.site_admin.grants_right?(user, :manage_global_outcomes)","typeGuard":null,"tryCatchPattern":"begin\n  AcademicBenchmark.import(user_id: user.id)\nrescue Canvas::Migration::Error => e\n  flash[:error] = I18n.t('You must be a site admin to import global outcomes')\nend","preventionTips":["Hide the import UI unless the user holds manage_global_outcomes.","Use a dedicated service account with the permission for automated imports.","Re-check permissions at job run time, not only at enqueue time."],"tags":["permissions","migrations","ruby"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}