{"record":{"id":"81594a5658c99bf8","repo":"instructure/canvas-lms","slug":"not-authorized-to-assess-user","errorCode":null,"errorMessage":"Not authorized to assess user","messagePattern":"Not authorized to assess user","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/save_rubric_assessment.rb","lineNumber":67,"sourceCode":"    # slot for the submitting provisional grader (or throws an error if no\n    # slots remain).\n    begin\n      opts = {}\n      provisional = input[:provisional]\n      if provisional\n        opts[:provisional_grader] = current_user\n        if input[:final] && association_object.permits_moderation?(current_user)\n          opts[:final] = true\n        end\n      end\n\n      ensure_adjudication_possible(provisional:, association_object:, grader: current_user) do\n        asset, user = association_object.find_asset_for_assessment(association, user_id, opts)\n        assessment_details = JSON.parse(input[:assessment_details]).with_indifferent_access\n        assessment_type = assessment_details[:assessment_type]\n\n        unless association.user_can_assess_for?(assessor: current_user, assessee: user, assessment_type:)\n          raise GraphQL::ExecutionError, \"Not authorized to assess user\"\n        end\n\n        rubric_assessment = association.assess(\n          assessor: current_user,\n          user:,\n          artifact: asset,\n          assessment: assessment_details,\n          graded_anonymously: input[:graded_anonymously]\n        )\n\n        submission.reload\n        return { submission:, rubric_assessment:, rubric_association: association }\n      end\n    rescue Assignment::MaxGradersReachedError => e\n      raise GraphQL::ExecutionError, e.message\n    rescue Assignment::GradeError\n      raise GraphQL::ExecutionError, \"Assignment Grade Error\"\n    end","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/save_rubric_assessment.rb#L49-L85","documentation":"After resolving the asset and assessee, RubricAssociation#user_can_assess_for? checks whether current_user may assess that user for the given assessment_type. The mutation raises \"Not authorized to assess user\" when the policy check fails — the assessor is not a permitted grader for this student/assessment kind.","triggerScenarios":"A provisional grader assessing a student not assigned to them; assessing with assessment_type that doesn't match the association (e.g. peer review when only grader assessments allowed); non-grader (student) calling the mutation; section-limited grader targeting a student outside their sections.","commonSituations":"LTI tools using a token whose Canvas user lacks grading rights; teachers in moderated assignments before provisioning; peer-review rubric calls made with wrong assessment_type.","solutions":["Verify current_user has :grade or :manage_grades rights on the assignment's course.","For moderated assignments, confirm the grader is a provisionally enrolled grader with available slots.","Ensure assessment_details.assessment_type matches the association's intent (grader vs peer)."],"exampleFix":"// before\nraise GraphQL::ExecutionError, 'Not authorized to assess user'\n// after\nunless association.user_can_assess_for?(assessor: current_user, assessee: user, assessment_type:)\n  Rails.logger.warn(\"assess denied user=#{current_user.id} assessee=#{user&.id} type=#{assessment_type}\")\n  raise GraphQL::ExecutionError, 'Not authorized to assess user'\nend","handlingStrategy":"validation","validationCode":"const perms = assignment.permissions\nconst canAssess = perms.grade || perms.manageGrades\nif (!canAssess) showError('You are not a grader for this assignment')","typeGuard":"function canAssessUser(assignment, studentId, grader) { return assignment.provisionalGraderIds?.includes(grader.id) && assignment.studentIdsForGrader?.includes(studentId) }","tryCatchPattern":"try { await saveRubricAssessment(...) } catch (e) { if (e.message === 'Not authorized to assess user') showError('You may not assess this student') }","preventionTips":["Check grading rights (:grade/:manage_grades) before opening the rubric UI","Respect section-limited grader assignments in the client","Confirm assessment_type matches grader vs peer review intent"],"tags":["graphql","permissions","rubric","moderated-grading"],"backgroundTag":"insufficient-permissions","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}