{"record":{"id":"c74b05aa10268931","repo":"instructure/canvas-lms","slug":"cannot-show-collaboration-when-masquerading","errorCode":null,"errorMessage":"cannot show collaboration when masquerading","messagePattern":"cannot show collaboration when masquerading","errorType":"exception","errorClass":"GoogleDrive::MasqueradingException","httpStatus":403,"severity":"error","filePath":"app/controllers/collaborations_controller.rb","lineNumber":223,"sourceCode":"                             .where(where_collaborators)\n    end\n\n    collaborations = Api.paginate(\n      collaborations_query,\n      self,\n      url\n    )\n\n    render json: collaborations.map { |c| collaboration_json(c, @current_user, session) }\n  end\n\n  def show\n    @collaboration = @context.collaborations.find(params[:id])\n    if authorized_action(@collaboration, @current_user, :read)\n      @collaboration.touch\n      begin\n        # error out when user tries to open a collaboration while masquerading\n        raise GoogleDrive::MasqueradingException, \"cannot show collaboration when masquerading\" if logged_in_user != @current_user\n\n        if @collaboration.valid_user?(@current_user)\n          @collaboration.authorize_user(@current_user)\n          log_asset_access(@collaboration, \"collaborations\", \"other\", \"participate\")\n          url = if @collaboration.is_a? ExternalToolCollaboration\n                  tool = Lti::ToolFinder.from_url(@collaboration.url, @context)\n                  @collaboration.migrate_to_1_3_if_needed!(tool)\n                  resource_link_lookup_uuid = @collaboration.resource_link_lookup_uuid if tool.use_1_3?\n\n                  external_tool_launch_url(\n                    @collaboration.url,\n                    resource_link_lookup_uuid\n                  )\n                else\n                  @collaboration.url\n                end\n\n          redirect_to url","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/controllers/collaborations_controller.rb#L205-L241","documentation":"Guard in CollaborationsController#show: a user viewing a collaboration while masquerading (acting as another user, where @real_current_user differs) is blocked. Google integrations bind to the real user's identity/credentials, so opening the collaboration under a spoofed session would access or create documents as the wrong account.","triggerScenarios":"Thrown at app/controllers/collaborations_controller.rb:223 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Stop masquerading (become yourself) before opening the collaboration","Access the collaboration directly from the Google/Office account of the masqueraded user if legitimately needed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}