{"record":{"id":"c862d5e8e3276828","repo":"instructure/canvas-lms","slug":"not-authorized-to-update-speed-grader-settings","errorCode":null,"errorMessage":"Not authorized to update speed grader settings","messagePattern":"Not authorized to update speed grader settings","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/update_speed_grader_settings.rb","lineNumber":28,"sourceCode":"# Software Foundation, version 3 of the License.\n#\n# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY\n# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR\n# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more\n# details.\n#\n# You should have received a copy of the GNU Affero General Public License along\n# with this program. If not, see <http://www.gnu.org/licenses/>.\n#\n\nclass Mutations::UpdateSpeedGraderSettings < Mutations::BaseMutation\n  argument :grade_by_question, Boolean, required: true\n\n  field :speed_grader_settings, Types::SpeedGraderSettingsType, null: false\n\n  def resolve(input:)\n    unless current_user.grants_right?(current_user, :update_speed_grader_settings)\n      raise GraphQL::ExecutionError, \"Not authorized to update speed grader settings\"\n    end\n\n    current_user.preferences[:enable_speedgrader_grade_by_question] = input.fetch(:grade_by_question)\n    current_user.save!\n    current_user\n  end\nend\n","sourceCodeStart":10,"sourceCodeEnd":36,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/update_speed_grader_settings.rb#L10-L36","documentation":"UpdateSpeedGraderSettings mutation raises this when current_user.grants_right?(current_user, :update_speed_grader_settings) is false. The mutation only updates the current user's own preference, so this indicates the user lacks the custom permission to change their SpeedGrader settings.","triggerScenarios":"A user whose role/role overrides do not grant :update_speed_grader_settings calls the mutation to toggle grade-by-question.","commonSituations":"Custom role without the permission enabled; permission disabled at account level; admin removed the override; API integration using a token for a restricted user.","solutions":["Enable the update_speed_grader_settings permission for the user's role in Account > Permissions","Have an admin grant the role override for the affected sub-account","Update the setting directly in user preferences via Rails console as a workaround","Verify which user the GraphQL context resolved (token/user mismatch)"],"exampleFix":"// before\n// assuming any authenticated user can toggle\nmutation { updateSpeedGraderSettings(input: {gradeByQuestion: true}) }\n// after\n// check permission client-side first\nif (canDo(SETTINGS_UPDATE_SPEEDGRADER)) mutation(...)\nelse notifyUser('Permission not granted')","handlingStrategy":"try-catch","validationCode":"const canUpdate = ENV.USER_PERMISSIONS.includes('update_speed_grader_settings') // or check via feature/permission query","typeGuard":null,"tryCatchPattern":"try { await gql(updateSpeedGraderSettingsMutation, {gradeByQuestion}) } catch (e) { if (/Not authorized/.test(e.message)) showAlert('Your account does not allow changing SpeedGrader settings'); else throw e }","preventionTips":["Check account-level role permissions before exposing the toggle","Keep custom role overrides in sync with UI expectations","Confirm the GraphQL context user matches the acting user"],"tags":["graphql","authorization","permission"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}