{"record":{"id":"cebd85006bcc51af","repo":"instructure/canvas-lms","slug":"not-authorized-create-institutional-tag-category","errorCode":null,"errorMessage":"not authorized","messagePattern":"not authorized","errorType":"exception","errorClass":"GraphQL::ExecutionError","httpStatus":null,"severity":"error","filePath":"app/graphql/mutations/create_institutional_tag_category.rb","lineNumber":33,"sourceCode":"# details.\n#\n# You should have received a copy of the GNU Affero General Public License along\n# with this program. If not, see <http://www.gnu.org/licenses/>.\n#\n\n# NOTE: Depends on InstitutionalTagCategory model (app/models/institutional_tag_category.rb)\n\nmodule Mutations\n  class CreateInstitutionalTagCategory < BaseMutation\n    argument :description, String, required: false\n    argument :name,        String, required: true\n\n    field :institutional_tag_category, Types::InstitutionalTagCategoryType, null: true\n\n    def resolve(input:)\n      root_account = context[:domain_root_account]\n      raise GraphQL::ExecutionError, \"feature flag is disabled\" unless root_account.feature_enabled?(:institutional_tags)\n      raise GraphQL::ExecutionError, \"not authorized\" unless root_account.grants_right?(current_user, session, :manage_institutional_tags_create)\n\n      category = root_account.institutional_tag_categories.new(\n        name: input[:name],\n        description: input[:description]\n      )\n\n      if category.save\n        { institutional_tag_category: category }\n      else\n        errors_for(category)\n      end\n    rescue ActiveRecord::RecordInvalid\n      errors_for(category)\n    rescue ActiveRecord::RecordNotFound\n      raise GraphQL::ExecutionError, \"not found\"\n    end\n  end\nend","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/graphql/mutations/create_institutional_tag_category.rb#L15-L51","documentation":"After the flag gate, CreateInstitutionalTagCategory requires the current user to have the manage_institutional_tags_create right on the root account; otherwise it raises this GraphQL::ExecutionError. Creating tag categories is limited to users explicitly granted that entitlement.","triggerScenarios":"createInstitutionalTagCategory by a user without manage_institutional_tags_create — teachers/students, admins on custom roles without the right, or nil current_user due to missing/invalid session.","commonSituations":"Service accounts not provisioned with the right; recently added permission not yet granted to admin roles; operating against a different root account than where the right was granted.","solutions":["Grant manage_institutional_tags_create to the user's role (Account > Permissions / role override).","Ensure the GraphQL request is authenticated as the privileged user (valid session/token).","Verify the right is being checked on the intended domain_root_account.","If tests hit this, seed the user with the right in factories before calling the mutation."],"exampleFix":"// before\nuser = user_factory # no rights -> raise\n// after (spec)\naccount_admin_user_with_role_changes(user:, role_changes: { manage_institutional_tags_create: true })\n# or in console: role.add_permission!(:manage_institutional_tags_create)","handlingStrategy":"validation","validationCode":"# pre-flight\nroot_account.grants_right?(user, session, :manage_institutional_tags_create) or\nraise 'not authorized to create institutional tag categories'","typeGuard":"def can_create_tag_category?(root_account, user, session)\n  !user.nil? && root_account.grants_right?(user, session, :manage_institutional_tags_create)\nend","tryCatchPattern":"try {\n  await createInstitutionalTagCategory({ variables })\n} catch (e) {\n  if (e.message === 'not authorized') {\n    // request the manage_institutional_tags_create entitlement or re-authenticate\n  }\n}","preventionTips":["Grant manage_institutional_tags_create to roles that administer tags","Verify session/authentication so current_user is populated","Check the right on the same root account used by context[:domain_root_account]","Seed rights in test factories before exercising the mutation"],"tags":["graphql","permissions","authorization","canvas"],"backgroundTag":"permission-denied","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}