instructure/canvas-lms · error

csp not explicitly set

Error message

csp not explicitly set

What it means

CSP account helper guard: set_csp_locked! requires that the account already has :csp_inherited_data in its settings hash. If the CSP settings were never initialized (csp not explicitly set via the CSP API/enable path), calling lock_csp!/unlock_csp! on a duplicated nil settings entry raises.

Solutions

1. Enable/configure CSP for the account first (via CSP API or csp account settings) so settings[:csp_inherited_data] exists
2. Guard the call: only lock/unlock when account.settings[:csp_inherited_data].present?
3. Use the account's CSP controller/API endpoints instead of calling the helper directly
4. Initialize settings[:csp_inherited_data] = {locked: value} explicitly in the script before calling set_csp_locked!

Example fix

// before
account.unlock_csp! # RuntimeError: csp not explicitly set
// after
if account.settings[:csp_inherited_data].present?
  account.unlock_csp!
else
  account.enable_csp! # or set csp settings via API first
end

raise 'csp not configured' unless account.settings[:csp_inherited_data].present?
account.unlock_csp!

begin
  account.unlock_csp!
rescue RuntimeError => e
  raise unless e.message == 'csp not explicitly set'
  account.enable_csp! # or initialize csp settings
end

When it happens

Trigger: Calling account.unlock_csp! or account.lock_csp!(true/false) on an Account whose settings[:csp_inherited_data] is nil/absent — i.e. CSP was never explicitly enabled or configured for that account (or an ancestor-inherited value was never materialized).

Common situations: Admin scripts or jobs toggling CSP lock on accounts that never went through the CSP enable flow; accounts migrated/copied without settings; calling unlock on a fresh account in a spec or console.

Related errors

• assessor and assessee required
• association required
• can only forward one conversation at a time
• can't accept
• Can't update submission scores unless it's completed

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/5eadfbbd5ea366fd. Report an issue: GitHub.

Appendix: source

Thrown at app/models/csp/account_helper.rb:85

  def enable_csp!
    set_csp_setting!([true, global_id])
  end

  def disable_csp!
    set_csp_setting!([false, global_id])
  end

  def lock_csp!
    set_csp_locked!(true)
  end

  def unlock_csp!
    set_csp_locked!(false)
  end

  def set_csp_locked!(value)
    csp_settings = settings[:csp_inherited_data].dup
    raise "csp not explicitly set" unless csp_settings

    csp_settings[:locked] = !!value
    settings[:csp_inherited_data] = csp_settings
    save!
  end

  def set_csp_setting!(value)
    csp_settings = settings[:csp_inherited_data].dup || {}
    csp_settings[:value] = value
    settings[:csp_inherited_data] = csp_settings
    save!
  end

  def inherit_csp!
    settings.delete(:csp_inherited_data)
    save!
  end

View on GitHub (pinned to 1c9f0bb801)