instructure/canvas-lms · error · GraphQL::ExecutionError

Insufficient permissions

Error message

Insufficient permissions

What it means

GraphQL::ExecutionError raised at the top of Mutations::DeleteConversations#resolve when the current_user's account root has the restrict_student_access feature flag enabled. In that mode students are not permitted to delete conversations through this mutation.

Solutions

1. Confirm the feature flag state: root_account.feature_enabled?(:restrict_student_access)
2. Disable the flag if the institution intends to allow student conversation deletion
3. Use an account admin user or admin API endpoint to delete conversations
4. Surface a friendly UI message instead of calling the mutation for flagged students

Example fix

// before
# student calls mutation with flag on -> 'Insufficient permissions'
if account.root_account.feature_enabled?(:restrict_student_access)
  hideDeleteUI()
end
// after
def canDeleteConversations?(user)
  !user.account.root_account.feature_enabled?(:restrict_student_access) || user.admin?
end

if (rootAccount.featureEnabled('restrict_student_access') && !user.isAdmin) hideDeleteConversations()

When it happens

Trigger: Calling deleteConversations while the root account feature restrict_student_access is enabled for the current user's account context.

Common situations: Institutions that enabled restrict_student_access to limit student messaging actions; test environments with the flag turned on; students hitting the error after their school changed feature settings.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• custom gradebook statuses feature flag is disabled
• feature flag is disabled
• Insufficient permissions
• peer_review_allocation_and_grading feature flag is not…
• ActiveRecord::RecordNotFound

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/6dc3622b810dfd14. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/delete_conversations.rb:31

# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along
# with this program. If not, see <http://www.gnu.org/licenses/>.
#

class Mutations::DeleteConversations < Mutations::BaseMutation
  graphql_name "DeleteConversations"

  # input arguments
  argument :ids, [ID], required: true, prepare: GraphQLHelpers.relay_or_legacy_ids_prepare_func("Conversation")

  field :conversation_ids, [ID], null: true

  def resolve(input:)
    if current_user.account.root_account.feature_enabled?(:restrict_student_access)
      raise GraphQL::ExecutionError, "Insufficient permissions"
    end

    errors = {}
    context[:deleted_models] = { conversations: {} }
    # rubocop:disable Style/BlockDelimiters
    resolved_ids = input[:ids].filter_map { |id|
      conversation = Conversation.find_by(id:)
      if conversation.nil?
        errors[id] = "Unable to find Conversation"
        next
      end

      participant_record = current_user.all_conversations.find_by(conversation_id: conversation.id)
      if participant_record.nil?
        errors[id] = "Insufficient permissions"
        next
      end

View on GitHub (pinned to 1c9f0bb801)