instructure/canvas-lms · error · GraphQL::ExecutionError

Insufficient permissions

Error message

Insufficient permissions

What it means

SetRubricSelfAssessment raises this GraphQL::ExecutionError when the loaded rubric_association does not grant the current user the :update right (app/graphql/mutations/set_rubric_self_assessment.rb:38). It is Canvas's way of rejecting a mutation whose caller is not allowed to modify that rubric association. It is a deliberate authorization guard, not an unexpected failure.

Solutions

1. Call the mutation as a user with the :update right on the rubric association (typically a teacher or admin in the course).
2. Verify the rubric association's permissions for the acting user via grants_right? before invoking.
3. Check the course/account role overrides to confirm the intended role can update rubric associations.
4. If the frontend should hide the control, gate the UI on the same :update permission check.

Example fix

// before: any user calls mutation
client.mutate({ mutation: SET_RUBRIC_SELF_ASSESSMENT, variables: { id } })
// after: check permission first
if (permissions.canUpdateRubricAssociation) {
  client.mutate({ mutation: SET_RUBRIC_SELF_ASSESSMENT, variables: { id } })
}

// fetch user permissions via GraphQL first
const perms = await client.query({ query: GET_RUBRIC_ASSOCIATION_PERMISSIONS, variables: { assignmentId } })
if (!perms.data.assignment.rubricAssociation.canUpdate) throw new SkipMutation('lacks :update right')

When it happens

Trigger: Calling the setRubricSelfAssessment GraphQL mutation when assignment.active_rubric_association? is truthy but rubric_association.grants_right?(current_user, session, :update) returns false — e.g. a student or grading assistant without edit rights on the rubric association attempts to toggle rubric self assessment.

Common situations: A non-teacher (student, TA without manage-rights, or observer) invokes the mutation; the user's enrollment role changed after the association was created; a token/session on behalf of a user lacking course-level permission; requesting with a user who only has :read on the association.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• not authorized
• not authorized
• not found
• unauthorized
• A maximum of 50 assessees can be provided at once

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/5223c94b1b0dd531. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/set_rubric_self_assessment.rb:38

module Mutations
  class SetRubricSelfAssessment < BaseMutation
    argument :assignment_id, ID, required: true
    argument :rubric_self_assessment_enabled, Boolean, required: true

    def resolve(input:)
      assignment = Assignment.find(input[:assignment_id])
      rubric_association = assignment.rubric_association

      unless Rubric.rubric_self_assessment_enabled?(assignment.course)
        raise GraphQL::ExecutionError, "enhanced_rubrics, rubric_self_assesment and assignments_2_student must be enabled"
      end

      unless assignment.active_rubric_association?
        raise GraphQL::ExecutionError, I18n.t("Rubric Association not found")
      end

      unless rubric_association.grants_right?(current_user, session, :update)
        raise GraphQL::ExecutionError, I18n.t("Insufficient permissions")
      end

      if assignment.has_group_category?
        raise GraphQL::ExecutionError, I18n.t("Cannot set rubric self assessment for group assignments")
      end

      if assignment.quiz_lti? || assignment.quiz?
        raise GraphQL::ExecutionError, I18n.t("Cannot set rubric self assessment for quiz assignments")
      end

      if assignment.discussion_topic?
        raise GraphQL::ExecutionError, I18n.t("Cannot set rubric self assessment for discussion assignments")
      end

      unless assignment.can_update_rubric_self_assessment?
        raise GraphQL::ExecutionError, I18n.t("Assignment has self assessments or due date has passed")
      end

View on GitHub (pinned to 1c9f0bb801)