instructure/canvas-lms · error · GraphQL::ExecutionError

Not authorized to assess user

Error message

Not authorized to assess user

What it means

After resolving the asset and assessee, RubricAssociation#user_can_assess_for? checks whether current_user may assess that user for the given assessment_type. The mutation raises "Not authorized to assess user" when the policy check fails — the assessor is not a permitted grader for this student/assessment kind.

Solutions

1. Verify current_user has :grade or :manage_grades rights on the assignment's course.
2. For moderated assignments, confirm the grader is a provisionally enrolled grader with available slots.
3. Ensure assessment_details.assessment_type matches the association's intent (grader vs peer).

Example fix

// before
raise GraphQL::ExecutionError, 'Not authorized to assess user'
// after
unless association.user_can_assess_for?(assessor: current_user, assessee: user, assessment_type:)
  Rails.logger.warn("assess denied user=#{current_user.id} assessee=#{user&.id} type=#{assessment_type}")
  raise GraphQL::ExecutionError, 'Not authorized to assess user'
end

const perms = assignment.permissions
const canAssess = perms.grade || perms.manageGrades
if (!canAssess) showError('You are not a grader for this assignment')

function canAssessUser(assignment, studentId, grader) { return assignment.provisionalGraderIds?.includes(grader.id) && assignment.studentIdsForGrader?.includes(studentId) }

try { await saveRubricAssessment(...) } catch (e) { if (e.message === 'Not authorized to assess user') showError('You may not assess this student') }

When it happens

Trigger: A provisional grader assessing a student not assigned to them; assessing with assessment_type that doesn't match the association (e.g. peer review when only grader assessments allowed); non-grader (student) calling the mutation; section-limited grader targeting a student outside their sections.

Common situations: LTI tools using a token whose Canvas user lacks grading rights; teachers in moderated assignments before provisioning; peer-review rubric calls made with wrong assessment_type.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• e.message (Assignment::MaxGradersReachedError)
• ActiveRecord::RecordNotFound
• Assignment Grade Error
• Assignments under moderation cannot be hidden before grades…
• Assignments under moderation cannot be hidden by section…

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/81594a5658c99bf8. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/save_rubric_assessment.rb:67

    # slot for the submitting provisional grader (or throws an error if no
    # slots remain).
    begin
      opts = {}
      provisional = input[:provisional]
      if provisional
        opts[:provisional_grader] = current_user
        if input[:final] && association_object.permits_moderation?(current_user)
          opts[:final] = true
        end
      end

      ensure_adjudication_possible(provisional:, association_object:, grader: current_user) do
        asset, user = association_object.find_asset_for_assessment(association, user_id, opts)
        assessment_details = JSON.parse(input[:assessment_details]).with_indifferent_access
        assessment_type = assessment_details[:assessment_type]

        unless association.user_can_assess_for?(assessor: current_user, assessee: user, assessment_type:)
          raise GraphQL::ExecutionError, "Not authorized to assess user"
        end

        rubric_assessment = association.assess(
          assessor: current_user,
          user:,
          artifact: asset,
          assessment: assessment_details,
          graded_anonymously: input[:graded_anonymously]
        )

        submission.reload
        return { submission:, rubric_assessment:, rubric_association: association }
      end
    rescue Assignment::MaxGradersReachedError => e
      raise GraphQL::ExecutionError, e.message
    rescue Assignment::GradeError
      raise GraphQL::ExecutionError, "Assignment Grade Error"
    end

View on GitHub (pinned to 1c9f0bb801)