instructure/canvas-lms · error · GraphQL::ExecutionError

Not authorized to update speed grader settings

Error message

Not authorized to update speed grader settings

What it means

UpdateSpeedGraderSettings mutation raises this when current_user.grants_right?(current_user, :update_speed_grader_settings) is false. The mutation only updates the current user's own preference, so this indicates the user lacks the custom permission to change their SpeedGrader settings.

Solutions

1. Enable the update_speed_grader_settings permission for the user's role in Account > Permissions
2. Have an admin grant the role override for the affected sub-account
3. Update the setting directly in user preferences via Rails console as a workaround
4. Verify which user the GraphQL context resolved (token/user mismatch)

Example fix

// before
// assuming any authenticated user can toggle
mutation { updateSpeedGraderSettings(input: {gradeByQuestion: true}) }
// after
// check permission client-side first
if (canDo(SETTINGS_UPDATE_SPEEDGRADER)) mutation(...)
else notifyUser('Permission not granted')

const canUpdate = ENV.USER_PERMISSIONS.includes('update_speed_grader_settings') // or check via feature/permission query

try { await gql(updateSpeedGraderSettingsMutation, {gradeByQuestion}) } catch (e) { if (/Not authorized/.test(e.message)) showAlert('Your account does not allow changing SpeedGrader settings'); else throw e }

When it happens

Trigger: A user whose role/role overrides do not grant :update_speed_grader_settings calls the mutation to toggle grade-by-question.

Common situations: Custom role without the permission enabled; permission disabled at account level; admin removed the override; API integration using a token for a restricted user.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• feature flag is disabled
• insufficient permission
• insufficient permission
• insufficient permission
• insufficient permission

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/c862d5e8e3276828. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/update_speed_grader_settings.rb:28

# Software Foundation, version 3 of the License.
#
# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along
# with this program. If not, see <http://www.gnu.org/licenses/>.
#

class Mutations::UpdateSpeedGraderSettings < Mutations::BaseMutation
  argument :grade_by_question, Boolean, required: true

  field :speed_grader_settings, Types::SpeedGraderSettingsType, null: false

  def resolve(input:)
    unless current_user.grants_right?(current_user, :update_speed_grader_settings)
      raise GraphQL::ExecutionError, "Not authorized to update speed grader settings"
    end

    current_user.preferences[:enable_speedgrader_grade_by_question] = input.fetch(:grade_by_question)
    current_user.save!
    current_user
  end
end

View on GitHub (pinned to 1c9f0bb801)