instructure/canvas-lms · error · GraphQL::ExecutionError

Not authorized to update SubmissionComment

Error message

Not authorized to update SubmissionComment

What it means

Raised in the PostDraftSubmissionComment mutation when the current user lacks the :update right on the submission comment. Canvas gates comment editing/creation via grants_right?; only the comment's author (or an admin with appropriate rights) may publish a draft comment.

Solutions

1. Confirm the current user is the author of the submission comment (submission_comment.author_id == current_user.id)
2. Check the user's enrollment/role grants :update on the comment (grants_right?(user, :update))
3. Use a valid masquerade/admin session only if policy permits
4. Fetch the comment via the API as the intended user to verify access before calling the mutation

Example fix

// before
postDraftSubmissionComment(commentId) // called as non-author
// after
if (comment.authorId === currentUser.id) {
  postDraftSubmissionComment(commentId)
}

const canUpdate = comment.authorId === currentUser.id || currentUser.admin
if (!canUpdate) disablePublishAction()

function canPublishComment(comment, user) {
  return Boolean(user) && (comment.authorId === user.id || user.permissions?.includes('manage_grades'))
}

try {
  await postDraftSubmissionComment({ id })
} catch (e) {
  if (e.message.includes('Not authorized')) notify('Only the comment author can publish this draft')
  else throw e
}

When it happens

Trigger: Calling mutation postDraftSubmissionComment with a submission comment id owned by another user, or as a student trying to publish a teacher's draft comment; session/token user differs from the comment author.

Common situations: Impersonation/masquerade edge cases; using an old comment id after grading permissions changed; acting as a non-author grader (e.g. TA without edit rights); copying another user's comment id from the network tab.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• feature flag is disabled
• insufficient permission
• insufficient permission
• insufficient permission
• insufficient permission

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/3325e58b85f95986. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/mutations/post_draft_submission_comment.rb:36

# with this program. If not, see <http://www.gnu.org/licenses/>.
#

class Mutations::PostDraftSubmissionComment < Mutations::BaseMutation
  graphql_name "PostDraftSubmissionComment"

  argument :submission_comment_id, ID, required: true

  field :submission_comment, Types::SubmissionCommentType, null: true
  def resolve(input:)
    submission_comment = SubmissionComment.find(input[:submission_comment_id])

    response = {}
    if submission_comment.grants_right?(current_user, :update)
      submission_comment.reload unless submission_comment.update(draft: false)

      response[:submission_comment] = submission_comment
    else
      raise GraphQL::ExecutionError, "Not authorized to update SubmissionComment"
    end

    response
  end
end

View on GitHub (pinned to 1c9f0bb801)