instructure/canvas-lms · error · ContentUnavailable

Page access denied

Error message

Page access denied

What it means

StudyAssist::ContentUnavailable with 'Page access denied' is raised by resolve_page when the page exists but page.grants_right?(@user, :read) is false. The service enforces per-user read permissions before using page content in an LLM call.

Solutions

1. Ensure the @user passed to StudyAssist has read access to the page (enrollment, published page)
2. Check page.grants_right?(user, :read) before invoking the service
3. Handle ContentUnavailable in the caller and surface a friendly message
4. Publish the page or adjust module locks if access should be granted

Example fix

// before
StudyAssist.new(course: @course, user: @user, prompt:, page_id: page.url).call
// after
if page.grants_right?(@user, :read)
  StudyAssist.new(course: @course, user: @user, prompt:, page_id: page.url).call
else
  render json: { error: 'page unavailable' }, status: :forbidden
end

page = course.wiki_pages.not_deleted.find_by(url: page_id)
return nil unless page&.grants_right?(user, :read)

null

begin
  StudyAssist.new(course:, user:, prompt:, page_id:).call
rescue StudyAssist::ContentUnavailable
  render json: { error: 'page not available' }, status: :forbidden
end

When it happens

Trigger: Calling #call with a valid page_id but a user who lacks :read on that wiki page (unpublished page, module-locked page, non-enrolled user, or user from a different course/account).

Common situations: Teacher-constructed service call reusing an admin's page but a student @user; unpublished pages students can't read; module requirement/lock rules denying read; token/user mismatch in API integration.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• File access denied
• Content exceeds # character limit
• File is locked
• File not found
• Insufficient permissions

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/f489febe0c710fc6. Report an issue: GitHub.

Appendix: source

Thrown at app/services/study_assist.rb:159

        if page_id.present?
          resolve_page(page_id)
        elsif file_id.present?
          resolve_file(file_id)
        else
          raise ContentUnavailable, "No pageID or fileID provided"
        end

      if content.text.length > MAX_CONTENT_CHARS
        raise ContentTooLarge, "Content exceeds #{MAX_CONTENT_CHARS} character limit"
      end

      content
    end

    def resolve_page(page_id)
      page = @course.wiki_pages.not_deleted.find_by(url: page_id)
      raise ContentUnavailable, "Page not found" if page.nil?
      raise ContentUnavailable, "Page access denied" unless page.grants_right?(@user, :read)

      shard_safe_key = shard_safe_cache_key_for(page)
      text = Rails.cache.fetch(text_cache_key_for(:page, shard_safe_key), expires_in: TEXT_CACHE_TTL) do
        html_to_text(page.body.to_s)
      end

      Content.new(kind: :page, id: page.id, cache_key_with_version: shard_safe_key, text:)
    end

    def resolve_file(file_id)
      attachment = @course.attachments.find_by(id: file_id)
      raise ContentUnavailable, "File not found" if attachment.nil? || attachment.deleted?
      raise ContentUnavailable, "File access denied" unless attachment.grants_right?(@user, :read)
      raise ContentUnavailable, "File is locked" if attachment.locked_for?(@user, check_policies: true)
      raise UnsupportedContentType unless supported_attachment?(attachment)
      raise ContentTooLarge, "File exceeds #{MAX_FILE_BYTES} byte limit" if attachment.size && attachment.size > MAX_FILE_BYTES

      shard_safe_key = shard_safe_cache_key_for(attachment)

View on GitHub (pinned to 1c9f0bb801)