instructure/canvas-lms · error · GraphQL::ExecutionError

You do not have permission to view this course.

Error message

You do not have permission to view this course.

What it means

files_scope in files_connection_interface.rb raises this GraphQL::ExecutionError when the current user cannot view course files on behalf of the requested scoped user, via current_user.can_current_user_view_as_user(course, scoped_user). Like the discussions variant, it guards the user_id masquerade path only; if the scoped user doesn't exist, Attachment.none is returned instead of raising.

Solutions

1. Drop the user_id argument or set it to the current user's id.
2. Request an admin token with 'View as' permission for the course.
3. Log in as the target user and query without masquerading.
4. Verify the viewer's course role actually grants can_current_user_view_as_user before calling.
5. If the target user was recently removed from the course, confirm scoped_user is resolvable in that course context.

Example fix

// before
const vars = { courseId: "1", userId: "42" }
// after
const vars = { courseId: "1", userId: currentUser.id } // or omit userId entirely

function canQueryFilesAs(targetUserId) {
  if (targetUserId == null || String(targetUserId) === String(currentUser.id)) return true
  return currentUser.permissions.includes("view_as") // admin-level check
}
if (!canQueryFilesAs(variables.userId)) throw new Error("not permitted to view files as that user")

const targetsSelf = (v) => v?.userId == null || String(v.userId) === String(currentUser.id)

When it happens

Trigger: Querying course.filesConnection (files_connection) with a user_id argument for another user — a student targeting a peer's id, or a caller without admin 'view as' permission.

Common situations: Scripts iterating student file listings with the wrong token; post-enrollment-change permissions (observer/teacher roles revoked) invalidating previously working user_id queries.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• You do not have permission to view this course.
• You do not have permission to view this course.
• insufficient permission
• insufficient permission
• insufficient permission

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/5ed58181f4e3d5a2. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/interfaces/files_connection_interface.rb:42

    argument :user_id, ID, <<~MD, required: false
      only return files for the given user. Defaults to
      the current user.
    MD
    argument :search_term, String, <<~MD, required: false
      only return files whose name matches this search term
    MD
  end

  def files_scope(course, user_id = nil, search_term = nil)
    scoped_user = user_id.nil? ? current_user : User.find_by(id: user_id)

    # If user_id was provided but user not found, return no files
    return Attachment.none if user_id.present? && scoped_user.nil?

    # Check if current user has permission to view files as the scoped user
    unless current_user.can_current_user_view_as_user(course, scoped_user)
      # Current user lacks permissions to view as the scoped user
      raise GraphQL::ExecutionError, "You do not have permission to view this course."
    end

    files = course.attachments.not_deleted

    # Apply search term filter if provided
    if search_term.present?
      files = files.where(Attachment.wildcard(:display_name, search_term))
    end

    # Only return files the user has permission to view, ensure we return a scope
    if scoped_user && course.grants_right?(scoped_user, :read_as_admin)
      files
    else
      visible_files = files.where(
        "attachments.context_id = ? AND attachments.context_type = ?",
        course.id,
        course.class.to_s
      )

View on GitHub (pinned to 1c9f0bb801)