instructure/canvas-lms · error · GraphQL::ExecutionError

You do not have permission to view this course.

Error message

You do not have permission to view this course.

What it means

pages_scope in pages_connection_interface.rb raises this GraphQL::ExecutionError when current_user cannot view course wiki pages as the requested scoped user (can_current_user_view_as_user fails). The masquerade guard is identical to the discussions/files interfaces; nonexistent scoped_user returns WikiPage.none instead of raising.

Solutions

1. Remove the user_id argument or pass the caller's own id.
2. Use an admin token permitted to view as the target user.
3. Log in as the target user.
4. Pre-check can_current_user_view_as_user (or replicate its role rules) before issuing the query.
5. Confirm the scoped user still exists and is enrolled in the course.

Example fix

// before
pagesConnection(userId: $otherUserId) { nodes { title } }
// after
pagesConnection { nodes { title } } // caller-scoped, no masquerade

const assertCanViewPagesAs = (vars) => {
  if (vars.userId && vars.userId !== currentUser.id && !currentUser.isCourseAdmin)
    throw new Error("pagesConnection userId requires view-as permission")
}
assertCanViewPagesAs(variables)

const selfOrUndefined = (userId) => userId === undefined || userId === currentUser.id

When it happens

Trigger: Querying course.pagesConnection (pages_connection) with a user_id argument identifying another user the caller may not view as, e.g. student A enumerating student B's page activity.

Common situations: Automated reports passing a fixed user_id while auth tokens rotate; custom tools built before the scoped_user permission guard was added now failing on upgrade.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• You do not have permission to view this course.
• You do not have permission to view this course.
• insufficient permission
• insufficient permission
• insufficient permission

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/e04b53f03e46b1ec. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/interfaces/pages_connection_interface.rb:42

    argument :user_id, ID, <<~MD, required: false
      only return pages for the given user. Defaults to
      the current user.
    MD
    argument :search_term, String, <<~MD, required: false
      only return pages whose title matches this search term
    MD
  end

  def pages_scope(course, user_id = nil, search_term = nil)
    scoped_user = user_id.nil? ? current_user : User.find_by(id: user_id)

    # If user_id was provided but user not found, return no pages
    return WikiPage.none if user_id.present? && scoped_user.nil?

    # Check if current user has permission to view pages as the scoped user
    unless current_user.can_current_user_view_as_user(course, scoped_user)
      # Current user lacks permissions to view as the scoped user
      raise GraphQL::ExecutionError, "You do not have permission to view this course."
    end

    pages = course.wiki.wiki_pages.not_deleted

    # Apply search term filter if provided
    if search_term.present?
      pages = pages.where(WikiPage.wildcard(:title, search_term))
    end

    # Only return pages the user has permission to view
    WikiPages::ScopedToUser.new(course, scoped_user, pages).scope
  end

  field :pages_connection,
        ::Types::PageType.connection_type,
        <<~MD,
          returns a list of wiki pages.
        MD

View on GitHub (pinned to 1c9f0bb801)