Add filtering to epic issues resolver

app/graphql/resolvers/concerns/caching_array_resolver.rb

@@ -43,8 +43,10 @@
 # (i.e. `resolve(**args).sync == query_for(query_input(**args)).to_a`).
 #
 # Classes may implement:
-# - #item_found(A, R) (return value is ignored)
 # - max_union_size Integer (the maximum number of queries to run in any one union)
+# - preload -> Preloads|NilClass (a set of preloads to apply to each query)
+# - #item_found(A, R) (return value is ignored)
+# - allowed?(R) -> Boolean (if this method returns false, the value is not resolved)
 module CachingArrayResolver
   MAX_UNION_SIZE = 50
 
@@ -76,6 +78,12 @@ module CachingArrayResolver
     end
   end
 
+  # Override to apply filters on a per-item basis
+  def allowed?(item)
+    true
+  end
+
+  # Override to specify preloads for each query
   def preload
     nil
   end
@@ -99,6 +107,8 @@ module CachingArrayResolver
   end
 
   def found(loader, key, value)
+    return unless allowed?(value)
+
     loader.call(key) do |vs|
       item_found(key, value)
       vs << value

ee/app/graphql/resolvers/epic_issues_resolver.rb

@@ -12,6 +12,10 @@ module Resolvers
       ::Issue
     end
 
+    def allowed?(issue)
+      DeclarativePolicy.user_scope { issue.visible_to_user?(current_user) }
+    end
+
     def query_input(**args)
       epic.id
     end

ee/spec/graphql/resolvers/epic_issues_resolver_spec.rb

@@ -39,6 +39,18 @@ RSpec.describe Resolvers::EpicIssuesResolver do
 
       expect(result).to eq [[issue2, issue1], [issue3, issue4]]
     end
+
+    it 'finds only epic issues that user can read' do
+      guest = create(:user)
+
+      result =
+        [
+          resolve_epic_issues(epic1, user: guest).to_a,
+          resolve_epic_issues(epic2, user: guest).to_a
+        ]
+
+      expect(result).to eq([[issue1], []])
+    end
   end
 
   def resolve_epic_issues(object, user: current_user)