1 files changed, 13 insertions, 6 deletions
diff --git a/app/graphql/resolvers/todo_resolver.rb b/app/graphql/resolvers/todo_resolver.rb
index 263b190c74e..f0be1b6e9a5 100644
--- a/app/graphql/resolvers/todo_resolver.rb
+++ b/app/graphql/resolvers/todo_resolver.rb
@@ -8,27 +8,34 @@ module Resolvers
 
     argument :action, [Types::TodoActionEnum],
              required: false,
-             description: 'The action to be filtered.'
+             description: 'Action to be filtered.'
 
     argument :author_id, [GraphQL::Types::ID],
              required: false,
-             description: 'The ID of an author.'
+             description: 'ID of an author.'
 
     argument :project_id, [GraphQL::Types::ID],
              required: false,
-             description: 'The ID of a project.'
+             description: 'ID of a project.'
 
     argument :group_id, [GraphQL::Types::ID],
              required: false,
-             description: 'The ID of a group.'
+             description: 'ID of a group.'
 
     argument :state, [Types::TodoStateEnum],
              required: false,
-             description: 'The state of the todo.'
+             description: 'State of the todo.'
 
     argument :type, [Types::TodoTargetEnum],
              required: false,
-             description: 'The type of the todo.'
+             description: 'Type of the todo.'
+
+    before_connection_authorization do |nodes, current_user|
+      Preloaders::UserMaxAccessLevelInProjectsPreloader.new(
+        nodes.map(&:project).compact,
+        current_user
+      ).execute
+    end
 
     def resolve(**args)
       return Todo.none unless current_user.present? && target.present?