graphql mutations are locked by user type.

src/clj/auto_ap/graphql/checks.clj

@@ -1,5 +1,5 @@
 (ns auto-ap.graphql.checks
-  (:require [auto-ap.graphql.utils :refer [->graphql <-graphql]]
+  (:require [auto-ap.graphql.utils :refer [->graphql <-graphql assert-can-see-company]]
 
             [com.walmartlabs.lacinia :refer [execute]]
             [com.walmartlabs.lacinia.executor :as executor]
@@ -44,6 +44,7 @@
 
 (defn add-handwritten-check [context args value]
   (let [invoice (invoices/get-by-id (:invoice_id args))
+        _ (assert-can-see-company  (:id context) (:company-id invoice))
         check (checks/insert! {:s3-uuid nil
                                :s3-key nil 
                                :s3-url nil