Return only documentations a user is allowed to view

aleksis/apps/alsijil/schema/documentation.py

+from django.core.exceptions import PermissionDenied
+
 import graphene
 from calendarweek import CalendarWeek
 from graphene_django import DjangoListField
@@ -28,6 +30,10 @@ class DocumentationType(PermissionsTypeMixin, DjangoFilterMixin, DjangoObjectTyp
             "course__name": ["exact"],
         }
 
+    @classmethod
+    def get_queryset(cls, queryset, info):
+        return get_objects_for_user(info.context.user, "alsijil.view_documentation", queryset)
+
 
 class DocumentationCreateMutation(DjangoCreateMutation):
     class Meta: