Add to Cart mutations in GraphQl should consider Catalog Permissions

app/code/Magento/QuoteGraphQl/Model/CartItem/DataProvider/Processor/ItemDataCompositeProcessor.php

@@ -0,0 +1,45 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\QuoteGraphQl\Model\CartItem\DataProvider\Processor;
+
+use Magento\GraphQl\Model\Query\ContextInterface;
+
+/**
+ * {@inheritdoc}
+ */
+class ItemDataCompositeProcessor implements ItemDataProcessorInterface
+{
+    /**
+     * @var ItemDataProcessorInterface[]
+     */
+    private $itemDataProcessors;
+
+    /**
+     * @param ItemDataProcessorInterface[] $itemDataProcessors
+     */
+    public function __construct(array $itemDataProcessors = [])
+    {
+        $this->itemDataProcessors = $itemDataProcessors;
+    }
+
+    /**
+     * Process cart item data
+     *
+     * @param array $cartItemData
+     * @param ContextInterface $context
+     * @return array
+     */
+    public function process(array $cartItemData, ContextInterface $context): array
+    {
+        foreach ($this->itemDataProcessors as $itemDataProcessor) {
+            $cartItemData = $itemDataProcessor->process($cartItemData, $context);
+        }
+
+        return $cartItemData;
+    }
+}

app/code/Magento/QuoteGraphQl/Model/CartItem/DataProvider/Processor/ItemDataProcessorInterface.php

@@ -0,0 +1,25 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\QuoteGraphQl\Model\CartItem\DataProvider\Processor;
+
+use Magento\GraphQl\Model\Query\ContextInterface;
+
+/**
+ * Process Cart Item Data
+ */
+interface ItemDataProcessorInterface
+{
+    /**
+     * Process cart item data
+     *
+     * @param array $cartItemData
+     * @param ContextInterface $context
+     * @return array
+     */
+    public function process(array $cartItemData, ContextInterface $context): array;
+}

app/code/Magento/QuoteGraphQl/Model/Resolver/AddProductsToCart.php

@@ -11,11 +11,13 @@
 use Magento\Framework\GraphQl\Exception\GraphQlInputException;
 use Magento\Framework\GraphQl\Query\ResolverInterface;
 use Magento\Framework\GraphQl\Schema\Type\ResolveInfo;
+use Magento\GraphQl\Model\Query\ContextInterface;
 use Magento\Quote\Model\Cart\AddProductsToCart as AddProductsToCartService;
 use Magento\Quote\Model\Cart\Data\AddProductsToCartOutput;
 use Magento\Quote\Model\Cart\Data\CartItemFactory;
 use Magento\QuoteGraphQl\Model\Cart\GetCartForUser;
 use Magento\Quote\Model\Cart\Data\Error;
+use Magento\QuoteGraphQl\Model\CartItem\DataProvider\Processor\ItemDataProcessorInterface;
 
 /**
  * Resolver for addProductsToCart mutation
@@ -34,16 +36,24 @@ class AddProductsToCart implements ResolverInterface
      */
     private $addProductsToCartService;
 
+    /**
+     * @var ItemDataProcessorInterface
+     */
+    private $itemDataProcessor;
+
     /**
      * @param GetCartForUser $getCartForUser
      * @param AddProductsToCartService $addProductsToCart
+     * @param  ItemDataProcessorInterface $itemDataProcessor
      */
     public function __construct(
         GetCartForUser $getCartForUser,
-        AddProductsToCartService $addProductsToCart
+        AddProductsToCartService $addProductsToCart,
+        ItemDataProcessorInterface $itemDataProcessor
     ) {
         $this->getCartForUser = $getCartForUser;
         $this->addProductsToCartService = $addProductsToCart;
+        $this->itemDataProcessor = $itemDataProcessor;
     }
 
     /**
@@ -68,6 +78,9 @@ public function resolve(Field $field, $context, ResolveInfo $info, array $value
 
         $cartItems = [];
         foreach ($cartItemsData as $cartItemData) {
+            if (!$this->itemIsAllowedToCart($cartItemData, $context)) {
+                continue;
+            }
             $cartItems[] = (new CartItemFactory())->create($cartItemData);
         }
 
@@ -90,4 +103,21 @@ function (Error $error) {
             )
         ];
     }
+
+    /**
+     * Check if the item can be added to cart
+     *
+     * @param array $cartItemData
+     * @param ContextInterface $context
+     * @return bool
+     */
+    private function itemIsAllowedToCart(array $cartItemData, ContextInterface $context): bool
+    {
+        $cartItemData = $this->itemDataProcessor->process($cartItemData, $context);
+        if (isset($cartItemData['grant_checkout']) && $cartItemData['grant_checkout'] === false) {
+            return false;
+        }
+
+        return true;
+    }
 }

app/code/Magento/QuoteGraphQl/etc/di.xml

@@ -7,6 +7,7 @@
 -->
 <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
     <preference for="Magento\QuoteGraphQl\Model\CartItem\DataProvider\CustomizableOptionValueInterface" type="Magento\QuoteGraphQl\Model\CartItem\DataProvider\CustomizableOptionValue\Composite" />
+    <preference for="Magento\QuoteGraphQl\Model\CartItem\DataProvider\Processor\ItemDataProcessorInterface" type="Magento\QuoteGraphQl\Model\CartItem\DataProvider\Processor\ItemDataCompositeProcessor" />
     <type name="Magento\QuoteGraphQl\Model\Resolver\CartItemTypeResolver">
         <arguments>
             <argument name="supportedTypes" xsi:type="array">