Only allow marking own notifications as read

aleksis/core/schema.py

@@ -30,8 +30,8 @@ class MarkNotificationReadMutation(graphene.Mutation):
 
     @classmethod
     def mutate(cls, root, info, id):  # noqa
-        notification = Notification.objects.get(pk=id)
-        # FIXME permissions
+        notification = Notification.objects.get(pk=id, recipient=info.context.user.person)
+
         notification.read = True
         notification.save()