Ensure that we test assignability during resolve_type

This is useful for usages of loads in arguments.

app/graphql/gitlab_schema.rb

@@ -78,6 +78,13 @@ class GitlabSchema < GraphQL::Schema
       find_by_gid(gid)
     end
 
+    def resolve_type(type, object, ctx = :__undefined__)
+      tc = type.metadata[:type_class]
+      return if tc.respond_to?(:assignable?) && !tc.assignable?(object)
+
+      super
+    end
+
     # Find an object by looking it up from its 'GlobalID'.
     #
     # * For `ApplicationRecord`s, this is equivalent to

app/graphql/types/base_object.rb

@@ -23,12 +23,12 @@ module Types
       context[:current_user]
     end
 
-    def self.resolve_type(object, context)
+    def self.assignable?(object)
       assignable = accepts
 
-      return self if assignable.blank?
+      return true if assignable.blank?
 
-      self if assignable.any? { |cls| object.is_a?(cls) }
+      assignable.any? { |cls| object.is_a?(cls) }
     end
   end
 end

ee/spec/requests/api/graphql/mutations/issues/update_spec.rb

@@ -75,6 +75,36 @@ RSpec.describe 'Update of an existing issue' do
         expect(graphql_errors).not_to be_blank
       end
     end
+
+    # TODO: remove when the global-ID compatibility layer is removed,
+    # at which point this error becomes unreachable because the query will
+    # be rejected as ill-typed.
+    context 'the epic is not an epic, using the ID type' do
+      let(:mutation) do
+        query = <<~GQL
+        mutation($epic: ID!, $path: ID!, $iid: String!) {
+          updateIssue(input: { epicId: $epic, projectPath: $path, iid: $iid }) {
+            errors
+          }
+        }
+        GQL
+
+        ::GraphqlHelpers::MutationDefinition.new(query, {
+          epic: global_id_of(create(:user)),
+          iid: issue.iid.to_s,
+          path: project.full_path
+        })
+      end
+
+      it 'does not set the epic' do
+        post_graphql_mutation(mutation, current_user: current_user)
+
+        expect(response).to have_gitlab_http_status(:success)
+        expect(graphql_errors).to contain_exactly(
+          a_hash_including('message' => /No object found/)
+        )
+      end
+    end
   end
 
   context 'removing epic' do