Remove tenant service pattern

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/console/v1/document_resolvers.go

@@ -55,7 +55,8 @@ func (r *documentResolver) Versions(ctx context.Context, obj *types.Document, fi
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{
 		Field:     coredata.DocumentVersionOrderFieldCreatedAt,
@@ -75,7 +76,7 @@ func (r *documentResolver) Versions(ctx context.Context, obj *types.Document, fi
 		versionFilter = versionFilter.WithStatuses(filter.Statuses...)
 	}
 
-	page, err := prb.Documents.ListVersions(ctx, obj.ID, cursor, versionFilter)
+	page, err := prb.Documents.ListVersions(ctx, scope, obj.ID, cursor, versionFilter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list document versions", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -90,7 +91,8 @@ func (r *documentResolver) Controls(ctx context.Context, obj *types.Document, fi
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
 		Field:     coredata.ControlOrderFieldCreatedAt,
@@ -110,7 +112,7 @@ func (r *documentResolver) Controls(ctx context.Context, obj *types.Document, fi
 		controlFilter = coredata.NewControlFilter(filter.Query)
 	}
 
-	page, err := prb.Controls.ListForDocumentID(ctx, obj.ID, cursor, controlFilter)
+	page, err := prb.Controls.ListForDocumentID(ctx, scope, obj.ID, cursor, controlFilter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list document controls", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -125,9 +127,10 @@ func (r *documentResolver) DefaultApprovers(ctx context.Context, obj *types.Docu
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	profiles, err := prb.Documents.GetDefaultApprovers(ctx, obj.ID)
+	profiles, err := prb.Documents.GetDefaultApprovers(ctx, scope, obj.ID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot get default approvers", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -152,11 +155,12 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.
 		return 0, err
 	}
 
-	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	prb := r.probo
 
 	switch obj.Resolver.(type) {
 	case *controlResolver:
-		count, err := prb.Documents.CountForControlID(ctx, obj.ParentID, obj.Filters)
+		count, err := prb.Documents.CountForControlID(ctx, scope, obj.ParentID, obj.Filters)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count controls", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
@@ -164,7 +168,7 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.
 
 		return count, nil
 	case *organizationResolver:
-		count, err := prb.Documents.CountForOrganizationID(ctx, obj.ParentID, obj.Filters)
+		count, err := prb.Documents.CountForOrganizationID(ctx, scope, obj.ParentID, obj.Filters)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count documents", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
@@ -172,7 +176,7 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.
 
 		return count, nil
 	case *riskResolver:
-		count, err := prb.Documents.CountForRiskID(ctx, obj.ParentID, obj.Filters)
+		count, err := prb.Documents.CountForRiskID(ctx, scope, obj.ParentID, obj.Filters)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count risks", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
@@ -180,7 +184,7 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.
 
 		return count, nil
 	case *measureResolver:
-		count, err := prb.Documents.CountForMeasureID(ctx, obj.ParentID, obj.Filters)
+		count, err := prb.Documents.CountForMeasureID(ctx, scope, obj.ParentID, obj.Filters)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count documents", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
@@ -229,7 +233,8 @@ func (r *documentVersionResolver) Approvers(ctx context.Context, obj *types.Docu
 		}, nil
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
 		Field:     coredata.MembershipProfileOrderFieldCreatedAt,
@@ -242,7 +247,7 @@ func (r *documentVersionResolver) Approvers(ctx context.Context, obj *types.Docu
 
 	c := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	p, err := prb.Documents.ListVersionApprovers(ctx, obj.ID, c)
+	p, err := prb.Documents.ListVersionApprovers(ctx, scope, obj.ID, c)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list document version approvers", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -257,7 +262,8 @@ func (r *documentVersionResolver) Signatures(ctx context.Context, obj *types.Doc
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionSignatureOrderField]{
 		Field:     coredata.DocumentVersionSignatureOrderFieldCreatedAt,
@@ -289,7 +295,7 @@ func (r *documentVersionResolver) Signatures(ctx context.Context, obj *types.Doc
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	page, err := prb.Documents.ListSignatures(ctx, obj.ID, cursor, signatureFilter)
+	page, err := prb.Documents.ListSignatures(ctx, scope, obj.ID, cursor, signatureFilter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list document version signatures", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -304,7 +310,8 @@ func (r *documentVersionResolver) ApprovalQuorums(ctx context.Context, obj *type
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionApprovalQuorumOrderField]{
 		Field:     coredata.DocumentVersionApprovalQuorumOrderFieldCreatedAt,
@@ -319,7 +326,7 @@ func (r *documentVersionResolver) ApprovalQuorums(ctx context.Context, obj *type
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	p, err := prb.DocumentApprovals.ListQuorums(ctx, obj.ID, cursor)
+	p, err := prb.DocumentApprovals.ListQuorums(ctx, scope, obj.ID, cursor)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list approval quorums", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -336,9 +343,10 @@ func (r *documentVersionResolver) Signed(ctx context.Context, obj *types.Documen
 
 	identity := authn.IdentityFromContext(ctx)
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	signed, err := prb.Documents.IsVersionSignedByUserEmail(ctx, obj.ID, identity.EmailAddress)
+	signed, err := prb.Documents.IsVersionSignedByUserEmail(ctx, scope, obj.ID, identity.EmailAddress)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot check if document version is signed", log.Error(err))
 		return false, gqlutils.Internal(ctx)
@@ -358,9 +366,10 @@ func (r *documentVersionApprovalDecisionResolver) Quorum(ctx context.Context, ob
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	quorum, err := prb.DocumentApprovals.GetQuorum(ctx, obj.Quorum.ID)
+	quorum, err := prb.DocumentApprovals.GetQuorum(ctx, scope, obj.Quorum.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -380,9 +389,10 @@ func (r *documentVersionApprovalDecisionResolver) DocumentVersion(ctx context.Co
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	quorum, err := prb.DocumentApprovals.GetQuorum(ctx, obj.Quorum.ID)
+	quorum, err := prb.DocumentApprovals.GetQuorum(ctx, scope, obj.Quorum.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -393,7 +403,7 @@ func (r *documentVersionApprovalDecisionResolver) DocumentVersion(ctx context.Co
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	documentVersion, err := prb.Documents.GetVersion(ctx, quorum.VersionID)
+	documentVersion, err := prb.Documents.GetVersion(ctx, scope, quorum.VersionID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -460,14 +470,15 @@ func (r *documentVersionApprovalDecisionConnectionResolver) TotalCount(ctx conte
 		return 0, err
 	}
 
-	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	prb := r.probo
 
 	filter := coredata.NewDocumentVersionApprovalDecisionFilter(nil)
 	if obj.Filters != nil {
 		filter = obj.Filters
 	}
 
-	count, err := prb.DocumentApprovals.CountDecisions(ctx, obj.ParentID, filter)
+	count, err := prb.DocumentApprovals.CountDecisions(ctx, scope, obj.ParentID, filter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count approval decisions", log.Error(err))
 		return 0, gqlutils.Internal(ctx)
@@ -482,9 +493,10 @@ func (r *documentVersionApprovalQuorumResolver) DocumentVersion(ctx context.Cont
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	documentVersion, err := prb.Documents.GetVersion(ctx, obj.DocumentVersion.ID)
+	documentVersion, err := prb.Documents.GetVersion(ctx, scope, obj.DocumentVersion.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -504,7 +516,8 @@ func (r *documentVersionApprovalQuorumResolver) Decisions(ctx context.Context, o
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionApprovalDecisionOrderField]{
 		Field:     coredata.DocumentVersionApprovalDecisionOrderFieldCreatedAt,
@@ -526,7 +539,7 @@ func (r *documentVersionApprovalQuorumResolver) Decisions(ctx context.Context, o
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	p, err := prb.DocumentApprovals.ListDecisions(ctx, obj.ID, cursor, approvalFilter)
+	p, err := prb.DocumentApprovals.ListDecisions(ctx, scope, obj.ID, cursor, approvalFilter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list approval decisions", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -546,9 +559,10 @@ func (r *documentVersionApprovalQuorumConnectionResolver) TotalCount(ctx context
 		return 0, err
 	}
 
-	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	prb := r.probo
 
-	count, err := prb.DocumentApprovals.CountQuorums(ctx, obj.ParentID)
+	count, err := prb.DocumentApprovals.CountQuorums(ctx, scope, obj.ParentID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count approval quorums", log.Error(err))
 		return 0, gqlutils.Internal(ctx)
@@ -563,7 +577,8 @@ func (r *documentVersionConnectionResolver) TotalCount(ctx context.Context, obj
 		return 0, err
 	}
 
-	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	prb := r.probo
 
 	switch obj.Resolver.(type) {
 	case *documentResolver:
@@ -572,7 +587,7 @@ func (r *documentVersionConnectionResolver) TotalCount(ctx context.Context, obj
 			filter = obj.Filters
 		}
 
-		count, err := prb.Documents.CountVersionsForDocumentID(ctx, obj.ParentID, filter)
+		count, err := prb.Documents.CountVersionsForDocumentID(ctx, scope, obj.ParentID, filter)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count document versions", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
@@ -592,9 +607,10 @@ func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context,
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	documentVersion, err := prb.Documents.GetVersion(ctx, obj.DocumentVersion.ID)
+	documentVersion, err := prb.Documents.GetVersion(ctx, scope, obj.DocumentVersion.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -641,7 +657,8 @@ func (r *documentVersionSignatureConnectionResolver) TotalCount(ctx context.Cont
 		return 0, err
 	}
 
-	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ParentID)
+	prb := r.probo
 
 	switch obj.Resolver.(type) {
 	case *documentVersionResolver:
@@ -650,7 +667,7 @@ func (r *documentVersionSignatureConnectionResolver) TotalCount(ctx context.Cont
 			filter = obj.Filters
 		}
 
-		count, err := prb.Documents.CountSignaturesForVersionID(ctx, obj.ParentID, filter)
+		count, err := prb.Documents.CountSignaturesForVersionID(ctx, scope, obj.ParentID, filter)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count signatures", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
@@ -672,9 +689,10 @@ func (r *employeeDocumentResolver) Signed(ctx context.Context, obj *types.Employ
 
 	identity := authn.IdentityFromContext(ctx)
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	signed, err := prb.Documents.IsSigned(ctx, obj.ID, identity.EmailAddress)
+	signed, err := prb.Documents.IsSigned(ctx, scope, obj.ID, identity.EmailAddress)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, nil
@@ -696,9 +714,10 @@ func (r *employeeDocumentResolver) ApprovalState(ctx context.Context, obj *types
 
 	identity := authn.IdentityFromContext(ctx)
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	state, err := prb.Documents.GetViewerApprovalState(ctx, obj.ID, identity.ID)
+	state, err := prb.Documents.GetViewerApprovalState(ctx, scope, obj.ID, identity.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, nil
@@ -718,7 +737,8 @@ func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.Empl
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{
 		Field:     coredata.DocumentVersionOrderFieldCreatedAt,
@@ -750,7 +770,7 @@ func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.Empl
 	versionFilter := coredata.NewDocumentVersionFilter().
 		WithEmployeeIdentityID(&identity.ID, filterMode)
 
-	versionsPage, err := prb.Documents.ListVersions(ctx, obj.ID, cursor, versionFilter)
+	versionsPage, err := prb.Documents.ListVersions(ctx, scope, obj.ID, cursor, versionFilter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list employee document versions", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -786,9 +806,10 @@ func (r *employeeDocumentVersionResolver) Signed(ctx context.Context, obj *types
 
 	identity := authn.IdentityFromContext(ctx)
 
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	signed, err := prb.Documents.IsVersionSignedByUserEmail(ctx, obj.ID, identity.EmailAddress)
+	signed, err := prb.Documents.IsVersionSignedByUserEmail(ctx, scope, obj.ID, identity.EmailAddress)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot check if version is signed", log.Error(err))
 		return false, gqlutils.Internal(ctx)
@@ -804,9 +825,10 @@ func (r *employeeDocumentVersionResolver) ApprovalDecision(ctx context.Context,
 	}
 
 	identity := authn.IdentityFromContext(ctx)
-	prb := r.ProboService(ctx, obj.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(obj.ID)
+	prb := r.probo
 
-	decision, err := prb.DocumentApprovals.GetViewerDecision(ctx, obj.ID, identity.ID)
+	decision, err := prb.DocumentApprovals.GetViewerDecision(ctx, scope, obj.ID, identity.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, nil
@@ -826,7 +848,8 @@ func (r *mutationResolver) CreateDocument(ctx context.Context, input types.Creat
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
+	prb := r.probo
 
 	var content string
 	if input.Content != nil {
@@ -834,7 +857,7 @@ func (r *mutationResolver) CreateDocument(ctx context.Context, input types.Creat
 	}
 
 	document, documentVersion, err := prb.Documents.Create(
-		ctx,
+		ctx, scope,
 		probo.CreateDocumentRequest{
 			OrganizationID:        input.OrganizationID,
 			Title:                 input.Title,
@@ -871,7 +894,8 @@ func (r *mutationResolver) UpdateDocument(ctx context.Context, input types.Updat
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.ID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.ID)
+	prb := r.probo
 
 	var defaultApproverIDs *[]gid.GID
 	if input.DefaultApproverIds != nil {
@@ -879,7 +903,7 @@ func (r *mutationResolver) UpdateDocument(ctx context.Context, input types.Updat
 	}
 
 	document, documentVersion, draftCreated, err := prb.Documents.Update(
-		ctx,
+		ctx, scope,
 		probo.UpdateDocumentRequest{
 			DocumentID:            input.ID,
 			Title:                 input.Title,
@@ -936,9 +960,10 @@ func (r *mutationResolver) DeleteDocumentDraft(ctx context.Context, input types.
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentID)
+	prb := r.probo
 
-	document, err := prb.Documents.DeleteDraft(ctx, input.DocumentID)
+	document, err := prb.Documents.DeleteDraft(ctx, scope, input.DocumentID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -968,9 +993,10 @@ func (r *mutationResolver) ArchiveDocument(ctx context.Context, input types.Arch
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentID)
+	prb := r.probo
 
-	document, err := prb.Documents.Archive(ctx, input.DocumentID)
+	document, err := prb.Documents.Archive(ctx, scope, input.DocumentID)
 	if err != nil {
 		if errArchived, ok := errors.AsType[*probo.ErrDocumentArchived](err); ok {
 			return nil, gqlutils.Conflict(ctx, errArchived)
@@ -992,9 +1018,10 @@ func (r *mutationResolver) UnarchiveDocument(ctx context.Context, input types.Un
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentID)
+	prb := r.probo
 
-	document, err := prb.Documents.Unarchive(ctx, input.DocumentID)
+	document, err := prb.Documents.Unarchive(ctx, scope, input.DocumentID)
 	if err != nil {
 		if errNotArchived, ok := errors.AsType[*probo.ErrDocumentNotArchived](err); ok {
 			return nil, gqlutils.Conflict(ctx, errNotArchived)
@@ -1016,9 +1043,10 @@ func (r *mutationResolver) DeleteDocument(ctx context.Context, input types.Delet
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentID)
+	prb := r.probo
 
-	err := prb.Documents.SoftDelete(ctx, input.DocumentID)
+	err := prb.Documents.SoftDelete(ctx, scope, input.DocumentID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot soft delete document", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -1040,9 +1068,10 @@ func (r *mutationResolver) PublishDocument(ctx context.Context, input types.Publ
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentID)
+	prb := r.probo
 
-	result, err := prb.Documents.PublishVersion(ctx, probo.PublishDocumentRequest{
+	result, err := prb.Documents.PublishVersion(ctx, scope, probo.PublishDocumentRequest{
 		DocumentID:  input.DocumentID,
 		Minor:       input.Minor,
 		ApproverIDs: input.ApproverIds,
@@ -1104,9 +1133,10 @@ func (r *mutationResolver) BulkPublishDocuments(ctx context.Context, input types
 		}
 	}
 
-	prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentIds[0])
+	prb := r.probo
 
-	versions, documents, err := prb.DocumentApprovals.BulkPublishVersions(ctx, probo.BulkPublishVersionsRequest{
+	versions, documents, err := prb.DocumentApprovals.BulkPublishVersions(ctx, scope, probo.BulkPublishVersionsRequest{
 		DocumentIDs: input.DocumentIds,
 		Minor:       input.Minor,
 		Changelog:   input.Changelog,
@@ -1151,9 +1181,10 @@ func (r *mutationResolver) VoidDocumentVersionApproval(ctx context.Context, inpu
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentVersionID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
+	prb := r.probo
 
-	quorum, documentVersion, err := prb.DocumentApprovals.VoidApproval(ctx, input.DocumentVersionID)
+	quorum, documentVersion, err := prb.DocumentApprovals.VoidApproval(ctx, scope, input.DocumentVersionID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -1192,9 +1223,10 @@ func (r *mutationResolver) BulkDeleteDocuments(ctx context.Context, input types.
 		}
 	}
 
-	prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentIds[0])
+	prb := r.probo
 
-	err := prb.Documents.BulkSoftDelete(ctx, input.DocumentIds)
+	err := prb.Documents.BulkSoftDelete(ctx, scope, input.DocumentIds)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot bulk delete documents", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -1219,9 +1251,10 @@ func (r *mutationResolver) BulkArchiveDocuments(ctx context.Context, input types
 		}
 	}
 
-	prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentIds[0])
+	prb := r.probo
 
-	if err := prb.Documents.BulkArchive(ctx, input.DocumentIds); err != nil {
+	if err := prb.Documents.BulkArchive(ctx, scope, input.DocumentIds); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot bulk archive documents", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -1245,9 +1278,10 @@ func (r *mutationResolver) BulkUnarchiveDocuments(ctx context.Context, input typ
 		}
 	}
 
-	prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentIds[0])
+	prb := r.probo
 
-	if err := prb.Documents.BulkUnarchive(ctx, input.DocumentIds); err != nil {
+	if err := prb.Documents.BulkUnarchive(ctx, scope, input.DocumentIds); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot bulk unarchive documents", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -1271,7 +1305,8 @@ func (r *mutationResolver) BulkExportDocuments(ctx context.Context, input types.
 		}
 	}
 
-	prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentIds[0])
+	prb := r.probo
 
 	identity := authn.IdentityFromContext(ctx)
 
@@ -1281,7 +1316,7 @@ func (r *mutationResolver) BulkExportDocuments(ctx context.Context, input types.
 		WatermarkEmail: input.WatermarkEmail,
 	}
 
-	documentExport, exportErr := prb.Documents.RequestExport(ctx, input.DocumentIds, identity.EmailAddress, identity.FullName, options)
+	documentExport, exportErr := prb.Documents.RequestExport(ctx, scope, input.DocumentIds, identity.EmailAddress, identity.FullName, options)
 	if exportErr != nil {
 		r.logger.ErrorCtx(ctx, "cannot request document export", log.Error(exportErr))
 		return nil, gqlutils.Internal(ctx)
@@ -1298,9 +1333,10 @@ func (r *mutationResolver) GenerateDocumentChangelog(ctx context.Context, input
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentID)
+	prb := r.probo
 
-	changelog, err := prb.Documents.GenerateChangelog(ctx, input.DocumentID)
+	changelog, err := prb.Documents.GenerateChangelog(ctx, scope, input.DocumentID)
 	if err != nil {
 		if errArchived, ok := errors.AsType[*probo.ErrDocumentArchived](err); ok {
 			return nil, gqlutils.Conflict(ctx, errArchived)
@@ -1322,10 +1358,11 @@ func (r *mutationResolver) RequestSignature(ctx context.Context, input types.Req
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentVersionID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
+	prb := r.probo
 
 	documentVersionSignature, err := prb.Documents.RequestSignature(
-		ctx,
+		ctx, scope,
 		probo.RequestSignatureRequest{
 			DocumentVersionID: input.DocumentVersionID,
 			Signatory:         input.SignatoryID,
@@ -1372,10 +1409,11 @@ func (r *mutationResolver) BulkRequestSignatures(ctx context.Context, input type
 		}
 	}
 
-	prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentIds[0])
+	prb := r.probo
 
 	documentVersionSignatures, err := prb.Documents.BulkRequestSignatures(
-		ctx,
+		ctx, scope,
 		probo.BulkRequestSignaturesRequest{
 			DocumentIDs:  input.DocumentIds,
 			SignatoryIDs: input.SignatoryIds,
@@ -1410,9 +1448,10 @@ func (r *mutationResolver) SendSigningNotifications(ctx context.Context, input t
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
+	prb := r.probo
 
-	err := prb.Documents.SendSigningNotifications(ctx, input.OrganizationID)
+	err := prb.Documents.SendSigningNotifications(ctx, scope, input.OrganizationID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot send signing notifications", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -1429,9 +1468,10 @@ func (r *mutationResolver) CancelSignatureRequest(ctx context.Context, input typ
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentVersionSignatureID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentVersionSignatureID)
+	prb := r.probo
 
-	err := prb.Documents.CancelSignatureRequest(ctx, input.DocumentVersionSignatureID)
+	err := prb.Documents.CancelSignatureRequest(ctx, scope, input.DocumentVersionSignatureID)
 	if err != nil {
 		if errArchived, ok := errors.AsType[*probo.ErrDocumentArchived](err); ok {
 			return nil, gqlutils.Conflict(ctx, errArchived)
@@ -1454,9 +1494,10 @@ func (r *mutationResolver) SignDocument(ctx context.Context, input types.SignDoc
 	}
 
 	identity := authn.IdentityFromContext(ctx)
-	prb := r.ProboService(ctx, input.DocumentVersionID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
+	prb := r.probo
 
-	documentVersionSignature, err := prb.Documents.SignDocumentVersionByIdentity(ctx, input.DocumentVersionID, identity.ID)
+	documentVersionSignature, err := prb.Documents.SignDocumentVersionByIdentity(ctx, scope, input.DocumentVersionID, identity.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceAlreadyExists) {
 			return nil, gqlutils.Conflict(ctx, err)
@@ -1486,9 +1527,10 @@ func (r *mutationResolver) ApproveDocumentVersion(ctx context.Context, input typ
 		signerIP = httpReq.RemoteAddr
 	}
 
-	prb := r.ProboService(ctx, input.DocumentVersionID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
+	prb := r.probo
 
-	decision, err := prb.DocumentApprovals.Approve(ctx, probo.ApproveDocumentVersionRequest{
+	decision, err := prb.DocumentApprovals.Approve(ctx, scope, probo.ApproveDocumentVersionRequest{
 		DocumentVersionID: input.DocumentVersionID,
 		IdentityID:        identity.ID,
 		Comment:           input.Comment,
@@ -1532,9 +1574,10 @@ func (r *mutationResolver) RejectDocumentVersion(ctx context.Context, input type
 
 	identity := authn.IdentityFromContext(ctx)
 
-	prb := r.ProboService(ctx, input.DocumentVersionID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
+	prb := r.probo
 
-	decision, err := prb.DocumentApprovals.Reject(ctx, probo.RejectDocumentVersionRequest{
+	decision, err := prb.DocumentApprovals.Reject(ctx, scope, probo.RejectDocumentVersionRequest{
 		DocumentVersionID: input.DocumentVersionID,
 		IdentityID:        identity.ID,
 		Comment:           input.Comment,
@@ -1572,7 +1615,8 @@ func (r *mutationResolver) ExportDocumentVersionPDF(ctx context.Context, input t
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentVersionID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
+	prb := r.probo
 
 	watermarkEmail := input.WatermarkEmail
 	if input.WithWatermark && watermarkEmail == nil {
@@ -1586,7 +1630,7 @@ func (r *mutationResolver) ExportDocumentVersionPDF(ctx context.Context, input t
 		WatermarkEmail: watermarkEmail,
 	}
 
-	pdf, err := prb.Documents.ExportPDF(ctx, input.DocumentVersionID, options)
+	pdf, err := prb.Documents.ExportPDF(ctx, scope, input.DocumentVersionID, options)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot export document version PDF", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -1603,9 +1647,10 @@ func (r *mutationResolver) ExportEmployeeDocumentVersionPDF(ctx context.Context,
 		return nil, err
 	}
 
-	prb := r.ProboService(ctx, input.DocumentVersionID.TenantID())
+	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
+	prb := r.probo
 
-	documentVersion, err := prb.Documents.GetVersion(ctx, input.DocumentVersionID)
+	documentVersion, err := prb.Documents.GetVersion(ctx, scope, input.DocumentVersionID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot get document version", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -1618,7 +1663,7 @@ func (r *mutationResolver) ExportEmployeeDocumentVersionPDF(ctx context.Context,
 		coredata.EmployeeFilterModeApproval,
 	)
 
-	_, err = prb.Documents.GetWithFilter(ctx, documentVersion.DocumentID, documentFilter)
+	_, err = prb.Documents.GetWithFilter(ctx, scope, documentVersion.DocumentID, documentFilter)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -1635,7 +1680,7 @@ func (r *mutationResolver) ExportEmployeeDocumentVersionPDF(ctx context.Context,
 		WatermarkEmail: &identity.EmailAddress,
 	}
 
-	pdf, err := prb.Documents.ExportPDF(ctx, input.DocumentVersionID, options)
+	pdf, err := prb.Documents.ExportPDF(ctx, scope, input.DocumentVersionID, options)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot export employee document PDF", log.Error(err))
 		return nil, gqlutils.Internal(ctx)