Rewrite the global id system to include tenant id

The API should be aware of the tenant they are working on. Many solution is possible like passing a header, adding the tenant id in each function call, encode the tenant id in the GID. I consider the header as a hack it force the client to keep in mind to pass this header, having to returns an error in case of not defined header and add a non standard header make the API more harder to use. Passing the tenant id everywhere will be a good option but since Relay impose to have node(id: ID!) Node interface it is not possible or by hacking by wrapping node(id: ID!) Node in top query who getting the tenant_id. I finish by simpliy encode the tenant id directly in the object id, it what AWS do too, it allow to always have the information, and it ensure a right data isolation. Signed-off-by: gearnode <bryan@frimin.fr>
2025-03-10 13:54:55 +01:00
parent 06bab5061c
commit 58eda95d93
23 changed files with 676 additions and 299 deletions
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
@@ -4166,6 +4166,52 @@ func (ec *executionContext) field_User_organizations_argsBefore(
 	return zeroVal, nil
 }

+func (ec *executionContext) field___Directive_args_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field___Directive_args_argsIncludeDeprecated(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["includeDeprecated"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field___Directive_args_argsIncludeDeprecated(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*bool, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("includeDeprecated"))
+	if tmp, ok := rawArgs["includeDeprecated"]; ok {
+		return ec.unmarshalOBoolean2ᚖbool(ctx, tmp)
+	}
+
+	var zeroVal *bool
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field___Field_args_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field___Field_args_argsIncludeDeprecated(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["includeDeprecated"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field___Field_args_argsIncludeDeprecated(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*bool, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("includeDeprecated"))
+	if tmp, ok := rawArgs["includeDeprecated"]; ok {
+		return ec.unmarshalOBoolean2ᚖbool(ctx, tmp)
+	}
+
+	var zeroVal *bool
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field___Type_enumValues_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -9984,6 +10030,8 @@ func (ec *executionContext) fieldContext_Query___type(ctx context.Context, field
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -9996,8 +10044,8 @@ func (ec *executionContext) fieldContext_Query___type(ctx context.Context, field
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -12435,6 +12483,44 @@ func (ec *executionContext) fieldContext___Directive_description(_ context.Conte
 	return fc, nil
 }

+func (ec *executionContext) ___Directive_isRepeatable(ctx context.Context, field graphql.CollectedField, obj *introspection.Directive) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___Directive_isRepeatable(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.IsRepeatable, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(bool)
+	fc.Result = res
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext___Directive_isRepeatable(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "__Directive",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) ___Directive_locations(ctx context.Context, field graphql.CollectedField, obj *introspection.Directive) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext___Directive_locations(ctx, field)
 	if err != nil {
@@ -12498,7 +12584,7 @@ func (ec *executionContext) ___Directive_args(ctx context.Context, field graphql
 	return ec.marshalN__InputValue2ᚕgithubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚋintrospectionᚐInputValueᚄ(ctx, field.Selections, res)
 }

-func (ec *executionContext) fieldContext___Directive_args(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext___Directive_args(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "__Directive",
 		Field:      field,
@@ -12514,47 +12600,18 @@ func (ec *executionContext) fieldContext___Directive_args(_ context.Context, fie
 				return ec.fieldContext___InputValue_type(ctx, field)
 			case "defaultValue":
 				return ec.fieldContext___InputValue_defaultValue(ctx, field)
+			case "isDeprecated":
+				return ec.fieldContext___InputValue_isDeprecated(ctx, field)
+			case "deprecationReason":
+				return ec.fieldContext___InputValue_deprecationReason(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __InputValue", field.Name)
 		},
 	}
-	return fc, nil
-}
-
-func (ec *executionContext) ___Directive_isRepeatable(ctx context.Context, field graphql.CollectedField, obj *introspection.Directive) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext___Directive_isRepeatable(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
 	ctx = graphql.WithFieldContext(ctx, fc)
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.IsRepeatable, nil
-	})
-	if err != nil {
+	if fc.Args, err = ec.field___Directive_args_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(bool)
-	fc.Result = res
-	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext___Directive_isRepeatable(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "__Directive",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
-		},
+		return fc, err
 	}
 	return fc, nil
 }
@@ -12803,7 +12860,7 @@ func (ec *executionContext) ___Field_args(ctx context.Context, field graphql.Col
 	return ec.marshalN__InputValue2ᚕgithubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚋintrospectionᚐInputValueᚄ(ctx, field.Selections, res)
 }

-func (ec *executionContext) fieldContext___Field_args(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext___Field_args(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "__Field",
 		Field:      field,
@@ -12819,10 +12876,19 @@ func (ec *executionContext) fieldContext___Field_args(_ context.Context, field g
 				return ec.fieldContext___InputValue_type(ctx, field)
 			case "defaultValue":
 				return ec.fieldContext___InputValue_defaultValue(ctx, field)
+			case "isDeprecated":
+				return ec.fieldContext___InputValue_isDeprecated(ctx, field)
+			case "deprecationReason":
+				return ec.fieldContext___InputValue_deprecationReason(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __InputValue", field.Name)
 		},
 	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field___Field_args_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }

@@ -12865,6 +12931,8 @@ func (ec *executionContext) fieldContext___Field_type(_ context.Context, field g
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -12877,8 +12945,8 @@ func (ec *executionContext) fieldContext___Field_type(_ context.Context, field g
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13071,6 +13139,8 @@ func (ec *executionContext) fieldContext___InputValue_type(_ context.Context, fi
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13083,8 +13153,8 @@ func (ec *executionContext) fieldContext___InputValue_type(_ context.Context, fi
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13127,6 +13197,79 @@ func (ec *executionContext) fieldContext___InputValue_defaultValue(_ context.Con
 	return fc, nil
 }

+func (ec *executionContext) ___InputValue_isDeprecated(ctx context.Context, field graphql.CollectedField, obj *introspection.InputValue) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___InputValue_isDeprecated(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.IsDeprecated(), nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(bool)
+	fc.Result = res
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext___InputValue_isDeprecated(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "__InputValue",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) ___InputValue_deprecationReason(ctx context.Context, field graphql.CollectedField, obj *introspection.InputValue) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___InputValue_deprecationReason(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.DeprecationReason(), nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext___InputValue_deprecationReason(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "__InputValue",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) ___Schema_description(ctx context.Context, field graphql.CollectedField, obj *introspection.Schema) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext___Schema_description(ctx, field)
 	if err != nil {
@@ -13201,6 +13344,8 @@ func (ec *executionContext) fieldContext___Schema_types(_ context.Context, field
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13213,8 +13358,8 @@ func (ec *executionContext) fieldContext___Schema_types(_ context.Context, field
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13261,6 +13406,8 @@ func (ec *executionContext) fieldContext___Schema_queryType(_ context.Context, f
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13273,8 +13420,8 @@ func (ec *executionContext) fieldContext___Schema_queryType(_ context.Context, f
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13318,6 +13465,8 @@ func (ec *executionContext) fieldContext___Schema_mutationType(_ context.Context
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13330,8 +13479,8 @@ func (ec *executionContext) fieldContext___Schema_mutationType(_ context.Context
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13375,6 +13524,8 @@ func (ec *executionContext) fieldContext___Schema_subscriptionType(_ context.Con
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13387,8 +13538,8 @@ func (ec *executionContext) fieldContext___Schema_subscriptionType(_ context.Con
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13433,12 +13584,12 @@ func (ec *executionContext) fieldContext___Schema_directives(_ context.Context,
 				return ec.fieldContext___Directive_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Directive_description(ctx, field)
+			case "isRepeatable":
+				return ec.fieldContext___Directive_isRepeatable(ctx, field)
 			case "locations":
 				return ec.fieldContext___Directive_locations(ctx, field)
 			case "args":
 				return ec.fieldContext___Directive_args(ctx, field)
-			case "isRepeatable":
-				return ec.fieldContext___Directive_isRepeatable(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Directive", field.Name)
 		},
@@ -13554,6 +13705,41 @@ func (ec *executionContext) fieldContext___Type_description(_ context.Context, f
 	return fc, nil
 }

+func (ec *executionContext) ___Type_specifiedByURL(ctx context.Context, field graphql.CollectedField, obj *introspection.Type) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___Type_specifiedByURL(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.SpecifiedByURL(), nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext___Type_specifiedByURL(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "__Type",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) ___Type_fields(ctx context.Context, field graphql.CollectedField, obj *introspection.Type) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext___Type_fields(ctx, field)
 	if err != nil {
@@ -13644,6 +13830,8 @@ func (ec *executionContext) fieldContext___Type_interfaces(_ context.Context, fi
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13656,8 +13844,8 @@ func (ec *executionContext) fieldContext___Type_interfaces(_ context.Context, fi
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13701,6 +13889,8 @@ func (ec *executionContext) fieldContext___Type_possibleTypes(_ context.Context,
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13713,8 +13903,8 @@ func (ec *executionContext) fieldContext___Type_possibleTypes(_ context.Context,
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13810,6 +14000,10 @@ func (ec *executionContext) fieldContext___Type_inputFields(_ context.Context, f
 				return ec.fieldContext___InputValue_type(ctx, field)
 			case "defaultValue":
 				return ec.fieldContext___InputValue_defaultValue(ctx, field)
+			case "isDeprecated":
+				return ec.fieldContext___InputValue_isDeprecated(ctx, field)
+			case "deprecationReason":
+				return ec.fieldContext___InputValue_deprecationReason(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __InputValue", field.Name)
 		},
@@ -13853,6 +14047,8 @@ func (ec *executionContext) fieldContext___Type_ofType(_ context.Context, field
 				return ec.fieldContext___Type_name(ctx, field)
 			case "description":
 				return ec.fieldContext___Type_description(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
 			case "fields":
 				return ec.fieldContext___Type_fields(ctx, field)
 			case "interfaces":
@@ -13865,8 +14061,8 @@ func (ec *executionContext) fieldContext___Type_ofType(_ context.Context, field
 				return ec.fieldContext___Type_inputFields(ctx, field)
 			case "ofType":
 				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			case "isOneOf":
+				return ec.fieldContext___Type_isOneOf(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
@@ -13874,15 +14070,15 @@ func (ec *executionContext) fieldContext___Type_ofType(_ context.Context, field
 	return fc, nil
 }

-func (ec *executionContext) ___Type_specifiedByURL(ctx context.Context, field graphql.CollectedField, obj *introspection.Type) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext___Type_specifiedByURL(ctx, field)
+func (ec *executionContext) ___Type_isOneOf(ctx context.Context, field graphql.CollectedField, obj *introspection.Type) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext___Type_isOneOf(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
 	ctx = graphql.WithFieldContext(ctx, fc)
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.SpecifiedByURL(), nil
+		return obj.IsOneOf(), nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -13891,19 +14087,19 @@ func (ec *executionContext) ___Type_specifiedByURL(ctx context.Context, field gr
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(*string)
+	res := resTmp.(bool)
 	fc.Result = res
-	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+	return ec.marshalOBoolean2bool(ctx, field.Selections, res)
 }

-func (ec *executionContext) fieldContext___Type_specifiedByURL(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext___Type_isOneOf(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "__Type",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Boolean does not have child fields")
 		},
 	}
 	return fc, nil
@@ -18254,6 +18450,11 @@ func (ec *executionContext) ___Directive(ctx context.Context, sel ast.SelectionS
 			}
 		case "description":
 			out.Values[i] = ec.___Directive_description(ctx, field, obj)
+		case "isRepeatable":
+			out.Values[i] = ec.___Directive_isRepeatable(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "locations":
 			out.Values[i] = ec.___Directive_locations(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
@@ -18264,11 +18465,6 @@ func (ec *executionContext) ___Directive(ctx context.Context, sel ast.SelectionS
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
-		case "isRepeatable":
-			out.Values[i] = ec.___Directive_isRepeatable(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
@@ -18423,6 +18619,13 @@ func (ec *executionContext) ___InputValue(ctx context.Context, sel ast.Selection
 			}
 		case "defaultValue":
 			out.Values[i] = ec.___InputValue_defaultValue(ctx, field, obj)
+		case "isDeprecated":
+			out.Values[i] = ec.___InputValue_isDeprecated(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deprecationReason":
+			out.Values[i] = ec.___InputValue_deprecationReason(ctx, field, obj)
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
@@ -18521,6 +18724,8 @@ func (ec *executionContext) ___Type(ctx context.Context, sel ast.SelectionSet, o
 			out.Values[i] = ec.___Type_name(ctx, field, obj)
 		case "description":
 			out.Values[i] = ec.___Type_description(ctx, field, obj)
+		case "specifiedByURL":
+			out.Values[i] = ec.___Type_specifiedByURL(ctx, field, obj)
 		case "fields":
 			out.Values[i] = ec.___Type_fields(ctx, field, obj)
 		case "interfaces":
@@ -18533,8 +18738,8 @@ func (ec *executionContext) ___Type(ctx context.Context, sel ast.SelectionSet, o
 			out.Values[i] = ec.___Type_inputFields(ctx, field, obj)
 		case "ofType":
 			out.Values[i] = ec.___Type_ofType(ctx, field, obj)
-		case "specifiedByURL":
-			out.Values[i] = ec.___Type_specifiedByURL(ctx, field, obj)
+		case "isOneOf":
+			out.Values[i] = ec.___Type_isOneOf(ctx, field, obj)
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -2,7 +2,7 @@ package console_v1

 // This file will be automatically regenerated based on the schema, any resolver implementations
 // will be copied through when generating and any unknown code will be moved to the end.
-// Code generated by github.com/99designs/gqlgen version v0.17.63
+// Code generated by github.com/99designs/gqlgen version v0.17.66

 import (
 	"context"
@@ -20,9 +20,10 @@ import (

 // StateTransisions is the resolver for the stateTransisions field.
 func (r *controlResolver) StateTransisions(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ControlStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListControlStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListControlStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -32,9 +33,10 @@ func (r *controlResolver) StateTransisions(ctx context.Context, obj *types.Contr

 // Tasks is the resolver for the tasks field.
 func (r *controlResolver) Tasks(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TaskConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListControlTasks(ctx, obj.ID, cursor)
+	page, err := svc.ListControlTasks(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -44,7 +46,9 @@ func (r *controlResolver) Tasks(ctx context.Context, obj *types.Control, first *

 // FileURL is the resolver for the fileUrl field.
 func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (string, error) {
-	fileURL, err := r.proboSvc.GetEvidenceFileURL(ctx, obj.ID, 15*time.Minute)
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
+	fileURL, err := svc.GetEvidenceFileURL(ctx, obj.ID, 15*time.Minute)
 	if err != nil {
 		return "", fmt.Errorf("cannot generate file URL: %w", err)
 	}
@@ -54,9 +58,10 @@ func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (st

 // StateTransisions is the resolver for the stateTransisions field.
 func (r *evidenceResolver) StateTransisions(ctx context.Context, obj *types.Evidence, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.EvidenceStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListEvidenceStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListEvidenceStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list evidence state transitions: %w", err)
 	}
@@ -66,9 +71,10 @@ func (r *evidenceResolver) StateTransisions(ctx context.Context, obj *types.Evid

 // Controls is the resolver for the controls field.
 func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ControlConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListFrameworkControls(ctx, obj.ID, cursor)
+	page, err := svc.ListFrameworkControls(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list framework controls: %w", err)
 	}
@@ -78,7 +84,9 @@ func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework,

 // CreateVendor is the resolver for the createVendor field.
 func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateVendorInput) (*types.CreateVendorPayload, error) {
-	vendor, err := r.proboSvc.CreateVendor(ctx, probo.CreateVendorRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	vendor, err := svc.CreateVendor(ctx, probo.CreateVendorRequest{
 		OrganizationID:       input.OrganizationID,
 		Name:                 input.Name,
 		Description:          input.Description,
@@ -100,7 +108,9 @@ func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateV

 // UpdateVendor is the resolver for the updateVendor field.
 func (r *mutationResolver) UpdateVendor(ctx context.Context, input types.UpdateVendorInput) (*types.UpdateVendorPayload, error) {
-	vendor, err := r.proboSvc.UpdateVendor(ctx, probo.UpdateVendorRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	vendor, err := svc.UpdateVendor(ctx, probo.UpdateVendorRequest{
 		ID:                   input.ID,
 		ExpectedVersion:      input.ExpectedVersion,
 		Name:                 input.Name,
@@ -124,7 +134,9 @@ func (r *mutationResolver) UpdateVendor(ctx context.Context, input types.UpdateV

 // DeleteVendor is the resolver for the deleteVendor field.
 func (r *mutationResolver) DeleteVendor(ctx context.Context, input types.DeleteVendorInput) (*types.DeleteVendorPayload, error) {
-	err := r.proboSvc.DeleteVendor(ctx, input.VendorID)
+	svc := r.proboSvc.WithTenant(input.VendorID.TenantID())
+
+	err := svc.DeleteVendor(ctx, input.VendorID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete vendor: %w", err)
 	}
@@ -136,7 +148,9 @@ func (r *mutationResolver) DeleteVendor(ctx context.Context, input types.DeleteV

 // CreatePeople is the resolver for the createPeople field.
 func (r *mutationResolver) CreatePeople(ctx context.Context, input types.CreatePeopleInput) (*types.CreatePeoplePayload, error) {
-	people, err := r.proboSvc.CreatePeople(ctx, probo.CreatePeopleRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	people, err := svc.CreatePeople(ctx, probo.CreatePeopleRequest{
 		OrganizationID:           input.OrganizationID,
 		FullName:                 input.FullName,
 		PrimaryEmailAddress:      input.PrimaryEmailAddress,
@@ -155,7 +169,9 @@ func (r *mutationResolver) CreatePeople(ctx context.Context, input types.CreateP

 // UpdatePeople is the resolver for the updatePeople field.
 func (r *mutationResolver) UpdatePeople(ctx context.Context, input types.UpdatePeopleInput) (*types.UpdatePeoplePayload, error) {
-	people, err := r.proboSvc.UpdatePeople(ctx, probo.UpdatePeopleRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	people, err := svc.UpdatePeople(ctx, probo.UpdatePeopleRequest{
 		ID:                       input.ID,
 		ExpectedVersion:          input.ExpectedVersion,
 		FullName:                 input.FullName,
@@ -174,7 +190,9 @@ func (r *mutationResolver) UpdatePeople(ctx context.Context, input types.UpdateP

 // DeletePeople is the resolver for the deletePeople field.
 func (r *mutationResolver) DeletePeople(ctx context.Context, input types.DeletePeopleInput) (*types.DeletePeoplePayload, error) {
-	err := r.proboSvc.DeletePeople(ctx, input.PeopleID)
+	svc := r.proboSvc.WithTenant(input.PeopleID.TenantID())
+
+	err := svc.DeletePeople(ctx, input.PeopleID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete people: %w", err)
 	}
@@ -210,7 +228,9 @@ func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.D

 // UpdateTaskState is the resolver for the updateTaskState field.
 func (r *mutationResolver) UpdateTaskState(ctx context.Context, input types.UpdateTaskStateInput) (*types.UpdateTaskStatePayload, error) {
-	task, err := r.proboSvc.UpdateTaskState(ctx, probo.UpdateTaskStateRequest{
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
+	task, err := svc.UpdateTaskState(ctx, probo.UpdateTaskStateRequest{
 		TaskID: input.TaskID,
 		State:  input.State,
 		Reason: nil,
@@ -226,7 +246,9 @@ func (r *mutationResolver) UpdateTaskState(ctx context.Context, input types.Upda

 // CreateTask is the resolver for the createTask field.
 func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTaskInput) (*types.CreateTaskPayload, error) {
-	task, err := r.proboSvc.CreateTask(ctx, probo.CreateTaskRequest{
+	svc := r.proboSvc.WithTenant(input.ControlID.TenantID())
+
+	task, err := svc.CreateTask(ctx, probo.CreateTaskRequest{
 		ControlID:   input.ControlID,
 		Name:        input.Name,
 		Description: input.Description,
@@ -242,7 +264,9 @@ func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTas

 // DeleteTask is the resolver for the deleteTask field.
 func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTaskInput) (*types.DeleteTaskPayload, error) {
-	err := r.proboSvc.DeleteTask(ctx, input.TaskID)
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
+	err := svc.DeleteTask(ctx, input.TaskID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete task: %w", err)
 	}
@@ -254,7 +278,9 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas

 // CreateFramework is the resolver for the createFramework field.
 func (r *mutationResolver) CreateFramework(ctx context.Context, input types.CreateFrameworkInput) (*types.CreateFrameworkPayload, error) {
-	framework, err := r.proboSvc.CreateFramework(ctx, probo.CreateFrameworkRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	framework, err := svc.CreateFramework(ctx, probo.CreateFrameworkRequest{
 		OrganizationID: input.OrganizationID,
 		Name:           input.Name,
 		Description:    input.Description,
@@ -270,7 +296,9 @@ func (r *mutationResolver) CreateFramework(ctx context.Context, input types.Crea

 // CreateControl is the resolver for the createControl field.
 func (r *mutationResolver) CreateControl(ctx context.Context, input types.CreateControlInput) (*types.CreateControlPayload, error) {
-	control, err := r.proboSvc.CreateControl(ctx, probo.CreateControlRequest{
+	svc := r.proboSvc.WithTenant(input.FrameworkID.TenantID())
+
+	control, err := svc.CreateControl(ctx, probo.CreateControlRequest{
 		FrameworkID: input.FrameworkID,
 		Name:        input.Name,
 		Description: input.Description,
@@ -287,19 +315,13 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create

 // UpdateFramework is the resolver for the updateFramework field.
 func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.UpdateFrameworkInput) (*types.UpdateFrameworkPayload, error) {
-	var name, description *string
-	if input.Name != nil {
-		name = input.Name
-	}
-	if input.Description != nil {
-		description = input.Description
-	}
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())

-	framework, err := r.proboSvc.UpdateFramework(ctx, probo.UpdateFrameworkRequest{
+	framework, err := svc.UpdateFramework(ctx, probo.UpdateFrameworkRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
-		Name:            name,
-		Description:     description,
+		Name:            input.Name,
+		Description:     input.Description,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot update framework: %w", err)
@@ -312,29 +334,15 @@ func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.Upda

 // UpdateControl is the resolver for the updateControl field.
 func (r *mutationResolver) UpdateControl(ctx context.Context, input types.UpdateControlInput) (*types.UpdateControlPayload, error) {
-	var name, description, category *string
-	var state *coredata.ControlState
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())

-	if input.Name != nil {
-		name = input.Name
-	}
-	if input.Description != nil {
-		description = input.Description
-	}
-	if input.Category != nil {
-		category = input.Category
-	}
-	if input.State != nil {
-		state = input.State
-	}
-
-	control, err := r.proboSvc.UpdateControl(ctx, probo.UpdateControlRequest{
+	control, err := svc.UpdateControl(ctx, probo.UpdateControlRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
-		Name:            name,
-		Description:     description,
-		Category:        category,
-		State:           state,
+		Name:            input.Name,
+		Description:     input.Description,
+		Category:        input.Category,
+		State:           input.State,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot update control: %w", err)
@@ -347,13 +355,15 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update

 // UploadEvidence is the resolver for the uploadEvidence field.
 func (r *mutationResolver) UploadEvidence(ctx context.Context, input types.UploadEvidenceInput) (*types.UploadEvidencePayload, error) {
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
 	req := probo.CreateEvidenceRequest{
 		TaskID: input.TaskID,
 		Name:   input.Name,
 		File:   input.File.File,
 	}

-	evidence, err := r.proboSvc.CreateEvidence(ctx, req)
+	evidence, err := svc.CreateEvidence(ctx, req)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create evidence: %w", err)
 	}
@@ -365,7 +375,9 @@ func (r *mutationResolver) UploadEvidence(ctx context.Context, input types.Uploa

 // DeleteEvidence is the resolver for the deleteEvidence field.
 func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error) {
-	err := r.proboSvc.DeleteEvidence(ctx, input.EvidenceID)
+	svc := r.proboSvc.WithTenant(input.EvidenceID.TenantID())
+
+	err := svc.DeleteEvidence(ctx, input.EvidenceID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to delete evidence: %w", err)
 	}
@@ -377,7 +389,9 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet

 // CreatePolicy is the resolver for the createPolicy field.
 func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error) {
-	policy, err := r.proboSvc.Policies.Create(ctx, probo.CreatePolicyRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	policy, err := svc.Policies.Create(ctx, probo.CreatePolicyRequest{
 		OrganizationID: input.OrganizationID,
 		Name:           input.Name,
 		Content:        input.Content,
@@ -396,7 +410,9 @@ func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreateP

 // UpdatePolicy is the resolver for the updatePolicy field.
 func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdatePolicyInput) (*types.UpdatePolicyPayload, error) {
-	policy, err := r.proboSvc.Policies.Update(ctx, probo.UpdatePolicyRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	policy, err := svc.Policies.Update(ctx, probo.UpdatePolicyRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
 		Name:            input.Name,
@@ -416,7 +432,9 @@ func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdateP

 // DeletePolicy is the resolver for the deletePolicy field.
 func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeletePolicyInput) (*types.DeletePolicyPayload, error) {
-	err := r.proboSvc.Policies.Delete(ctx, input.PolicyID)
+	svc := r.proboSvc.WithTenant(input.PolicyID.TenantID())
+
+	err := svc.Policies.Delete(ctx, input.PolicyID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete policy: %w", err)
 	}
@@ -428,9 +446,11 @@ func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeleteP

 // Frameworks is the resolver for the frameworks field.
 func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.FrameworkConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListOrganizationFrameworks(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationFrameworks(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization frameworks: %w", err)
 	}
@@ -440,9 +460,11 @@ func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organi

 // Vendors is the resolver for the vendors field.
 func (r *organizationResolver) Vendors(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.VendorConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListOrganizationVendors(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationVendors(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization vendors: %w", err)
 	}
@@ -452,9 +474,11 @@ func (r *organizationResolver) Vendors(ctx context.Context, obj *types.Organizat

 // Peoples is the resolver for the peoples field.
 func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PeopleConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListOrganizationPeoples(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationPeoples(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization peoples: %w", err)
 	}
@@ -464,9 +488,10 @@ func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organizat

 // Policies is the resolver for the policies field.
 func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PolicyConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.Policies.ListByOrganization(ctx, obj.ID, cursor)
+	page, err := svc.Policies.ListByOrganization(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization policies: %w", err)
 	}
@@ -476,13 +501,15 @@ func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organiza

 // Owner is the resolver for the owner field.
 func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.People, error) {
-	policy, err := r.proboSvc.Policies.Get(ctx, obj.ID)
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
+	policy, err := svc.Policies.Get(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get policy: %w", err)
 	}

 	// Get the owner
-	owner, err := r.proboSvc.GetPeople(ctx, policy.OwnerID)
+	owner, err := svc.GetPeople(ctx, policy.OwnerID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get owner: %w", err)
 	}
@@ -492,58 +519,60 @@ func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.P

 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
+	svc := r.proboSvc.WithTenant(id.TenantID())
+
 	switch id.EntityType() {
 	case coredata.OrganizationEntityType:
-		organization, err := r.proboSvc.GetOrganization(ctx, id)
+		organization, err := svc.GetOrganization(ctx, id)
 		if err != nil {
 			return nil, err
 		}

 		return types.NewOrganization(organization), nil
 	case coredata.PeopleEntityType:
-		people, err := r.proboSvc.GetPeople(ctx, id)
+		people, err := svc.GetPeople(ctx, id)
 		if err != nil {
 			return nil, err
 		}

 		return types.NewPeople(people), nil
 	case coredata.VendorEntityType:
-		vendor, err := r.proboSvc.GetVendor(ctx, id)
+		vendor, err := svc.GetVendor(ctx, id)
 		if err != nil {
 			return nil, err
 		}

 		return types.NewVendor(vendor), nil
 	case coredata.FrameworkEntityType:
-		framework, err := r.proboSvc.GetFramework(ctx, id)
+		framework, err := svc.GetFramework(ctx, id)
 		if err != nil {
 			return nil, err
 		}

 		return types.NewFramework(framework), nil
 	case coredata.ControlEntityType:
-		control, err := r.proboSvc.GetControl(ctx, id)
+		control, err := svc.GetControl(ctx, id)
 		if err != nil {
 			return nil, err
 		}

 		return types.NewControl(control), nil
 	case coredata.TaskEntityType:
-		task, err := r.proboSvc.GetTask(ctx, id)
+		task, err := svc.GetTask(ctx, id)
 		if err != nil {
 			return nil, err
 		}

 		return types.NewTask(task), nil
 	case coredata.EvidenceEntityType:
-		evidence, err := r.proboSvc.GetEvidence(ctx, id)
+		evidence, err := svc.GetEvidence(ctx, id)
 		if err != nil {
 			return nil, err
 		}

 		return types.NewEvidence(evidence), nil
 	case coredata.PolicyEntityType:
-		policy, err := r.proboSvc.Policies.Get(ctx, id)
+		policy, err := svc.Policies.Get(ctx, id)
 		if err != nil {
 			return nil, err
 		}
@@ -562,9 +591,10 @@ func (r *queryResolver) Viewer(ctx context.Context) (*types.User, error) {

 // StateTransisions is the resolver for the stateTransisions field.
 func (r *taskResolver) StateTransisions(ctx context.Context, obj *types.Task, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TaskStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListTaskStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListTaskStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -574,9 +604,10 @@ func (r *taskResolver) StateTransisions(ctx context.Context, obj *types.Task, fi

 // Evidences is the resolver for the evidences field.
 func (r *taskResolver) Evidences(ctx context.Context, obj *types.Task, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.EvidenceConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)

-	page, err := r.proboSvc.ListTaskEvidences(ctx, obj.ID, cursor)
+	page, err := svc.ListTaskEvidences(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization frameworks: %w", err)
 	}