Rewrite the global id system to include tenant id

The API should be aware of the tenant they are working on. Many solution
is possible like passing a header, adding the tenant id in each function
call, encode the tenant id in the GID.

I consider the header as a hack it force the client to keep in mind to
pass this header, having to returns an error in case of not defined
header and add a non standard header make the API more harder to use.

Passing the tenant id everywhere will be a good option but since Relay
impose to have node(id: ID!) Node interface it is not possible or by
hacking by wrapping node(id: ID!) Node in top query who getting the
tenant_id.

I finish by simpliy encode the tenant id directly in the object id, it
what AWS do too, it allow to always have the information, and it ensure
a right data isolation.

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/server/api/console/v1/v1_resolver.go

@@ -2,7 +2,7 @@ package console_v1
 
 // This file will be automatically regenerated based on the schema, any resolver implementations
 // will be copied through when generating and any unknown code will be moved to the end.
-// Code generated by github.com/99designs/gqlgen version v0.17.63
+// Code generated by github.com/99designs/gqlgen version v0.17.66
 
 import (
 	"context"
@@ -20,9 +20,10 @@ import (
 
 // StateTransisions is the resolver for the stateTransisions field.
 func (r *controlResolver) StateTransisions(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ControlStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListControlStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListControlStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -32,9 +33,10 @@ func (r *controlResolver) StateTransisions(ctx context.Context, obj *types.Contr
 
 // Tasks is the resolver for the tasks field.
 func (r *controlResolver) Tasks(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TaskConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListControlTasks(ctx, obj.ID, cursor)
+	page, err := svc.ListControlTasks(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -44,7 +46,9 @@ func (r *controlResolver) Tasks(ctx context.Context, obj *types.Control, first *
 
 // FileURL is the resolver for the fileUrl field.
 func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (string, error) {
-	fileURL, err := r.proboSvc.GetEvidenceFileURL(ctx, obj.ID, 15*time.Minute)
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
+	fileURL, err := svc.GetEvidenceFileURL(ctx, obj.ID, 15*time.Minute)
 	if err != nil {
 		return "", fmt.Errorf("cannot generate file URL: %w", err)
 	}
@@ -54,9 +58,10 @@ func (r *evidenceResolver) FileURL(ctx context.Context, obj *types.Evidence) (st
 
 // StateTransisions is the resolver for the stateTransisions field.
 func (r *evidenceResolver) StateTransisions(ctx context.Context, obj *types.Evidence, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.EvidenceStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListEvidenceStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListEvidenceStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list evidence state transitions: %w", err)
 	}
@@ -66,9 +71,10 @@ func (r *evidenceResolver) StateTransisions(ctx context.Context, obj *types.Evid
 
 // Controls is the resolver for the controls field.
 func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ControlConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListFrameworkControls(ctx, obj.ID, cursor)
+	page, err := svc.ListFrameworkControls(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list framework controls: %w", err)
 	}
@@ -78,7 +84,9 @@ func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework,
 
 // CreateVendor is the resolver for the createVendor field.
 func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateVendorInput) (*types.CreateVendorPayload, error) {
-	vendor, err := r.proboSvc.CreateVendor(ctx, probo.CreateVendorRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	vendor, err := svc.CreateVendor(ctx, probo.CreateVendorRequest{
 		OrganizationID:       input.OrganizationID,
 		Name:                 input.Name,
 		Description:          input.Description,
@@ -100,7 +108,9 @@ func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateV
 
 // UpdateVendor is the resolver for the updateVendor field.
 func (r *mutationResolver) UpdateVendor(ctx context.Context, input types.UpdateVendorInput) (*types.UpdateVendorPayload, error) {
-	vendor, err := r.proboSvc.UpdateVendor(ctx, probo.UpdateVendorRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	vendor, err := svc.UpdateVendor(ctx, probo.UpdateVendorRequest{
 		ID:                   input.ID,
 		ExpectedVersion:      input.ExpectedVersion,
 		Name:                 input.Name,
@@ -124,7 +134,9 @@ func (r *mutationResolver) UpdateVendor(ctx context.Context, input types.UpdateV
 
 // DeleteVendor is the resolver for the deleteVendor field.
 func (r *mutationResolver) DeleteVendor(ctx context.Context, input types.DeleteVendorInput) (*types.DeleteVendorPayload, error) {
-	err := r.proboSvc.DeleteVendor(ctx, input.VendorID)
+	svc := r.proboSvc.WithTenant(input.VendorID.TenantID())
+
+	err := svc.DeleteVendor(ctx, input.VendorID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete vendor: %w", err)
 	}
@@ -136,7 +148,9 @@ func (r *mutationResolver) DeleteVendor(ctx context.Context, input types.DeleteV
 
 // CreatePeople is the resolver for the createPeople field.
 func (r *mutationResolver) CreatePeople(ctx context.Context, input types.CreatePeopleInput) (*types.CreatePeoplePayload, error) {
-	people, err := r.proboSvc.CreatePeople(ctx, probo.CreatePeopleRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	people, err := svc.CreatePeople(ctx, probo.CreatePeopleRequest{
 		OrganizationID:           input.OrganizationID,
 		FullName:                 input.FullName,
 		PrimaryEmailAddress:      input.PrimaryEmailAddress,
@@ -155,7 +169,9 @@ func (r *mutationResolver) CreatePeople(ctx context.Context, input types.CreateP
 
 // UpdatePeople is the resolver for the updatePeople field.
 func (r *mutationResolver) UpdatePeople(ctx context.Context, input types.UpdatePeopleInput) (*types.UpdatePeoplePayload, error) {
-	people, err := r.proboSvc.UpdatePeople(ctx, probo.UpdatePeopleRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	people, err := svc.UpdatePeople(ctx, probo.UpdatePeopleRequest{
 		ID:                       input.ID,
 		ExpectedVersion:          input.ExpectedVersion,
 		FullName:                 input.FullName,
@@ -174,7 +190,9 @@ func (r *mutationResolver) UpdatePeople(ctx context.Context, input types.UpdateP
 
 // DeletePeople is the resolver for the deletePeople field.
 func (r *mutationResolver) DeletePeople(ctx context.Context, input types.DeletePeopleInput) (*types.DeletePeoplePayload, error) {
-	err := r.proboSvc.DeletePeople(ctx, input.PeopleID)
+	svc := r.proboSvc.WithTenant(input.PeopleID.TenantID())
+
+	err := svc.DeletePeople(ctx, input.PeopleID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete people: %w", err)
 	}
@@ -210,7 +228,9 @@ func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.D
 
 // UpdateTaskState is the resolver for the updateTaskState field.
 func (r *mutationResolver) UpdateTaskState(ctx context.Context, input types.UpdateTaskStateInput) (*types.UpdateTaskStatePayload, error) {
-	task, err := r.proboSvc.UpdateTaskState(ctx, probo.UpdateTaskStateRequest{
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
+	task, err := svc.UpdateTaskState(ctx, probo.UpdateTaskStateRequest{
 		TaskID: input.TaskID,
 		State:  input.State,
 		Reason: nil,
@@ -226,7 +246,9 @@ func (r *mutationResolver) UpdateTaskState(ctx context.Context, input types.Upda
 
 // CreateTask is the resolver for the createTask field.
 func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTaskInput) (*types.CreateTaskPayload, error) {
-	task, err := r.proboSvc.CreateTask(ctx, probo.CreateTaskRequest{
+	svc := r.proboSvc.WithTenant(input.ControlID.TenantID())
+
+	task, err := svc.CreateTask(ctx, probo.CreateTaskRequest{
 		ControlID:   input.ControlID,
 		Name:        input.Name,
 		Description: input.Description,
@@ -242,7 +264,9 @@ func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTas
 
 // DeleteTask is the resolver for the deleteTask field.
 func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTaskInput) (*types.DeleteTaskPayload, error) {
-	err := r.proboSvc.DeleteTask(ctx, input.TaskID)
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
+	err := svc.DeleteTask(ctx, input.TaskID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete task: %w", err)
 	}
@@ -254,7 +278,9 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas
 
 // CreateFramework is the resolver for the createFramework field.
 func (r *mutationResolver) CreateFramework(ctx context.Context, input types.CreateFrameworkInput) (*types.CreateFrameworkPayload, error) {
-	framework, err := r.proboSvc.CreateFramework(ctx, probo.CreateFrameworkRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	framework, err := svc.CreateFramework(ctx, probo.CreateFrameworkRequest{
 		OrganizationID: input.OrganizationID,
 		Name:           input.Name,
 		Description:    input.Description,
@@ -270,7 +296,9 @@ func (r *mutationResolver) CreateFramework(ctx context.Context, input types.Crea
 
 // CreateControl is the resolver for the createControl field.
 func (r *mutationResolver) CreateControl(ctx context.Context, input types.CreateControlInput) (*types.CreateControlPayload, error) {
-	control, err := r.proboSvc.CreateControl(ctx, probo.CreateControlRequest{
+	svc := r.proboSvc.WithTenant(input.FrameworkID.TenantID())
+
+	control, err := svc.CreateControl(ctx, probo.CreateControlRequest{
 		FrameworkID: input.FrameworkID,
 		Name:        input.Name,
 		Description: input.Description,
@@ -287,19 +315,13 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 
 // UpdateFramework is the resolver for the updateFramework field.
 func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.UpdateFrameworkInput) (*types.UpdateFrameworkPayload, error) {
-	var name, description *string
-	if input.Name != nil {
-		name = input.Name
-	}
-	if input.Description != nil {
-		description = input.Description
-	}
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
 
-	framework, err := r.proboSvc.UpdateFramework(ctx, probo.UpdateFrameworkRequest{
+	framework, err := svc.UpdateFramework(ctx, probo.UpdateFrameworkRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
-		Name:            name,
-		Description:     description,
+		Name:            input.Name,
+		Description:     input.Description,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot update framework: %w", err)
@@ -312,29 +334,15 @@ func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.Upda
 
 // UpdateControl is the resolver for the updateControl field.
 func (r *mutationResolver) UpdateControl(ctx context.Context, input types.UpdateControlInput) (*types.UpdateControlPayload, error) {
-	var name, description, category *string
-	var state *coredata.ControlState
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
 
-	if input.Name != nil {
-		name = input.Name
-	}
-	if input.Description != nil {
-		description = input.Description
-	}
-	if input.Category != nil {
-		category = input.Category
-	}
-	if input.State != nil {
-		state = input.State
-	}
-
-	control, err := r.proboSvc.UpdateControl(ctx, probo.UpdateControlRequest{
+	control, err := svc.UpdateControl(ctx, probo.UpdateControlRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
-		Name:            name,
-		Description:     description,
-		Category:        category,
-		State:           state,
+		Name:            input.Name,
+		Description:     input.Description,
+		Category:        input.Category,
+		State:           input.State,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot update control: %w", err)
@@ -347,13 +355,15 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 
 // UploadEvidence is the resolver for the uploadEvidence field.
 func (r *mutationResolver) UploadEvidence(ctx context.Context, input types.UploadEvidenceInput) (*types.UploadEvidencePayload, error) {
+	svc := r.proboSvc.WithTenant(input.TaskID.TenantID())
+
 	req := probo.CreateEvidenceRequest{
 		TaskID: input.TaskID,
 		Name:   input.Name,
 		File:   input.File.File,
 	}
 
-	evidence, err := r.proboSvc.CreateEvidence(ctx, req)
+	evidence, err := svc.CreateEvidence(ctx, req)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create evidence: %w", err)
 	}
@@ -365,7 +375,9 @@ func (r *mutationResolver) UploadEvidence(ctx context.Context, input types.Uploa
 
 // DeleteEvidence is the resolver for the deleteEvidence field.
 func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error) {
-	err := r.proboSvc.DeleteEvidence(ctx, input.EvidenceID)
+	svc := r.proboSvc.WithTenant(input.EvidenceID.TenantID())
+
+	err := svc.DeleteEvidence(ctx, input.EvidenceID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to delete evidence: %w", err)
 	}
@@ -377,7 +389,9 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 
 // CreatePolicy is the resolver for the createPolicy field.
 func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error) {
-	policy, err := r.proboSvc.Policies.Create(ctx, probo.CreatePolicyRequest{
+	svc := r.proboSvc.WithTenant(input.OrganizationID.TenantID())
+
+	policy, err := svc.Policies.Create(ctx, probo.CreatePolicyRequest{
 		OrganizationID: input.OrganizationID,
 		Name:           input.Name,
 		Content:        input.Content,
@@ -396,7 +410,9 @@ func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreateP
 
 // UpdatePolicy is the resolver for the updatePolicy field.
 func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdatePolicyInput) (*types.UpdatePolicyPayload, error) {
-	policy, err := r.proboSvc.Policies.Update(ctx, probo.UpdatePolicyRequest{
+	svc := r.proboSvc.WithTenant(input.ID.TenantID())
+
+	policy, err := svc.Policies.Update(ctx, probo.UpdatePolicyRequest{
 		ID:              input.ID,
 		ExpectedVersion: input.ExpectedVersion,
 		Name:            input.Name,
@@ -416,7 +432,9 @@ func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdateP
 
 // DeletePolicy is the resolver for the deletePolicy field.
 func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeletePolicyInput) (*types.DeletePolicyPayload, error) {
-	err := r.proboSvc.Policies.Delete(ctx, input.PolicyID)
+	svc := r.proboSvc.WithTenant(input.PolicyID.TenantID())
+
+	err := svc.Policies.Delete(ctx, input.PolicyID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot delete policy: %w", err)
 	}
@@ -428,9 +446,11 @@ func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeleteP
 
 // Frameworks is the resolver for the frameworks field.
 func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.FrameworkConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListOrganizationFrameworks(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationFrameworks(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization frameworks: %w", err)
 	}
@@ -440,9 +460,11 @@ func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organi
 
 // Vendors is the resolver for the vendors field.
 func (r *organizationResolver) Vendors(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.VendorConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListOrganizationVendors(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationVendors(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization vendors: %w", err)
 	}
@@ -452,9 +474,11 @@ func (r *organizationResolver) Vendors(ctx context.Context, obj *types.Organizat
 
 // Peoples is the resolver for the peoples field.
 func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PeopleConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListOrganizationPeoples(ctx, obj.ID, cursor)
+	page, err := svc.ListOrganizationPeoples(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization peoples: %w", err)
 	}
@@ -464,9 +488,10 @@ func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organizat
 
 // Policies is the resolver for the policies field.
 func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PolicyConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.Policies.ListByOrganization(ctx, obj.ID, cursor)
+	page, err := svc.Policies.ListByOrganization(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization policies: %w", err)
 	}
@@ -476,13 +501,15 @@ func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organiza
 
 // Owner is the resolver for the owner field.
 func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.People, error) {
-	policy, err := r.proboSvc.Policies.Get(ctx, obj.ID)
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
+
+	policy, err := svc.Policies.Get(ctx, obj.ID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get policy: %w", err)
 	}
 
 	// Get the owner
-	owner, err := r.proboSvc.GetPeople(ctx, policy.OwnerID)
+	owner, err := svc.GetPeople(ctx, policy.OwnerID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get owner: %w", err)
 	}
@@ -492,58 +519,60 @@ func (r *policyResolver) Owner(ctx context.Context, obj *types.Policy) (*types.P
 
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
+	svc := r.proboSvc.WithTenant(id.TenantID())
+
 	switch id.EntityType() {
 	case coredata.OrganizationEntityType:
-		organization, err := r.proboSvc.GetOrganization(ctx, id)
+		organization, err := svc.GetOrganization(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewOrganization(organization), nil
 	case coredata.PeopleEntityType:
-		people, err := r.proboSvc.GetPeople(ctx, id)
+		people, err := svc.GetPeople(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewPeople(people), nil
 	case coredata.VendorEntityType:
-		vendor, err := r.proboSvc.GetVendor(ctx, id)
+		vendor, err := svc.GetVendor(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewVendor(vendor), nil
 	case coredata.FrameworkEntityType:
-		framework, err := r.proboSvc.GetFramework(ctx, id)
+		framework, err := svc.GetFramework(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewFramework(framework), nil
 	case coredata.ControlEntityType:
-		control, err := r.proboSvc.GetControl(ctx, id)
+		control, err := svc.GetControl(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewControl(control), nil
 	case coredata.TaskEntityType:
-		task, err := r.proboSvc.GetTask(ctx, id)
+		task, err := svc.GetTask(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewTask(task), nil
 	case coredata.EvidenceEntityType:
-		evidence, err := r.proboSvc.GetEvidence(ctx, id)
+		evidence, err := svc.GetEvidence(ctx, id)
 		if err != nil {
 			return nil, err
 		}
 
 		return types.NewEvidence(evidence), nil
 	case coredata.PolicyEntityType:
-		policy, err := r.proboSvc.Policies.Get(ctx, id)
+		policy, err := svc.Policies.Get(ctx, id)
 		if err != nil {
 			return nil, err
 		}
@@ -562,9 +591,10 @@ func (r *queryResolver) Viewer(ctx context.Context) (*types.User, error) {
 
 // StateTransisions is the resolver for the stateTransisions field.
 func (r *taskResolver) StateTransisions(ctx context.Context, obj *types.Task, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TaskStateTransitionConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListTaskStateTransitions(ctx, obj.ID, cursor)
+	page, err := svc.ListTaskStateTransitions(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list control tasks: %w", err)
 	}
@@ -574,9 +604,10 @@ func (r *taskResolver) StateTransisions(ctx context.Context, obj *types.Task, fi
 
 // Evidences is the resolver for the evidences field.
 func (r *taskResolver) Evidences(ctx context.Context, obj *types.Task, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.EvidenceConnection, error) {
+	svc := r.proboSvc.WithTenant(obj.ID.TenantID())
 	cursor := types.NewCursor(first, after, last, before)
 
-	page, err := r.proboSvc.ListTaskEvidences(ctx, obj.ID, cursor)
+	page, err := svc.ListTaskEvidences(ctx, obj.ID, cursor)
 	if err != nil {
 		return nil, fmt.Errorf("cannot list organization frameworks: %w", err)
 	}