Add e2e tests

Signed-off-by: Bryan Frimin <bryan@probo.com>

e2e/console/third_party_compliance_report_test.go

@@ -243,3 +243,93 @@ func TestThirdPartyComplianceReport_Delete(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, reportID, deleteResult.DeleteThirdPartyComplianceReport.DeletedThirdPartyComplianceReportID)
 }
+
+func TestThirdPartyComplianceReport_TenantIsolation(t *testing.T) {
+	t.Parallel()
+
+	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
+	org2Owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	org1ThirdPartyID := factory.NewThirdParty(org1Owner).WithName("Org1 ThirdParty for Report").Create()
+
+	pdfContent := []byte("%PDF-1.4\n1 0 obj\n<< /Type /Catalog >>\nendobj\ntrailer\n<< /Root 1 0 R >>\n%%EOF")
+
+	var createResult struct {
+		UploadThirdPartyComplianceReport struct {
+			ThirdPartyComplianceReportEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"thirdPartyComplianceReportEdge"`
+		} `json:"uploadThirdPartyComplianceReport"`
+	}
+
+	err := org1Owner.ExecuteWithFile(
+		`
+			mutation($input: UploadThirdPartyComplianceReportInput!) {
+				uploadThirdPartyComplianceReport(input: $input) {
+					thirdPartyComplianceReportEdge { node { id } }
+				}
+			}
+		`,
+		map[string]any{
+			"input": map[string]any{
+				"thirdPartyId": org1ThirdPartyID,
+				"reportName":   "Org1 Report",
+				"reportDate":   "2024-01-01T00:00:00Z",
+				"file":         nil,
+			},
+		}, "input.file", testutil.UploadFile{
+			Filename:    "report.pdf",
+			ContentType: "application/pdf",
+			Content:     pdfContent,
+		},
+		&createResult,
+	)
+	require.NoError(t, err)
+
+	reportID := createResult.UploadThirdPartyComplianceReport.ThirdPartyComplianceReportEdge.Node.ID
+
+	t.Run("cannot delete thirdPartyComplianceReport from another organization", func(t *testing.T) {
+		_, err := org2Owner.Do(`
+			mutation($input: DeleteThirdPartyComplianceReportInput!) {
+				deleteThirdPartyComplianceReport(input: $input) {
+					deletedThirdPartyComplianceReportId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"reportId": reportID,
+			},
+		})
+		require.Error(t, err, "Should not be able to delete thirdPartyComplianceReport from another org")
+	})
+
+	t.Run("cannot upload thirdPartyComplianceReport on a thirdParty from another organization", func(t *testing.T) {
+		var result struct{}
+
+		err := org2Owner.ExecuteWithFile(
+			`
+				mutation($input: UploadThirdPartyComplianceReportInput!) {
+					uploadThirdPartyComplianceReport(input: $input) {
+						thirdPartyComplianceReportEdge { node { id } }
+					}
+				}
+			`,
+			map[string]any{
+				"input": map[string]any{
+					"thirdPartyId": org1ThirdPartyID,
+					"reportName":   "Attacker Report",
+					"reportDate":   "2024-01-01T00:00:00Z",
+					"file":         nil,
+				},
+			}, "input.file", testutil.UploadFile{
+				Filename:    "attacker.pdf",
+				ContentType: "application/pdf",
+				Content:     pdfContent,
+			},
+			&result,
+		)
+		require.Error(t, err, "must not accept a thirdPartyId belonging to another organization")
+	})
+}