Add e2e tests

Signed-off-by: Bryan Frimin <bryan@probo.com>

e2e/console/third_party_contact_test.go

@@ -291,3 +291,87 @@ func TestThirdPartyContact_List(t *testing.T) {
 	require.NoError(t, err)
 	assert.GreaterOrEqual(t, len(result.Node.Contacts.Edges), 3)
 }
+
+func TestThirdPartyContact_TenantIsolation(t *testing.T) {
+	t.Parallel()
+
+	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
+	org2Owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	org1ThirdPartyID := factory.NewThirdParty(org1Owner).WithName("Org1 ThirdParty for Contact").Create()
+
+	var createResult struct {
+		CreateThirdPartyContact struct {
+			ThirdPartyContactEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"thirdPartyContactEdge"`
+		} `json:"createThirdPartyContact"`
+	}
+
+	err := org1Owner.Execute(`
+		mutation($input: CreateThirdPartyContactInput!) {
+			createThirdPartyContact(input: $input) {
+				thirdPartyContactEdge { node { id } }
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"thirdPartyId": org1ThirdPartyID,
+			"fullName":     "Org1 Contact",
+			"email":        fmt.Sprintf("org1.contact.%d@thirdParty.com", time.Now().UnixNano()),
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	contactID := createResult.CreateThirdPartyContact.ThirdPartyContactEdge.Node.ID
+
+	t.Run("cannot update thirdPartyContact from another organization", func(t *testing.T) {
+		_, err := org2Owner.Do(`
+			mutation($input: UpdateThirdPartyContactInput!) {
+				updateThirdPartyContact(input: $input) {
+					thirdPartyContact { id }
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"id":       contactID,
+				"fullName": "Hijacked Contact",
+			},
+		})
+		require.Error(t, err, "Should not be able to update thirdPartyContact from another org")
+	})
+
+	t.Run("cannot delete thirdPartyContact from another organization", func(t *testing.T) {
+		_, err := org2Owner.Do(`
+			mutation($input: DeleteThirdPartyContactInput!) {
+				deleteThirdPartyContact(input: $input) {
+					deletedThirdPartyContactId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"thirdPartyContactId": contactID,
+			},
+		})
+		require.Error(t, err, "Should not be able to delete thirdPartyContact from another org")
+	})
+
+	t.Run("cannot create thirdPartyContact on a thirdParty from another organization", func(t *testing.T) {
+		_, err := org2Owner.Do(`
+			mutation($input: CreateThirdPartyContactInput!) {
+				createThirdPartyContact(input: $input) {
+					thirdPartyContactEdge { node { id } }
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"thirdPartyId": org1ThirdPartyID,
+				"fullName":     "Attacker Contact",
+				"email":        fmt.Sprintf("attacker.%d@thirdParty.com", time.Now().UnixNano()),
+			},
+		})
+		require.Error(t, err, "must not accept a thirdPartyId belonging to another organization")
+	})
+}