Add e2e tests

Signed-off-by: Bryan Frimin <bryan@probo.com>

e2e/console/third_party_service_test.go

@@ -19,6 +19,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/e2e/internal/factory"
 	"go.probo.inc/probo/e2e/internal/testutil"
 )
 
@@ -755,3 +756,85 @@ func TestThirdPartyService_List(t *testing.T) {
 		})
 	}
 }
+
+func TestThirdPartyService_TenantIsolation(t *testing.T) {
+	t.Parallel()
+
+	org1Owner := testutil.NewClient(t, testutil.RoleOwner)
+	org2Owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	org1ThirdPartyID := factory.NewThirdParty(org1Owner).WithName("Org1 ThirdParty for Service").Create()
+
+	var createResult struct {
+		CreateThirdPartyService struct {
+			ThirdPartyServiceEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"thirdPartyServiceEdge"`
+		} `json:"createThirdPartyService"`
+	}
+
+	err := org1Owner.Execute(`
+		mutation($input: CreateThirdPartyServiceInput!) {
+			createThirdPartyService(input: $input) {
+				thirdPartyServiceEdge { node { id } }
+			}
+		}
+	`, map[string]any{
+		"input": map[string]any{
+			"thirdPartyId": org1ThirdPartyID,
+			"name":         "Org1 Service",
+		},
+	}, &createResult)
+	require.NoError(t, err)
+
+	serviceID := createResult.CreateThirdPartyService.ThirdPartyServiceEdge.Node.ID
+
+	t.Run("cannot update thirdPartyService from another organization", func(t *testing.T) {
+		_, err := org2Owner.Do(`
+			mutation($input: UpdateThirdPartyServiceInput!) {
+				updateThirdPartyService(input: $input) {
+					thirdPartyService { id }
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"id":   serviceID,
+				"name": "Hijacked Service",
+			},
+		})
+		require.Error(t, err, "Should not be able to update thirdPartyService from another org")
+	})
+
+	t.Run("cannot delete thirdPartyService from another organization", func(t *testing.T) {
+		_, err := org2Owner.Do(`
+			mutation($input: DeleteThirdPartyServiceInput!) {
+				deleteThirdPartyService(input: $input) {
+					deletedThirdPartyServiceId
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"thirdPartyServiceId": serviceID,
+			},
+		})
+		require.Error(t, err, "Should not be able to delete thirdPartyService from another org")
+	})
+
+	t.Run("cannot create thirdPartyService on a thirdParty from another organization", func(t *testing.T) {
+		_, err := org2Owner.Do(`
+			mutation($input: CreateThirdPartyServiceInput!) {
+				createThirdPartyService(input: $input) {
+					thirdPartyServiceEdge { node { id } }
+				}
+			}
+		`, map[string]any{
+			"input": map[string]any{
+				"thirdPartyId": org1ThirdPartyID,
+				"name":         "Attacker Service",
+			},
+		})
+		require.Error(t, err, "must not accept a thirdPartyId belonging to another organization")
+	})
+}