From 04efdfe74a5116d85d3e770e3b639f1b4a626e10 Mon Sep 17 00:00:00 2001
From: Todd Knight <T.Alan.Knight@gmail.com>
Date: Wed, 7 Oct 2020 17:43:12 -0700
Subject: [PATCH] Adding scope list check and test. (#574)

---
 .../servers/controller/handlers/scopes/scope_service.go     | 3 +++
 .../controller/handlers/scopes/scope_service_test.go        | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/internal/servers/controller/handlers/scopes/scope_service.go b/internal/servers/controller/handlers/scopes/scope_service.go
index ba7b0cd12..e597656c0 100644
--- a/internal/servers/controller/handlers/scopes/scope_service.go
+++ b/internal/servers/controller/handlers/scopes/scope_service.go
@@ -478,6 +478,9 @@ func validateDeleteRequest(req *pbs.DeleteScopeRequest) error {
 
 func validateListRequest(req *pbs.ListScopesRequest) error {
 	badFields := map[string]string{}
+	if req.GetScopeId() != scope.Global.String() && !handlers.ValidId(scope.Org.Prefix(), req.GetScopeId()) {
+		badFields["scope_id"] = "Must be 'global' or a valid org scope id when listing."
+	}
 	if len(badFields) > 0 {
 		return handlers.InvalidArgumentErrorf("Error in provided request.", badFields)
 	}
diff --git a/internal/servers/controller/handlers/scopes/scope_service_test.go b/internal/servers/controller/handlers/scopes/scope_service_test.go
index b07dde17b..8ffe15584 100644
--- a/internal/servers/controller/handlers/scopes/scope_service_test.go
+++ b/internal/servers/controller/handlers/scopes/scope_service_test.go
@@ -198,6 +198,12 @@ func TestList(t *testing.T) {
 			req:     &pbs.ListScopesRequest{ScopeId: oNoProjects.GetPublicId()},
 			res:     &pbs.ListScopesResponse{},
 		},
+		{
+			name:    "Cant List Project Scopes",
+			scopeId: p1.GetPublicId(),
+			req:     &pbs.ListScopesRequest{ScopeId: p1.GetPublicId()},
+			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
+		},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {