Move api tests to internal package to remove issue with external resources depending on internal libs

api/internal/genapi/detail_template_test.go

@@ -1,4 +1,4 @@
-package tests
+package main_test
 
 // TODO: Reenable once we reimplement generation of As functions once static hosts lands
 /*

api/internal/tests/authmethods/authenticate_test.go

@@ -0,0 +1,37 @@
+package authmethods_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/kr/pretty"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAuthenticate(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	methods := authmethods.NewAuthMethodsClient(client)
+
+	tok, apiErr, err := methods.Authenticate(tc.Context(), amId, "user", "passpass")
+	require.NoError(err)
+	assert.Nil(apiErr, pretty.Sprint(apiErr))
+	assert.NotNil(tok)
+
+	_, apiErr, err = methods.Authenticate(tc.Context(), amId, "user", "wrong")
+	require.NoError(err)
+	require.NotNil(t, apiErr)
+	assert.EqualValuesf(http.StatusUnauthorized, apiErr.Status, "Expected unauthenticated, got %q", apiErr.Message)
+}

api/internal/tests/authtokens/authtoken_test.go

@@ -0,0 +1,141 @@
+package authtokens_test
+
+import (
+	"net/http"
+	"sort"
+	"testing"
+
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/api/authtokens"
+	"github.com/hashicorp/boundary/internal/authtoken"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAuthTokens_List(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	tokens := authtokens.NewAuthTokensClient(client)
+	methods := authmethods.NewAuthMethodsClient(client)
+
+	atl, apiErr, err := tokens.List(tc.Context())
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.Empty(atl)
+
+	var expected []*authtokens.AuthToken
+
+	at, apiErr, err := methods.Authenticate(tc.Context(), amId, "user", "passpass")
+	require.NoError(err)
+	assert.Nil(apiErr)
+	expected = append(expected, at)
+
+	atl, apiErr, err = tokens.List(tc.Context())
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(atl))
+
+	for i := 1; i < 10; i++ {
+		at, apiErr, err = methods.Authenticate(tc.Context(), amId, "user", "passpass")
+		require.NoError(err)
+		assert.Nil(apiErr)
+		expected = append(expected, at)
+	}
+	atl, apiErr, err = tokens.List(tc.Context())
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(atl))
+}
+
+func comparableResource(i *authtokens.AuthToken) authtokens.AuthToken {
+	return authtokens.AuthToken{
+		Id:                      i.Id,
+		UserId:                  i.UserId,
+		AuthMethodId:            i.AuthMethodId,
+		CreatedTime:             i.CreatedTime,
+		UpdatedTime:             i.UpdatedTime,
+		ApproximateLastUsedTime: i.ApproximateLastUsedTime,
+		ExpirationTime:          i.ExpirationTime,
+	}
+}
+
+func comparableSlice(in []*authtokens.AuthToken) []authtokens.AuthToken {
+	var filtered []authtokens.AuthToken
+	for _, i := range in {
+		filtered = append(filtered, comparableResource(i))
+	}
+	sort.Slice(filtered, func(i, j int) bool {
+		return filtered[i].Id < filtered[j].Id
+	})
+	return filtered
+}
+
+func TestAuthToken_Crud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	tokens := authtokens.NewAuthTokensClient(client)
+	methods := authmethods.NewAuthMethodsClient(client)
+
+	want, apiErr, err := methods.Authenticate(tc.Context(), amId, "user", "passpass")
+	require.NoError(err)
+	assert.Empty(apiErr)
+
+	at, apiErr, err := tokens.Read(tc.Context(), want.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.EqualValues(comparableResource(want), comparableResource(at))
+
+	existed, _, err := tokens.Delete(tc.Context(), at.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.True(existed, "Expected existing user when deleted, but it wasn't.")
+
+	existed, apiErr, err = tokens.Delete(tc.Context(), at.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.False(existed, "Expected user to not exist when deleted, but it did.")
+}
+
+func TestAuthToken_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	tokens := authtokens.NewAuthTokensClient(client)
+
+	_, apiErr, err := tokens.Read(tc.Context(), authtoken.AuthTokenPrefix+"_doesntexis")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, apiErr, err = tokens.Read(tc.Context(), "invalid id")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
+}

api/internal/tests/groups/group_test.go

@@ -0,0 +1,256 @@
+package groups_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/groups"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGroup_List(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	projClient := client.Clone()
+	projClient.SetScopeId(proj.Id)
+
+	cases := []struct {
+		name        string
+		scopeClient *api.Client
+	}{
+		{
+			name:        "org",
+			scopeClient: client,
+		},
+		{
+			name:        "proj",
+			scopeClient: projClient,
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			grps := groups.NewGroupsClient(tt.scopeClient)
+			pl, apiErr, err := grps.List(tc.Context())
+			assert.NoError(err)
+			assert.Nil(apiErr)
+			assert.Empty(pl)
+
+			expected := make([]*groups.Group, 10)
+			for i := 0; i < 10; i++ {
+				expected[i], apiErr, err = grps.Create(tc.Context(), groups.WithName(fmt.Sprint(i)))
+				require.NoError(err)
+				assert.Nil(apiErr)
+			}
+			pl, apiErr, err = grps.List(tc.Context())
+			require.NoError(err)
+			assert.Nil(apiErr)
+			require.NotNil(pl)
+			require.Len(pl, 10)
+			assert.ElementsMatch(comparableSlice(expected), comparableSlice(pl))
+		})
+	}
+}
+
+func comparableSlice(in []*groups.Group) []groups.Group {
+	var filtered []groups.Group
+	for _, i := range in {
+		p := groups.Group{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestGroup_Crud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	projClient := client.Clone()
+	projClient.SetScopeId(proj.Id)
+
+	checkGroup := func(step string, g *groups.Group, apiErr *api.Error, err error, wantedName string, wantedVersion uint32, expectedUserIds []string) {
+		require.NoError(err, step)
+		if !assert.Nil(apiErr, step) && apiErr.Message != "" {
+			t.Errorf("ApiError message: %q", apiErr.Message)
+		}
+		assert.NotNil(g, "returned no resource", step)
+		gotName := ""
+		if g.Name != "" {
+			gotName = g.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, g.Version)
+		assert.Equal(len(expectedUserIds), len(g.MemberIds))
+		if len(expectedUserIds) > 0 {
+			assert.EqualValues(expectedUserIds, g.MemberIds)
+		}
+	}
+
+	cases := []struct {
+		name        string
+		scopeClient *api.Client
+	}{
+		{
+			name:        "org",
+			scopeClient: client,
+		},
+		{
+			name:        "proj",
+			scopeClient: projClient,
+		},
+	}
+
+	user1, apiErr, err := users.NewUsersClient(client).Create(tc.Context())
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	user2, apiErr, err := users.NewUsersClient(client).Create(tc.Context())
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			groupsClient := groups.NewGroupsClient(tt.scopeClient)
+			g, apiErr, err := groupsClient.Create(tc.Context(), groups.WithName("foo"))
+			checkGroup("create", g, apiErr, err, "foo", 1, nil)
+
+			g, apiErr, err = groupsClient.Read(tc.Context(), g.Id)
+			checkGroup("read", g, apiErr, err, "foo", 1, nil)
+
+			g, apiErr, err = groupsClient.Update(tc.Context(), g.Id, g.Version, groups.WithName("bar"))
+			checkGroup("update", g, apiErr, err, "bar", 2, nil)
+
+			g, apiErr, err = groupsClient.Update(tc.Context(), g.Id, g.Version, groups.DefaultName())
+			checkGroup("update", g, apiErr, err, "", 3, nil)
+
+			g, apiErr, err = groupsClient.AddMembers(tc.Context(), g.Id, g.Version, []string{user1.Id})
+			checkGroup("update", g, apiErr, err, "", 4, []string{user1.Id})
+
+			g, apiErr, err = groupsClient.SetMembers(tc.Context(), g.Id, g.Version, []string{user2.Id})
+			checkGroup("update", g, apiErr, err, "", 5, []string{user2.Id})
+
+			g, apiErr, err = groupsClient.RemoveMembers(tc.Context(), g.Id, g.Version, []string{user2.Id})
+			checkGroup("update", g, apiErr, err, "", 6, nil)
+
+			existed, apiErr, err := groupsClient.Delete(tc.Context(), g.Id)
+			assert.NoError(err)
+			assert.True(existed, "Expected existing user when deleted, but it wasn't.")
+
+			existed, apiErr, err = groupsClient.Delete(tc.Context(), g.Id)
+			assert.NoError(err)
+			assert.False(existed, "Expected user to not exist when deleted, but it did.")
+		})
+	}
+}
+
+func TestGroup_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	projClient := client.Clone()
+	projClient.SetScopeId(proj.Id)
+
+	cases := []struct {
+		name        string
+		scopeClient *api.Client
+	}{
+		{
+			name:        "org",
+			scopeClient: client,
+		},
+		{
+			name:        "proj",
+			scopeClient: projClient,
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			groupClient := groups.NewGroupsClient(tt.scopeClient)
+
+			g, apiErr, err := groupClient.Create(tc.Context(), groups.WithName("first"))
+			require.NoError(err)
+			assert.Nil(apiErr)
+			assert.NotNil(g)
+
+			// Create another resource with the same name.
+			_, apiErr, err = groupClient.Create(tc.Context(), groups.WithName("first"))
+			require.NoError(err)
+			assert.NotNil(apiErr)
+
+			_, apiErr, err = groupClient.Read(tc.Context(), iam.GroupPrefix+"_doesntexis")
+			require.NoError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+			_, apiErr, err = groupClient.Read(tc.Context(), "invalid id")
+			require.NoError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusForbidden, apiErr.Status)
+
+			_, apiErr, err = groupClient.Update(tc.Context(), g.Id, g.Version)
+			require.NoError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+		})
+	}
+}

api/internal/tests/hosts/host_catalog_test.go

@@ -0,0 +1,122 @@
+package hosts_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/hosts"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/internal/host/static"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCatalogs_Crud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	projClient := client.Clone()
+	projClient.SetScopeId(proj.Id)
+
+	checkCatalog := func(step string, hc *hosts.HostCatalog, apiErr *api.Error, err error, wantedName string, wantVersion uint32) {
+		require.NoError(err, step)
+		if !assert.Nil(apiErr, step) && apiErr.Message != "" {
+			t.Errorf("ApiError message: %q", apiErr.Message)
+		}
+		assert.NotNil(hc, "returned no resource", step)
+		gotName := ""
+		if hc.Name != "" {
+			gotName = hc.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.Equal(wantVersion, hc.Version)
+	}
+
+	hcClient := hosts.NewHostCatalogsClient(projClient)
+
+	hc, apiErr, err := hcClient.Create(tc.Context(), hosts.WithName("foo"), hosts.WithType("static"))
+	checkCatalog("create", hc, apiErr, err, "foo", 1)
+
+	hc, apiErr, err = hcClient.Read(tc.Context(), hc.Id)
+	checkCatalog("read", hc, apiErr, err, "foo", 1)
+
+	hc, apiErr, err = hcClient.Update(tc.Context(), hc.Id, hc.Version, hosts.WithName("bar"))
+	checkCatalog("update", hc, apiErr, err, "bar", 2)
+
+	hc, apiErr, err = hcClient.Update(tc.Context(), hc.Id, hc.Version, hosts.DefaultName())
+	checkCatalog("update", hc, apiErr, err, "", 3)
+
+	existed, apiErr, err := hcClient.Delete(tc.Context(), hc.Id)
+	assert.NoError(err)
+	assert.True(existed, "Expected existing catalog when deleted, but it wasn't.")
+
+	existed, apiErr, err = hcClient.Delete(tc.Context(), hc.Id)
+	assert.NoError(err)
+	assert.False(existed, "Expected catalog to not exist when deleted, but it did.")
+}
+
+// TODO: Get better coverage for expected errors and error formats.
+func TestCatalogs_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	client.SetScopeId(proj.Id)
+	pc := hosts.NewHostCatalogsClient(client)
+
+	hc, apiErr, err := pc.Create(tc.Context(), hosts.WithType("static"))
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.NotNil(hc)
+
+	_, apiErr, err = pc.Create(tc.Context())
+	require.NoError(err)
+	assert.NotNil(apiErr)
+
+	_, apiErr, err = pc.Read(tc.Context(), static.HostCatalogPrefix+"_doesntexis")
+	require.NoError(err)
+	// TODO: Should this be nil instead of just a catalog that has no values set
+	assert.NotNil(apiErr)
+	assert.EqualValues(apiErr.Status, http.StatusNotFound)
+
+	_, apiErr, err = pc.Read(tc.Context(), "invalid id")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
+
+	_, apiErr, err = pc.Update(tc.Context(), hc.Id, hc.Version, hosts.WithType("Cant Update"))
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

api/internal/tests/roles/role_test.go

@@ -0,0 +1,386 @@
+package roles_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/groups"
+	"github.com/hashicorp/boundary/api/internal/strutil"
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/kr/pretty"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustom(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	projClient := client.Clone()
+	projClient.SetScopeId(proj.Id)
+
+	cases := []struct {
+		name        string
+		scopeClient *api.Client
+	}{
+		{
+			name:        "org",
+			scopeClient: client,
+		},
+		{
+			name:        "proj",
+			scopeClient: projClient,
+		},
+	}
+
+	user, apiErr, err := users.NewUsersClient(client).Create(tc.Context())
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	hasPrincipal := func(role *roles.Role, principalId string) bool {
+		var foundInPrincipals bool
+		var foundInPrincipalIds bool
+		for _, v := range role.Principals {
+			if v.Id == principalId {
+				foundInPrincipals = true
+			}
+		}
+		for _, v := range role.PrincipalIds {
+			if v == principalId {
+				foundInPrincipalIds = true
+			}
+		}
+		return foundInPrincipals && foundInPrincipalIds
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			g, apiErr, err := groups.NewGroupsClient(tt.scopeClient).Create(tc.Context())
+			require.NoError(err)
+			require.Nil(apiErr)
+			require.NotNil(g)
+
+			rc := roles.NewRolesClient(tt.scopeClient)
+			var version uint32 = 1
+
+			r, apiErr, err := rc.Create(tc.Context(), roles.WithName("foo"))
+			require.NoError(err)
+			require.Nil(apiErr)
+			require.NotNil(r)
+			require.EqualValues(r.Version, version)
+			version++
+
+			updatedRole, apiErr, err := rc.AddPrincipals(tc.Context(), r.Id, r.Version, []string{g.Id})
+			require.NoError(err)
+			require.Nil(apiErr, "Got error ", pretty.Sprint(apiErr))
+			assert.EqualValues(updatedRole.Version, version)
+			assert.True(hasPrincipal(updatedRole, g.Id))
+			version++
+
+			updatedRole, apiErr, err = rc.SetPrincipals(tc.Context(), updatedRole.Id, updatedRole.Version, []string{user.Id})
+			require.NoError(err)
+			require.Nil(apiErr, "Got error ", apiErr)
+			assert.EqualValues(updatedRole.Version, version)
+			assert.True(hasPrincipal(updatedRole, user.Id))
+			version++
+
+			updatedRole, apiErr, err = rc.RemovePrincipals(tc.Context(), updatedRole.Id, updatedRole.Version, []string{user.Id})
+			require.NoError(err)
+			require.Nil(apiErr, "Got error ", apiErr)
+			assert.EqualValues(updatedRole.Version, version)
+			assert.Empty(updatedRole.Principals)
+			version++
+
+			updatedRole, apiErr, err = rc.AddGrants(tc.Context(), updatedRole.Id, updatedRole.Version, []string{"id=*;actions=read"})
+			require.NoError(err)
+			require.Nil(apiErr, "Got error ", apiErr)
+			assert.EqualValues(updatedRole.Version, version)
+			assert.Contains(updatedRole.GrantStrings, "id=*;actions=read")
+			version++
+
+			updatedRole, apiErr, err = rc.SetGrants(tc.Context(), updatedRole.Id, updatedRole.Version, []string{"id=*;actions=*"})
+			require.NoError(err)
+			require.Nil(apiErr, "Got error ", apiErr)
+			assert.EqualValues(updatedRole.Version, version)
+			assert.Contains(updatedRole.GrantStrings, "id=*;actions=*")
+			version++
+
+			updatedRole, apiErr, err = rc.RemoveGrants(tc.Context(), updatedRole.Id, updatedRole.Version, []string{"id=*;actions=*"})
+			require.NoError(err)
+			require.Nil(apiErr, "Got error ", apiErr)
+			assert.EqualValues(updatedRole.Version, version)
+			assert.Empty(updatedRole.Grants)
+			version++
+		})
+	}
+}
+
+func TestRole_List(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	projClient := client.Clone()
+	projClient.SetScopeId(proj.Id)
+
+	cases := []struct {
+		name        string
+		scopeClient *api.Client
+	}{
+		{
+			name:        "org",
+			scopeClient: client,
+		},
+		{
+			name:        "proj",
+			scopeClient: projClient,
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			roleClient := roles.NewRolesClient(tt.scopeClient)
+			p1, apiErr, err := roleClient.List(tc.Context())
+			require.NoError(err)
+			assert.Nil(apiErr)
+			var defaultRoleIds []string
+			if tt.name == "org" {
+				require.True(2 == len(p1))
+				defaultRoleIds = []string{p1[0].Id, p1[1].Id}
+			} else {
+				require.Empty(p1)
+			}
+
+			var expected []*roles.Role
+			for i := 0; i < 10; i++ {
+				expected = append(expected, &roles.Role{Name: fmt.Sprint(i)})
+			}
+
+			expected[0], apiErr, err = roleClient.Create(tc.Context(), roles.WithName(expected[0].Name))
+			require.NoError(err)
+			assert.Nil(apiErr)
+
+			p2, apiErr, err := roleClient.List(tc.Context())
+			assert.NoError(err)
+			assert.Nil(apiErr)
+			var p2ForComparison []*roles.Role
+			for _, v := range p2 {
+				if !strutil.StrListContains(defaultRoleIds, v.Id) {
+					p2ForComparison = append(p2ForComparison, v)
+				}
+			}
+			assert.ElementsMatch(comparableSlice(expected[:1]), comparableSlice(p2ForComparison))
+
+			for i := 1; i < 10; i++ {
+				expected[i], apiErr, err = roleClient.Create(tc.Context(), roles.WithName(expected[i].Name))
+				assert.NoError(err)
+				assert.Nil(apiErr)
+			}
+			p3, apiErr, err := roleClient.List(tc.Context())
+			require.NoError(err)
+			assert.Nil(apiErr)
+			var p3ForComparison []*roles.Role
+			for _, v := range p3 {
+				if !strutil.StrListContains(defaultRoleIds, v.Id) {
+					p3ForComparison = append(p3ForComparison, v)
+				}
+			}
+			assert.ElementsMatch(comparableSlice(expected), comparableSlice(p3ForComparison))
+		})
+	}
+}
+
+func comparableSlice(in []*roles.Role) []roles.Role {
+	var filtered []roles.Role
+	for _, i := range in {
+		p := roles.Role{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestRole_Crud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	projClient := client.Clone()
+	projClient.SetScopeId(proj.Id)
+
+	cases := []struct {
+		name        string
+		scopeClient *api.Client
+	}{
+		{
+			name:        "org",
+			scopeClient: client,
+		},
+		{
+			name:        "proj",
+			scopeClient: projClient,
+		},
+	}
+
+	checkRole := func(step string, g *roles.Role, apiErr *api.Error, err error, wantedName string, wantedVersion uint32) {
+		assert.NoError(err, step)
+		if !assert.Nil(apiErr, step) && apiErr.Message != "" {
+			t.Errorf("ApiError message: %q", apiErr.Message)
+		}
+		assert.NotNil(g, "returned no resource", step)
+		gotName := ""
+		if g.Name != "" {
+			gotName = g.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, g.Version)
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			roleClient := roles.NewRolesClient(tt.scopeClient)
+			g, apiErr, err := roleClient.Create(tc.Context(), roles.WithName("foo"))
+			checkRole("create", g, apiErr, err, "foo", 1)
+
+			g, apiErr, err = roleClient.Read(tc.Context(), g.Id)
+			checkRole("read", g, apiErr, err, "foo", 1)
+
+			g, apiErr, err = roleClient.Update(tc.Context(), g.Id, g.Version, roles.WithName("bar"))
+			checkRole("update", g, apiErr, err, "bar", 2)
+
+			g, apiErr, err = roleClient.Update(tc.Context(), g.Id, g.Version, roles.DefaultName())
+			checkRole("update", g, apiErr, err, "", 3)
+
+			existed, apiErr, err := roleClient.Delete(tc.Context(), g.Id)
+			require.NoError(err)
+			assert.Nil(apiErr)
+			assert.True(existed, "Expected existing user when deleted, but it wasn't.")
+
+			existed, apiErr, err = roleClient.Delete(tc.Context(), g.Id)
+			require.NoError(err)
+			assert.Nil(apiErr)
+			assert.False(existed, "Expected user to not exist when deleted, but it did.")
+		})
+	}
+}
+
+func TestRole_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+
+	proj, apiErr, err := scopes.NewScopesClient(client).Create(tc.Context(), orgId)
+	require.NoError(err)
+	require.Nil(apiErr)
+
+	projClient := client.Clone()
+	projClient.SetScopeId(proj.Id)
+
+	cases := []struct {
+		name        string
+		scopeClient *api.Client
+	}{
+		{
+			name:        "org",
+			scopeClient: client,
+		},
+		{
+			name:        "proj",
+			scopeClient: projClient,
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			roleClient := roles.NewRolesClient(tt.scopeClient)
+			u, apiErr, err := roleClient.Create(tc.Context(), roles.WithName("first"))
+			require.NoError(err)
+			assert.Nil(apiErr)
+			assert.NotNil(u)
+
+			// Create another resource with the same name.
+			_, apiErr, err = roleClient.Create(tc.Context(), roles.WithName("first"))
+			require.NoError(err)
+			assert.NotNil(apiErr)
+
+			_, apiErr, err = roleClient.Read(tc.Context(), iam.RolePrefix+"_doesntexis")
+			require.NoError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+			_, apiErr, err = roleClient.Read(tc.Context(), "invalid id")
+			require.NoError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusForbidden, apiErr.Status)
+
+			_, apiErr, err = roleClient.Update(tc.Context(), u.Id, u.Version)
+			require.NoError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+		})
+	}
+}

api/internal/tests/scopes/project_test.go

@@ -0,0 +1,146 @@
+package scopes_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestProjects_List(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	scps := scopes.NewScopesClient(client)
+
+	pl, apiErr, err := scps.List(tc.Context(), orgId)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.Empty(pl)
+
+	expected := make([]*scopes.Scope, 10)
+	for i := 0; i < 10; i++ {
+		expected[i], apiErr, err = scps.Create(tc.Context(), orgId, scopes.WithName(fmt.Sprintf("%d", i)))
+		require.NoError(err)
+		assert.Nil(apiErr)
+	}
+	pl, apiErr, err = scps.List(tc.Context(), orgId)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(pl))
+}
+
+func comparableSlice(in []*scopes.Scope) []scopes.Scope {
+	var filtered []scopes.Scope
+	for _, i := range in {
+		p := scopes.Scope{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestProjects_Crud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	scps := scopes.NewScopesClient(client)
+
+	checkProject := func(step string, s *scopes.Scope, apiErr *api.Error, err error, wantedName string, wantedVersion uint32) {
+		require.NoError(err, step)
+		assert.Nil(apiErr, step)
+		assert.NotNil(s, "returned project", step)
+		gotName := ""
+		if s.Name != "" {
+			gotName = s.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.Equal(wantedVersion, s.Version)
+	}
+
+	s, apiErr, err := scps.Create(tc.Context(), orgId, scopes.WithName("foo"))
+	checkProject("create", s, apiErr, err, "foo", 1)
+
+	s, apiErr, err = scps.Read(tc.Context(), s.Id)
+	checkProject("read", s, apiErr, err, "foo", 1)
+
+	s, apiErr, err = scps.Update(tc.Context(), s.Id, s.Version, scopes.WithName("bar"))
+	checkProject("update", s, apiErr, err, "bar", 2)
+
+	s, apiErr, err = scps.Update(tc.Context(), s.Id, s.Version, scopes.DefaultName())
+	checkProject("update, unset name", s, apiErr, err, "", 3)
+
+	existed, apiErr, err := scps.Delete(tc.Context(), s.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.True(existed, "Expected existing project when deleted, but it wasn't.")
+
+	_, apiErr, err = scps.Delete(tc.Context(), s.Id)
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status, "Expected project to not exist when deleted, but it did.")
+}
+
+// TODO: Get better coverage for expected errors and error formats.
+func TestProject_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	scps := scopes.NewScopesClient(client)
+
+	createdProj, apiErr, err := scps.Create(tc.Context(), orgId)
+	require.NoError(err)
+	assert.NotNil(createdProj)
+	assert.Nil(apiErr)
+
+	_, apiErr, err = scps.Read(tc.Context(), "p_doesntexis")
+	require.NoError(err)
+	// TODO: Should this be nil instead of just a Project that has no values set
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
+
+	_, apiErr, err = scps.Read(tc.Context(), "invalid id")
+	assert.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
+}

api/internal/tests/users/user_test.go

@@ -0,0 +1,170 @@
+package users_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUsers_List(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	userClient := users.NewUsersClient(client)
+
+	ul, apiErr, err := userClient.List(tc.Context())
+	assert.NoError(err)
+	assert.Nil(apiErr)
+	assert.Empty(ul)
+
+	var expected []*users.User
+	for i := 0; i < 10; i++ {
+		expected = append(expected, &users.User{Name: fmt.Sprint(i)})
+	}
+
+	expected[0], apiErr, err = userClient.Create(tc.Context(), users.WithName(expected[0].Name))
+	assert.NoError(err)
+	assert.Nil(apiErr)
+
+	ul, apiErr, err = userClient.List(tc.Context())
+	assert.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected[:1]), comparableSlice(ul))
+
+	for i := 1; i < 10; i++ {
+		expected[i], apiErr, err = userClient.Create(tc.Context(), users.WithName(expected[i].Name))
+		assert.NoError(err)
+		assert.Nil(apiErr)
+	}
+	ul, apiErr, err = userClient.List(tc.Context())
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(ul))
+}
+
+func comparableSlice(in []*users.User) []users.User {
+	var filtered []users.User
+	for _, i := range in {
+		p := users.User{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestUser_Crud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	userClient := users.NewUsersClient(client)
+
+	checkUser := func(step string, u *users.User, apiErr *api.Error, err error, wantedName string, wantedVersion uint32) {
+		assert.NoError(err, step)
+		if !assert.Nil(apiErr, step) && apiErr.Message != "" {
+			t.Errorf("ApiError message: %q", apiErr.Message)
+		}
+		assert.NotNil(u, "returned no resource", step)
+		gotName := ""
+		if u.Name != "" {
+			gotName = u.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, u.Version)
+	}
+
+	u, apiErr, err := userClient.Create(tc.Context(), users.WithName("foo"))
+	checkUser("create", u, apiErr, err, "foo", 1)
+
+	u, apiErr, err = userClient.Read(tc.Context(), u.Id)
+	checkUser("read", u, apiErr, err, "foo", 1)
+
+	u, apiErr, err = userClient.Update(tc.Context(), u.Id, u.Version, users.WithName("bar"))
+	checkUser("update", u, apiErr, err, "bar", 2)
+
+	u, apiErr, err = userClient.Update(tc.Context(), u.Id, u.Version, users.DefaultName())
+	checkUser("update", u, apiErr, err, "", 3)
+
+	existed, _, err := userClient.Delete(tc.Context(), u.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.True(existed, "Expected existing user when deleted, but it wasn't.")
+
+	existed, apiErr, err = userClient.Delete(tc.Context(), u.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.False(existed, "Expected user to not exist when deleted, but it did.")
+}
+
+func TestUser_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	orgId := "o_1234567890"
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultOrgId:                 orgId,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	userClient := users.NewUsersClient(client)
+
+	u, apiErr, err := userClient.Create(tc.Context(), users.WithName("first"))
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.NotNil(u)
+
+	// Create another resource with the same name.
+	_, apiErr, err = userClient.Create(tc.Context(), users.WithName("first"))
+	require.NoError(err)
+	assert.NotNil(apiErr)
+
+	_, apiErr, err = userClient.Read(tc.Context(), iam.UserPrefix+"_doesntexis")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, apiErr, err = userClient.Read(tc.Context(), "invalid id")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
+
+	_, apiErr, err = userClient.Update(tc.Context(), u.Id, u.Version)
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}