Fix test scope errors (#1029)

When using a disabled verifier context we were faking scope information. Due to other recent changes, this was now causing test errors. This adjusts that flow to actually query the DB, fixing tests and making them more like real code.

internal/auth/auth.go

@@ -133,18 +133,50 @@ func Verify(ctx context.Context, opt ...Option) (ret VerifyResults) {
 	opts := getOpts(opt...)
 
 	ret.Scope = new(scopes.ScopeInfo)
+
+	// In tests we often simply disable auth so we can test the service handlers
+	// without fuss
 	if v.requestInfo.DisableAuthEntirely {
+		const op = "auth.(disabled).lookupScope"
 		ret.Scope.Id = v.requestInfo.scopeIdOverride
 		if ret.Scope.Id == "" {
 			ret.Scope.Id = opts.withScopeId
 		}
-		switch {
-		case ret.Scope.Id == "global":
-			ret.Scope.Type = "global"
-		case strings.HasPrefix(ret.Scope.Id, scope.Org.Prefix()):
-			ret.Scope.Type = scope.Org.String()
-		case strings.HasPrefix(ret.Scope.Id, scope.Project.Prefix()):
-			ret.Scope.Type = scope.Project.String()
+		// Look up scope details to return. We can skip a lookup when using the
+		// global scope
+		switch ret.Scope.Id {
+		case "global":
+			ret.Scope = &scopes.ScopeInfo{
+				Id:            scope.Global.String(),
+				Type:          scope.Global.String(),
+				Name:          scope.Global.String(),
+				Description:   "Global Scope",
+				ParentScopeId: "",
+			}
+
+		default:
+			iamRepo, err := v.iamRepoFn()
+			if err != nil {
+				ret.Error = errors.Wrap(err, op, errors.WithMsg("failed to get iam repo"))
+				return
+			}
+
+			scp, err := iamRepo.LookupScope(v.ctx, ret.Scope.Id)
+			if err != nil {
+				ret.Error = errors.Wrap(err, op)
+				return
+			}
+			if scp == nil {
+				ret.Error = errors.New(errors.InvalidParameter, op, fmt.Sprint("non-existent scope $q", ret.Scope.Id))
+				return
+			}
+			ret.Scope = &scopes.ScopeInfo{
+				Id:            scp.GetPublicId(),
+				Type:          scp.GetType(),
+				Name:          scp.GetName(),
+				Description:   scp.GetDescription(),
+				ParentScopeId: scp.GetParentId(),
+			}
 		}
 		ret.UserId = v.requestInfo.userIdOverride
 		ret.Error = nil

internal/auth/testing.go

@@ -1,12 +1,19 @@
 package auth
 
-import "context"
+import (
+	"context"
+
+	"github.com/hashicorp/boundary/internal/servers/controller/common"
+)
 
 // DisabledAuthTestContext is meant for testing, and uses a context that has auth checking entirely disabled
-func DisabledAuthTestContext(opt ...Option) context.Context {
+func DisabledAuthTestContext(iamRepoFn common.IamRepoFactory, scopeId string, opt ...Option) context.Context {
 	reqInfo := RequestInfo{DisableAuthEntirely: true}
 	opts := getOpts(opt...)
 	reqInfo.scopeIdOverride = opts.withScopeId
+	if reqInfo.scopeIdOverride == "" {
+		reqInfo.scopeIdOverride = scopeId
+	}
 	reqInfo.userIdOverride = opts.withUserId
-	return NewVerifierContext(context.Background(), nil, nil, nil, nil, opts.withKms, reqInfo)
+	return NewVerifierContext(context.Background(), nil, iamRepoFn, nil, nil, opts.withKms, reqInfo)
 }

internal/iam/repository_scope.go

@@ -464,7 +464,7 @@ func (r *Repository) ListScopes(ctx context.Context, withParentIds []string, opt
 // ID. It returns the root scope ID as a part of the set.
 func (r *Repository) ListScopesRecursively(ctx context.Context, rootScopeId string, opt ...Option) ([]*Scope, error) {
 	const op = "iam.(Repository).ListRecursively"
-	var orgs []*Scope
+	var scopes []*Scope
 	var where string
 	var args []interface{}
 	switch {
@@ -483,9 +483,9 @@ func (r *Repository) ListScopesRecursively(ctx context.Context, rootScopeId stri
 		// We have no idea what scope type this is so bail
 		return nil, errors.New(errors.InvalidPublicId, op+":TypeSwitch", "invalid scope ID")
 	}
-	err := r.list(ctx, &orgs, where, args, opt...)
+	err := r.list(ctx, &scopes, where, args, opt...)
 	if err != nil {
 		return nil, errors.Wrap(err, op+":ListQuery")
 	}
-	return orgs, nil
+	return scopes, nil
 }

internal/servers/controller/common/scopeids/scope_ids.go

@@ -57,7 +57,7 @@ func GetListingScopeIds(
 	// Base case: if not recursive, return the scope we were given and the
 	// already-looked-up info
 	if !recursive {
-		return []string{rootScopeId}, map[string]*scopes.ScopeInfo{rootScopeId: authResults.Scope}, nil
+		return []string{authResults.Scope.Id}, map[string]*scopes.ScopeInfo{authResults.Scope.Id: authResults.Scope}, nil
 	}
 
 	// This will be used to memoize scope info so we can put the right scope

internal/servers/controller/handlers/accounts/account_service_test.go

@@ -37,6 +37,9 @@ func TestGet(t *testing.T) {
 	repoFn := func() (*password.Repository, error) {
 		return password.NewRepository(rw, rw, kms)
 	}
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iam.NewRepository(rw, rw, kms)
+	}
 
 	s, err := accounts.NewService(repoFn)
 	require.NoError(t, err, "Couldn't create new auth token service.")
@@ -50,7 +53,7 @@ func TestGet(t *testing.T) {
 		AuthMethodId:      aa.GetAuthMethodId(),
 		CreatedTime:       aa.GetCreateTime().GetTimestamp(),
 		UpdatedTime:       aa.GetUpdateTime().GetTimestamp(),
-		Scope:             &scopepb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+		Scope:             &scopepb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Version:           1,
 		Type:              "password",
 		Attributes:        &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
@@ -90,7 +93,7 @@ func TestGet(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.GetAccount(auth.DisabledAuthTestContext(auth.WithScopeId(org.GetPublicId())), tc.req)
+			got, gErr := s.GetAccount(auth.DisabledAuthTestContext(iamRepoFn, org.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -108,6 +111,9 @@ func TestList(t *testing.T) {
 	repoFn := func() (*password.Repository, error) {
 		return password.NewRepository(rw, rw, kms)
 	}
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iam.NewRepository(rw, rw, kms)
+	}
 
 	o, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrap))
 	ams := password.TestAuthMethods(t, conn, o.GetPublicId(), 3)
@@ -120,7 +126,7 @@ func TestList(t *testing.T) {
 			AuthMethodId:      aa.GetAuthMethodId(),
 			CreatedTime:       aa.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       aa.GetUpdateTime().GetTimestamp(),
-			Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+			Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:           1,
 			Type:              "password",
 			Attributes:        &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
@@ -135,7 +141,7 @@ func TestList(t *testing.T) {
 			AuthMethodId:      aa.GetAuthMethodId(),
 			CreatedTime:       aa.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       aa.GetUpdateTime().GetTimestamp(),
-			Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+			Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:           1,
 			Type:              "password",
 			Attributes:        &structpb.Struct{Fields: map[string]*structpb.Value{"login_name": structpb.NewStringValue(aa.GetLoginName())}},
@@ -197,7 +203,7 @@ func TestList(t *testing.T) {
 			s, err := accounts.NewService(repoFn)
 			require.NoError(err, "Couldn't create new user service.")
 
-			got, gErr := s.ListAccounts(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), tc.req)
+			got, gErr := s.ListAccounts(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListAccounts() with auth method %q got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -217,6 +223,9 @@ func TestDelete(t *testing.T) {
 	repoFn := func() (*password.Repository, error) {
 		return password.NewRepository(rw, rw, kms)
 	}
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iam.NewRepository(rw, rw, kms)
+	}
 
 	o, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrap))
 	am1 := password.TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
@@ -257,7 +266,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), tc.req)
+			got, gErr := s.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -276,6 +285,9 @@ func TestDelete_twice(t *testing.T) {
 	repoFn := func() (*password.Repository, error) {
 		return password.NewRepository(rw, rw, kms)
 	}
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iam.NewRepository(rw, rw, kms)
+	}
 
 	o, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrap))
 	am := password.TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
@@ -286,9 +298,9 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteAccountRequest{
 		Id: ac.GetPublicId(),
 	}
-	_, gErr := s.DeleteAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+	_, gErr := s.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
 	assert.NoError(gErr, "First attempt")
-	_, gErr = s.DeleteAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+	_, gErr = s.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
 	assert.Error(gErr, "Second attempt")
 	assert.True(errors.Is(gErr, handlers.ApiErrorWithCode(codes.NotFound)), "Expected permission denied for the second delete.")
 }
@@ -301,6 +313,9 @@ func TestCreate(t *testing.T) {
 	repoFn := func() (*password.Repository, error) {
 		return password.NewRepository(rw, rw, kms)
 	}
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iam.NewRepository(rw, rw, kms)
+	}
 
 	s, err := accounts.NewService(repoFn)
 	require.NoError(t, err, "Error when getting new account service.")
@@ -344,7 +359,7 @@ func TestCreate(t *testing.T) {
 					AuthMethodId:      defaultAccount.GetAuthMethodId(),
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:           1,
 					Type:              "password",
 					Attributes:        createAttr("validaccount", ""),
@@ -364,7 +379,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("accounts/%s_", password.AccountPrefix),
 				Item: &pb.Account{
 					AuthMethodId:      defaultAccount.GetAuthMethodId(),
-					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:           1,
 					Type:              "password",
 					Attributes:        createAttr("notypedefined", ""),
@@ -388,7 +403,7 @@ func TestCreate(t *testing.T) {
 					AuthMethodId:      defaultAccount.GetAuthMethodId(),
 					Name:              &wrapperspb.StringValue{Value: "name_with_password"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String()},
+					Scope:             &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:           1,
 					Type:              "password",
 					Attributes:        createAttr("haspassword", ""),
@@ -462,7 +477,7 @@ func TestCreate(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.CreateAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), tc.req)
+			got, gErr := s.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -496,13 +511,16 @@ func TestUpdate(t *testing.T) {
 	repoFn := func() (*password.Repository, error) {
 		return password.NewRepository(rw, rw, kms)
 	}
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iam.NewRepository(rw, rw, kms)
+	}
 
 	o, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrap))
 	am := password.TestAuthMethods(t, conn, o.GetPublicId(), 1)[0]
 	tested, err := accounts.NewService(repoFn)
 	require.NoError(t, err, "Error when getting new auth_method service.")
 
-	defaultScopeInfo := &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType()}
+	defaultScopeInfo := &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType(), ParentScopeId: scope.Global.String()}
 	defaultAttributes := &structpb.Struct{Fields: map[string]*structpb.Value{
 		"login_name": structpb.NewStringValue("default"),
 	}}
@@ -512,7 +530,7 @@ func TestUpdate(t *testing.T) {
 
 	freshAccount := func(t *testing.T) (*pb.Account, func()) {
 		t.Helper()
-		acc, err := tested.CreateAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())),
+		acc, err := tested.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
 			&pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
@@ -526,7 +544,7 @@ func TestUpdate(t *testing.T) {
 		require.NoError(t, err)
 
 		clean := func() {
-			_, err := tested.DeleteAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())),
+			_, err := tested.DeleteAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
 				&pbs.DeleteAccountRequest{Id: acc.GetItem().GetId()})
 			require.NoError(t, err)
 		}
@@ -816,7 +834,7 @@ func TestUpdate(t *testing.T) {
 				tc.res.Item.CreatedTime = acc.GetCreatedTime()
 			}
 
-			got, gErr := tested.UpdateAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), tc.req)
+			got, gErr := tested.UpdateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateAccount(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -856,6 +874,9 @@ func TestSetPassword(t *testing.T) {
 	repoFn := func() (*password.Repository, error) {
 		return password.NewRepository(rw, rw, kms)
 	}
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iam.NewRepository(rw, rw, kms)
+	}
 
 	o, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrap))
 	tested, err := accounts.NewService(repoFn)
@@ -871,7 +892,7 @@ func TestSetPassword(t *testing.T) {
 		}
 		attrs, err := handlers.ProtoToStruct(pwAttrs)
 		require.NoError(t, err)
-		createResp, err := tested.CreateAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.CreateAccountRequest{
+		createResp, err := tested.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.CreateAccountRequest{
 			Item: &pb.Account{
 				AuthMethodId: am.GetPublicId(),
 				Type:         "password",
@@ -911,7 +932,7 @@ func TestSetPassword(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 			acct := createAccount(t, tt.oldPw)
 
-			setResp, err := tested.SetPassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.SetPasswordRequest{
+			setResp, err := tested.SetPassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.SetPasswordRequest{
 				Id:       acct.GetId(),
 				Version:  acct.GetVersion(),
 				Password: tt.newPw,
@@ -951,7 +972,7 @@ func TestSetPassword(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			assert := assert.New(t)
 
-			setResp, err := tested.SetPassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.SetPasswordRequest{
+			setResp, err := tested.SetPassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.SetPasswordRequest{
 				Id:       tt.accountId,
 				Version:  tt.version,
 				Password: tt.password,
@@ -970,6 +991,9 @@ func TestChangePassword(t *testing.T) {
 	repoFn := func() (*password.Repository, error) {
 		return password.NewRepository(rw, rw, kms)
 	}
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iam.NewRepository(rw, rw, kms)
+	}
 
 	o, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrap))
 	tested, err := accounts.NewService(repoFn)
@@ -985,7 +1009,7 @@ func TestChangePassword(t *testing.T) {
 		}
 		attrs, err := handlers.ProtoToStruct(pwAttrs)
 		require.NoError(t, err)
-		createResp, err := tested.CreateAccount(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.CreateAccountRequest{
+		createResp, err := tested.CreateAccount(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.CreateAccountRequest{
 			Item: &pb.Account{
 				AuthMethodId: am.GetPublicId(),
 				Type:         "password",
@@ -1002,7 +1026,7 @@ func TestChangePassword(t *testing.T) {
 		assert, require := assert.New(t), require.New(t)
 		acct := createAccount(t, "originalpassword")
 
-		changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.ChangePasswordRequest{
+		changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
 			Id:              acct.GetId(),
 			Version:         acct.GetVersion(),
 			CurrentPassword: "originalpassword",
@@ -1021,7 +1045,7 @@ func TestChangePassword(t *testing.T) {
 		assert := assert.New(t)
 		acct := createAccount(t, "originalpassword")
 
-		changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.ChangePasswordRequest{
+		changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
 			Id:              acct.GetId(),
 			Version:         acct.GetVersion(),
 			CurrentPassword: "thewrongpassword",
@@ -1094,7 +1118,7 @@ func TestChangePassword(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			assert := assert.New(t)
 
-			changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.ChangePasswordRequest{
+			changeResp, err := tested.ChangePassword(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.ChangePasswordRequest{
 				Id:              tt.accountId,
 				Version:         tt.version,
 				CurrentPassword: tt.oldPW,

internal/servers/controller/handlers/authmethods/authmethod_service_test.go

@@ -76,8 +76,9 @@ func TestGet(t *testing.T) {
 		}},
 		Version: 1,
 		Scope: &scopepb.ScopeInfo{
-			Id:   o.GetPublicId(),
-			Type: o.GetType(),
+			Id:            o.GetPublicId(),
+			Type:          o.GetType(),
+			ParentScopeId: scope.Global.String(),
 		},
 		AuthorizedActions:           []string{"read", "update", "delete", "authenticate"},
 		AuthorizedCollectionActions: authorizedCollectionActions,
@@ -125,7 +126,7 @@ func TestGet(t *testing.T) {
 			s, err := authmethods.NewService(kms, pwRepoFn, iamRepoFn, atRepoFn)
 			require.NoError(err, "Couldn't create new auth_method service.")
 
-			got, gErr := s.GetAuthMethod(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.GetAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetAuthMethod(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -162,7 +163,7 @@ func TestList(t *testing.T) {
 			ScopeId:     oWithAuthMethods.GetPublicId(),
 			CreatedTime: am.GetCreateTime().GetTimestamp(),
 			UpdatedTime: am.GetUpdateTime().GetTimestamp(),
-			Scope:       &scopepb.ScopeInfo{Id: oWithAuthMethods.GetPublicId(), Type: scope.Org.String()},
+			Scope:       &scopepb.ScopeInfo{Id: oWithAuthMethods.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:     1,
 			Type:        "password",
 			Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
@@ -181,7 +182,7 @@ func TestList(t *testing.T) {
 			ScopeId:     oWithOtherAuthMethods.GetPublicId(),
 			CreatedTime: aa.GetCreateTime().GetTimestamp(),
 			UpdatedTime: aa.GetUpdateTime().GetTimestamp(),
-			Scope:       &scopepb.ScopeInfo{Id: oWithOtherAuthMethods.GetPublicId(), Type: scope.Org.String()},
+			Scope:       &scopepb.ScopeInfo{Id: oWithOtherAuthMethods.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:     1,
 			Type:        "password",
 			Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
@@ -251,7 +252,7 @@ func TestList(t *testing.T) {
 			s, err := authmethods.NewService(kms, pwRepoFn, iamRepoFn, atRepoFn)
 			require.NoError(err, "Couldn't create new auth_method service.")
 
-			got, gErr := s.ListAuthMethods(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetScopeId())), tc.req)
+			got, gErr := s.ListAuthMethods(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListAuthMethods() for scope %q got error %v, wanted %v", tc.req.GetScopeId(), gErr, tc.err)
@@ -316,7 +317,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteAuthMethod(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), tc.req)
+			got, gErr := s.DeleteAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteAuthMethod(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -352,9 +353,9 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteAuthMethodRequest{
 		Id: am.GetPublicId(),
 	}
-	_, gErr := s.DeleteAuthMethod(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+	_, gErr := s.DeleteAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
 	assert.NoError(gErr, "First attempt")
-	_, gErr = s.DeleteAuthMethod(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+	_, gErr = s.DeleteAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), req)
 	assert.Error(gErr, "Second attempt")
 	assert.True(errors.Is(gErr, handlers.ApiErrorWithCode(codes.NotFound)), "Expected permission denied for the second delete.")
 }
@@ -402,7 +403,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Name:        &wrapperspb.StringValue{Value: "name"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Scope:       &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType()},
+					Scope:       &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType(), ParentScopeId: scope.Global.String()},
 					Version:     1,
 					Type:        "password",
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
@@ -431,7 +432,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Name:        &wrapperspb.StringValue{Value: "name"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Scope:       &scopepb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Scope:       &scopepb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Version:     1,
 					Type:        "password",
 					Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
@@ -515,7 +516,7 @@ func TestCreate(t *testing.T) {
 			s, err := authmethods.NewService(kms, pwRepoFn, iamRepoFn, atRepoFn)
 			require.NoError(err, "Error when getting new auth_method service.")
 
-			got, gErr := s.CreateAuthMethod(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetItem().GetScopeId())), tc.req)
+			got, gErr := s.CreateAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetItem().GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateAuthMethod(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -562,10 +563,10 @@ func TestUpdate(t *testing.T) {
 	tested, err := authmethods.NewService(kms, pwRepoFn, iamRepoFn, atRepoFn)
 	require.NoError(t, err, "Error when getting new auth_method service.")
 
-	defaultScopeInfo := &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType()}
+	defaultScopeInfo := &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType(), ParentScopeId: scope.Global.String()}
 
 	freshAuthMethod := func() (*pb.AuthMethod, func()) {
-		am, err := tested.CreateAuthMethod(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())),
+		am, err := tested.CreateAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
 			&pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:     o.GetPublicId(),
 				Name:        wrapperspb.String("default"),
@@ -575,7 +576,7 @@ func TestUpdate(t *testing.T) {
 		require.NoError(t, err)
 
 		clean := func() {
-			_, err := tested.DeleteAuthMethod(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())),
+			_, err := tested.DeleteAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()),
 				&pbs.DeleteAuthMethodRequest{Id: am.GetItem().GetId()})
 			require.NoError(t, err)
 		}
@@ -915,7 +916,7 @@ func TestUpdate(t *testing.T) {
 				tc.res.Item.CreatedTime = am.GetCreatedTime()
 			}
 
-			got, gErr := tested.UpdateAuthMethod(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), tc.req)
+			got, gErr := tested.UpdateAuthMethod(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateAuthMethod(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1086,7 +1087,7 @@ func TestAuthenticate(t *testing.T) {
 			s, err := authmethods.NewService(kms, pwRepoFn, iamRepoFn, atRepoFn)
 			require.NoError(err)
 
-			resp, err := s.Authenticate(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), tc.request)
+			resp, err := s.Authenticate(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), tc.request)
 			if tc.wantErr != nil {
 				assert.Error(err)
 				assert.Truef(errors.Is(err, tc.wantErr), "Got %#v, wanted %#v", err, tc.wantErr)
@@ -1142,7 +1143,7 @@ func TestAuthenticate_AuthAccountConnectedToIamUser(t *testing.T) {
 
 	s, err := authmethods.NewService(kms, pwRepoFn, iamRepoFn, atRepoFn)
 	require.NoError(err)
-	resp, err := s.Authenticate(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), &pbs.AuthenticateRequest{
+	resp, err := s.Authenticate(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId()), &pbs.AuthenticateRequest{
 		AuthMethodId: am.GetPublicId(),
 		Credentials: func() *structpb.Struct {
 			creds := map[string]*structpb.Value{

internal/servers/controller/handlers/authtokens/authtoken_service_test.go

@@ -52,7 +52,7 @@ func TestGet(t *testing.T) {
 		UpdatedTime:             at.GetUpdateTime().GetTimestamp(),
 		ApproximateLastUsedTime: at.GetApproximateLastAccessTime().GetTimestamp(),
 		ExpirationTime:          at.GetExpirationTime().GetTimestamp(),
-		Scope:                   &scopes.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+		Scope:                   &scopes.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		AuthorizedActions:       []string{"read", "delete"},
 	}
 
@@ -89,7 +89,7 @@ func TestGet(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.GetAuthToken(auth.DisabledAuthTestContext(auth.WithScopeId(org.GetPublicId())), tc.req)
+			got, gErr := s.GetAuthToken(auth.DisabledAuthTestContext(iamRepoFn, org.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetAuthToken(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -127,7 +127,7 @@ func TestList(t *testing.T) {
 			UpdatedTime:             at.GetUpdateTime().GetTimestamp(),
 			ApproximateLastUsedTime: at.GetApproximateLastAccessTime().GetTimestamp(),
 			ExpirationTime:          at.GetExpirationTime().GetTimestamp(),
-			Scope:                   &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+			Scope:                   &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 			AuthorizedActions:       []string{"read", "delete"},
 		})
 	}
@@ -146,7 +146,7 @@ func TestList(t *testing.T) {
 			UpdatedTime:             at.GetUpdateTime().GetTimestamp(),
 			ApproximateLastUsedTime: at.GetApproximateLastAccessTime().GetTimestamp(),
 			ExpirationTime:          at.GetExpirationTime().GetTimestamp(),
-			Scope:                   &scopes.ScopeInfo{Id: orgWithSomeTokens.GetPublicId(), Type: scope.Org.String()},
+			Scope:                   &scopes.ScopeInfo{Id: orgWithSomeTokens.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			AuthorizedActions:       []string{"read", "delete"},
 		})
 	}
@@ -165,7 +165,7 @@ func TestList(t *testing.T) {
 			UpdatedTime:             at.GetUpdateTime().GetTimestamp(),
 			ApproximateLastUsedTime: at.GetApproximateLastAccessTime().GetTimestamp(),
 			ExpirationTime:          at.GetExpirationTime().GetTimestamp(),
-			Scope:                   &scopes.ScopeInfo{Id: orgWithOtherTokens.GetPublicId(), Type: scope.Org.String()},
+			Scope:                   &scopes.ScopeInfo{Id: orgWithOtherTokens.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			AuthorizedActions:       []string{"read", "delete"},
 		})
 	}
@@ -229,7 +229,7 @@ func TestList(t *testing.T) {
 			s, err := authtokens.NewService(repoFn, iamRepoFn)
 			require.NoError(t, err, "Couldn't create new user service.")
 
-			got, gErr := s.ListAuthTokens(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetScopeId())), tc.req)
+			got, gErr := s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(t, gErr)
 				assert.True(t, errors.Is(gErr, tc.err), "ListAuthTokens() with scope %q got error %v, wanted %v", tc.req.GetScopeId(), gErr, tc.err)
@@ -295,7 +295,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteAuthToken(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scope)), tc.req)
+			got, gErr := s.DeleteAuthToken(auth.DisabledAuthTestContext(iamRepoFn, tc.scope), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteAuthToken(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -327,9 +327,9 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteAuthTokenRequest{
 		Id: at.GetPublicId(),
 	}
-	_, gErr := s.DeleteAuthToken(auth.DisabledAuthTestContext(auth.WithScopeId(at.GetScopeId())), req)
+	_, gErr := s.DeleteAuthToken(auth.DisabledAuthTestContext(iamRepoFn, at.GetScopeId()), req)
 	assert.NoError(gErr, "First attempt")
-	_, gErr = s.DeleteAuthToken(auth.DisabledAuthTestContext(auth.WithScopeId(at.GetScopeId())), req)
+	_, gErr = s.DeleteAuthToken(auth.DisabledAuthTestContext(iamRepoFn, at.GetScopeId()), req)
 	assert.Error(gErr, "Second attempt")
 	assert.True(errors.Is(gErr, handlers.ApiErrorWithCode(codes.NotFound)), "Expected permission denied for the second delete.")
 }

internal/servers/controller/handlers/groups/group_service_test.go

@@ -93,7 +93,7 @@ func TestGet(t *testing.T) {
 	wantOrgGroup := &pb.Group{
 		Id:          og.GetPublicId(),
 		ScopeId:     og.GetScopeId(),
-		Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String()},
+		Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Name:        &wrapperspb.StringValue{Value: og.GetName()},
 		Description: &wrapperspb.StringValue{Value: og.GetDescription()},
 		CreatedTime: og.CreateTime.GetTimestamp(),
@@ -112,7 +112,7 @@ func TestGet(t *testing.T) {
 	wantProjGroup := &pb.Group{
 		Id:          pg.GetPublicId(),
 		ScopeId:     pg.GetScopeId(),
-		Scope:       &scopes.ScopeInfo{Id: pg.GetScopeId(), Type: scope.Project.String()},
+		Scope:       &scopes.ScopeInfo{Id: pg.GetScopeId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 		Name:        &wrapperspb.StringValue{Value: pg.GetName()},
 		Description: &wrapperspb.StringValue{Value: pg.GetDescription()},
 		CreatedTime: pg.CreateTime.GetTimestamp(),
@@ -196,7 +196,7 @@ func TestGet(t *testing.T) {
 			s, err := groups.NewService(repoFn)
 			require.NoError(err, "Couldn't create new group service.")
 
-			got, gErr := s.GetGroup(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			got, gErr := s.GetGroup(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetGroup(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -223,7 +223,7 @@ func TestList(t *testing.T) {
 		wantOrgGroups = append(wantOrgGroups, &pb.Group{
 			Id:                og.GetPublicId(),
 			ScopeId:           og.GetScopeId(),
-			Scope:             &scopes.ScopeInfo{Id: oWithGroups.GetPublicId(), Type: scope.Org.String()},
+			Scope:             &scopes.ScopeInfo{Id: oWithGroups.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			CreatedTime:       og.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       og.GetUpdateTime().GetTimestamp(),
 			Version:           1,
@@ -234,7 +234,7 @@ func TestList(t *testing.T) {
 		wantProjGroups = append(wantProjGroups, &pb.Group{
 			Id:                pg.GetPublicId(),
 			ScopeId:           pg.GetScopeId(),
-			Scope:             &scopes.ScopeInfo{Id: pWithGroups.GetPublicId(), Type: scope.Project.String()},
+			Scope:             &scopes.ScopeInfo{Id: pWithGroups.GetPublicId(), Type: scope.Project.String(), ParentScopeId: oNoGroups.GetPublicId()},
 			CreatedTime:       pg.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       pg.GetUpdateTime().GetTimestamp(),
 			Version:           1,
@@ -317,7 +317,7 @@ func TestList(t *testing.T) {
 			s, err := groups.NewService(repoFn)
 			require.NoError(err, "Couldn't create new group service.")
 
-			got, gErr := s.ListGroups(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetScopeId())), tc.req)
+			got, gErr := s.ListGroups(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListGroups(%q) got error %v, wanted %v", tc.req.GetScopeId(), gErr, tc.err)
@@ -328,9 +328,9 @@ func TestList(t *testing.T) {
 }
 
 func TestDelete(t *testing.T) {
-	og, pg, repo := createDefaultGroupsAndRepo(t)
+	og, pg, repoFn := createDefaultGroupsAndRepo(t)
 
-	s, err := groups.NewService(repo)
+	s, err := groups.NewService(repoFn)
 	require.NoError(t, err, "Error when getting new group service.")
 
 	cases := []struct {
@@ -384,7 +384,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteGroup(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.DeleteGroup(auth.DisabledAuthTestContext(repoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteGroup(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -396,15 +396,15 @@ func TestDelete(t *testing.T) {
 
 func TestDelete_twice(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
-	og, pg, repo := createDefaultGroupsAndRepo(t)
+	og, pg, repoFn := createDefaultGroupsAndRepo(t)
 
-	s, err := groups.NewService(repo)
+	s, err := groups.NewService(repoFn)
 	require.NoError(err, "Error when getting new group service")
 	scopeId := og.GetScopeId()
 	req := &pbs.DeleteGroupRequest{
 		Id: og.GetPublicId(),
 	}
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId(scopeId))
+	ctx := auth.DisabledAuthTestContext(repoFn, scopeId)
 	_, gErr := s.DeleteGroup(ctx, req)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteGroup(ctx, req)
@@ -415,7 +415,7 @@ func TestDelete_twice(t *testing.T) {
 	projReq := &pbs.DeleteGroupRequest{
 		Id: pg.GetPublicId(),
 	}
-	ctx = auth.DisabledAuthTestContext(auth.WithScopeId(scopeId))
+	ctx = auth.DisabledAuthTestContext(repoFn, scopeId)
 	_, gErr = s.DeleteGroup(ctx, projReq)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteGroup(ctx, projReq)
@@ -424,7 +424,7 @@ func TestDelete_twice(t *testing.T) {
 }
 
 func TestCreate(t *testing.T) {
-	defaultOGroup, defaultPGroup, repo := createDefaultGroupsAndRepo(t)
+	defaultOGroup, defaultPGroup, repoFn := createDefaultGroupsAndRepo(t)
 	defaultCreated, err := ptypes.Timestamp(defaultOGroup.GetCreateTime().GetTimestamp())
 	require.NoError(t, err, "Error converting proto to timestamp.")
 	toMerge := &pbs.CreateGroupRequest{}
@@ -446,7 +446,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("groups/%s_", iam.GroupPrefix),
 				Item: &pb.Group{
 					ScopeId:           defaultOGroup.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: defaultOGroup.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: defaultOGroup.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Version:           1,
@@ -465,7 +465,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("groups/%s_", iam.GroupPrefix),
 				Item: &pb.Group{
 					ScopeId:           scope.Global.String(),
-					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Version:           1,
@@ -486,7 +486,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("groups/%s_", iam.GroupPrefix),
 				Item: &pb.Group{
 					ScopeId:           defaultPGroup.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: defaultPGroup.GetScopeId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: defaultPGroup.GetScopeId(), Type: scope.Project.String(), ParentScopeId: defaultOGroup.GetScopeId()},
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Version:           1,
@@ -525,10 +525,10 @@ func TestCreate(t *testing.T) {
 			req := proto.Clone(toMerge).(*pbs.CreateGroupRequest)
 			proto.Merge(req, tc.req)
 
-			s, err := groups.NewService(repo)
+			s, err := groups.NewService(repoFn)
 			require.NoError(err, "Error when getting new group service.")
 
-			got, gErr := s.CreateGroup(auth.DisabledAuthTestContext(auth.WithScopeId(req.GetItem().GetScopeId())), req)
+			got, gErr := s.CreateGroup(auth.DisabledAuthTestContext(repoFn, req.GetItem().GetScopeId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateGroup(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -621,7 +621,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Group{
 					Id:          og.GetPublicId(),
 					ScopeId:     og.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String()},
+					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime: og.GetCreateTime().GetTimestamp(),
@@ -652,7 +652,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Group{
 					Id:          og.GetPublicId(),
 					ScopeId:     og.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String()},
+					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime: og.GetCreateTime().GetTimestamp(),
@@ -684,7 +684,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Group{
 					Id:          pg.GetPublicId(),
 					ScopeId:     pg.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: pg.GetScopeId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: pg.GetScopeId(), Type: scope.Project.String(), ParentScopeId: og.GetScopeId()},
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime: pg.GetCreateTime().GetTimestamp(),
@@ -716,7 +716,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Group{
 					Id:          pg.GetPublicId(),
 					ScopeId:     pg.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: pg.GetScopeId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: pg.GetScopeId(), Type: scope.Project.String(), ParentScopeId: og.GetScopeId()},
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime: pg.GetCreateTime().GetTimestamp(),
@@ -780,7 +780,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Group{
 					Id:          og.GetPublicId(),
 					ScopeId:     og.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String()},
+					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Description: &wrapperspb.StringValue{Value: "default"},
 					CreatedTime: og.GetCreateTime().GetTimestamp(),
 					MemberIds:   []string{u.GetPublicId()},
@@ -810,7 +810,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Group{
 					Id:          og.GetPublicId(),
 					ScopeId:     og.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String()},
+					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:        &wrapperspb.StringValue{Value: "updated"},
 					Description: &wrapperspb.StringValue{Value: "default"},
 					CreatedTime: og.GetCreateTime().GetTimestamp(),
@@ -841,7 +841,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Group{
 					Id:          og.GetPublicId(),
 					ScopeId:     og.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String()},
+					Scope:       &scopes.ScopeInfo{Id: og.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "notignored"},
 					CreatedTime: og.GetCreateTime().GetTimestamp(),
@@ -927,14 +927,14 @@ func TestUpdate(t *testing.T) {
 
 			// Test with bad version (too high, too low)
 			req.Item.Version = ver + 2
-			_, gErr := tested.UpdateGroup(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			_, gErr := tested.UpdateGroup(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			require.Error(gErr)
 			req.Item.Version = ver - 1
-			_, gErr = tested.UpdateGroup(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			_, gErr = tested.UpdateGroup(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			require.Error(gErr)
 			req.Item.Version = ver
 
-			got, gErr := tested.UpdateGroup(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			got, gErr := tested.UpdateGroup(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateGroup(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -1037,7 +1037,7 @@ func TestAddMember(t *testing.T) {
 					MemberIds: tc.addUsers,
 				}
 
-				got, err := s.AddGroupMembers(auth.DisabledAuthTestContext(auth.WithScopeId(scp.GetPublicId())), req)
+				got, err := s.AddGroupMembers(auth.DisabledAuthTestContext(repoFn, scp.GetPublicId()), req)
 				if tc.wantErr {
 					assert.Error(t, err)
 					return
@@ -1088,7 +1088,7 @@ func TestAddMember(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.AddGroupMembers(auth.DisabledAuthTestContext(auth.WithScopeId(grp.GetScopeId())), tc.req)
+			_, gErr := s.AddGroupMembers(auth.DisabledAuthTestContext(repoFn, grp.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "AddGroupMembers(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1167,7 +1167,7 @@ func TestSetMember(t *testing.T) {
 					MemberIds: tc.setUsers,
 				}
 
-				got, err := s.SetGroupMembers(auth.DisabledAuthTestContext(auth.WithScopeId(scp.GetPublicId())), req)
+				got, err := s.SetGroupMembers(auth.DisabledAuthTestContext(repoFn, scp.GetPublicId()), req)
 				if tc.wantErr {
 					assert.Error(t, err)
 					return
@@ -1218,7 +1218,7 @@ func TestSetMember(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.SetGroupMembers(auth.DisabledAuthTestContext(auth.WithScopeId(grp.GetScopeId())), tc.req)
+			_, gErr := s.SetGroupMembers(auth.DisabledAuthTestContext(repoFn, grp.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "SetGroupMembers(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1306,7 +1306,7 @@ func TestRemoveMember(t *testing.T) {
 					MemberIds: tc.removeUsers,
 				}
 
-				got, err := s.RemoveGroupMembers(auth.DisabledAuthTestContext(auth.WithScopeId(scp.GetPublicId())), req)
+				got, err := s.RemoveGroupMembers(auth.DisabledAuthTestContext(repoFn, scp.GetPublicId()), req)
 				if tc.wantErr {
 					assert.Error(t, err)
 					return
@@ -1348,7 +1348,7 @@ func TestRemoveMember(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.RemoveGroupMembers(auth.DisabledAuthTestContext(auth.WithScopeId(grp.GetScopeId())), tc.req)
+			_, gErr := s.RemoveGroupMembers(auth.DisabledAuthTestContext(repoFn, grp.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "RemoveGroupMembers(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)

internal/servers/controller/handlers/host_catalogs/host_catalog_service_test.go

@@ -84,7 +84,7 @@ func TestGet(t *testing.T) {
 	pHostCatalog := &pb.HostCatalog{
 		Id:                          hc.GetPublicId(),
 		ScopeId:                     hc.GetScopeId(),
-		Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+		Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 		Name:                        &wrappers.StringValue{Value: hc.GetName()},
 		Description:                 &wrappers.StringValue{Value: hc.GetDescription()},
 		CreatedTime:                 hc.CreateTime.GetTimestamp(),
@@ -133,7 +133,7 @@ func TestGet(t *testing.T) {
 			s, err := host_catalogs.NewService(repo, iamRepoFn)
 			require.NoError(err, "Couldn't create a new host catalog service.")
 
-			got, gErr := s.GetHostCatalog(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, gErr := s.GetHostCatalog(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetHostCatalog(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -161,8 +161,8 @@ func TestList(t *testing.T) {
 	iamRepo := iam.TestRepo(t, conn, wrapper)
 
 	_, pNoCatalogs := iam.TestScopes(t, iamRepo)
-	_, pWithCatalogs := iam.TestScopes(t, iamRepo)
-	_, pWithOtherCatalogs := iam.TestScopes(t, iamRepo)
+	oWithCatalogs, pWithCatalogs := iam.TestScopes(t, iamRepo)
+	oWithOtherCatalogs, pWithOtherCatalogs := iam.TestScopes(t, iamRepo)
 
 	var wantSomeCatalogs []*pb.HostCatalog
 	for _, hc := range static.TestCatalogs(t, conn, pWithCatalogs.GetPublicId(), 3) {
@@ -171,7 +171,7 @@ func TestList(t *testing.T) {
 			ScopeId:                     hc.GetScopeId(),
 			CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 			UpdatedTime:                 hc.GetUpdateTime().GetTimestamp(),
-			Scope:                       &scopepb.ScopeInfo{Id: pWithCatalogs.GetPublicId(), Type: scope.Project.String()},
+			Scope:                       &scopepb.ScopeInfo{Id: pWithCatalogs.GetPublicId(), Type: scope.Project.String(), ParentScopeId: oWithCatalogs.GetPublicId()},
 			Version:                     1,
 			Type:                        "static",
 			AuthorizedActions:           []string{"read", "update", "delete"},
@@ -186,7 +186,7 @@ func TestList(t *testing.T) {
 			ScopeId:                     hc.GetScopeId(),
 			CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 			UpdatedTime:                 hc.GetUpdateTime().GetTimestamp(),
-			Scope:                       &scopepb.ScopeInfo{Id: pWithOtherCatalogs.GetPublicId(), Type: scope.Project.String()},
+			Scope:                       &scopepb.ScopeInfo{Id: pWithOtherCatalogs.GetPublicId(), Type: scope.Project.String(), ParentScopeId: oWithOtherCatalogs.GetPublicId()},
 			Version:                     1,
 			Type:                        "static",
 			AuthorizedActions:           []string{"read", "update", "delete"},
@@ -257,7 +257,7 @@ func TestList(t *testing.T) {
 			s, err := host_catalogs.NewService(repoFn, iamRepoFn)
 			require.NoError(err, "Couldn't create new auth_method service.")
 
-			got, gErr := s.ListHostCatalogs(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetScopeId())), tc.req)
+			got, gErr := s.ListHostCatalogs(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListHostCatalogs() for scope %q got error %v, wanted %v", tc.req.GetScopeId(), gErr, tc.err)
@@ -309,7 +309,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteHostCatalog(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.DeleteHostCatalog(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteHostCatalog(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -329,7 +329,7 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteHostCatalogRequest{
 		Id: hc.GetPublicId(),
 	}
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId()))
+	ctx := auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId())
 	_, gErr := s.DeleteHostCatalog(ctx, req)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteHostCatalog(ctx, req)
@@ -362,7 +362,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("host-catalogs/%s_", static.HostCatalogPrefix),
 				Item: &pb.HostCatalog{
 					ScopeId:                     proj.GetPublicId(),
-					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Name:                        &wrappers.StringValue{Value: "name"},
 					Description:                 &wrappers.StringValue{Value: "desc"},
 					Type:                        "static",
@@ -442,7 +442,7 @@ func TestCreate(t *testing.T) {
 			s, err := host_catalogs.NewService(repo, iamRepoFn)
 			require.NoError(err, "Failed to create a new host catalog service.")
 
-			got, gErr := s.CreateHostCatalog(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, gErr := s.CreateHostCatalog(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateHostCatalog(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -516,7 +516,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostCatalog{
 					Id:                          hc.GetPublicId(),
 					ScopeId:                     hc.GetScopeId(),
-					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Name:                        &wrappers.StringValue{Value: "new"},
 					Description:                 &wrappers.StringValue{Value: "desc"},
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
@@ -542,7 +542,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostCatalog{
 					Id:                          hc.GetPublicId(),
 					ScopeId:                     hc.GetScopeId(),
-					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Name:                        &wrappers.StringValue{Value: "new"},
 					Description:                 &wrappers.StringValue{Value: "desc"},
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
@@ -598,7 +598,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostCatalog{
 					Id:                          hc.GetPublicId(),
 					ScopeId:                     hc.GetScopeId(),
-					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Description:                 &wrappers.StringValue{Value: "default"},
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 					Type:                        "static",
@@ -621,7 +621,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostCatalog{
 					Id:                          hc.GetPublicId(),
 					ScopeId:                     hc.GetScopeId(),
-					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Name:                        &wrappers.StringValue{Value: "default"},
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 					Type:                        "static",
@@ -645,7 +645,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostCatalog{
 					Id:                          hc.GetPublicId(),
 					ScopeId:                     hc.GetScopeId(),
-					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Name:                        &wrappers.StringValue{Value: "updated"},
 					Description:                 &wrappers.StringValue{Value: "default"},
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
@@ -670,7 +670,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostCatalog{
 					Id:                          hc.GetPublicId(),
 					ScopeId:                     hc.GetScopeId(),
-					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:                       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Name:                        &wrappers.StringValue{Value: "default"},
 					Description:                 &wrappers.StringValue{Value: "notignored"},
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
@@ -702,7 +702,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.HostCatalog{
 					Name:        &wrappers.StringValue{Value: "new"},
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Description: &wrappers.StringValue{Value: "desc"},
 				},
 			},
@@ -717,7 +717,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.HostCatalog{
 					Id:          "p_somethinge",
-					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
 					Name:        &wrappers.StringValue{Value: "new"},
 					Description: &wrappers.StringValue{Value: "new desc"},
 				},
@@ -775,14 +775,14 @@ func TestUpdate(t *testing.T) {
 
 			// Test some bad versions
 			req.Item.Version = version + 2
-			_, gErr := tested.UpdateHostCatalog(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			_, gErr := tested.UpdateHostCatalog(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.Error(gErr)
 			req.Item.Version = version - 1
-			_, gErr = tested.UpdateHostCatalog(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			_, gErr = tested.UpdateHostCatalog(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.Error(gErr)
 			req.Item.Version = version
 
-			got, gErr := tested.UpdateHostCatalog(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, gErr := tested.UpdateHostCatalog(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateHostCatalog(%+v) got error %v, wanted %v", req, gErr, tc.err)

internal/servers/controller/handlers/host_sets/host_set_service_test.go

@@ -37,7 +37,12 @@ func TestGet(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -57,7 +62,7 @@ func TestGet(t *testing.T) {
 		Id:                hs.GetPublicId(),
 		CreatedTime:       hs.CreateTime.GetTimestamp(),
 		UpdatedTime:       hs.UpdateTime.GetTimestamp(),
-		Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+		Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 		Type:              "static",
 		HostIds:           hIds,
 		AuthorizedActions: []string{"read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
@@ -102,7 +107,7 @@ func TestGet(t *testing.T) {
 			s, err := host_sets.NewService(repoFn)
 			require.NoError(err, "Couldn't create a new host set service.")
 
-			got, gErr := s.GetHostSet(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, gErr := s.GetHostSet(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetHostSet(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -121,7 +126,12 @@ func TestList(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -135,7 +145,7 @@ func TestList(t *testing.T) {
 		wantHs = append(wantHs, &pb.HostSet{
 			Id:                h.GetPublicId(),
 			HostCatalogId:     h.GetCatalogId(),
-			Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+			Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 			CreatedTime:       h.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       h.GetUpdateTime().GetTimestamp(),
 			Version:           h.GetVersion(),
@@ -182,7 +192,7 @@ func TestList(t *testing.T) {
 			s, err := host_sets.NewService(repoFn)
 			require.NoError(err, "Couldn't create new host set service.")
 
-			got, gErr := s.ListHostSets(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			got, gErr := s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListHostSets(%q) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -200,7 +210,12 @@ func TestDelete(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -255,7 +270,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteHostSet(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.DeleteHostSet(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteHostSet(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -272,7 +287,12 @@ func TestDelete_twice(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -286,7 +306,7 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteHostSetRequest{
 		Id: h.GetPublicId(),
 	}
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId()))
+	ctx := auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId())
 	_, gErr := s.DeleteHostSet(ctx, req)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteHostSet(ctx, req)
@@ -300,7 +320,12 @@ func TestCreate(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -329,7 +354,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("host-sets/%s_", static.HostSetPrefix),
 				Item: &pb.HostSet{
 					HostCatalogId:     hc.GetPublicId(),
-					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:              &wrappers.StringValue{Value: "name"},
 					Description:       &wrappers.StringValue{Value: "desc"},
 					Type:              "static",
@@ -358,7 +383,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("host-sets/%s_", static.HostSetPrefix),
 				Item: &pb.HostSet{
 					HostCatalogId:     hc.GetPublicId(),
-					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:              &wrappers.StringValue{Value: "no type name"},
 					Description:       &wrappers.StringValue{Value: "no type desc"},
 					Type:              "static",
@@ -401,7 +426,7 @@ func TestCreate(t *testing.T) {
 			s, err := host_sets.NewService(repoFn)
 			require.NoError(err, "Failed to create a new host set service.")
 
-			got, gErr := s.CreateHostSet(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			got, gErr := s.CreateHostSet(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateHostSet(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -436,7 +461,12 @@ func TestUpdate(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -497,7 +527,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostSet{
 					HostCatalogId:     hc.GetPublicId(),
 					Id:                hs.GetPublicId(),
-					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:              &wrappers.StringValue{Value: "new"},
 					Description:       &wrappers.StringValue{Value: "desc"},
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
@@ -523,7 +553,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostSet{
 					HostCatalogId:     hc.GetPublicId(),
 					Id:                hs.GetPublicId(),
-					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:              &wrappers.StringValue{Value: "new"},
 					Description:       &wrappers.StringValue{Value: "desc"},
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
@@ -593,7 +623,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostSet{
 					HostCatalogId:     hc.GetPublicId(),
 					Id:                hs.GetPublicId(),
-					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Description:       &wrappers.StringValue{Value: "default"},
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
 					Type:              "static",
@@ -616,7 +646,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostSet{
 					HostCatalogId:     hc.GetPublicId(),
 					Id:                hs.GetPublicId(),
-					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:              &wrappers.StringValue{Value: "default"},
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
 					Type:              "static",
@@ -640,7 +670,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostSet{
 					HostCatalogId:     hc.GetPublicId(),
 					Id:                hs.GetPublicId(),
-					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:              &wrappers.StringValue{Value: "updated"},
 					Description:       &wrappers.StringValue{Value: "default"},
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
@@ -665,7 +695,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.HostSet{
 					HostCatalogId:     hc.GetPublicId(),
 					Id:                hs.GetPublicId(),
-					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:              &wrappers.StringValue{Value: "default"},
 					Description:       &wrappers.StringValue{Value: "notignored"},
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
@@ -684,7 +714,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.HostSet{
 					Name:        &wrappers.StringValue{Value: "new"},
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Description: &wrappers.StringValue{Value: "desc"},
 				},
 			},
@@ -699,7 +729,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.HostSet{
 					Id:          "p_somethinge",
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        &wrappers.StringValue{Value: "new"},
 					Description: &wrappers.StringValue{Value: "new desc"},
 				},
@@ -757,14 +787,14 @@ func TestUpdate(t *testing.T) {
 
 			// Test some bad versions
 			req.Item.Version = version + 2
-			_, gErr := tested.UpdateHostSet(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			_, gErr := tested.UpdateHostSet(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.Error(gErr)
 			req.Item.Version = version - 1
-			_, gErr = tested.UpdateHostSet(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			_, gErr = tested.UpdateHostSet(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.Error(gErr)
 			req.Item.Version = version
 
-			got, gErr := tested.UpdateHostSet(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, gErr := tested.UpdateHostSet(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateHostSet(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -798,7 +828,12 @@ func TestAddHostSetHosts(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -850,7 +885,7 @@ func TestAddHostSetHosts(t *testing.T) {
 				HostIds: tc.addHosts,
 			}
 
-			got, err := s.AddHostSetHosts(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, err := s.AddHostSetHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			s, ok := status.FromError(err)
 			require.True(t, ok)
 			require.NoError(t, err, "Got error: %v", s)
@@ -896,7 +931,7 @@ func TestAddHostSetHosts(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.AddHostSetHosts(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			_, gErr := s.AddHostSetHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "AddHostSetHosts(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -910,7 +945,12 @@ func TestSetHostSetHosts(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -969,7 +1009,7 @@ func TestSetHostSetHosts(t *testing.T) {
 				HostIds: tc.setHosts,
 			}
 
-			got, err := s.SetHostSetHosts(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, err := s.SetHostSetHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.NoError(t, err, "Got error: %v", s)
 			assert.ElementsMatch(t, tc.resultHosts, got.GetItem().GetHostIds())
 		})
@@ -1004,7 +1044,7 @@ func TestSetHostSetHosts(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.SetHostSetHosts(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			_, gErr := s.SetHostSetHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "SetHostSetHosts(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1018,7 +1058,12 @@ func TestRemoveHostSetHosts(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -1079,7 +1124,7 @@ func TestRemoveHostSetHosts(t *testing.T) {
 				HostIds: tc.removeHosts,
 			}
 
-			got, err := s.RemoveHostSetHosts(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, err := s.RemoveHostSetHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.wantErr {
 				assert.Error(t, err)
 				return
@@ -1130,7 +1175,7 @@ func TestRemoveHostSetHosts(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.RemoveHostSetHosts(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			_, gErr := s.RemoveHostSetHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "RemoveHostSetHosts(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)

internal/servers/controller/handlers/hosts/host_service_test.go

@@ -37,7 +37,12 @@ func TestGet(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -51,7 +56,7 @@ func TestGet(t *testing.T) {
 		Id:            h.GetPublicId(),
 		CreatedTime:   h.CreateTime.GetTimestamp(),
 		UpdatedTime:   h.UpdateTime.GetTimestamp(),
-		Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+		Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 		Type:          "static",
 		Attributes: &structpb.Struct{Fields: map[string]*structpb.Value{
 			"address": structpb.NewStringValue(h.GetAddress()),
@@ -95,7 +100,7 @@ func TestGet(t *testing.T) {
 			s, err := hosts.NewService(repoFn)
 			require.NoError(err, "Couldn't create a new host set service.")
 
-			got, gErr := s.GetHost(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			got, gErr := s.GetHost(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetHost(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -114,7 +119,12 @@ func TestList(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -128,7 +138,7 @@ func TestList(t *testing.T) {
 		wantHs = append(wantHs, &pb.Host{
 			Id:            h.GetPublicId(),
 			HostCatalogId: h.GetCatalogId(),
-			Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+			Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 			CreatedTime:   h.GetCreateTime().GetTimestamp(),
 			UpdatedTime:   h.GetUpdateTime().GetTimestamp(),
 			Version:       h.GetVersion(),
@@ -177,7 +187,7 @@ func TestList(t *testing.T) {
 			s, err := hosts.NewService(repoFn)
 			require.NoError(err, "Couldn't create new host set service.")
 
-			got, gErr := s.ListHosts(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			got, gErr := s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListHosts(%q) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -195,7 +205,12 @@ func TestDelete(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -242,7 +257,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteHost(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.DeleteHost(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteHost(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -259,7 +274,12 @@ func TestDelete_twice(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -273,7 +293,7 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteHostRequest{
 		Id: h.GetPublicId(),
 	}
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId()))
+	ctx := auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId())
 	_, gErr := s.DeleteHost(ctx, req)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteHost(ctx, req)
@@ -287,7 +307,12 @@ func TestCreate(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -319,7 +344,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("hosts/%s_", static.HostPrefix),
 				Item: &pb.Host{
 					HostCatalogId: hc.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:          &wrappers.StringValue{Value: "name"},
 					Description:   &wrappers.StringValue{Value: "desc"},
 					Type:          "static",
@@ -378,7 +403,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("hosts/%s_", static.HostPrefix),
 				Item: &pb.Host{
 					HostCatalogId: hc.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:          &wrappers.StringValue{Value: "no type name"},
 					Description:   &wrappers.StringValue{Value: "no type desc"},
 					Type:          "static",
@@ -422,7 +447,7 @@ func TestCreate(t *testing.T) {
 			s, err := hosts.NewService(repoFn)
 			require.NoError(err, "Failed to create a new host set service.")
 
-			got, gErr := s.CreateHost(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			got, gErr := s.CreateHost(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateHost(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -457,7 +482,12 @@ func TestUpdate(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*static.Repository, error) {
@@ -513,7 +543,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Host{
 					HostCatalogId: hc.GetPublicId(),
 					Id:            h.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:          &wrappers.StringValue{Value: "new"},
 					Description:   &wrappers.StringValue{Value: "desc"},
 					CreatedTime:   h.GetCreateTime().GetTimestamp(),
@@ -541,7 +571,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Host{
 					HostCatalogId: hc.GetPublicId(),
 					Id:            h.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:          &wrappers.StringValue{Value: "new"},
 					Description:   &wrappers.StringValue{Value: "desc"},
 					CreatedTime:   h.GetCreateTime().GetTimestamp(),
@@ -612,7 +642,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Host{
 					HostCatalogId: hc.GetPublicId(),
 					Id:            h.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Description:   &wrappers.StringValue{Value: "default"},
 					CreatedTime:   h.GetCreateTime().GetTimestamp(),
 					Type:          "static",
@@ -637,7 +667,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Host{
 					HostCatalogId: hc.GetPublicId(),
 					Id:            h.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:          &wrappers.StringValue{Value: "default"},
 					CreatedTime:   h.GetCreateTime().GetTimestamp(),
 					Type:          "static",
@@ -663,7 +693,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Host{
 					HostCatalogId: hc.GetPublicId(),
 					Id:            h.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:          &wrappers.StringValue{Value: "updated"},
 					Description:   &wrappers.StringValue{Value: "default"},
 					CreatedTime:   h.GetCreateTime().GetTimestamp(),
@@ -690,7 +720,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Host{
 					HostCatalogId: hc.GetPublicId(),
 					Id:            h.GetPublicId(),
-					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:          &wrappers.StringValue{Value: "default"},
 					Description:   &wrappers.StringValue{Value: "notignored"},
 					CreatedTime:   h.GetCreateTime().GetTimestamp(),
@@ -711,7 +741,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.Host{
 					Name:        &wrappers.StringValue{Value: "new"},
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Description: &wrappers.StringValue{Value: "desc"},
 				},
 			},
@@ -726,7 +756,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.Host{
 					Id:          "p_somethinge",
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        &wrappers.StringValue{Value: "new"},
 					Description: &wrappers.StringValue{Value: "new desc"},
 				},
@@ -816,14 +846,14 @@ func TestUpdate(t *testing.T) {
 
 			// Test some bad versions
 			req.Item.Version = version + 2
-			_, gErr := tested.UpdateHost(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			_, gErr := tested.UpdateHost(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.Error(gErr)
 			req.Item.Version = version - 1
-			_, gErr = tested.UpdateHost(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			_, gErr = tested.UpdateHost(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.Error(gErr)
 			req.Item.Version = version
 
-			got, gErr := tested.UpdateHost(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, gErr := tested.UpdateHost(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateHost(%+v) got error %v, wanted %v", req, gErr, tc.err)

internal/servers/controller/handlers/roles/role_service_test.go

@@ -71,7 +71,7 @@ func equalPrincipals(role *pb.Role, principals []string) bool {
 
 func TestGet(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
-	or, pr, repo := createDefaultRolesAndRepo(t)
+	or, pr, repoFn := createDefaultRolesAndRepo(t)
 	toMerge := &pbs.GetRoleRequest{
 		Id: or.GetPublicId(),
 	}
@@ -79,7 +79,7 @@ func TestGet(t *testing.T) {
 	wantOrgRole := &pb.Role{
 		Id:                or.GetPublicId(),
 		ScopeId:           or.GetScopeId(),
-		Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+		Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Name:              &wrapperspb.StringValue{Value: or.GetName()},
 		Description:       &wrapperspb.StringValue{Value: or.GetDescription()},
 		GrantScopeId:      &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
@@ -92,7 +92,7 @@ func TestGet(t *testing.T) {
 	wantProjRole := &pb.Role{
 		Id:                pr.GetPublicId(),
 		ScopeId:           pr.GetScopeId(),
-		Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
+		Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String(), ParentScopeId: or.GetScopeId()},
 		Name:              &wrapperspb.StringValue{Value: pr.GetName()},
 		Description:       &wrapperspb.StringValue{Value: pr.GetDescription()},
 		GrantScopeId:      &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
@@ -166,10 +166,10 @@ func TestGet(t *testing.T) {
 			req := proto.Clone(toMerge).(*pbs.GetRoleRequest)
 			proto.Merge(req, tc.req)
 
-			s, err := roles.NewService(repo)
+			s, err := roles.NewService(repoFn)
 			require.NoError(err, "Couldn't create new role service.")
 
-			got, gErr := s.GetRole(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			got, gErr := s.GetRole(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetRole(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -196,7 +196,7 @@ func TestList(t *testing.T) {
 		wantOrgRoles = append(wantOrgRoles, &pb.Role{
 			Id:                or.GetPublicId(),
 			ScopeId:           or.GetScopeId(),
-			Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+			Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			CreatedTime:       or.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       or.GetUpdateTime().GetTimestamp(),
 			GrantScopeId:      &wrapperspb.StringValue{Value: or.GetGrantScopeId()},
@@ -208,7 +208,7 @@ func TestList(t *testing.T) {
 		wantProjRoles = append(wantProjRoles, &pb.Role{
 			Id:                pr.GetPublicId(),
 			ScopeId:           pr.GetScopeId(),
-			Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
+			Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String(), ParentScopeId: oNoRoles.GetPublicId()},
 			CreatedTime:       pr.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       pr.GetUpdateTime().GetTimestamp(),
 			GrantScopeId:      &wrapperspb.StringValue{Value: pr.GetGrantScopeId()},
@@ -292,7 +292,7 @@ func TestList(t *testing.T) {
 			s, err := roles.NewService(repoFn)
 			require.NoError(err, "Couldn't create new role service.")
 
-			got, gErr := s.ListRoles(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetScopeId())), tc.req)
+			got, gErr := s.ListRoles(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err))
@@ -305,9 +305,9 @@ func TestList(t *testing.T) {
 }
 
 func TestDelete(t *testing.T) {
-	or, pr, repo := createDefaultRolesAndRepo(t)
+	or, pr, repoFn := createDefaultRolesAndRepo(t)
 
-	s, err := roles.NewService(repo)
+	s, err := roles.NewService(repoFn)
 	require.NoError(t, err, "Error when getting new role service.")
 
 	cases := []struct {
@@ -319,7 +319,7 @@ func TestDelete(t *testing.T) {
 	}{
 		{
 			name:    "Delete an Existing Role",
-			scopeId: or.GetPublicId(),
+			scopeId: or.GetScopeId(),
 			req: &pbs.DeleteRoleRequest{
 				Id: or.GetPublicId(),
 			},
@@ -327,7 +327,7 @@ func TestDelete(t *testing.T) {
 		},
 		{
 			name:    "Delete bad role id",
-			scopeId: or.GetPublicId(),
+			scopeId: or.GetScopeId(),
 			req: &pbs.DeleteRoleRequest{
 				Id: iam.RolePrefix + "_doesntexis",
 			},
@@ -335,7 +335,7 @@ func TestDelete(t *testing.T) {
 		},
 		{
 			name:    "Bad Role Id formatting",
-			scopeId: or.GetPublicId(),
+			scopeId: or.GetScopeId(),
 			req: &pbs.DeleteRoleRequest{
 				Id: "bad_format",
 			},
@@ -343,7 +343,7 @@ func TestDelete(t *testing.T) {
 		},
 		{
 			name:    "Project Scoped Delete an Existing Role",
-			scopeId: pr.GetPublicId(),
+			scopeId: pr.GetScopeId(),
 			req: &pbs.DeleteRoleRequest{
 				Id: pr.GetPublicId(),
 			},
@@ -351,7 +351,7 @@ func TestDelete(t *testing.T) {
 		},
 		{
 			name:    "Project Scoped Delete bad Role id",
-			scopeId: pr.GetPublicId(),
+			scopeId: pr.GetScopeId(),
 			req: &pbs.DeleteRoleRequest{
 				Id: iam.RolePrefix + "_doesntexis",
 			},
@@ -361,7 +361,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteRole(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.DeleteRole(auth.DisabledAuthTestContext(repoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.NotNil(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteRole(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -373,14 +373,14 @@ func TestDelete(t *testing.T) {
 
 func TestDelete_twice(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
-	or, pr, repo := createDefaultRolesAndRepo(t)
+	or, pr, repoFn := createDefaultRolesAndRepo(t)
 
-	s, err := roles.NewService(repo)
+	s, err := roles.NewService(repoFn)
 	require.NoError(err, "Error when getting new role service")
 	req := &pbs.DeleteRoleRequest{
 		Id: or.GetPublicId(),
 	}
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId(or.GetPublicId()))
+	ctx := auth.DisabledAuthTestContext(repoFn, or.GetScopeId())
 	_, gErr := s.DeleteRole(ctx, req)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteRole(ctx, req)
@@ -390,7 +390,7 @@ func TestDelete_twice(t *testing.T) {
 	projReq := &pbs.DeleteRoleRequest{
 		Id: pr.GetPublicId(),
 	}
-	ctx = auth.DisabledAuthTestContext(auth.WithScopeId(pr.GetPublicId()))
+	ctx = auth.DisabledAuthTestContext(repoFn, pr.GetScopeId())
 	_, gErr = s.DeleteRole(ctx, projReq)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteRole(ctx, projReq)
@@ -399,7 +399,7 @@ func TestDelete_twice(t *testing.T) {
 }
 
 func TestCreate(t *testing.T) {
-	defaultOrgRole, defaultProjRole, repo := createDefaultRolesAndRepo(t)
+	defaultOrgRole, defaultProjRole, repoFn := createDefaultRolesAndRepo(t)
 	defaultCreated, err := ptypes.Timestamp(defaultOrgRole.GetCreateTime().GetTimestamp())
 	require.NoError(t, err, "Error converting proto to timestamp.")
 	toMerge := &pbs.CreateRoleRequest{}
@@ -422,7 +422,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("roles/%s_", iam.RolePrefix),
 				Item: &pb.Role{
 					ScopeId:           defaultOrgRole.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: defaultOrgRole.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: defaultOrgRole.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					GrantScopeId:      &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
@@ -443,7 +443,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("roles/%s_", iam.RolePrefix),
 				Item: &pb.Role{
 					ScopeId:           scope.Global.String(),
-					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					GrantScopeId:      &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
@@ -465,7 +465,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("roles/%s_", iam.RolePrefix),
 				Item: &pb.Role{
 					ScopeId:           defaultProjRole.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: defaultProjRole.GetScopeId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: defaultProjRole.GetScopeId(), Type: scope.Project.String(), ParentScopeId: defaultOrgRole.GetScopeId()},
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					GrantScopeId:      &wrapperspb.StringValue{Value: defaultProjRole.ScopeId},
@@ -521,10 +521,10 @@ func TestCreate(t *testing.T) {
 			req := proto.Clone(toMerge).(*pbs.CreateRoleRequest)
 			proto.Merge(req, tc.req)
 
-			s, err := roles.NewService(repo)
+			s, err := roles.NewService(repoFn)
 			require.NoError(err, "Error when getting new role service.")
 
-			got, gErr := s.CreateRole(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetItem().GetScopeId())), req)
+			got, gErr := s.CreateRole(auth.DisabledAuthTestContext(repoFn, tc.req.GetItem().GetScopeId()), req)
 			if tc.err != nil {
 				require.NotNil(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateRole(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -640,7 +640,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Role{
 					Id:                or.GetPublicId(),
 					ScopeId:           or.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:       or.GetCreateTime().GetTimestamp(),
@@ -669,7 +669,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Role{
 					Id:                or.GetPublicId(),
 					ScopeId:           or.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:       or.GetCreateTime().GetTimestamp(),
@@ -699,7 +699,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Role{
 					Id:                pr.GetPublicId(),
 					ScopeId:           pr.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String(), ParentScopeId: or.GetScopeId()},
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:       pr.GetCreateTime().GetTimestamp(),
@@ -729,7 +729,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Role{
 					Id:                pr.GetPublicId(),
 					ScopeId:           pr.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String()},
+					Scope:             &scopes.ScopeInfo{Id: pr.GetScopeId(), Type: scope.Project.String(), ParentScopeId: or.GetScopeId()},
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:       pr.GetCreateTime().GetTimestamp(),
@@ -791,7 +791,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Role{
 					Id:                or.GetPublicId(),
 					ScopeId:           or.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Description:       &wrapperspb.StringValue{Value: "default"},
 					CreatedTime:       or.GetCreateTime().GetTimestamp(),
 					GrantScopeId:      &wrapperspb.StringValue{Value: or.GetScopeId()},
@@ -819,7 +819,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Role{
 					Id:                or.GetPublicId(),
 					ScopeId:           or.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "updated"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
 					CreatedTime:       or.GetCreateTime().GetTimestamp(),
@@ -848,7 +848,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Role{
 					Id:                or.GetPublicId(),
 					ScopeId:           or.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: or.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "notignored"},
 					CreatedTime:       or.GetCreateTime().GetTimestamp(),
@@ -957,14 +957,14 @@ func TestUpdate(t *testing.T) {
 
 			// Test with bad version (too high, too low)
 			req.Item.Version = ver + 2
-			_, gErr := tested.UpdateRole(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			_, gErr := tested.UpdateRole(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			require.Error(gErr)
 			req.Item.Version = ver - 1
-			_, gErr = tested.UpdateRole(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			_, gErr = tested.UpdateRole(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			require.Error(gErr)
 			req.Item.Version = ver
 
-			got, gErr := tested.UpdateRole(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			got, gErr := tested.UpdateRole(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateRole(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -1086,7 +1086,7 @@ func TestAddPrincipal(t *testing.T) {
 					PrincipalIds: append(tc.addUsers, tc.addGroups...),
 				}
 
-				got, err := s.AddRolePrincipals(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+				got, err := s.AddRolePrincipals(auth.DisabledAuthTestContext(repoFn, o.GetPublicId()), req)
 				if tc.wantErr {
 					assert.Error(t, err)
 					return
@@ -1137,7 +1137,7 @@ func TestAddPrincipal(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.AddRolePrincipals(auth.DisabledAuthTestContext(auth.WithScopeId(p.GetPublicId())), tc.req)
+			_, gErr := s.AddRolePrincipals(auth.DisabledAuthTestContext(repoFn, p.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "AddRolePrincipals(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1241,7 +1241,7 @@ func TestSetPrincipal(t *testing.T) {
 					PrincipalIds: append(tc.setUsers, tc.setGroups...),
 				}
 
-				got, err := s.SetRolePrincipals(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+				got, err := s.SetRolePrincipals(auth.DisabledAuthTestContext(repoFn, o.GetPublicId()), req)
 				if tc.wantErr {
 					assert.Error(t, err)
 					return
@@ -1292,7 +1292,7 @@ func TestSetPrincipal(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.SetRolePrincipals(auth.DisabledAuthTestContext(auth.WithScopeId(p.GetPublicId())), tc.req)
+			_, gErr := s.SetRolePrincipals(auth.DisabledAuthTestContext(repoFn, p.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "SetRolePrincipals(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1418,7 +1418,7 @@ func TestRemovePrincipal(t *testing.T) {
 					PrincipalIds: append(tc.removeUsers, tc.removeGroups...),
 				}
 
-				got, err := s.RemoveRolePrincipals(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+				got, err := s.RemoveRolePrincipals(auth.DisabledAuthTestContext(repoFn, o.GetPublicId()), req)
 				if tc.wantErr {
 					assert.Error(t, err)
 					return
@@ -1469,7 +1469,7 @@ func TestRemovePrincipal(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.RemoveRolePrincipals(auth.DisabledAuthTestContext(auth.WithScopeId(p.GetPublicId())), tc.req)
+			_, gErr := s.RemoveRolePrincipals(auth.DisabledAuthTestContext(repoFn, p.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "AddRolePrincipals(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1557,7 +1557,7 @@ func TestAddGrants(t *testing.T) {
 					scopeId = p.GetPublicId()
 				}
 				req.GrantStrings = tc.add
-				got, err := s.AddRoleGrants(auth.DisabledAuthTestContext(auth.WithScopeId(scopeId)), req)
+				got, err := s.AddRoleGrants(auth.DisabledAuthTestContext(repoFn, scopeId), req)
 				if tc.wantErr {
 					assert.Error(err)
 					return
@@ -1615,7 +1615,7 @@ func TestAddGrants(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.AddRoleGrants(auth.DisabledAuthTestContext(auth.WithScopeId(p.GetPublicId())), tc.req)
+			_, gErr := s.AddRoleGrants(auth.DisabledAuthTestContext(repoFn, p.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "AddRoleGrants(%+v) got error %#v, wanted %#v", tc.req, gErr, tc.err)
@@ -1691,7 +1691,7 @@ func TestSetGrants(t *testing.T) {
 					scopeId = p.GetPublicId()
 				}
 				req.GrantStrings = tc.set
-				got, err := s.SetRoleGrants(auth.DisabledAuthTestContext(auth.WithScopeId(scopeId)), req)
+				got, err := s.SetRoleGrants(auth.DisabledAuthTestContext(repoFn, scopeId), req)
 				if tc.wantErr {
 					assert.Error(err)
 					return
@@ -1741,7 +1741,7 @@ func TestSetGrants(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.SetRoleGrants(auth.DisabledAuthTestContext(auth.WithScopeId(p.GetPublicId())), tc.req)
+			_, gErr := s.SetRoleGrants(auth.DisabledAuthTestContext(repoFn, p.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "SetRoleGrants(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1816,7 +1816,7 @@ func TestRemoveGrants(t *testing.T) {
 					scopeId = p.GetPublicId()
 				}
 				req.GrantStrings = tc.remove
-				got, err := s.RemoveRoleGrants(auth.DisabledAuthTestContext(auth.WithScopeId(scopeId)), req)
+				got, err := s.RemoveRoleGrants(auth.DisabledAuthTestContext(repoFn, scopeId), req)
 				if tc.wantErr {
 					assert.Error(err)
 					return
@@ -1877,7 +1877,7 @@ func TestRemoveGrants(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.RemoveRoleGrants(auth.DisabledAuthTestContext(auth.WithScopeId(p.GetPublicId())), tc.req)
+			_, gErr := s.RemoveRoleGrants(auth.DisabledAuthTestContext(repoFn, p.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "RemoveRoleGrants(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)

internal/servers/controller/handlers/scopes/scope_service_test.go

@@ -40,8 +40,8 @@ func createDefaultScopesAndRepo(t *testing.T) (*iam.Scope, *iam.Scope, func() (*
 
 	oRes, pRes := iam.TestScopes(t, iamRepo)
 
-	oRes.Name = "defaultProj"
-	oRes.Description = "defaultProj"
+	oRes.Name = "defaultOrg"
+	oRes.Description = "defaultOrg"
 	repo, err := repoFn()
 	require.NoError(t, err)
 	oRes, _, err = repo.UpdateScope(context.Background(), oRes, 1, []string{"Name", "Description"})
@@ -127,7 +127,7 @@ var projectAuthorizedCollectionActions = map[string]*structpb.ListValue{
 }
 
 func TestGet(t *testing.T) {
-	org, proj, repo := createDefaultScopesAndRepo(t)
+	org, proj, repoFn := createDefaultScopesAndRepo(t)
 	toMerge := &pbs.GetScopeRequest{
 		Id: proj.GetPublicId(),
 	}
@@ -135,7 +135,7 @@ func TestGet(t *testing.T) {
 	oScope := &pb.Scope{
 		Id:                          org.GetPublicId(),
 		ScopeId:                     org.GetParentId(),
-		Scope:                       &pb.ScopeInfo{Id: "global", Type: scope.Global.String()},
+		Scope:                       &pb.ScopeInfo{Id: "global", Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 		Name:                        &wrapperspb.StringValue{Value: org.GetName()},
 		Description:                 &wrapperspb.StringValue{Value: org.GetDescription()},
 		CreatedTime:                 org.CreateTime.GetTimestamp(),
@@ -149,7 +149,7 @@ func TestGet(t *testing.T) {
 	pScope := &pb.Scope{
 		Id:                          proj.GetPublicId(),
 		ScopeId:                     proj.GetParentId(),
-		Scope:                       &pb.ScopeInfo{Id: oScope.Id, Type: scope.Org.String()},
+		Scope:                       &pb.ScopeInfo{Id: oScope.Id, Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 		Name:                        &wrapperspb.StringValue{Value: proj.GetName()},
 		Description:                 &wrapperspb.StringValue{Value: proj.GetDescription()},
 		CreatedTime:                 proj.CreateTime.GetTimestamp(),
@@ -215,10 +215,10 @@ func TestGet(t *testing.T) {
 			req := proto.Clone(toMerge).(*pbs.GetScopeRequest)
 			proto.Merge(req, tc.req)
 
-			s, err := scopes.NewService(repo)
+			s, err := scopes.NewService(repoFn)
 			require.NoError(err, "Couldn't create new project service.")
 
-			got, gErr := s.GetScope(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			got, gErr := s.GetScope(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetScope(%+v) got error\n%v, wanted\n%v", req, gErr, tc.err)
@@ -246,7 +246,7 @@ func TestList(t *testing.T) {
 	require.NoError(t, err)
 
 	var initialOrgs []*pb.Scope
-	globalScope := &pb.ScopeInfo{Id: "global", Type: scope.Global.String()}
+	globalScope := &pb.ScopeInfo{Id: "global", Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"}
 	oNoProjectsProto := scopes.ToProto(oNoProjects)
 	oNoProjectsProto.Scope = globalScope
 	oNoProjectsProto.AuthorizedActions = []string{"read", "update", "delete"}
@@ -296,7 +296,7 @@ func TestList(t *testing.T) {
 			s, err := scopes.NewService(repoFn)
 			require.NoError(err, "Couldn't create new role service.")
 
-			got, gErr := s.ListScopes(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListScopes(%+v) got error\n%v, wanted\n%v", tc.req, gErr, tc.err)
@@ -335,7 +335,7 @@ func TestList(t *testing.T) {
 		wantProjects = append(wantProjects, &pb.Scope{
 			Id:                          p.GetPublicId(),
 			ScopeId:                     oWithProjects.GetPublicId(),
-			Scope:                       &pb.ScopeInfo{Id: oWithProjects.GetPublicId(), Type: scope.Org.String()},
+			Scope:                       &pb.ScopeInfo{Id: oWithProjects.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			CreatedTime:                 p.GetCreateTime().GetTimestamp(),
 			UpdatedTime:                 p.GetUpdateTime().GetTimestamp(),
 			Version:                     1,
@@ -398,7 +398,7 @@ func TestList(t *testing.T) {
 			s, err := scopes.NewService(repoFn)
 			require.NoError(err, "Couldn't create new role service.")
 
-			got, gErr := s.ListScopes(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListScopes(%+v) got error\n%v, wanted\n%v", tc.req, gErr, tc.err)
@@ -409,9 +409,9 @@ func TestList(t *testing.T) {
 }
 
 func TestDelete(t *testing.T) {
-	org, proj, repo := createDefaultScopesAndRepo(t)
+	org, proj, repoFn := createDefaultScopesAndRepo(t)
 
-	s, err := scopes.NewService(repo)
+	s, err := scopes.NewService(repoFn)
 	require.NoError(t, err, "Error when getting new project service.")
 
 	cases := []struct {
@@ -473,7 +473,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteScope(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.DeleteScope(auth.DisabledAuthTestContext(repoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteScope(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -485,11 +485,11 @@ func TestDelete(t *testing.T) {
 
 func TestDelete_twice(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
-	org, proj, repo := createDefaultScopesAndRepo(t)
+	org, proj, repoFn := createDefaultScopesAndRepo(t)
 
-	s, err := scopes.NewService(repo)
+	s, err := scopes.NewService(repoFn)
 	require.NoError(err, "Error when getting new scopes service")
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId(org.GetPublicId()))
+	ctx := auth.DisabledAuthTestContext(repoFn, org.GetPublicId())
 	req := &pbs.DeleteScopeRequest{
 		Id: proj.GetPublicId(),
 	}
@@ -499,7 +499,7 @@ func TestDelete_twice(t *testing.T) {
 	assert.Error(gErr, "Second attempt")
 	assert.True(errors.Is(gErr, handlers.ApiErrorWithCode(codes.NotFound)), "Expected not found for the second delete.")
 
-	ctx = auth.DisabledAuthTestContext(auth.WithScopeId(scope.Global.String()))
+	ctx = auth.DisabledAuthTestContext(repoFn, scope.Global.String())
 	req = &pbs.DeleteScopeRequest{
 		Id: org.GetPublicId(),
 	}
@@ -549,7 +549,7 @@ func TestCreate(t *testing.T) {
 				Uri: "scopes/p_",
 				Item: &pb.Scope{
 					ScopeId:                     defaultOrg.GetPublicId(),
-					Scope:                       &pb.ScopeInfo{Id: defaultOrg.GetPublicId(), Type: scope.Org.String()},
+					Scope:                       &pb.ScopeInfo{Id: defaultOrg.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Name:                        &wrapperspb.StringValue{Value: "name"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
 					Version:                     1,
@@ -573,7 +573,7 @@ func TestCreate(t *testing.T) {
 				Uri: "scopes/o_",
 				Item: &pb.Scope{
 					ScopeId:                     scope.Global.String(),
-					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Name:                        &wrapperspb.StringValue{Value: "name"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
 					Version:                     1,
@@ -597,7 +597,7 @@ func TestCreate(t *testing.T) {
 				Uri: "scopes/p_",
 				Item: &pb.Scope{
 					ScopeId:                     defaultOrg.GetPublicId(),
-					Scope:                       &pb.ScopeInfo{Id: defaultOrg.GetPublicId(), Type: scope.Org.String()},
+					Scope:                       &pb.ScopeInfo{Id: defaultOrg.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
 					Version:                     1,
 					Type:                        scope.Project.String(),
@@ -620,7 +620,7 @@ func TestCreate(t *testing.T) {
 				Uri: "scopes/o_",
 				Item: &pb.Scope{
 					ScopeId:                     scope.Global.String(),
-					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
 					Version:                     1,
 					Type:                        scope.Org.String(),
@@ -712,7 +712,7 @@ func TestCreate(t *testing.T) {
 					}
 					assert.NotEmpty(userId)
 				}
-				got, gErr := s.CreateScope(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId), auth.WithUserId(userId)), req)
+				got, gErr := s.CreateScope(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(userId)), req)
 				if tc.err != nil {
 					require.Error(gErr)
 					assert.True(errors.Is(gErr, tc.err), "CreateScope(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -831,7 +831,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Scope{
 					Id:                          proj.GetPublicId(),
 					ScopeId:                     org.GetPublicId(),
-					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Name:                        &wrapperspb.StringValue{Value: "new"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
@@ -858,7 +858,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Scope{
 					Id:                          org.GetPublicId(),
 					ScopeId:                     scope.Global.String(),
-					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Scope:                       &pb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Name:                        &wrapperspb.StringValue{Value: "new"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:                 org.GetCreateTime().GetTimestamp(),
@@ -884,7 +884,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Scope{
 					Id:                          proj.GetPublicId(),
 					ScopeId:                     org.GetPublicId(),
-					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Name:                        &wrapperspb.StringValue{Value: "new"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
@@ -958,7 +958,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Scope{
 					Id:                          proj.GetPublicId(),
 					ScopeId:                     org.GetPublicId(),
-					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Description:                 &wrapperspb.StringValue{Value: "defaultProj"},
 					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
 					Type:                        scope.Project.String(),
@@ -982,7 +982,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Scope{
 					Id:                          proj.GetPublicId(),
 					ScopeId:                     org.GetPublicId(),
-					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Name:                        &wrappers.StringValue{Value: "defaultProj"},
 					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
 					Type:                        scope.Project.String(),
@@ -1007,7 +1007,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Scope{
 					Id:                          proj.GetPublicId(),
 					ScopeId:                     org.GetPublicId(),
-					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Name:                        &wrapperspb.StringValue{Value: "updated"},
 					Description:                 &wrapperspb.StringValue{Value: "defaultProj"},
 					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
@@ -1033,7 +1033,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Scope{
 					Id:                          proj.GetPublicId(),
 					ScopeId:                     org.GetPublicId(),
-					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Scope:                       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Name:                        &wrapperspb.StringValue{Value: "defaultProj"},
 					Description:                 &wrapperspb.StringValue{Value: "notignored"},
 					CreatedTime:                 proj.GetCreateTime().GetTimestamp(),
@@ -1068,7 +1068,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.Scope{
 					Id:          "p_somethinge",
-					Scope:       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String()},
+					Scope:       &pb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String(), Name: "defaultOrg", Description: "defaultOrg"},
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "new desc"},
 				},
@@ -1131,7 +1131,7 @@ func TestUpdate(t *testing.T) {
 			}
 			proto.Merge(req, tc.req)
 
-			got, gErr := tested.UpdateScope(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), req)
+			got, gErr := tested.UpdateScope(auth.DisabledAuthTestContext(repoFn, tc.scopeId), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateScope(%+v) got error\n%v, wanted\n%v", req, gErr, tc.err)

internal/servers/controller/handlers/sessions/session_service_test.go

@@ -82,7 +82,7 @@ func TestGetSession(t *testing.T) {
 		UpdatedTime:       sess.UpdateTime.GetTimestamp(),
 		CreatedTime:       sess.CreateTime.GetTimestamp(),
 		ExpirationTime:    sess.ExpirationTime.GetTimestamp(),
-		Scope:             &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String()},
+		Scope:             &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 		States:            []*pb.SessionState{{Status: session.StatusPending.String(), StartTime: sess.CreateTime.GetTimestamp()}},
 		Certificate:       sess.Certificate,
 		Type:              target.TcpSubType.String(),
@@ -128,7 +128,7 @@ func TestGetSession(t *testing.T) {
 			s, err := sessions.NewService(sessRepoFn, iamRepoFn)
 			require.NoError(err, "Couldn't create new session service.")
 
-			got, gErr := s.GetSession(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.GetSession(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetSession(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -294,7 +294,7 @@ func TestList(t *testing.T) {
 			UpdatedTime:       sess.UpdateTime.GetTimestamp(),
 			CreatedTime:       sess.CreateTime.GetTimestamp(),
 			ExpirationTime:    sess.ExpirationTime.GetTimestamp(),
-			Scope:             &scopes.ScopeInfo{Id: pWithSessions.GetPublicId(), Type: scope.Project.String()},
+			Scope:             &scopes.ScopeInfo{Id: pWithSessions.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 			Status:            status,
 			States:            states,
 			Certificate:       sess.Certificate,
@@ -329,7 +329,7 @@ func TestList(t *testing.T) {
 			UpdatedTime:       sess.UpdateTime.GetTimestamp(),
 			CreatedTime:       sess.CreateTime.GetTimestamp(),
 			ExpirationTime:    sess.ExpirationTime.GetTimestamp(),
-			Scope:             &scopes.ScopeInfo{Id: pWithOtherSessions.GetPublicId(), Type: scope.Project.String()},
+			Scope:             &scopes.ScopeInfo{Id: pWithOtherSessions.GetPublicId(), Type: scope.Project.String(), ParentScopeId: oOther.GetPublicId()},
 			Status:            status,
 			States:            states,
 			Certificate:       sess.Certificate,
@@ -388,7 +388,7 @@ func TestList(t *testing.T) {
 			s, err := sessions.NewService(sessRepoFn, iamRepoFn)
 			require.NoError(t, err, "Couldn't create new session service.")
 
-			got, gErr := s.ListSessions(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetScopeId())), tc.req)
+			got, gErr := s.ListSessions(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(t, gErr)
 				assert.True(t, errors.Is(gErr, tc.err), "ListSessions(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -473,7 +473,7 @@ func TestCancel(t *testing.T) {
 		Endpoint:          sess.Endpoint,
 		CreatedTime:       sess.CreateTime.GetTimestamp(),
 		ExpirationTime:    sess.ExpirationTime.GetTimestamp(),
-		Scope:             &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String()},
+		Scope:             &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 		Status:            session.StatusCanceling.String(),
 		Certificate:       sess.Certificate,
 		Type:              target.TcpSubType.String(),
@@ -523,7 +523,7 @@ func TestCancel(t *testing.T) {
 
 			tc.req.Version = version
 
-			got, gErr := s.CancelSession(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.CancelSession(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetSession(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)

internal/servers/controller/handlers/targets/target_service_test.go

@@ -62,7 +62,12 @@ func TestGet(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	o, proj := iam.TestScopes(t, iamRepo)
 
 	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
 	hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
@@ -75,7 +80,7 @@ func TestGet(t *testing.T) {
 		Name:                   wrapperspb.String("test"),
 		CreatedTime:            tar.CreateTime.GetTimestamp(),
 		UpdatedTime:            tar.UpdateTime.GetTimestamp(),
-		Scope:                  &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+		Scope:                  &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 		Type:                   target.TcpTargetType.String(),
 		HostSetIds:             []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
 		Attributes:             new(structpb.Struct),
@@ -124,7 +129,7 @@ func TestGet(t *testing.T) {
 			s, err := testService(t, conn, kms, wrapper)
 			require.NoError(err, "Couldn't create a new host set service.")
 
-			got, gErr := s.GetTarget(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			got, gErr := s.GetTarget(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetTarget(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -144,9 +149,13 @@ func TestList(t *testing.T) {
 	kms := kms.TestKms(t, conn, wrapper)
 
 	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
 	_, projNoTar := iam.TestScopes(t, iamRepo)
-	_, proj := iam.TestScopes(t, iamRepo)
-	_, otherProj := iam.TestScopes(t, iamRepo)
+	org, proj := iam.TestScopes(t, iamRepo)
+	otherOrg, otherProj := iam.TestScopes(t, iamRepo)
 	hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
 	otherHc := static.TestCatalogs(t, conn, otherProj.GetPublicId(), 1)[0]
 	hss := static.TestSets(t, conn, hc.GetPublicId(), 2)
@@ -161,7 +170,7 @@ func TestList(t *testing.T) {
 			Id:                     tar.GetPublicId(),
 			ScopeId:                proj.GetPublicId(),
 			Name:                   wrapperspb.String(name),
-			Scope:                  &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+			Scope:                  &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 			CreatedTime:            tar.GetCreateTime().GetTimestamp(),
 			UpdatedTime:            tar.GetUpdateTime().GetTimestamp(),
 			Version:                tar.GetVersion(),
@@ -177,7 +186,7 @@ func TestList(t *testing.T) {
 			Id:                     tar.GetPublicId(),
 			ScopeId:                otherProj.GetPublicId(),
 			Name:                   wrapperspb.String(name),
-			Scope:                  &scopes.ScopeInfo{Id: otherProj.GetPublicId(), Type: scope.Project.String()},
+			Scope:                  &scopes.ScopeInfo{Id: otherProj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: otherOrg.GetPublicId()},
 			CreatedTime:            tar.GetCreateTime().GetTimestamp(),
 			UpdatedTime:            tar.GetUpdateTime().GetTimestamp(),
 			Version:                tar.GetVersion(),
@@ -232,7 +241,7 @@ func TestList(t *testing.T) {
 			s, err := testService(t, conn, kms, wrapper)
 			require.NoError(err, "Couldn't create new host set service.")
 
-			got, gErr := s.ListTargets(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetScopeId())), tc.req)
+			got, gErr := s.ListTargets(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListTargets(%q) got error %v, wanted %v", tc.req.GetScopeId(), gErr, tc.err)
@@ -250,7 +259,12 @@ func TestDelete(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "test")
 
 	s, err := testService(t, conn, kms, wrapper)
@@ -291,7 +305,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteTarget(auth.DisabledAuthTestContext(auth.WithScopeId(tc.scopeId)), tc.req)
+			got, gErr := s.DeleteTarget(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteTarget(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -308,7 +322,12 @@ func TestDelete_twice(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	tar := target.TestTcpTarget(t, conn, proj.GetPublicId(), "test")
 
@@ -317,7 +336,7 @@ func TestDelete_twice(t *testing.T) {
 	req := &pbs.DeleteTargetRequest{
 		Id: tar.GetPublicId(),
 	}
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId()))
+	ctx := auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId())
 	_, gErr := s.DeleteTarget(ctx, req)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteTarget(ctx, req)
@@ -331,7 +350,12 @@ func TestCreate(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	cases := []struct {
 		name string
@@ -355,7 +379,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("targets/%s_", target.TcpTargetPrefix),
 				Item: &pb.Target{
 					ScopeId:     proj.GetPublicId(),
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("name"),
 					Description: wrapperspb.String("desc"),
 					Type:        target.TcpTargetType.String(),
@@ -438,7 +462,7 @@ func TestCreate(t *testing.T) {
 			s, err := testService(t, conn, kms, wrapper)
 			require.NoError(err, "Failed to create a new host set service.")
 
-			got, gErr := s.CreateTarget(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			got, gErr := s.CreateTarget(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateTarget(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -469,7 +493,12 @@ func TestUpdate(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	org, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*target.Repository, error) {
@@ -535,7 +564,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Target{
 					Id:          tar.GetPublicId(),
 					ScopeId:     tar.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("name"),
 					Description: wrapperspb.String("desc"),
 					Type:        target.TcpTargetType.String(),
@@ -567,7 +596,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Target{
 					Id:          tar.GetPublicId(),
 					ScopeId:     tar.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("name"),
 					Description: wrapperspb.String("desc"),
 					CreatedTime: tar.GetCreateTime().GetTimestamp(),
@@ -653,7 +682,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Target{
 					Id:          tar.GetPublicId(),
 					ScopeId:     tar.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("default"),
 					CreatedTime: tar.GetCreateTime().GetTimestamp(),
 					Type:        target.TcpTargetType.String(),
@@ -683,7 +712,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Target{
 					Id:          tar.GetPublicId(),
 					ScopeId:     tar.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("updated"),
 					Description: wrapperspb.String("default"),
 					CreatedTime: tar.GetCreateTime().GetTimestamp(),
@@ -714,7 +743,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Target{
 					Id:          tar.GetPublicId(),
 					ScopeId:     tar.GetScopeId(),
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("default"),
 					Description: wrapperspb.String("notignored"),
 					CreatedTime: tar.GetCreateTime().GetTimestamp(),
@@ -739,7 +768,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.Target{
 					Name:        wrapperspb.String("new"),
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Description: wrapperspb.String("desc"),
 				},
 			},
@@ -754,7 +783,7 @@ func TestUpdate(t *testing.T) {
 				},
 				Item: &pb.Target{
 					Id:          "p_somethinge",
-					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String()},
+					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("new"),
 					Description: wrapperspb.String("new desc"),
 				},
@@ -797,7 +826,7 @@ func TestUpdate(t *testing.T) {
 			req := proto.Clone(toMerge).(*pbs.UpdateTargetRequest)
 			proto.Merge(req, tc.req)
 
-			got, gErr := tested.UpdateTarget(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, gErr := tested.UpdateTarget(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "UpdateTarget(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -832,7 +861,12 @@ func TestUpdate_BadVersion(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	rw := db.New(conn)
 	repoFn := func() (*target.Repository, error) {
@@ -850,7 +884,7 @@ func TestUpdate_BadVersion(t *testing.T) {
 	tested, err := testService(t, conn, kms, wrapper)
 	require.NoError(t, err, "Failed to create a new host set service.")
 
-	upTar, err := tested.UpdateTarget(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), &pbs.UpdateTargetRequest{
+	upTar, err := tested.UpdateTarget(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), &pbs.UpdateTargetRequest{
 		Id: gtar.GetPublicId(),
 		Item: &pb.Target{
 			Description: wrapperspb.String("updated"),
@@ -868,7 +902,12 @@ func TestAddTargetHostSets(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	s, err := testService(t, conn, kms, wrapper)
 	require.NoError(t, err, "Error when getting new target service.")
@@ -910,7 +949,7 @@ func TestAddTargetHostSets(t *testing.T) {
 				HostSetIds: tc.addHostSets,
 			}
 
-			got, err := s.AddTargetHostSets(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, err := s.AddTargetHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			s, ok := status.FromError(err)
 			require.True(t, ok)
 			require.NoError(t, err, "Got error: %v", s)
@@ -965,7 +1004,7 @@ func TestAddTargetHostSets(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.AddTargetHostSets(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			_, gErr := s.AddTargetHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "AddTargetHostSets(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -979,7 +1018,12 @@ func TestSetTargetHostSets(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	s, err := testService(t, conn, kms, wrapper)
 	require.NoError(t, err, "Error when getting new host set service.")
@@ -1026,7 +1070,7 @@ func TestSetTargetHostSets(t *testing.T) {
 				HostSetIds: tc.setHostSets,
 			}
 
-			got, err := s.SetTargetHostSets(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, err := s.SetTargetHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.NoError(t, err, "Got error: %v", s)
 			assert.ElementsMatch(t, tc.resultHostSets, got.GetItem().GetHostSetIds())
 		})
@@ -1070,7 +1114,7 @@ func TestSetTargetHostSets(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.SetTargetHostSets(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			_, gErr := s.SetTargetHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "SetTargetHostSets(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -1084,7 +1128,12 @@ func TestRemoveTargetHostSets(t *testing.T) {
 	wrapper := db.TestWrapper(t)
 	kms := kms.TestKms(t, conn, wrapper)
 
-	_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	iamRepo := iam.TestRepo(t, conn, wrapper)
+	iamRepoFn := func() (*iam.Repository, error) {
+		return iamRepo, nil
+	}
+
+	_, proj := iam.TestScopes(t, iamRepo)
 
 	s, err := testService(t, conn, kms, wrapper)
 	require.NoError(t, err, "Error when getting new host set service.")
@@ -1133,7 +1182,7 @@ func TestRemoveTargetHostSets(t *testing.T) {
 				HostSetIds: tc.removeHosts,
 			}
 
-			got, err := s.RemoveTargetHostSets(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), req)
+			got, err := s.RemoveTargetHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			if tc.wantErr {
 				assert.Error(t, err)
 				return
@@ -1193,7 +1242,7 @@ func TestRemoveTargetHostSets(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.RemoveTargetHostSets(auth.DisabledAuthTestContext(auth.WithScopeId(proj.GetPublicId())), tc.req)
+			_, gErr := s.RemoveTargetHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "RemoveTargetHostSets(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)

internal/servers/controller/handlers/users/user_service_test.go

@@ -51,7 +51,7 @@ func TestGet(t *testing.T) {
 	wantU := &pb.User{
 		Id:                u.GetPublicId(),
 		ScopeId:           u.GetScopeId(),
-		Scope:             &scopes.ScopeInfo{Id: u.ScopeId, Type: scope.Org.String()},
+		Scope:             &scopes.ScopeInfo{Id: u.ScopeId, Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Name:              &wrapperspb.StringValue{Value: u.GetName()},
 		Description:       &wrapperspb.StringValue{Value: u.GetDescription()},
 		CreatedTime:       u.CreateTime.GetTimestamp(),
@@ -99,7 +99,7 @@ func TestGet(t *testing.T) {
 			s, err := users.NewService(repoFn)
 			require.NoError(err, "Couldn't create new user service.")
 
-			got, gErr := s.GetUser(auth.DisabledAuthTestContext(auth.WithScopeId(u.GetScopeId())), req)
+			got, gErr := s.GetUser(auth.DisabledAuthTestContext(repoFn, u.GetScopeId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "GetUser(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -128,7 +128,7 @@ func TestList(t *testing.T) {
 
 	// Populate expected values for recursive test
 	var totalUsers []*pb.User
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId("global"))
+	ctx := auth.DisabledAuthTestContext(repoFn, "global")
 	anon, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: "u_anon"})
 	require.NoError(t, err)
 	totalUsers = append(totalUsers, anon.GetItem())
@@ -148,7 +148,7 @@ func TestList(t *testing.T) {
 		wantUsers = append(wantUsers, &pb.User{
 			Id:                u.GetPublicId(),
 			ScopeId:           u.GetScopeId(),
-			Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+			Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			CreatedTime:       u.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       u.GetUpdateTime().GetTimestamp(),
 			Version:           1,
@@ -157,7 +157,7 @@ func TestList(t *testing.T) {
 	}
 
 	// Populate these users into the total
-	ctx = auth.DisabledAuthTestContext(auth.WithScopeId(oWithUsers.GetPublicId()))
+	ctx = auth.DisabledAuthTestContext(repoFn, oWithUsers.GetPublicId())
 	usersInOrg, err := s.ListUsers(ctx, &pbs.ListUsersRequest{ScopeId: oWithUsers.GetPublicId()})
 	require.NoError(t, err)
 	totalUsers = append(totalUsers, usersInOrg.GetItems()...)
@@ -208,7 +208,7 @@ func TestList(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 			require.NoError(err, "Couldn't create new user service.")
 
-			got, gErr := s.ListUsers(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetScopeId())), tc.req)
+			got, gErr := s.ListUsers(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListUsers(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -219,9 +219,9 @@ func TestList(t *testing.T) {
 }
 
 func TestDelete(t *testing.T) {
-	u, repo := createDefaultUserAndRepo(t)
+	u, repoFn := createDefaultUserAndRepo(t)
 
-	s, err := users.NewService(repo)
+	s, err := users.NewService(repoFn)
 	require.NoError(t, err, "Error when getting new user service.")
 
 	cases := []struct {
@@ -254,7 +254,7 @@ func TestDelete(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, gErr := s.DeleteUser(auth.DisabledAuthTestContext(auth.WithScopeId(u.GetScopeId())), tc.req)
+			got, gErr := s.DeleteUser(auth.DisabledAuthTestContext(repoFn, u.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "DeleteUser(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -266,14 +266,14 @@ func TestDelete(t *testing.T) {
 
 func TestDelete_twice(t *testing.T) {
 	assert, require := assert.New(t), require.New(t)
-	u, repo := createDefaultUserAndRepo(t)
+	u, repoFn := createDefaultUserAndRepo(t)
 
-	s, err := users.NewService(repo)
+	s, err := users.NewService(repoFn)
 	require.NoError(err, "Error when getting new user service")
 	req := &pbs.DeleteUserRequest{
 		Id: u.GetPublicId(),
 	}
-	ctx := auth.DisabledAuthTestContext(auth.WithScopeId(u.GetScopeId()))
+	ctx := auth.DisabledAuthTestContext(repoFn, u.GetScopeId())
 	_, gErr := s.DeleteUser(ctx, req)
 	assert.NoError(gErr, "First attempt")
 	_, gErr = s.DeleteUser(ctx, req)
@@ -282,7 +282,7 @@ func TestDelete_twice(t *testing.T) {
 }
 
 func TestCreate(t *testing.T) {
-	defaultUser, repo := createDefaultUserAndRepo(t)
+	defaultUser, repoFn := createDefaultUserAndRepo(t)
 	defaultCreated, err := ptypes.Timestamp(defaultUser.GetCreateTime().GetTimestamp())
 	require.NoError(t, err, "Error converting proto to timestamp.")
 
@@ -303,7 +303,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("users/%s_", iam.UserPrefix),
 				Item: &pb.User{
 					ScopeId:           defaultUser.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: defaultUser.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: defaultUser.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Version:           1,
@@ -322,7 +322,7 @@ func TestCreate(t *testing.T) {
 				Uri: fmt.Sprintf("users/%s_", iam.UserPrefix),
 				Item: &pb.User{
 					ScopeId:           scope.Global.String(),
-					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String()},
+					Scope:             &scopes.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Name:              &wrapperspb.StringValue{Value: "name"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Version:           1,
@@ -361,10 +361,10 @@ func TestCreate(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			s, err := users.NewService(repo)
+			s, err := users.NewService(repoFn)
 			require.NoError(err, "Error when getting new user service.")
 
-			got, gErr := s.CreateUser(auth.DisabledAuthTestContext(auth.WithScopeId(tc.req.GetItem().GetScopeId())), tc.req)
+			got, gErr := s.CreateUser(auth.DisabledAuthTestContext(repoFn, tc.req.GetItem().GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "CreateUser(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -433,7 +433,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.User{
 					Id:                u.GetPublicId(),
 					ScopeId:           u.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:       u.GetCreateTime().GetTimestamp(),
@@ -456,7 +456,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.User{
 					Id:                u.GetPublicId(),
 					ScopeId:           u.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					CreatedTime:       u.GetCreateTime().GetTimestamp(),
@@ -510,7 +510,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.User{
 					Id:                u.GetPublicId(),
 					ScopeId:           u.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Description:       &wrapperspb.StringValue{Value: "default"},
 					CreatedTime:       u.GetCreateTime().GetTimestamp(),
 					AuthorizedActions: []string{"read", "update", "delete", "add-accounts", "set-accounts", "remove-accounts"},
@@ -532,7 +532,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.User{
 					Id:                u.GetPublicId(),
 					ScopeId:           u.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "updated"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
 					CreatedTime:       u.GetCreateTime().GetTimestamp(),
@@ -555,7 +555,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.User{
 					Id:                u.GetPublicId(),
 					ScopeId:           u.GetScopeId(),
-					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String()},
+					Scope:             &scopes.ScopeInfo{Id: u.GetScopeId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "notignored"},
 					CreatedTime:       u.GetCreateTime().GetTimestamp(),
@@ -630,14 +630,14 @@ func TestUpdate(t *testing.T) {
 
 			// Test with bad version (too high, too low)
 			req.Item.Version = version + 2
-			_, gErr := tested.UpdateUser(auth.DisabledAuthTestContext(auth.WithScopeId(u.GetScopeId())), req)
+			_, gErr := tested.UpdateUser(auth.DisabledAuthTestContext(repoFn, u.GetScopeId()), req)
 			require.Error(gErr)
 			req.Item.Version = version - 1
-			_, gErr = tested.UpdateUser(auth.DisabledAuthTestContext(auth.WithScopeId(u.GetScopeId())), req)
+			_, gErr = tested.UpdateUser(auth.DisabledAuthTestContext(repoFn, u.GetScopeId()), req)
 			require.Error(gErr)
 			req.Item.Version = version
 
-			got, gErr := tested.UpdateUser(auth.DisabledAuthTestContext(auth.WithScopeId(u.GetScopeId())), req)
+			got, gErr := tested.UpdateUser(auth.DisabledAuthTestContext(repoFn, u.GetScopeId()), req)
 			if tc.err != nil {
 				require.Error(gErr)
 				require.True(errors.Is(gErr, tc.err), "UpdateUser(%+v) got error %v, wanted %v", req, gErr, tc.err)
@@ -737,7 +737,7 @@ func TestAddAccount(t *testing.T) {
 				AccountIds: tc.addAccounts,
 			}
 
-			got, err := s.AddUserAccounts(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+			got, err := s.AddUserAccounts(auth.DisabledAuthTestContext(repoFn, o.GetPublicId()), req)
 			if tc.wantErr {
 				assert.Error(t, err)
 				return
@@ -775,7 +775,7 @@ func TestAddAccount(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.AddUserAccounts(auth.DisabledAuthTestContext(auth.WithScopeId(usr.GetScopeId())), tc.req)
+			_, gErr := s.AddUserAccounts(auth.DisabledAuthTestContext(repoFn, usr.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "AddUserAccounts(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -860,7 +860,7 @@ func TestSetAccount(t *testing.T) {
 				AccountIds: tc.setAccounts,
 			}
 
-			got, err := s.SetUserAccounts(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+			got, err := s.SetUserAccounts(auth.DisabledAuthTestContext(repoFn, o.GetPublicId()), req)
 			if tc.wantErr {
 				assert.Error(t, err)
 				return
@@ -898,7 +898,7 @@ func TestSetAccount(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.SetUserAccounts(auth.DisabledAuthTestContext(auth.WithScopeId(usr.GetScopeId())), tc.req)
+			_, gErr := s.SetUserAccounts(auth.DisabledAuthTestContext(repoFn, usr.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "SetUserAccounts(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -992,7 +992,7 @@ func TestRemoveAccount(t *testing.T) {
 				AccountIds: tc.removeAccounts,
 			}
 
-			got, err := s.RemoveUserAccounts(auth.DisabledAuthTestContext(auth.WithScopeId(o.GetPublicId())), req)
+			got, err := s.RemoveUserAccounts(auth.DisabledAuthTestContext(repoFn, o.GetPublicId()), req)
 			if tc.wantErr {
 				assert.Error(t, err)
 				return
@@ -1031,7 +1031,7 @@ func TestRemoveAccount(t *testing.T) {
 	for _, tc := range failCases {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			_, gErr := s.RemoveUserAccounts(auth.DisabledAuthTestContext(auth.WithScopeId(usr.GetScopeId())), tc.req)
+			_, gErr := s.RemoveUserAccounts(auth.DisabledAuthTestContext(repoFn, usr.GetScopeId()), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "AddUserAccounts(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)