Shuffle things around out of new modules

internal/tests/api/accounts/account_test.go

@@ -0,0 +1,193 @@
+package accounts_test
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/accounts"
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestList(t *testing.T) {
+	os.Setenv("BOUNDARY_LOG_URLS", "1")
+	os.Setenv("BOUNDARY_DEV_SKIP_AUTHZ", "1")
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	require.NotNil(client)
+	token := tc.Token()
+	require.NotNil(token)
+	client.SetToken(token.Token)
+	org := iam.TestOrg(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	amClient := authmethods.NewClient(client)
+	amResult, err := amClient.Create(tc.Context(), "password", org.GetPublicId())
+	require.NoError(err)
+	require.NotNil(amResult)
+	am := amResult.Item
+
+	accountClient := accounts.NewClient(client)
+
+	lr, err := accountClient.List(tc.Context(), am.Id)
+	require.NoError(err)
+	expected := lr.Items
+	assert.Len(expected, 0)
+
+	expected = append(expected, &accounts.Account{Attributes: map[string]interface{}{"login_name": "loginname0"}})
+
+	cr, err := accountClient.Create(tc.Context(), am.Id, accounts.WithPasswordAccountLoginName(expected[0].Attributes["login_name"].(string)))
+	require.NoError(err)
+	expected[0] = cr.Item
+
+	ulResult, err := accountClient.List(tc.Context(), am.Id)
+	require.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected[:1]), comparableSlice(ulResult.Items))
+
+	for i := 1; i < 10; i++ {
+		newAcctResult, err := accountClient.Create(tc.Context(), am.Id, accounts.WithPasswordAccountLoginName(fmt.Sprintf("loginname%d", i)))
+		require.NoError(err)
+		expected = append(expected, newAcctResult.Item)
+	}
+	ulResult, err = accountClient.List(tc.Context(), am.Id)
+	require.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(ulResult.Items))
+}
+
+func comparableSlice(in []*accounts.Account) []accounts.Account {
+	var filtered []accounts.Account
+	for _, i := range in {
+		p := accounts.Account{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+			Attributes:  i.Attributes,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	amId := token.AuthMethodId
+	accountClient := accounts.NewClient(client)
+
+	checkAccount := func(step string, u *accounts.Account, err error, wantedName string, wantedVersion uint32) {
+		assert.NoError(err, step)
+		require.NotNil(u, "returned no resource", step)
+		gotName := ""
+		if u.Name != "" {
+			gotName = u.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, u.Version)
+	}
+
+	u, err := accountClient.Create(tc.Context(), amId, accounts.WithName("foo"), accounts.WithPasswordAccountLoginName("loginname"))
+	checkAccount("create", u.Item, err, "foo", 1)
+
+	u, err = accountClient.Read(tc.Context(), u.Item.Id)
+	checkAccount("read", u.Item, err, "foo", 1)
+
+	u, err = accountClient.Update(tc.Context(), u.Item.Id, u.Item.Version, accounts.WithName("bar"))
+	checkAccount("update", u.Item, err, "bar", 2)
+
+	u, err = accountClient.Update(tc.Context(), u.Item.Id, u.Item.Version, accounts.DefaultName())
+	checkAccount("update", u.Item, err, "", 3)
+
+	_, err = accountClient.Delete(tc.Context(), u.Item.Id)
+	require.NoError(err)
+}
+
+func TestCustomMethods(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	amId := token.AuthMethodId
+
+	accountClient := accounts.NewClient(client)
+
+	al, err := accountClient.List(tc.Context(), amId)
+	require.NoError(err)
+	require.Len(al.Items, 1)
+
+	acct := al.Items[0]
+
+	setAcct, err := accountClient.SetPassword(tc.Context(), acct.Id, "setpassword", acct.Version)
+	require.NoError(err)
+	require.NotNil(setAcct)
+	assert.Equal(acct.Version+1, setAcct.Item.Version)
+
+	changeAcct, err := accountClient.ChangePassword(tc.Context(), acct.Id, "setpassword", "changepassword", setAcct.Item.Version)
+	require.NoError(err)
+	require.NotNil(changeAcct)
+	assert.Equal(setAcct.Item.Version+1, changeAcct.Item.Version)
+}
+
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	amId := token.AuthMethodId
+	accountClient := accounts.NewClient(client)
+
+	u, err := accountClient.Create(tc.Context(), amId, accounts.WithPasswordAccountLoginName("first"))
+	require.NoError(err)
+	assert.NotNil(u)
+
+	// Updating the wrong version should fail.
+	_, err = accountClient.Update(tc.Context(), u.Item.Id, 73, accounts.WithName("anything"))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	// Create another resource with the same name.
+	_, err = accountClient.Create(tc.Context(), amId, accounts.WithPasswordAccountLoginName("first"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	require.NotNil(apiErr)
+
+	_, err = accountClient.Read(tc.Context(), password.AccountPrefix+"_doesntexis")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = accountClient.Read(tc.Context(), "invalid id")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+
+	_, err = accountClient.Update(tc.Context(), u.Item.Id, u.Item.Version)
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

internal/tests/api/authmethods/authenticate_test.go

@@ -0,0 +1,36 @@
+package authmethods_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAuthenticate(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "ampw_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DefaultAuthMethodId: amId,
+		DefaultLoginName:    "user",
+		DefaultPassword:     "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	methods := authmethods.NewClient(client)
+
+	tok, err := methods.Authenticate(tc.Context(), amId, map[string]interface{}{"login_name": "user", "password": "passpass"})
+	require.NoError(err)
+	assert.NotNil(tok)
+
+	_, err = methods.Authenticate(tc.Context(), amId, map[string]interface{}{"login_name": "user", "password": "wrong"})
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValuesf(http.StatusUnauthorized, apiErr.Status, "Expected unauthorized, got %q", apiErr.Message)
+}

internal/tests/api/authtokens/authtoken_test.go

@@ -0,0 +1,155 @@
+package authtokens_test
+
+import (
+	"net/http"
+	"sort"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/accounts"
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/boundary/api/authtokens"
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/boundary/internal/authtoken"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "ampw_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DefaultAuthMethodId: amId,
+		DefaultLoginName:    "user",
+		DefaultPassword:     "passpass",
+	})
+	defer tc.Shutdown()
+
+	token := tc.Token()
+	client := tc.Client()
+	client.SetToken(token.Token)
+
+	org := iam.TestOrg(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	amClient := authmethods.NewClient(client)
+	amResult, err := amClient.Create(tc.Context(), "password", org.GetPublicId())
+	require.NoError(err)
+	require.NotNil(amResult)
+	amId = amResult.Item.Id
+
+	rolesClient := roles.NewClient(client)
+	role, err := rolesClient.Create(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+	require.NotNil(role)
+	role, err = rolesClient.AddPrincipals(tc.Context(), role.Item.Id, 0, []string{"u_anon"}, roles.WithAutomaticVersioning(true))
+	require.NoError(err)
+	require.NotNil(role)
+	role, err = rolesClient.AddGrants(tc.Context(), role.Item.Id, 0, []string{"id=*;type=auth-method;actions=authenticate"}, roles.WithAutomaticVersioning(true))
+	require.NoError(err)
+	require.NotNil(role)
+
+	acctClient := accounts.NewClient(client)
+	acct, err := acctClient.Create(tc.Context(), amId, accounts.WithPasswordAccountLoginName("user"), accounts.WithPasswordAccountPassword("passpass"))
+	require.NoError(err)
+	require.NotNil(acct)
+
+	tokens := authtokens.NewClient(client)
+
+	atl, err := tokens.List(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+	assert.Empty(atl.Items)
+
+	var expected []*authtokens.AuthToken
+	methods := authmethods.NewClient(client)
+
+	at, err := methods.Authenticate(tc.Context(), amId, map[string]interface{}{"login_name": "user", "password": "passpass"})
+	require.NoError(err)
+	expected = append(expected, at.Item)
+
+	atl, err = tokens.List(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(atl.Items))
+
+	for i := 1; i < 10; i++ {
+		at, err = methods.Authenticate(tc.Context(), amId, map[string]interface{}{"login_name": "user", "password": "passpass"})
+		require.NoError(err)
+		expected = append(expected, at.Item)
+	}
+	atl, err = tokens.List(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(atl.Items))
+}
+
+func comparableResource(i *authtokens.AuthToken) authtokens.AuthToken {
+	return authtokens.AuthToken{
+		Id:                      i.Id,
+		UserId:                  i.UserId,
+		AuthMethodId:            i.AuthMethodId,
+		CreatedTime:             i.CreatedTime,
+		UpdatedTime:             i.UpdatedTime,
+		ApproximateLastUsedTime: i.ApproximateLastUsedTime,
+		ExpirationTime:          i.ExpirationTime,
+	}
+}
+
+func comparableSlice(in []*authtokens.AuthToken) []authtokens.AuthToken {
+	var filtered []authtokens.AuthToken
+	for _, i := range in {
+		filtered = append(filtered, comparableResource(i))
+	}
+	sort.Slice(filtered, func(i, j int) bool {
+		return filtered[i].Id < filtered[j].Id
+	})
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "ampw_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DefaultAuthMethodId: amId,
+		DefaultLoginName:    "user",
+		DefaultPassword:     "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	tokens := authtokens.NewClient(client)
+	methods := authmethods.NewClient(client)
+
+	want, err := methods.Authenticate(tc.Context(), amId, map[string]interface{}{"login_name": "user", "password": "passpass"})
+	require.NoError(err)
+
+	at, err := tokens.Read(tc.Context(), want.Item.Id)
+	require.NoError(err)
+	assert.EqualValues(comparableResource(want.Item), comparableResource(at.Item))
+
+	_, err = tokens.Delete(tc.Context(), at.Item.Id)
+	require.NoError(err)
+}
+
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	tokens := authtokens.NewClient(client)
+
+	_, err := tokens.Read(tc.Context(), authtoken.AuthTokenPrefix+"_doesntexis")
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = tokens.Read(tc.Context(), "invalid id")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

internal/tests/api/client_test.go

@@ -0,0 +1,72 @@
+package api
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConfigSetAddress(t *testing.T) {
+	type test struct {
+		name    string
+		input   string
+		address string
+		err     string
+	}
+
+	tests := []test{
+		{
+			"bare",
+			"http://127.0.0.1:9200",
+			"http://127.0.0.1:9200",
+			"",
+		},
+		{
+			"bare with version",
+			"http://127.0.0.1:9200/v1",
+			"http://127.0.0.1:9200",
+			"",
+		},
+		{
+			"bare with version and trailing slash",
+			"http://127.0.0.1:9200/v1/",
+			"http://127.0.0.1:9200",
+			"",
+		},
+		{
+			"valid top level scope",
+			"http://127.0.0.1:9200/v1/scopes",
+			"http://127.0.0.1:9200",
+			"",
+		},
+		{
+			"valid scope",
+			"http://127.0.0.1:9200/v1/scopes/scopeid",
+			"http://127.0.0.1:9200",
+			"",
+		},
+		{
+			"longer path project",
+			"http://127.0.0.1:9200/v1/auth-methods",
+			"http://127.0.0.1:9200",
+			"",
+		},
+		{
+			"valid project",
+			"http://127.0.0.1:9200/my-install",
+			"http://127.0.0.1:9200/my-install",
+			"",
+		},
+	}
+
+	for _, v := range tests {
+		t.Run(v.name, func(t *testing.T) {
+			var c Config
+			err := c.setAddr(v.input)
+			if err != nil {
+				assert.Equal(t, v.err, err.Error())
+			}
+			assert.Equal(t, v.address, c.Addr)
+		})
+	}
+}

internal/tests/api/groups/group_test.go

@@ -0,0 +1,221 @@
+package groups_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/groups"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	cases := []struct {
+		name    string
+		scopeId string
+	}{
+		{
+			name:    "org",
+			scopeId: org.GetPublicId(),
+		},
+		{
+			name:    "proj",
+			scopeId: proj.GetPublicId(),
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			grps := groups.NewClient(client)
+			pl, err := grps.List(tc.Context(), tt.scopeId)
+			assert.NoError(err)
+			assert.Empty(pl.Items)
+
+			expected := make([]*groups.Group, 10)
+			for i := 0; i < 10; i++ {
+				createResult, err := grps.Create(tc.Context(), tt.scopeId, groups.WithName(fmt.Sprint(i)))
+				require.NoError(err)
+				expected[i] = createResult.Item
+			}
+			pl, err = grps.List(tc.Context(), tt.scopeId)
+			require.NoError(err)
+			require.NotNil(pl)
+			require.Len(pl.Items, 10)
+			assert.ElementsMatch(comparableSlice(expected), comparableSlice(pl.Items))
+		})
+	}
+}
+
+func comparableSlice(in []*groups.Group) []groups.Group {
+	var filtered []groups.Group
+	for _, i := range in {
+		p := groups.Group{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	checkGroup := func(step string, g *groups.Group, err error, wantedName string, wantedVersion uint32, expectedUserIds []string) {
+		require.NoError(err, step)
+		assert.NotNil(g, "returned no resource", step)
+		gotName := ""
+		if g.Name != "" {
+			gotName = g.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, g.Version)
+		assert.Equal(len(expectedUserIds), len(g.MemberIds))
+		if len(expectedUserIds) > 0 {
+			assert.EqualValues(expectedUserIds, g.MemberIds)
+		}
+	}
+
+	cases := []struct {
+		name    string
+		scopeId string
+	}{
+		{
+			name:    "org",
+			scopeId: org.GetPublicId(),
+		},
+		{
+			name:    "proj",
+			scopeId: proj.GetPublicId(),
+		},
+	}
+
+	user1, err := users.NewClient(client).Create(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+
+	user2, err := users.NewClient(client).Create(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			groupsClient := groups.NewClient(client)
+			g, err := groupsClient.Create(tc.Context(), tt.scopeId, groups.WithName("foo"))
+			checkGroup("create", g.Item, err, "foo", 1, nil)
+
+			g, err = groupsClient.Read(tc.Context(), g.Item.Id)
+			checkGroup("read", g.Item, err, "foo", 1, nil)
+
+			g, err = groupsClient.Update(tc.Context(), g.Item.Id, g.Item.Version, groups.WithName("bar"))
+			checkGroup("update", g.Item, err, "bar", 2, nil)
+
+			g, err = groupsClient.Update(tc.Context(), g.Item.Id, g.Item.Version, groups.DefaultName())
+			checkGroup("update", g.Item, err, "", 3, nil)
+
+			g, err = groupsClient.AddMembers(tc.Context(), g.Item.Id, g.Item.Version, []string{user1.Item.Id})
+			checkGroup("update", g.Item, err, "", 4, []string{user1.Item.Id})
+
+			g, err = groupsClient.SetMembers(tc.Context(), g.Item.Id, g.Item.Version, []string{user2.Item.Id})
+			checkGroup("update", g.Item, err, "", 5, []string{user2.Item.Id})
+
+			g, err = groupsClient.RemoveMembers(tc.Context(), g.Item.Id, g.Item.Version, []string{user2.Item.Id})
+			checkGroup("update", g.Item, err, "", 6, nil)
+
+			_, err = groupsClient.Delete(tc.Context(), g.Item.Id)
+			require.NoError(err)
+
+			_, err = groupsClient.Delete(tc.Context(), g.Item.Id)
+			require.Error(err)
+			apiErr := api.AsServerError(err)
+			require.NotNil(apiErr)
+			assert.EqualValues(http.StatusNotFound, apiErr.Status)
+		})
+	}
+}
+
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	cases := []struct {
+		name    string
+		scopeId string
+	}{
+		{
+			name:    "org",
+			scopeId: org.GetPublicId(),
+		},
+		{
+			name:    "proj",
+			scopeId: proj.GetPublicId(),
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			groupClient := groups.NewClient(client)
+
+			g, err := groupClient.Create(tc.Context(), tt.scopeId, groups.WithName("first"))
+			require.NoError(err)
+			assert.NotNil(g)
+
+			// Updating the wrong version should fail.
+			_, err = groupClient.Update(tc.Context(), g.Item.Id, 73, groups.WithName("anything"))
+			require.Error(err)
+			apiErr := api.AsServerError(err)
+			require.NotNil(apiErr)
+			assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+			// Create another resource with the same name.
+			_, err = groupClient.Create(tc.Context(), tt.scopeId, groups.WithName("first"))
+			require.Error(err)
+
+			_, err = groupClient.Read(tc.Context(), iam.GroupPrefix+"_doesntexis")
+			require.Error(err)
+			apiErr = api.AsServerError(err)
+			require.NotNil(apiErr)
+			assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+			_, err = groupClient.Read(tc.Context(), "invalid id")
+			require.Error(err)
+			apiErr = api.AsServerError(err)
+			require.NotNil(apiErr)
+			assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+
+			_, err = groupClient.Update(tc.Context(), g.Item.Id, g.Item.Version)
+			require.Error(err)
+			apiErr = api.AsServerError(err)
+			require.NotNil(apiErr)
+			assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+		})
+	}
+}

internal/tests/api/hostcatalogs/host_catalog_test.go

@@ -0,0 +1,155 @@
+package hostcatalogs_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/hostcatalogs"
+	"github.com/hashicorp/boundary/internal/host/static"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	catalogClient := hostcatalogs.NewClient(client)
+
+	ul, err := catalogClient.List(tc.Context(), proj.GetPublicId())
+	require.NoError(err)
+	assert.Empty(ul.Items)
+
+	var expected []*hostcatalogs.HostCatalog
+	for i := 0; i < 10; i++ {
+		expected = append(expected, &hostcatalogs.HostCatalog{Name: fmt.Sprint(i)})
+	}
+
+	cr, err := catalogClient.Create(tc.Context(), "static", proj.GetPublicId(), hostcatalogs.WithName(expected[0].Name))
+	require.NoError(err)
+	expected[0] = cr.Item
+
+	ul, err = catalogClient.List(tc.Context(), proj.GetPublicId())
+	require.NoError(err)
+	assert.ElementsMatch(comparableCatalogSlice(expected[:1]), comparableCatalogSlice(ul.Items))
+
+	for i := 1; i < 10; i++ {
+		cr, err = catalogClient.Create(tc.Context(), "static", proj.GetPublicId(), hostcatalogs.WithName(expected[i].Name))
+		require.NoError(err)
+		expected[i] = cr.Item
+	}
+	ul, err = catalogClient.List(tc.Context(), proj.GetPublicId())
+	require.NoError(err)
+	assert.ElementsMatch(comparableCatalogSlice(expected), comparableCatalogSlice(ul.Items))
+}
+
+func comparableCatalogSlice(in []*hostcatalogs.HostCatalog) []hostcatalogs.HostCatalog {
+	var filtered []hostcatalogs.HostCatalog
+	for _, i := range in {
+		p := hostcatalogs.HostCatalog{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	checkCatalog := func(step string, hc *hostcatalogs.HostCatalog, err error, wantedName string, wantVersion uint32) {
+		require.NoError(err, step)
+		assert.NotNil(hc, "returned no resource", step)
+		gotName := ""
+		if hc.Name != "" {
+			gotName = hc.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.Equal(wantVersion, hc.Version)
+	}
+
+	hcClient := hostcatalogs.NewClient(client)
+
+	hc, err := hcClient.Create(tc.Context(), "static", proj.GetPublicId(), hostcatalogs.WithName("foo"))
+	checkCatalog("create", hc.Item, err, "foo", 1)
+
+	hc, err = hcClient.Read(tc.Context(), hc.Item.Id)
+	checkCatalog("read", hc.Item, err, "foo", 1)
+
+	hc, err = hcClient.Update(tc.Context(), hc.Item.Id, hc.Item.Version, hostcatalogs.WithName("bar"))
+	checkCatalog("update", hc.Item, err, "bar", 2)
+
+	hc, err = hcClient.Update(tc.Context(), hc.Item.Id, hc.Item.Version, hostcatalogs.DefaultName())
+	checkCatalog("update", hc.Item, err, "", 3)
+
+	_, err = hcClient.Delete(tc.Context(), hc.Item.Id)
+	assert.NoError(err)
+
+	_, err = hcClient.Delete(tc.Context(), hc.Item.Id)
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+}
+
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	pc := hostcatalogs.NewClient(client)
+
+	hc, err := pc.Create(tc.Context(), "static", proj.GetPublicId(), hostcatalogs.WithName("foo"))
+	require.NoError(err)
+	apiErr := api.AsServerError(err)
+	assert.Nil(apiErr)
+	assert.NotNil(hc)
+
+	// Updating the wrong version should fail.
+	_, err = pc.Update(tc.Context(), hc.Item.Id, 73, hostcatalogs.WithName("anything"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = pc.Create(tc.Context(), "static", proj.GetPublicId(), hostcatalogs.WithName("foo"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+
+	_, err = pc.Read(tc.Context(), static.HostCatalogPrefix+"_doesntexis")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = pc.Read(tc.Context(), "invalid id")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

internal/tests/api/hosts/host_test.go

@@ -0,0 +1,168 @@
+package hosts_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/hostcatalogs"
+	"github.com/hashicorp/boundary/api/hosts"
+	"github.com/hashicorp/boundary/internal/host/static"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	hc, err := hostcatalogs.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(hc)
+
+	hClient := hosts.NewClient(client)
+
+	ul, err := hClient.List(tc.Context(), hc.Item.Id)
+	assert.NoError(err)
+	assert.Empty(ul.Items)
+
+	var expected []*hosts.Host
+	for i := 0; i < 10; i++ {
+		expected = append(expected, &hosts.Host{Name: fmt.Sprint(i)})
+	}
+
+	hcr, err := hClient.Create(tc.Context(), hc.Item.Id, hosts.WithName(expected[0].Name), hosts.WithStaticHostAddress("someaddress"))
+	assert.NoError(err)
+	expected[0] = hcr.Item
+
+	ul, err = hClient.List(tc.Context(), hc.Item.Id)
+	assert.NoError(err)
+	assert.ElementsMatch(comparableHostSlice(expected[:1]), comparableHostSlice(ul.Items))
+
+	for i := 1; i < 10; i++ {
+		hcr, err = hClient.Create(tc.Context(), hc.Item.Id, hosts.WithName(expected[i].Name), hosts.WithStaticHostAddress("someaddress"))
+		assert.NoError(err)
+		expected[i] = hcr.Item
+	}
+	ul, err = hClient.List(tc.Context(), hc.Item.Id)
+	require.NoError(err)
+	assert.ElementsMatch(comparableHostSlice(expected), comparableHostSlice(ul.Items))
+}
+
+func comparableHostSlice(in []*hosts.Host) []hosts.Host {
+	var filtered []hosts.Host
+	for _, i := range in {
+		p := hosts.Host{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	hc, err := hostcatalogs.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(hc)
+
+	checkHost := func(step string, h *hosts.Host, err error, wantedName string, wantVersion uint32) {
+		require.NoError(err, step)
+		assert.NotNil(h, "returned no resource", step)
+		gotName := ""
+		if h.Name != "" {
+			gotName = h.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.Equal(wantVersion, h.Version)
+	}
+
+	hClient := hosts.NewClient(client)
+
+	h, err := hClient.Create(tc.Context(), hc.Item.Id, hosts.WithName("foo"), hosts.WithStaticHostAddress("someaddress"))
+	checkHost("create", h.Item, err, "foo", 1)
+
+	h, err = hClient.Read(tc.Context(), h.Item.Id)
+	checkHost("read", h.Item, err, "foo", 1)
+
+	h, err = hClient.Update(tc.Context(), h.Item.Id, h.Item.Version, hosts.WithName("bar"))
+	checkHost("update", h.Item, err, "bar", 2)
+
+	h, err = hClient.Update(tc.Context(), h.Item.Id, h.Item.Version, hosts.DefaultName())
+	checkHost("update", h.Item, err, "", 3)
+
+	_, err = hClient.Delete(tc.Context(), h.Item.Id)
+	assert.NoError(err)
+
+	_, err = hClient.Delete(tc.Context(), h.Item.Id)
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+}
+
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	hc, err := hostcatalogs.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(hc)
+
+	hClient := hosts.NewClient(client)
+
+	h, err := hClient.Create(tc.Context(), hc.Item.Id, hosts.WithName("foo"), hosts.WithStaticHostAddress("someaddress"))
+	require.NoError(err)
+	assert.NotNil(h)
+
+	// Updating the wrong version should fail.
+	_, err = hClient.Update(tc.Context(), h.Item.Id, 73, hosts.WithName("anything"))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = hClient.Create(tc.Context(), hc.Item.Id, hosts.WithName("foo"), hosts.WithStaticHostAddress("someaddress"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+
+	_, err = hClient.Read(tc.Context(), static.HostPrefix+"_doesntexis")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = hClient.Read(tc.Context(), "invalid id")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

internal/tests/api/hostsets/host_set_test.go

@@ -0,0 +1,207 @@
+package hostsets_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/hostcatalogs"
+	"github.com/hashicorp/boundary/api/hosts"
+	"github.com/hashicorp/boundary/api/hostsets"
+	"github.com/hashicorp/boundary/internal/host/static"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustom(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	hc, err := hostcatalogs.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+
+	hClient := hosts.NewClient(client)
+	h1, err := hClient.Create(tc.Context(), hc.Item.Id, hosts.WithStaticHostAddress("someaddress"))
+	require.NoError(err)
+	h2, err := hClient.Create(tc.Context(), hc.Item.Id, hosts.WithStaticHostAddress("someaddress"))
+	require.NoError(err)
+
+	hSetClient := hostsets.NewClient(client)
+	hSet, err := hSetClient.Create(tc.Context(), hc.Item.Id)
+	require.NoError(err)
+
+	hSet, err = hSetClient.AddHosts(tc.Context(), hSet.Item.Id, hSet.Item.Version, []string{h1.Item.Id, h2.Item.Id})
+	require.NoError(err)
+	assert.Contains(hSet.Item.HostIds, h1.Item.Id, h2.Item.Id)
+
+	hSet, err = hSetClient.SetHosts(tc.Context(), hSet.Item.Id, hSet.Item.Version, []string{h1.Item.Id})
+	require.NoError(err)
+	assert.ElementsMatch([]string{h1.Item.Id}, hSet.Item.HostIds)
+
+	hSet, err = hSetClient.RemoveHosts(tc.Context(), hSet.Item.Id, hSet.Item.Version, []string{h1.Item.Id})
+	require.NoError(err)
+	assert.Empty(hSet.Item.HostIds)
+}
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	hc, err := hostcatalogs.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(hc)
+
+	hClient := hostsets.NewClient(client)
+
+	ul, err := hClient.List(tc.Context(), hc.Item.Id)
+	require.NoError(err)
+	assert.Empty(ul.Items)
+
+	var expected []*hostsets.HostSet
+	for i := 0; i < 10; i++ {
+		expected = append(expected, &hostsets.HostSet{Name: fmt.Sprint(i)})
+	}
+
+	hcr, err := hClient.Create(tc.Context(), hc.Item.Id, hostsets.WithName(expected[0].Name))
+	require.NoError(err)
+	expected[0] = hcr.Item
+
+	ul, err = hClient.List(tc.Context(), hc.Item.Id)
+	require.NoError(err)
+	assert.ElementsMatch(comparableSetSlice(expected[:1]), comparableSetSlice(ul.Items))
+
+	for i := 1; i < 10; i++ {
+		hcr, err = hClient.Create(tc.Context(), hc.Item.Id, hostsets.WithName(expected[i].Name))
+		require.NoError(err)
+		expected[i] = hcr.Item
+	}
+	ul, err = hClient.List(tc.Context(), hc.Item.Id)
+	require.NoError(err)
+	assert.ElementsMatch(comparableSetSlice(expected), comparableSetSlice(ul.Items))
+}
+
+func comparableSetSlice(in []*hostsets.HostSet) []hostsets.HostSet {
+	var filtered []hostsets.HostSet
+	for _, i := range in {
+		p := hostsets.HostSet{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	hc, err := hostcatalogs.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(hc)
+
+	checkHost := func(t *testing.T, step string, h *hostsets.HostSet, err error, wantedName string, wantVersion uint32) {
+		t.Helper()
+		require.NoError(err, step)
+		assert.NotNil(h, "returned no resource", step)
+		gotName := ""
+		if h.Name != "" {
+			gotName = h.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.Equal(wantVersion, h.Version)
+	}
+
+	hClient := hostsets.NewClient(client)
+
+	h, err := hClient.Create(tc.Context(), hc.Item.Id, hostsets.WithName("foo"))
+	checkHost(t, "create", h.Item, err, "foo", 1)
+
+	h, err = hClient.Read(tc.Context(), h.Item.Id)
+	checkHost(t, "read", h.Item, err, "foo", 1)
+
+	h, err = hClient.Update(tc.Context(), h.Item.Id, h.Item.Version, hostsets.WithName("bar"))
+	checkHost(t, "update", h.Item, err, "bar", 2)
+
+	h, err = hClient.Update(tc.Context(), h.Item.Id, h.Item.Version, hostsets.DefaultName())
+	checkHost(t, "update", h.Item, err, "", 3)
+
+	_, err = hClient.Delete(tc.Context(), h.Item.Id)
+	assert.NoError(err)
+	_, err = hClient.Delete(tc.Context(), h.Item.Id)
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	require.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+}
+
+// TODO: Get better coverage for expected errors and error formats.
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	hc, err := hostcatalogs.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+	require.NotNil(hc)
+
+	hClient := hostsets.NewClient(client)
+
+	h, err := hClient.Create(tc.Context(), hc.Item.Id, hostsets.WithName("foo"))
+	require.NoError(err)
+	assert.NotNil(h)
+
+	// Updating the wrong version should fail.
+	_, err = hClient.Update(tc.Context(), h.Item.Id, 73, hostsets.WithName("anything"))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	h, err = hClient.Create(tc.Context(), hc.Item.Id, hostsets.WithName("foo"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.Nil(h)
+
+	_, err = hClient.Read(tc.Context(), static.HostSetPrefix+"_doesntexis")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = hClient.Read(tc.Context(), "invalid id")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

internal/tests/api/roles/role_test.go

@@ -0,0 +1,307 @@
+package roles_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/groups"
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustom(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	cases := []struct {
+		name    string
+		scopeId string
+	}{
+		{
+			name:    "org",
+			scopeId: org.GetPublicId(),
+		},
+		{
+			name:    "proj",
+			scopeId: proj.GetPublicId(),
+		},
+	}
+
+	user, err := users.NewClient(client).Create(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+
+	hasPrincipal := func(role *roles.Role, principalId string) bool {
+		var foundInPrincipals bool
+		var foundInPrincipalIds bool
+		for _, v := range role.Principals {
+			if v.Id == principalId {
+				foundInPrincipals = true
+			}
+		}
+		for _, v := range role.PrincipalIds {
+			if v == principalId {
+				foundInPrincipalIds = true
+			}
+		}
+		return foundInPrincipals && foundInPrincipalIds
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			g, err := groups.NewClient(client).Create(tc.Context(), tt.scopeId)
+			require.NoError(err)
+			require.NotNil(g)
+
+			rc := roles.NewClient(client)
+			var version uint32 = 1
+
+			r, err := rc.Create(tc.Context(), tt.scopeId, roles.WithName("foo"))
+			require.NoError(err)
+			require.NotNil(r)
+			require.EqualValues(r.Item.Version, version)
+			version++
+
+			updatedRole, err := rc.AddPrincipals(tc.Context(), r.Item.Id, r.Item.Version, []string{g.Item.Id})
+			require.NoError(err)
+			assert.EqualValues(updatedRole.Item.Version, version)
+			assert.True(hasPrincipal(updatedRole.Item, g.Item.Id))
+			version++
+
+			updatedRole, err = rc.SetPrincipals(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{user.Item.Id})
+			require.NoError(err)
+			assert.EqualValues(updatedRole.Item.Version, version)
+			assert.True(hasPrincipal(updatedRole.Item, user.Item.Id))
+			version++
+
+			updatedRole, err = rc.RemovePrincipals(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{user.Item.Id})
+			require.NoError(err)
+			assert.EqualValues(updatedRole.Item.Version, version)
+			assert.Empty(updatedRole.Item.Principals)
+			version++
+
+			updatedRole, err = rc.AddGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=read"})
+			require.NoError(err)
+			assert.EqualValues(updatedRole.Item.Version, version)
+			assert.Contains(updatedRole.Item.GrantStrings, "id=*;type=*;actions=read")
+			version++
+
+			updatedRole, err = rc.SetGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=*"})
+			require.NoError(err)
+			assert.EqualValues(updatedRole.Item.Version, version)
+			assert.Contains(updatedRole.Item.GrantStrings, "id=*;type=*;actions=*")
+			version++
+
+			updatedRole, err = rc.RemoveGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=*"})
+			require.NoError(err)
+			assert.EqualValues(updatedRole.Item.Version, version)
+			assert.Empty(updatedRole.Item.Grants)
+			version++
+		})
+	}
+}
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	cases := []struct {
+		name    string
+		scopeId string
+	}{
+		{
+			name:    "org",
+			scopeId: org.GetPublicId(),
+		},
+		{
+			name:    "proj",
+			scopeId: proj.GetPublicId(),
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			var expected []*roles.Role
+
+			roleClient := roles.NewClient(client)
+			p1, err := roleClient.List(tc.Context(), tt.scopeId)
+			require.NoError(err)
+			require.Len(p1.Items, 2)
+			expected = append(expected, p1.Items[0:2]...)
+
+			for i := 2; i < 12; i++ {
+				expected = append(expected, &roles.Role{Name: fmt.Sprint(i)})
+			}
+
+			rcr, err := roleClient.Create(tc.Context(), tt.scopeId, roles.WithName(expected[2].Name))
+			require.NoError(err)
+			expected[2] = rcr.Item
+
+			p2, err := roleClient.List(tc.Context(), tt.scopeId)
+			require.NoError(err)
+			assert.ElementsMatch(comparableSlice(expected[0:3]), comparableSlice(p2.Items))
+
+			for i := 3; i < 12; i++ {
+				rcr, err = roleClient.Create(tc.Context(), tt.scopeId, roles.WithName(expected[i].Name))
+				assert.NoError(err)
+				expected[i] = rcr.Item
+			}
+			p3, err := roleClient.List(tc.Context(), tt.scopeId)
+			require.NoError(err)
+			assert.ElementsMatch(comparableSlice(expected), comparableSlice(p3.Items))
+		})
+	}
+}
+
+func comparableSlice(in []*roles.Role) []roles.Role {
+	var filtered []roles.Role
+	for _, i := range in {
+		p := roles.Role{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	cases := []struct {
+		name    string
+		scopeId string
+	}{
+		{
+			name:    "org",
+			scopeId: org.GetPublicId(),
+		},
+		{
+			name:    "proj",
+			scopeId: proj.GetPublicId(),
+		},
+	}
+
+	checkRole := func(step string, g *roles.Role, err error, wantedName string, wantedVersion uint32) {
+		assert.NoError(err, step)
+		assert.NotNil(g, "returned no resource", step)
+		gotName := ""
+		if g.Name != "" {
+			gotName = g.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, g.Version)
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			roleClient := roles.NewClient(client)
+			g, err := roleClient.Create(tc.Context(), tt.scopeId, roles.WithName("foo"))
+			checkRole("create", g.Item, err, "foo", 1)
+
+			g, err = roleClient.Read(tc.Context(), g.Item.Id)
+			checkRole("read", g.Item, err, "foo", 1)
+
+			g, err = roleClient.Update(tc.Context(), g.Item.Id, g.Item.Version, roles.WithName("bar"))
+			checkRole("update", g.Item, err, "bar", 2)
+
+			g, err = roleClient.Update(tc.Context(), g.Item.Id, g.Item.Version, roles.DefaultName())
+			checkRole("update", g.Item, err, "", 3)
+
+			_, err = roleClient.Delete(tc.Context(), g.Item.Id)
+			require.NoError(err)
+		})
+	}
+}
+
+func TestErrors(t *testing.T) {
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	cases := []struct {
+		name    string
+		scopeId string
+	}{
+		{
+			name:    "org",
+			scopeId: org.GetPublicId(),
+		},
+		{
+			name:    "proj",
+			scopeId: proj.GetPublicId(),
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			roleClient := roles.NewClient(client)
+			u, err := roleClient.Create(tc.Context(), tt.scopeId, roles.WithName("first"))
+			require.NoError(err)
+			assert.NotNil(u)
+
+			// Updating the wrong version should fail.
+			_, err = roleClient.Update(tc.Context(), u.Item.Id, 73, roles.WithName("anything"))
+			require.Error(err)
+			apiErr := api.AsServerError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+			// Create another resource with the same name.
+			_, err = roleClient.Create(tc.Context(), tt.scopeId, roles.WithName("first"))
+			require.Error(err)
+			apiErr = api.AsServerError(err)
+			assert.NotNil(apiErr)
+
+			_, err = roleClient.Read(tc.Context(), iam.RolePrefix+"_doesntexis")
+			require.Error(err)
+			apiErr = api.AsServerError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+			_, err = roleClient.Read(tc.Context(), "invalid id")
+			require.Error(err)
+			apiErr = api.AsServerError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+
+			_, err = roleClient.Update(tc.Context(), u.Item.Id, u.Item.Version)
+			require.Error(err)
+			apiErr = api.AsServerError(err)
+			assert.NotNil(apiErr)
+			assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+		})
+	}
+}

internal/tests/api/scopes/scope_test.go

@@ -0,0 +1,138 @@
+package scopes_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org := iam.TestOrg(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	scps := scopes.NewClient(client)
+
+	pl, err := scps.List(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+	assert.Empty(pl.Items)
+
+	expected := make([]*scopes.Scope, 10)
+	for i := 0; i < 10; i++ {
+		scr, err := scps.Create(tc.Context(), org.GetPublicId(), scopes.WithName(fmt.Sprintf("%d", i)))
+		require.NoError(err)
+		expected[i] = scr.Item
+	}
+	pl, err = scps.List(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(pl.Items))
+}
+
+func comparableSlice(in []*scopes.Scope) []scopes.Scope {
+	var filtered []scopes.Scope
+	for _, i := range in {
+		p := scopes.Scope{
+			Id:          i.Id,
+			ScopeId:     i.ScopeId,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, _ := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	scps := scopes.NewClient(client)
+
+	checkProject := func(step string, s *scopes.Scope, err error, wantedName string, wantedVersion uint32) {
+		require.NoError(err, step)
+		assert.NotNil(s, "returned project", step)
+		gotName := ""
+		if s.Name != "" {
+			gotName = s.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.Equal(wantedVersion, s.Version)
+	}
+
+	s, err := scps.Create(tc.Context(), org.GetPublicId(), scopes.WithName("foo"))
+	checkProject("create", s.Item, err, "foo", 1)
+
+	s, err = scps.Read(tc.Context(), s.Item.Id)
+	checkProject("read", s.Item, err, "foo", 1)
+
+	s, err = scps.Update(tc.Context(), s.Item.Id, s.Item.Version, scopes.WithName("bar"))
+	checkProject("update", s.Item, err, "bar", 2)
+
+	s, err = scps.Update(tc.Context(), s.Item.Id, s.Item.Version, scopes.DefaultName())
+	checkProject("update, unset name", s.Item, err, "", 3)
+
+	_, err = scps.Delete(tc.Context(), s.Item.Id)
+	require.NoError(err)
+
+	_, err = scps.Delete(tc.Context(), s.Item.Id)
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+}
+
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org, _ := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	scps := scopes.NewClient(client)
+
+	createdProj, err := scps.Create(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+	assert.NotNil(createdProj)
+
+	// Updating the wrong version should fail.
+	_, err = scps.Update(tc.Context(), createdProj.Item.Id, 73, scopes.WithName("anything"))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = scps.Read(tc.Context(), "p_doesntexis")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = scps.Read(tc.Context(), "invalid id")
+	assert.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

internal/tests/api/targets/target_test.go

@@ -0,0 +1,198 @@
+package targets_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/hostcatalogs"
+	"github.com/hashicorp/boundary/api/hostsets"
+	"github.com/hashicorp/boundary/api/targets"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/hashicorp/boundary/internal/target"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustom(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	token := tc.Token()
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	client := tc.Client().Clone()
+	client.SetToken(token.Token)
+
+	hc, err := hostcatalogs.NewClient(client).Create(tc.Context(), "static", proj.GetPublicId())
+	require.NoError(err)
+
+	hSetClient := hostsets.NewClient(client)
+	hSet, err := hSetClient.Create(tc.Context(), hc.Item.Id)
+	require.NoError(err)
+	require.NotNil(hSet)
+	hSet2, err := hSetClient.Create(tc.Context(), hc.Item.Id)
+	require.NoError(err)
+	require.NotNil(hSet2)
+
+	tarClient := targets.NewClient(client)
+	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
+	require.NoError(err)
+	require.NotNil(tar)
+	assert.Empty(tar.Item.HostSetIds)
+
+	tar, err = tarClient.AddHostSets(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet.Item.Id})
+	require.NoError(err)
+	require.NotNil(tar)
+	assert.ElementsMatch(tar.Item.HostSetIds, []string{hSet.Item.Id})
+
+	tar, err = tarClient.SetHostSets(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet2.Item.Id})
+	require.NoError(err)
+	require.NotNil(tar)
+	assert.ElementsMatch(tar.Item.HostSetIds, []string{hSet2.Item.Id})
+
+	tar, err = tarClient.RemoveHostSets(tc.Context(), tar.Item.Id, tar.Item.Version, []string{hSet2.Item.Id})
+	require.NoError(err)
+	require.NotNil(tar)
+	assert.Empty(tar.Item.HostSetIds)
+}
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	tarClient := targets.NewClient(client)
+	ul, err := tarClient.List(tc.Context(), proj.GetPublicId())
+	require.NoError(err)
+	assert.Empty(ul.Items)
+
+	var expected []*targets.Target
+	for i := 0; i < 10; i++ {
+		expected = append(expected, &targets.Target{Name: fmt.Sprint(i)})
+	}
+
+	tcr, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName(expected[0].Name))
+	require.NoError(err)
+	expected[0] = tcr.Item
+
+	ul, err = tarClient.List(tc.Context(), proj.GetPublicId())
+	require.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected[:1]), comparableSlice(ul.Items))
+
+	for i := 1; i < 10; i++ {
+		tcr, err = tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName(expected[i].Name))
+		require.NoError(err)
+		expected[i] = tcr.Item
+	}
+	ul, err = tarClient.List(tc.Context(), proj.GetPublicId())
+	require.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(ul.Items))
+}
+
+func comparableSlice(in []*targets.Target) []targets.Target {
+	var filtered []targets.Target
+	for _, i := range in {
+		p := targets.Target{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	checkResource := func(t *testing.T, step string, h *targets.Target, err error, wantedName string, wantVersion uint32) {
+		t.Helper()
+		require.NoError(err, step)
+		assert.NotNil(h, "returned no resource", step)
+		gotName := ""
+		if h.Name != "" {
+			gotName = h.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.Equal(wantVersion, h.Version)
+	}
+
+	tarClient := targets.NewClient(client)
+
+	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
+	checkResource(t, "create", tar.Item, err, "foo", 1)
+
+	tar, err = tarClient.Read(tc.Context(), tar.Item.Id)
+	checkResource(t, "read", tar.Item, err, "foo", 1)
+
+	tar, err = tarClient.Update(tc.Context(), tar.Item.Id, tar.Item.Version, targets.WithName("bar"))
+	checkResource(t, "update", tar.Item, err, "bar", 2)
+
+	_, err = tarClient.Delete(tc.Context(), tar.Item.Id)
+	assert.NoError(err)
+
+	_, err = tarClient.Delete(tc.Context(), tar.Item.Id)
+	assert.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+}
+
+func TestSet_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	_, proj := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+
+	tarClient := targets.NewClient(client)
+
+	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
+	require.NoError(err)
+	assert.NotNil(tar)
+
+	// Updating the wrong version should fail.
+	_, err = tarClient.Update(tc.Context(), tar.Item.Id, 73, targets.WithName("anything"))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	tar, err = tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.Nil(tar)
+
+	_, err = tarClient.Read(tc.Context(), target.TcpTargetPrefix+"_doesntexis")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = tarClient.Read(tc.Context(), "invalid id")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

internal/tests/api/users/user_test.go

@@ -0,0 +1,199 @@
+package users_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/accounts"
+	"github.com/hashicorp/boundary/api/users"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustom(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	uClient := users.NewClient(client)
+	aClient := accounts.NewClient(client)
+
+	usr1, err := uClient.Create(tc.Context(), "global")
+	require.NoError(err)
+
+	acct1, err := aClient.Create(tc.Context(), token.AuthMethodId, accounts.WithPasswordAccountLoginName("accountname"))
+	require.NoError(err)
+	acct2, err := aClient.Create(tc.Context(), token.AuthMethodId, accounts.WithPasswordAccountLoginName("accountname2"))
+	require.NoError(err)
+
+	addResult, err := uClient.AddAccounts(tc.Context(), usr1.Item.Id, 0, []string{acct1.Item.Id, acct2.Item.Id}, users.WithAutomaticVersioning(true))
+	assert.NoError(err)
+	assert.ElementsMatch([]string{acct1.Item.Id, acct2.Item.Id}, addResult.Item.AccountIds)
+
+	// Add the account to the default user
+	_, err = uClient.AddAccounts(tc.Context(), token.UserId, 0, []string{acct1.Item.Id}, users.WithAutomaticVersioning(true))
+	assert.Error(err)
+
+	remResult, err := uClient.RemoveAccounts(tc.Context(), usr1.Item.Id, 0, []string{acct1.Item.Id}, users.WithAutomaticVersioning(true))
+	assert.NoError(err)
+	assert.ElementsMatch([]string{acct2.Item.Id}, remResult.Item.AccountIds)
+
+	// Cannot remove an account that isn't associated with a user.
+	_, err = uClient.RemoveAccounts(tc.Context(), usr1.Item.Id, 0, []string{acct1.Item.Id}, users.WithAutomaticVersioning(true))
+	assert.Error(err)
+
+	setResult, err := uClient.SetAccounts(tc.Context(), usr1.Item.Id, 0, []string{acct1.Item.Id, acct2.Item.Id}, users.WithAutomaticVersioning(true))
+	assert.NoError(err)
+	assert.ElementsMatch([]string{acct1.Item.Id, acct2.Item.Id}, setResult.Item.AccountIds)
+}
+
+func TestList(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org := iam.TestOrg(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	userClient := users.NewClient(client)
+
+	ul, err := userClient.List(tc.Context(), org.GetPublicId())
+	assert.NoError(err)
+	assert.Empty(ul.Items)
+
+	var expected []*users.User
+	for i := 0; i < 10; i++ {
+		expected = append(expected, &users.User{Name: fmt.Sprint(i)})
+	}
+
+	ucr, err := userClient.Create(tc.Context(), org.GetPublicId(), users.WithName(expected[0].Name))
+	assert.NoError(err)
+	expected[0] = ucr.Item
+
+	ul, err = userClient.List(tc.Context(), org.GetPublicId())
+	assert.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected[:1]), comparableSlice(ul.Items))
+
+	for i := 1; i < 10; i++ {
+		ucr, err = userClient.Create(tc.Context(), org.GetPublicId(), users.WithName(expected[i].Name))
+		assert.NoError(err)
+		expected[i] = ucr.Item
+	}
+	ul, err = userClient.List(tc.Context(), org.GetPublicId())
+	require.NoError(err)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(ul.Items))
+}
+
+func comparableSlice(in []*users.User) []users.User {
+	var filtered []users.User
+	for _, i := range in {
+		p := users.User{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestCrud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org := iam.TestOrg(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	userClient := users.NewClient(client)
+
+	checkUser := func(step string, u *users.User, err error, wantedName string, wantedVersion uint32) {
+		assert.NoError(err, step)
+		assert.NotNil(u, "returned no resource", step)
+		gotName := ""
+		if u.Name != "" {
+			gotName = u.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, u.Version)
+	}
+
+	u, err := userClient.Create(tc.Context(), org.GetPublicId(), users.WithName("foo"))
+	checkUser("create", u.Item, err, "foo", 1)
+
+	u, err = userClient.Read(tc.Context(), u.Item.Id)
+	checkUser("read", u.Item, err, "foo", 1)
+
+	u, err = userClient.Update(tc.Context(), u.Item.Id, u.Item.Version, users.WithName("bar"))
+	checkUser("update", u.Item, err, "bar", 2)
+
+	u, err = userClient.Update(tc.Context(), u.Item.Id, u.Item.Version, users.DefaultName())
+	checkUser("update", u.Item, err, "", 3)
+
+	_, err = userClient.Delete(tc.Context(), u.Item.Id)
+	require.NoError(err)
+
+	_, err = userClient.Delete(tc.Context(), u.Item.Id)
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+}
+
+func TestErrors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	tc := controller.NewTestController(t, nil)
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	token := tc.Token()
+	client.SetToken(token.Token)
+	org := iam.TestOrg(t, tc.IamRepo(), iam.WithUserId(token.UserId))
+	userClient := users.NewClient(client)
+
+	u, err := userClient.Create(tc.Context(), org.GetPublicId(), users.WithName("first"))
+	require.NoError(err)
+	assert.NotNil(u)
+
+	// Updating the wrong version should fail.
+	_, err = userClient.Update(tc.Context(), u.Item.Id, 73, users.WithName("anything"))
+	require.Error(err)
+	apiErr := api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	// Create another resource with the same name.
+	_, err = userClient.Create(tc.Context(), org.GetPublicId(), users.WithName("first"))
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+
+	_, err = userClient.Read(tc.Context(), iam.UserPrefix+"_doesntexis")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, err = userClient.Read(tc.Context(), "invalid id")
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+
+	_, err = userClient.Update(tc.Context(), u.Item.Id, u.Item.Version)
+	require.Error(err)
+	apiErr = api.AsServerError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}