@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/backend/packages/iam/src/@api/iam/user/resolvers/iam-find-user-by-id.resolver.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/user.aurora.yaml
  */
-import { IamUser } from '@api/graphql';
-import { IamFindUserByIdHandler } from '@app/iam/user';
-import { Auth } from '@aurora/decorators';
+import { IamUser } from '@api/graphql.js';
+import { IamFindUserByIdHandler } from '@app/iam/user/index.js';
+import { Auth } from '@aurora/decorators/index.js';
 import { QueryStatement, Timezone } from '@aurorajs.dev/core-back';
 import { Args, Query, Resolver } from '@nestjs/graphql';
 

package/dist/templates/backend/packages/iam/src/@api/iam/user/resolvers/iam-find-user.resolver.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/user.aurora.yaml
  */
-import { IamUser } from '@api/graphql';
-import { IamFindUserHandler } from '@app/iam/user';
-import { Auth } from '@aurora/decorators';
+import { IamUser } from '@api/graphql.js';
+import { IamFindUserHandler } from '@app/iam/user/index.js';
+import { Auth } from '@aurora/decorators/index.js';
 import { QueryStatement, Timezone } from '@aurorajs.dev/core-back';
 import { Args, Query, Resolver } from '@nestjs/graphql';
 

package/dist/templates/backend/packages/iam/src/@api/iam/user/resolvers/iam-forgot-password-user.resolver.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/user.aurora.yaml
  */
-import { IamUpdateUserByIdInput } from '@api/graphql';
-import { IamForgotPasswordUserHandler } from '@app/iam/user';
-import { Auth } from '@aurora/decorators';
+import { IamUpdateUserByIdInput } from '@api/graphql.js';
+import { IamForgotPasswordUserHandler } from '@app/iam/user/index.js';
+import { Auth } from '@aurora/decorators/index.js';
 import { Auditing, AuditingMeta, QueryStatement, Timezone } from '@aurorajs.dev/core-back';
 import { Args, Mutation, Resolver } from '@nestjs/graphql';
 

package/dist/templates/backend/packages/iam/src/@api/iam/user/resolvers/iam-get-users.resolver.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/user.aurora.yaml
  */
-import { IamUser } from '@api/graphql';
-import { IamGetUsersHandler } from '@app/iam/user';
-import { Auth } from '@aurora/decorators';
+import { IamUser } from '@api/graphql.js';
+import { IamGetUsersHandler } from '@app/iam/user/index.js';
+import { Auth } from '@aurora/decorators/index.js';
 import { QueryStatement, Timezone } from '@aurorajs.dev/core-back';
 import { Args, Query, Resolver } from '@nestjs/graphql';
 

package/dist/templates/backend/packages/iam/src/@api/iam/user/resolvers/iam-paginate-users.resolver.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/user.aurora.yaml
  */
-import { Pagination } from '@api/graphql';
-import { IamPaginateUsersHandler } from '@app/iam/user';
-import { Auth } from '@aurora/decorators';
+import { Pagination } from '@api/graphql.js';
+import { IamPaginateUsersHandler } from '@app/iam/user/index.js';
+import { Auth } from '@aurora/decorators/index.js';
 import { QueryStatement, Timezone } from '@aurorajs.dev/core-back';
 import { Args, Query, Resolver } from '@nestjs/graphql';
 

package/dist/templates/backend/packages/iam/src/@api/iam/user/resolvers/iam-reset-password-user.resolver.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/user.aurora.yaml
  */
-import { IamUpdateUserByIdInput } from '@api/graphql';
-import { IamResetPasswordUserHandler } from '@app/iam/user';
-import { Auth } from '@aurora/decorators';
+import { IamUpdateUserByIdInput } from '@api/graphql.js';
+import { IamResetPasswordUserHandler } from '@app/iam/user/index.js';
+import { Auth } from '@aurora/decorators/index.js';
 import { Auditing, AuditingMeta, QueryStatement, Timezone } from '@aurorajs.dev/core-back';
 import { Args, Mutation, Resolver } from '@nestjs/graphql';
 

package/dist/templates/backend/packages/iam/src/@api/iam/user/resolvers/iam-update-user-by-id.resolver.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/user.aurora.yaml
  */
-import { IamUpdateUserByIdInput, IamUser } from '@api/graphql';
-import { IamUpdateUserByIdHandler } from '@app/iam/user';
-import { Auth } from '@aurora/decorators';
+import { IamUpdateUserByIdInput, IamUser } from '@api/graphql.js';
+import { IamUpdateUserByIdHandler } from '@app/iam/user/index.js';
+import { Auth } from '@aurora/decorators/index.js';
 import { Auditing, AuditingMeta, QueryStatement, Timezone } from '@aurorajs.dev/core-back';
 import { Args, Mutation, Resolver } from '@nestjs/graphql';
 

package/dist/templates/backend/packages/iam/src/@api/iam/user/resolvers/iam-update-users.resolver.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/user.aurora.yaml
  */
-import { IamUpdateUsersInput, IamUser } from '@api/graphql';
-import { IamUpdateUsersHandler } from '@app/iam/user';
-import { Auth } from '@aurora/decorators';
+import { IamUpdateUsersInput, IamUser } from '@api/graphql.js';
+import { IamUpdateUsersHandler } from '@app/iam/user/index.js';
+import { Auth } from '@aurora/decorators/index.js';
 import { Auditing, AuditingMeta, QueryStatement, Timezone } from '@aurorajs.dev/core-back';
 import { Args, Mutation, Resolver } from '@nestjs/graphql';
 

package/dist/templates/backend/packages/iam/src/@app/iam/account/application/check-password-me/iam-check-password-me-account.handler.ts

@@ -2,7 +2,7 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/account.aurora.yaml
  */
-import { IamAccount } from '@api/graphql';
+import { IamAccount } from '@api/graphql.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/account/application/check-unique-email/iam-check-unique-email-account.handler.spec.ts

@@ -7,17 +7,17 @@
  * (`{ eq: 'x' }`). Because getService is mocked below, that runtime failure is invisible
  * unless the exact `where` shape emitted by the handler is fed through the REAL validator.
  */
-import { IamGetAccountsService } from '@app/iam/account';
+import { IamGetAccountsService } from '@app/iam/account/index.js';
 import { QueryDslValidator } from '@aurorajs.dev/core-back';
 import { Test, TestingModule } from '@nestjs/testing';
-import { IamCheckUniqueEmailAccountHandler } from './iam-check-unique-email-account.handler';
+import { IamCheckUniqueEmailAccountHandler } from './iam-check-unique-email-account.handler.js';
 
 describe('IamCheckUniqueEmailAccountHandler', () => {
   let handler: IamCheckUniqueEmailAccountHandler;
-  const getService = { main: jest.fn() };
+  const getService = { main: vi.fn() };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
     const module: TestingModule = await Test.createTestingModule({
       providers: [
         IamCheckUniqueEmailAccountHandler,

package/dist/templates/backend/packages/iam/src/@app/iam/account/application/check-unique-email/iam-check-unique-email-account.handler.ts

@@ -2,7 +2,7 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/account.aurora.yaml
  */
-import { IamGetAccountsService } from '@app/iam/account';
+import { IamGetAccountsService } from '@app/iam/account/application/get/iam-get-accounts.service.js';
 import { HandlerMeta } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/account/application/check-unique-username/iam-check-unique-username-account.handler.spec.ts

@@ -7,17 +7,17 @@
  * (`{ eq: 'x' }`). Because getService is mocked below, that runtime failure is invisible
  * unless the exact `where` shape emitted by the handler is fed through the REAL validator.
  */
-import { IamGetAccountsService } from '@app/iam/account';
+import { IamGetAccountsService } from '@app/iam/account/index.js';
 import { QueryDslValidator } from '@aurorajs.dev/core-back';
 import { Test, TestingModule } from '@nestjs/testing';
-import { IamCheckUniqueUsernameAccountHandler } from './iam-check-unique-username-account.handler';
+import { IamCheckUniqueUsernameAccountHandler } from './iam-check-unique-username-account.handler.js';
 
 describe('IamCheckUniqueUsernameAccountHandler', () => {
   let handler: IamCheckUniqueUsernameAccountHandler;
-  const getService = { main: jest.fn() };
+  const getService = { main: vi.fn() };
 
   beforeEach(async () => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
     const module: TestingModule = await Test.createTestingModule({
       providers: [
         IamCheckUniqueUsernameAccountHandler,

package/dist/templates/backend/packages/iam/src/@app/iam/account/application/check-unique-username/iam-check-unique-username-account.handler.ts

@@ -2,7 +2,7 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/account.aurora.yaml
  */
-import { IamGetAccountsService } from '@app/iam/account';
+import { IamGetAccountsService } from '@app/iam/account/application/get/iam-get-accounts.service.js';
 import { HandlerMeta } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/account/application/count/iam-count-account.handler.ts

@@ -2,7 +2,7 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/account.aurora.yaml
  */
-import { IamCountAccountService } from '@app/iam/account';
+import { IamCountAccountService } from '@app/iam/account/application/count/iam-count-account.service.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/account/application/count/iam-count-account.service.ts

@@ -2,7 +2,7 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/account.aurora.yaml
  */
-import { IamDrizzleAccountRepository } from '@app/iam/account';
+import { IamDrizzleAccountRepository } from '@app/iam/account/infrastructure/drizzle/iam-drizzle-account.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/account/application/create/iam-create-account.handler.spec.ts

@@ -1,18 +1,20 @@
-import { IamAccount, IamAccountTypeEnum, IamCreateAccountInput } from '@api/graphql';
+import type { Mock } from 'vitest';
+import { IamAccount, IamAccountTypeEnum, IamCreateAccountInput } from '@api/graphql.js';
 import {
   IamCreateAccountService,
   IamFindAccountByIdService,
   IamGetAccountsService,
-} from '@app/iam/account';
-import { IamGetRolesService } from '@app/iam/role';
-import { IamPermissions } from '@app/iam/shared';
-import { IamGetTenantsService } from '@app/iam/tenant';
-import { IamCreateUserService } from '@app/iam/user';
-import { IAM_CLIENT_READER } from '@bridges/iam/client';
+} from '@app/iam/account/index.js';
+import { IamGetRolesService } from '@app/iam/role/index.js';
+import { IamPermissions } from '@app/iam/shared/index.js';
+import { IamGetTenantsService } from '@app/iam/tenant/index.js';
+import { IamCreateUserService } from '@app/iam/user/index.js';
+import { mapToAuthenticatedAccount } from '@bridges/iam/account/adapters/iam-account-loader.adapter.js';
+import { IAM_CLIENT_READER } from '@bridges/iam/client/index.js';
 import { BadRequestException, ConflictException } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { Test, TestingModule } from '@nestjs/testing';
-import { IamCreateAccountHandler } from './iam-create-account.handler';
+import { IamCreateAccountHandler } from './iam-create-account.handler.js';
 
 const ACCOUNT_ID = 'a1111111-a111-4111-8111-111111111111';
 const CLIENT_ID = 'c1111111-c111-4111-8111-111111111111';
@@ -34,46 +36,60 @@ const buildPayload = (overrides: Partial<IamCreateAccountInput> = {}): IamCreate
   clientId: CLIENT_ID,
   tags: null,
   scopes: null,
-  dApplicationCodes: [],
-  dPermissions: {},
-  dTenants: [],
+  hasAddChildTenants: false,
   meta: null,
   roleIds: [],
   tenantIds: [],
   ...overrides,
 });
 
+// Routed through the real `mapToAuthenticatedAccount` (not a hand-fabricated cast literal) so a
+// field the mapper forgets to carry — e.g. `hasAddChildTenants` — fails the tests that depend on
+// it instead of silently defaulting to `undefined` only in production.
 const buildCurrentAccount = (overrides: Partial<IamAccount> = {}): IamAccount =>
-  ({
+  mapToAuthenticatedAccount({
     id: CALLER_ID,
     dPermissions: { all: ['p1', 'p2', 'p3', IamPermissions.SUDO] },
     ...overrides,
-  }) as unknown as IamAccount;
+  } as unknown as IamAccount) as unknown as IamAccount;
+
+/**
+ * Asserting only the exception class would also pass for any other 400 (a type or null-element
+ * failure); the message binds the assertion to the readonly gate
+ * (`buildReadonlyFieldRejectedMessage` in `type-handler.types.ts`).
+ */
+const readonlyRejection = (field: string) => ({
+  response: {
+    message: expect.arrayContaining([
+      expect.stringMatching(new RegExp(`^${field}: property is readonly`)),
+    ]),
+  },
+});
 
 describe('IamCreateAccountHandler', () => {
   let handler: IamCreateAccountHandler;
-  let createService: { main: jest.Mock };
-  let findByIdService: { main: jest.Mock };
-  let getAccountsService: { main: jest.Mock };
-  let getRolesService: { main: jest.Mock };
-  let getTenantsService: { main: jest.Mock };
-  let clientReader: { findByIdWithApplications: jest.Mock };
-  let userCreateService: { main: jest.Mock };
-  let eventEmitter: { emit: jest.Mock };
+  let createService: { main: Mock };
+  let findByIdService: { main: Mock };
+  let getAccountsService: { main: Mock };
+  let getRolesService: { main: Mock };
+  let getTenantsService: { main: Mock };
+  let clientReader: { findByIdWithApplications: Mock };
+  let userCreateService: { main: Mock };
+  let eventEmitter: { emit: Mock };
 
   beforeEach(async () => {
-    createService = { main: jest.fn().mockResolvedValue(undefined) };
-    findByIdService = { main: jest.fn().mockResolvedValue({ id: ACCOUNT_ID }) };
-    getAccountsService = { main: jest.fn().mockResolvedValue([]) };
-    getRolesService = { main: jest.fn().mockResolvedValue([]) };
-    getTenantsService = { main: jest.fn().mockResolvedValue([]) };
+    createService = { main: vi.fn().mockResolvedValue(undefined) };
+    findByIdService = { main: vi.fn().mockResolvedValue({ id: ACCOUNT_ID }) };
+    getAccountsService = { main: vi.fn().mockResolvedValue([]) };
+    getRolesService = { main: vi.fn().mockResolvedValue([]) };
+    getTenantsService = { main: vi.fn().mockResolvedValue([]) };
     clientReader = {
-      findByIdWithApplications: jest
+      findByIdWithApplications: vi
         .fn()
         .mockResolvedValue({ id: CLIENT_ID, applicationCodes: ['APP_A'] }),
     };
-    userCreateService = { main: jest.fn().mockResolvedValue(undefined) };
-    eventEmitter = { emit: jest.fn() };
+    userCreateService = { main: vi.fn().mockResolvedValue(undefined) };
+    eventEmitter = { emit: vi.fn() };
 
     const module: TestingModule = await Test.createTestingModule({
       providers: [
@@ -149,6 +165,42 @@ describe('IamCreateAccountHandler', () => {
     expect(userCreateService.main).not.toHaveBeenCalled();
   });
 
+  it('rejects a client-supplied dApplicationCodes on create', async () => {
+    const payload = {
+      ...buildPayload(),
+      dApplicationCodes: ['APP_HACKED'],
+    } as IamCreateAccountInput;
+
+    await expect(handler.main(payload, buildCurrentAccount())).rejects.toMatchObject(
+      readonlyRejection('dApplicationCodes'),
+    );
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('rejects a client-supplied dPermissions on create', async () => {
+    const payload = {
+      ...buildPayload(),
+      dPermissions: { all: ['iam.sudo'] },
+    } as IamCreateAccountInput;
+
+    await expect(handler.main(payload, buildCurrentAccount())).rejects.toMatchObject(
+      readonlyRejection('dPermissions'),
+    );
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('rejects a client-supplied dTenants on create', async () => {
+    const payload = {
+      ...buildPayload(),
+      dTenants: [T_ROOT],
+    } as IamCreateAccountInput;
+
+    await expect(handler.main(payload, buildCurrentAccount())).rejects.toMatchObject(
+      readonlyRejection('dTenants'),
+    );
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
   it('rejects when email already exists', async () => {
     getAccountsService.main.mockResolvedValueOnce([
       { id: COLLIDER_ID, email: 'service@example.com', username: 'other', code: null },
@@ -196,7 +248,7 @@ describe('IamCreateAccountHandler', () => {
     );
   });
 
-  it('overrides dApplicationCodes and dPermissions with computed values', async () => {
+  it('computes dApplicationCodes and dPermissions from clientId/roleIds (D3 evidence)', async () => {
     clientReader.findByIdWithApplications.mockResolvedValueOnce({
       id: CLIENT_ID,
       applicationCodes: ['APP_X', 'APP_Y'],
@@ -205,10 +257,12 @@ describe('IamCreateAccountHandler', () => {
       { id: ROLE_ID, permissions: [{ name: 'p1' }, { name: 'p2' }] },
     ]);
 
+    // dApplicationCodes/dPermissions/dTenants are no longer declared on the TypeScript
+    // IamCreateAccountInput type, and a runtime payload that carries them is rejected by the
+    // readonly gate (see the sibling rejection tests above). This test only proves the
+    // server-side computation still reaches the service unconditionally.
     const payload = buildPayload({
       roleIds: [ROLE_ID],
-      dApplicationCodes: ['SHOULD_BE_DISCARDED'],
-      dPermissions: { all: ['SHOULD_BE_DISCARDED'] },
     });
 
     await handler.main(payload, buildCurrentAccount());
@@ -266,7 +320,65 @@ describe('IamCreateAccountHandler', () => {
     expect(createService.main).toHaveBeenCalledTimes(1);
   });
 
-  it('expands tenantIds with descendants when hasAddChildTenants is true', async () => {
+  it('rejects when caller without SUDO assigns a tenant outside their dTenants', async () => {
+    const payload = buildPayload({ tenantIds: [T_ROOT] });
+    const caller = buildCurrentAccount({
+      dPermissions: { all: ['p1'] },
+      dTenants: [T_OTHER],
+    });
+
+    await expect(handler.main(payload, caller)).rejects.toMatchObject({
+      response: { statusCode: 401, translation: 'iam.error.insufficientTenantScope' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('rejects when caller without SUDO widens hasAddChildTenants beyond their own dTenants', async () => {
+    getTenantsService.main.mockResolvedValueOnce([
+      { id: T_ROOT, parentId: null },
+      { id: T_CHILD_1, parentId: T_ROOT },
+    ]);
+
+    const payload = buildPayload({ tenantIds: [T_ROOT], hasAddChildTenants: true });
+    const caller = buildCurrentAccount({
+      dPermissions: { all: ['p1'] },
+      dTenants: [T_ROOT], // holds T_ROOT directly, but not its descendant T_CHILD_1
+    });
+
+    await expect(handler.main(payload, caller)).rejects.toMatchObject({
+      response: { statusCode: 401, translation: 'iam.error.insufficientTenantScope' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('allows a SUDO caller to widen hasAddChildTenants beyond their own dTenants', async () => {
+    getTenantsService.main.mockResolvedValueOnce([
+      { id: T_ROOT, parentId: null },
+      { id: T_CHILD_1, parentId: T_ROOT },
+    ]);
+
+    const payload = buildPayload({ tenantIds: [T_ROOT], hasAddChildTenants: true });
+    const caller = buildCurrentAccount({
+      dPermissions: { all: [IamPermissions.SUDO] },
+      dTenants: [],
+    });
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('allows a caller without SUDO to assign tenants fully inside their own dTenants', async () => {
+    const payload = buildPayload({ tenantIds: [T_ROOT] });
+    const caller = buildCurrentAccount({
+      dPermissions: { all: ['p1'] },
+      dTenants: [T_ROOT, T_OTHER],
+    });
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('persists only the direct tenantIds and expands descendants into dTenants when hasAddChildTenants is true', async () => {
     getTenantsService.main.mockResolvedValueOnce([
       { id: T_ROOT, parentId: null },
       { id: T_CHILD_1, parentId: T_ROOT },
@@ -278,7 +390,7 @@ describe('IamCreateAccountHandler', () => {
     await handler.main(payload, buildCurrentAccount());
 
     const persisted = createService.main.mock.calls[0][0];
-    expect(new Set(persisted.tenantIds)).toEqual(new Set([T_ROOT, T_CHILD_1, T_CHILD_2]));
+    expect(persisted.tenantIds).toEqual([T_ROOT]);
     expect(new Set(persisted.dTenants)).toEqual(new Set([T_ROOT, T_CHILD_1, T_CHILD_2]));
   });
 
@@ -291,6 +403,56 @@ describe('IamCreateAccountHandler', () => {
     expect(persisted.tenantIds).toEqual([T_ROOT]);
   });
 
+  it('rejects a non-SUDO caller whose own hasAddChildTenants is false setting it true on the new account', async () => {
+    const payload = buildPayload({ tenantIds: [], hasAddChildTenants: true });
+    const caller = buildCurrentAccount({
+      dPermissions: { all: ['p1'] },
+      dTenants: [],
+      hasAddChildTenants: false,
+    });
+
+    await expect(handler.main(payload, caller)).rejects.toMatchObject({
+      response: { statusCode: 401, translation: 'iam.error.insufficientHasAddChildTenantsScope' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('allows a non-SUDO caller whose own hasAddChildTenants is true to set it true on the new account', async () => {
+    const payload = buildPayload({ tenantIds: [], hasAddChildTenants: true });
+    const caller = buildCurrentAccount({
+      dPermissions: { all: ['p1'] },
+      dTenants: [],
+      hasAddChildTenants: true,
+    });
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('allows a SUDO caller to set hasAddChildTenants true regardless of their own flag', async () => {
+    const payload = buildPayload({ tenantIds: [], hasAddChildTenants: true });
+    const caller = buildCurrentAccount({
+      dPermissions: { all: [IamPermissions.SUDO] },
+      dTenants: [],
+      hasAddChildTenants: false,
+    });
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('persists the hasAddChildTenants flag itself, not only the tenant ids it derived', async () => {
+    getTenantsService.main.mockResolvedValueOnce([
+      { id: T_ROOT, parentId: null },
+      { id: T_CHILD_1, parentId: T_ROOT },
+    ]);
+
+    const payload = buildPayload({ tenantIds: [T_ROOT], hasAddChildTenants: true });
+    await handler.main(payload, buildCurrentAccount());
+
+    expect(createService.main.mock.calls[0][0].hasAddChildTenants).toBe(true);
+  });
+
   it('emits iam.account.created on success', async () => {
     await handler.main(buildPayload(), buildCurrentAccount());