ddd-ts-kit 0.13.0 → 0.15.0

package/templates/presets/identity/context/test/unit/accept-invitation.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { AcceptInvitationCommand } from '{{alias.context}}/application/commands/accept-invitation/accept-invitation.command{{alias.ext}}';
+import { AcceptInvitationController } from '{{alias.context}}/presentation/http/invitations/accept-invitation/accept-invitation.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /invitations/acceptance', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: { token: 'token-1' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/invitations/acceptance');
+    expect([response.status, response.body]).toEqual([200, { id: 'invitation-1' }]);
+    expect(sent).toMatchObject([{ token: 'token-1' }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: {}, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: AcceptInvitationCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(AcceptInvitationCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'invitation-1';
+    },
+  });
+
+  return { route: controllerRoute(new AcceptInvitationController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/accept-invitation.handler.spec.ts.tpl

@@ -0,0 +1,69 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InvitationStatus } from '{{alias.context}}/domain/vocabularies/invitation-status.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { AcceptInvitationCommand } from '{{alias.context}}/application/commands/accept-invitation/accept-invitation.command{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { anInvitation } from '{{alias.context}}/test/builders/invitation.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity, startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+describe('Accept invitation', () => {
+  it('makes the person it was sent to a member, in its role, and tells the provider and the other contexts', async () => {
+    const { application, accounts, invitations, members, identityProvider, tokens, as } = await startedIdentity();
+    const token = tokens.issue();
+
+    await accounts.save(anAccount().identifiedBy('subject-grace').reachedAt('grace@example.test').build());
+
+    await invitations.save(
+      anInvitation().identifiedBy('invitation-1').to('acme').as(MemberRole.Admin).withTokenHash(token.digest).build(),
+    );
+
+    await application.commandBus.execute(new AcceptInvitationCommand(as('subject-grace'), token.token));
+
+    expect((await members.findOf('acme', 'subject-grace'))?.role).toBe(MemberRole.Admin);
+    expect((await invitations.findById('invitation-1'))?.status).toBe(InvitationStatus.Accepted);
+    expect(identityProvider.asked).toEqual(['add subject-grace to acme']);
+    expect(application.eventBus.published).toMatchObject([{ type: '{{context.kebab}}.member.joined' }]);
+  });
+
+  it('knows no token it did not issue, and no person who never signed in', async () => {
+    const { application, invitations, tokens, as } = arrangeIdentity();
+    const token = tokens.issue();
+
+    await invitations.save(anInvitation().withTokenHash(token.digest).build());
+
+    await expect(
+      application.commandBus.execute(new AcceptInvitationCommand(as('subject-grace'), 'forged')),
+    ).rejects.toMatchObject({
+      code: 'INVITATION_NOT_FOUND',
+    });
+
+    await expect(
+      application.commandBus.execute(new AcceptInvitationCommand(as('subject-ghost'), token.token)),
+    ).rejects.toMatchObject({
+      code: 'ACCOUNT_NOT_FOUND',
+    });
+  });
+
+  it('refuses another person than the one it was sent to, and a member already there', async () => {
+    const { application, accounts, invitations, members, tokens, as } = arrangeIdentity();
+    const token = tokens.issue();
+
+    await accounts.save(anAccount().identifiedBy('subject-alan').reachedAt('alan@example.test').build());
+    await accounts.save(anAccount().identifiedBy('subject-grace').reachedAt('grace@example.test').build());
+    await invitations.save(anInvitation().to('acme').withTokenHash(token.digest).build());
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    await expect(
+      application.commandBus.execute(new AcceptInvitationCommand(as('subject-alan'), token.token)),
+    ).rejects.toMatchObject({
+      code: 'INVITATION_ADDRESSED_TO_ANOTHER',
+    });
+
+    await expect(
+      application.commandBus.execute(new AcceptInvitationCommand(as('subject-grace'), token.token)),
+    ).rejects.toMatchObject({
+      code: 'ALREADY_MEMBER',
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/account-deactivated.integration-handler.spec.ts.tpl

@@ -0,0 +1,24 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { accountDeactivatedV1 } from '{{alias.context}}/published-language/account-deactivated.v1.integration-event{{alias.ext}}';
+import { startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const deactivation = accountDeactivatedV1.create(
+  { accountId: 'subject-ada' },
+  { id: 'event-1', occurredAt: '2026-01-01T00:00:00.000Z' },
+);
+
+describe('When an account is deactivated, the identity provider follows', () => {
+  it('disables the person once, asked again after a failure until it answers: a deactivation is never lost', async () => {
+    const { application, identityProvider } = await startedIdentity();
+
+    identityProvider.failWith(new Error('provider unreachable'));
+
+    await expect(application.eventBus.publish([deactivation])).rejects.toThrow();
+
+    identityProvider.answerAgain();
+    await application.eventBus.publish([deactivation]);
+    await application.eventBus.publish([deactivation]);
+
+    expect(identityProvider.asked).toEqual(['disable subject-ada']);
+  });
+});

package/templates/presets/identity/context/test/unit/account-deactivated.publisher.spec.ts.tpl

@@ -0,0 +1,25 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { AccountDeactivatedPublisher } from '{{alias.context}}/application/integration/publishers/account-deactivated.publisher{{alias.ext}}';
+import { AccountDeactivated } from '{{alias.context}}/domain/events/account-deactivated.event{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "account deactivated" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.account.deactivated, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new AccountDeactivatedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new AccountDeactivated('subject-ada', at));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.account.deactivated',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { accountId: 'subject-ada' },
+      },
+    ]);
+  });
+});

package/templates/presets/identity/context/test/unit/account.aggregate.spec.ts.tpl

@@ -0,0 +1,72 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { given } from '@ddd-ts-kit/testing';
+import { Account } from '{{alias.context}}/domain/aggregates/account.aggregate{{alias.ext}}';
+import { DisplayName } from '{{alias.context}}/domain/value-objects/display-name.vo{{alias.ext}}';
+import { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+
+const signedIn = new Date('2026-02-01T00:00:00.000Z');
+const later = new Date('2026-02-02T00:00:00.000Z');
+const profile = { email: EmailAddress.create('ada@example.test'), displayName: DisplayName.create('Ada Lovelace') };
+
+describe('Account', () => {
+  it('is provisioned under the subject of the provider, active, and announces who it is', () => {
+    const account = Account.provision('subject-ada', profile, signedIn);
+
+    expect(account.id).toBe('subject-ada');
+    expect(account.isActive).toBe(true);
+
+    expect(account.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.account.provisioned',
+        aggregateId: 'subject-ada',
+        occurredAt: signedIn,
+        facts: { email: 'ada@example.test', displayName: 'Ada Lovelace' },
+      },
+    ]);
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = anAccount().build();
+    const loaded = Account.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});
+
+describe('An active account', () => {
+  it('takes the profile the provider holds at a later sign-in, silently', () => {
+    const renamed = { email: EmailAddress.create('ada@lovelace.test'), displayName: DisplayName.create('Countess') };
+
+    given(anAccount())
+      .when((account) => account.refreshProfile(renamed))
+      .thenNoEvent()
+      .thenState((account) => expect([account.email.value, account.displayName.value]).toEqual(['ada@lovelace.test', 'Countess']));
+  });
+
+  it('is deactivated once, and announces it', () => {
+    given(anAccount().identifiedBy('subject-ada'))
+      .when((account) => account.deactivate(later))
+      .thenEvents([{ name: '{{context.kebab}}.account.deactivated', aggregateId: 'subject-ada', occurredAt: later }])
+      .thenState((account) => expect(account.isActive).toBe(false));
+  });
+});
+
+describe('A deactivated account', () => {
+  it('refuses to be deactivated again', () => {
+    given(anAccount().deactivatedAt(signedIn))
+      .when((account) => account.deactivate(later))
+      .thenError('ACCOUNT_ALREADY_DEACTIVATED');
+  });
+
+  it('refuses a new profile, and every intention that asks it to be active', () => {
+    given(anAccount().deactivatedAt(signedIn))
+      .when((account) => account.refreshProfile(profile))
+      .thenError('ACCOUNT_DEACTIVATED');
+
+    given(anAccount().deactivatedAt(signedIn))
+      .when((account) => account.assertActive())
+      .thenError('ACCOUNT_DEACTIVATED');
+  });
+});

package/templates/presets/identity/context/test/unit/change-member-role.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { ChangeMemberRoleCommand } from '{{alias.context}}/application/commands/change-member-role/change-member-role.command{{alias.ext}}';
+import { ChangeMemberRoleController } from '{{alias.context}}/presentation/http/organisations/change-member-role/change-member-role.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('PUT /organisations/:organisationId/members/:accountId/role', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme', accountId: 'subject-grace' }, query: {}, headers: {}, body: { role: 'member' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/organisations/:organisationId/members/:accountId/role');
+    expect([response.status, response.body]).toEqual([200, { id: 'member-1' }]);
+    expect(sent).toMatchObject([{ organisationId: 'acme', accountId: 'subject-grace', role: 'member' }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme', accountId: 'subject-grace' }, query: {}, headers: {}, body: { role: 'emperor' }, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: ChangeMemberRoleCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(ChangeMemberRoleCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'member-1';
+    },
+  });
+
+  return { route: controllerRoute(new ChangeMemberRoleController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/change-member-role.handler.spec.ts.tpl

@@ -0,0 +1,135 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { ChangeMemberRoleCommand } from '{{alias.context}}/application/commands/change-member-role/change-member-role.command{{alias.ext}}';
+import { aDelegation } from '{{alias.context}}/test/builders/delegation.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { anOrganisation } from '{{alias.context}}/test/builders/organisation.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const DAY = 86_400_000;
+
+describe('Change member role', () => {
+  it('gives the member the new role, tells the other contexts, and ends the delegations they gave', async () => {
+    const arranged = arrangeIdentity();
+    const { application, members, delegations, as } = arranged;
+    const now = application.clock.now();
+
+    await acmeOwnedBy(arranged, 'subject-ada', 'subject-grace');
+    await members.save(aMember().of('acme', 'subject-alan').build());
+
+    await delegations.save(
+      aDelegation()
+        .identifiedBy('delegation-1')
+        .from('subject-grace')
+        .to('subject-alan')
+        .lending(MemberRight.InviteMembers)
+        .between(now, new Date(now.getTime() + DAY))
+        .build(),
+    );
+
+    const before = application.eventBus.published.length;
+
+    await application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-ada'), 'acme', 'subject-grace', MemberRole.Member));
+
+    expect((await members.findOf('acme', 'subject-grace'))?.role).toBe(MemberRole.Member);
+    expect((await delegations.findById('delegation-1'))?.isActiveAt(now)).toBe(false);
+
+    expect(application.eventBus.published.slice(before).map((event) => event.type)).toEqual([
+      '{{context.kebab}}.member.role-changed',
+      '{{context.kebab}}.delegation.revoked',
+    ]);
+  });
+
+  it('never changes the role of who asks: another member does', async () => {
+    const arranged = arrangeIdentity();
+
+    await acmeOwnedBy(arranged, 'subject-ada', 'subject-grace');
+
+    await expect(
+      arranged.application.commandBus.execute(new ChangeMemberRoleCommand(arranged.as('subject-ada'), 'acme', 'subject-ada', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'OWN_ROLE' });
+  });
+
+  it('refuses a person who is not a member, and an admin who touches an owner', async () => {
+    const arranged = arrangeIdentity();
+    const { application, members, as } = arranged;
+
+    await acmeOwnedBy(arranged, 'subject-ada');
+    await members.save(aMember().of('acme', 'subject-grace').as(MemberRole.Admin).build());
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-grace'), 'acme', 'subject-nobody', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'MEMBER_NOT_FOUND' });
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-grace'), 'acme', 'subject-ada', MemberRole.Member)),
+    ).rejects.toMatchObject({ code: 'OWNERS_ONLY' });
+  });
+
+  it('is refused to a member who does not manage the members', async () => {
+    const arranged = arrangeIdentity();
+
+    await acmeOwnedBy(arranged, 'subject-ada');
+    await arranged.members.save(aMember().of('acme', 'subject-alan').build());
+    await arranged.members.save(aMember().of('acme', 'subject-grace').build());
+
+    await expect(
+      arranged.application.commandBus.execute(new ChangeMemberRoleCommand(arranged.as('subject-alan'), 'acme', 'subject-grace', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+  });
+});
+
+describe('Change member role under a delegation', () => {
+  it('never turns the delegation into a role: the delegate does not promote themselves', async () => {
+    const { application, as } = await delegateOfAlan();
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-alan'), 'acme', 'subject-alan', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'OWN_ROLE' });
+  });
+
+  it('keeps the delegate within their own role: they appoint nobody above it, and touch nobody above it', async () => {
+    const { application, as } = await delegateOfAlan();
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-alan'), 'acme', 'subject-grace', MemberRole.Admin)),
+    ).rejects.toMatchObject({ code: 'ABOVE_OWN_ROLE' });
+
+    await expect(
+      application.commandBus.execute(new ChangeMemberRoleCommand(as('subject-alan'), 'acme', 'subject-linus', MemberRole.Member)),
+    ).rejects.toMatchObject({ code: 'ABOVE_OWN_ROLE' });
+  });
+});
+
+/** The organisation `acme`, with an owner of each name given. */
+async function acmeOwnedBy(arranged: ReturnType<typeof arrangeIdentity>, ...owners: readonly string[]): Promise<void> {
+  await arranged.organisations.save(anOrganisation().identifiedBy('acme').build());
+
+  for (const owner of owners) {
+    await arranged.members.save(aMember().of('acme', owner).as(MemberRole.Owner).build());
+  }
+}
+
+/** A member lent the right to manage the members of acme for a day. */
+async function delegateOfAlan(): Promise<ReturnType<typeof arrangeIdentity>> {
+  const arranged = arrangeIdentity();
+  const now = arranged.application.clock.now();
+
+  await acmeOwnedBy(arranged, 'subject-ada');
+  await arranged.members.save(aMember().of('acme', 'subject-alan').build());
+  await arranged.members.save(aMember().of('acme', 'subject-grace').build());
+  await arranged.members.save(aMember().of('acme', 'subject-linus').as(MemberRole.Admin).build());
+
+  await arranged.delegations.save(
+    aDelegation()
+      .identifiedBy('delegation-1')
+      .from('subject-ada')
+      .to('subject-alan')
+      .lending(MemberRight.ManageMembers)
+      .between(now, new Date(now.getTime() + DAY))
+      .build(),
+  );
+
+  return arranged;
+}

package/templates/presets/identity/context/test/unit/crypto-invitation-tokens.adapter.spec.ts.tpl

@@ -0,0 +1,15 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { CryptoInvitationTokens } from '{{alias.context}}/infrastructure/external/crypto-invitation-tokens.adapter{{alias.ext}}';
+
+describe('CryptoInvitationTokens', () => {
+  it('issues a new token each time, fit for an address, with the digest it is found by', () => {
+    const tokens = new CryptoInvitationTokens();
+    const first = tokens.issue();
+    const second = tokens.issue();
+
+    expect(first.token).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(first.token).not.toBe(second.token);
+    expect(first.digest).toBe(tokens.digestOf(first.token));
+    expect(first.digest).toMatch(/^[0-9a-f]{64}$/);
+  });
+});

package/templates/presets/identity/context/test/unit/deactivate-account.controller.spec.ts.tpl

@@ -0,0 +1,44 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { DeactivateAccountCommand } from '{{alias.context}}/application/commands/deactivate-account/deactivate-account.command{{alias.ext}}';
+import { DeactivateAccountController } from '{{alias.context}}/presentation/http/accounts/deactivate-account/deactivate-account.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /accounts/me/deactivation', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: {}, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/accounts/me/deactivation');
+    expect([response.status, response.body]).toEqual([200, { id: 'subject-ada' }]);
+    expect(sent).toMatchObject([{ actor: { id: 'subject-ada' } }]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: DeactivateAccountCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(DeactivateAccountCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'subject-ada';
+    },
+  });
+
+  return { route: controllerRoute(new DeactivateAccountController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/deactivate-account.handler.spec.ts.tpl

@@ -0,0 +1,106 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { offsetPage } from '@ddd-ts-kit/kernel';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { DeactivateAccountCommand } from '{{alias.context}}/application/commands/deactivate-account/deactivate-account.command{{alias.ext}}';
+import { InviteMemberCommand } from '{{alias.context}}/application/commands/invite-member/invite-member.command{{alias.ext}}';
+import { RemoveMemberCommand } from '{{alias.context}}/application/commands/remove-member/remove-member.command{{alias.ext}}';
+import { SearchMembersQuery } from '{{alias.context}}/application/queries/search-members/search-members.query{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { aDelegation } from '{{alias.context}}/test/builders/delegation.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { anOrganisation } from '{{alias.context}}/test/builders/organisation.builder{{alias.ext}}';
+import { arrangeIdentity, startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const DAY = 86_400_000;
+
+describe('Deactivate account', () => {
+  it('deactivates the account of the person who asks, tells the other contexts, then the provider', async () => {
+    const { application, accounts, identityProvider, as } = await startedIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-ada').build());
+    await application.commandBus.execute(new DeactivateAccountCommand(as('subject-ada')));
+
+    expect((await accounts.findById('subject-ada'))?.isActive).toBe(false);
+    expect(identityProvider.asked).toEqual(['disable subject-ada']);
+
+    expect(application.eventBus.published).toMatchObject([
+      { type: '{{context.kebab}}.account.deactivated', payload: { accountId: 'subject-ada' } },
+    ]);
+  });
+
+  it('leaves every organisation and ends every delegation, so that the account holds no right anywhere', async () => {
+    const { application, accounts, organisations, members, delegations, as } = arrangeIdentity();
+    const now = application.clock.now();
+
+    await accounts.save(anAccount().identifiedBy('subject-grace').build());
+
+    for (const slug of ['acme', 'globex']) {
+      await organisations.save(anOrganisation().identifiedBy(slug).build());
+      await members.save(aMember().of(slug, 'subject-ada').as(MemberRole.Owner).build());
+      await members.save(aMember().of(slug, 'subject-grace').as(MemberRole.Admin).build());
+    }
+
+    await delegations.save(
+      aDelegation()
+        .identifiedBy('delegation-1')
+        .in('acme')
+        .from('subject-ada')
+        .to('subject-grace')
+        .lending(MemberRight.GrantDelegations)
+        .between(now, new Date(now.getTime() + DAY))
+        .build(),
+    );
+
+    await application.commandBus.execute(new DeactivateAccountCommand(as('subject-grace')));
+
+    expect(await members.searchCurrentOf('subject-grace')).toEqual([]);
+    expect((await delegations.findById('delegation-1'))?.isActiveAt(now)).toBe(false);
+  });
+
+  it('leaves a deactivated person no use case of an organisation, whatever their token still says', async () => {
+    const { application, accounts, organisations, members, as } = arrangeIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-grace').build());
+    await organisations.save(anOrganisation().identifiedBy('acme').build());
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+    await members.save(aMember().of('acme', 'subject-grace').as(MemberRole.Owner).build());
+    await members.save(aMember().of('acme', 'subject-alan').build());
+    await application.commandBus.execute(new DeactivateAccountCommand(as('subject-grace')));
+
+    const invite = new InviteMemberCommand(as('subject-grace'), 'acme', { email: 'eve@example.test', role: MemberRole.Member });
+    const remove = new RemoveMemberCommand(as('subject-grace'), 'acme', 'subject-alan');
+    const search = new SearchMembersQuery(as('subject-grace'), 'acme', offsetPage({ limit: 20 }));
+
+    await expect(application.commandBus.execute(invite)).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    await expect(application.commandBus.execute(remove)).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    await expect(application.queryBus.execute(search)).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    expect(await members.countOwners('acme')).toBe(1);
+  });
+
+  it('refuses the last owner of an organisation, who appoints another owner first, and changes nothing', async () => {
+    const { application, accounts, organisations, members, as } = arrangeIdentity();
+
+    await accounts.save(anAccount().identifiedBy('subject-ada').build());
+    await organisations.save(anOrganisation().identifiedBy('acme').build());
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+
+    await expect(application.commandBus.execute(new DeactivateAccountCommand(as('subject-ada')))).rejects.toMatchObject(
+      {
+        code: 'LAST_OWNER',
+      },
+    );
+
+    expect((await accounts.findById('subject-ada'))?.isActive).toBe(true);
+  });
+
+  it('refuses a person who never signed in', async () => {
+    const { application, as } = arrangeIdentity();
+
+    await expect(
+      application.commandBus.execute(new DeactivateAccountCommand(as('subject-ghost'))),
+    ).rejects.toMatchObject({
+      code: 'ACCOUNT_NOT_FOUND',
+    });
+  });
+});