ddd-ts-kit 0.13.0 → 0.15.0

package/templates/presets/identity/context/test/unit/decline-invitation.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { DeclineInvitationCommand } from '{{alias.context}}/application/commands/decline-invitation/decline-invitation.command{{alias.ext}}';
+import { DeclineInvitationController } from '{{alias.context}}/presentation/http/invitations/decline-invitation/decline-invitation.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /invitations/declination', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: { token: 'token-1' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/invitations/declination');
+    expect([response.status, response.body]).toEqual([200, { id: 'invitation-1' }]);
+    expect(sent).toMatchObject([{ token: 'token-1' }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: {}, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: DeclineInvitationCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(DeclineInvitationCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'invitation-1';
+    },
+  });
+
+  return { route: controllerRoute(new DeclineInvitationController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/decline-invitation.handler.spec.ts.tpl

@@ -0,0 +1,40 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InvitationStatus } from '{{alias.context}}/domain/vocabularies/invitation-status.vocabulary{{alias.ext}}';
+import { DeclineInvitationCommand } from '{{alias.context}}/application/commands/decline-invitation/decline-invitation.command{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { anInvitation } from '{{alias.context}}/test/builders/invitation.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+describe('Decline invitation', () => {
+  it('records the answer of the person it was sent to, who joins nothing', async () => {
+    const { application, accounts, invitations, members, tokens, as } = arrangeIdentity();
+    const token = tokens.issue();
+
+    await accounts.save(anAccount().identifiedBy('subject-grace').reachedAt('grace@example.test').build());
+    await invitations.save(anInvitation().identifiedBy('invitation-1').withTokenHash(token.digest).build());
+
+    await application.commandBus.execute(new DeclineInvitationCommand(as('subject-grace'), token.token));
+
+    expect((await invitations.findById('invitation-1'))?.status).toBe(InvitationStatus.Declined);
+    expect(members.all()).toEqual([]);
+  });
+
+  it('knows no token it did not issue, and no person who never signed in', async () => {
+    const { application, invitations, tokens, as } = arrangeIdentity();
+    const token = tokens.issue();
+
+    await invitations.save(anInvitation().withTokenHash(token.digest).build());
+
+    await expect(
+      application.commandBus.execute(new DeclineInvitationCommand(as('subject-grace'), 'forged')),
+    ).rejects.toMatchObject({
+      code: 'INVITATION_NOT_FOUND',
+    });
+
+    await expect(
+      application.commandBus.execute(new DeclineInvitationCommand(as('subject-ghost'), token.token)),
+    ).rejects.toMatchObject({
+      code: 'ACCOUNT_NOT_FOUND',
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/delegation-granted.publisher.spec.ts.tpl

@@ -0,0 +1,36 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { DelegationGrantedPublisher } from '{{alias.context}}/application/integration/publishers/delegation-granted.publisher{{alias.ext}}';
+import { DelegationGranted } from '{{alias.context}}/domain/events/delegation-granted.event{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "delegation granted" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.delegation.granted, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new DelegationGrantedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new DelegationGranted('delegation-1', at, { organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace', rights: [MemberRight.InviteMembers], startsAt: at, endsAt: new Date('2026-01-15T00:00:00.000Z') }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.delegation.granted',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { delegationId: 'delegation-1', organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace', rights: ['invite-members'], startsAt: '2026-01-01T00:00:00.000Z', endsAt: '2026-01-15T00:00:00.000Z' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new DelegationGrantedPublisher(bus, new SequentialIdGenerator('event')).handle(new DelegationGranted('delegation-1', at, { organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace', rights: [MemberRight.InviteMembers], startsAt: at, endsAt: new Date('2026-01-15T00:00:00.000Z') }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/delegation-period.vo.spec.ts.tpl

@@ -0,0 +1,32 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { expectRefusal } from '@ddd-ts-kit/testing';
+import { DelegationPeriod } from '{{alias.context}}/domain/value-objects/delegation-period.vo{{alias.ext}}';
+
+const start = new Date('2026-03-01T00:00:00.000Z');
+const end = new Date('2026-03-15T00:00:00.000Z');
+
+describe('DelegationPeriod', () => {
+  it('holds from its start, included, to its end, excluded', () => {
+    const period = DelegationPeriod.create(start, end);
+
+    expect(period.includes(start)).toBe(true);
+    expect(period.includes(new Date('2026-03-14T23:59:59.999Z'))).toBe(true);
+    expect(period.includes(end)).toBe(false);
+    expect(period.includes(new Date('2026-02-28T23:59:59.999Z'))).toBe(false);
+  });
+
+  it('refuses to end before it starts, or when it starts', () => {
+    expectRefusal(() => DelegationPeriod.create(end, start), 'DELEGATION_PERIOD_INVERTED');
+    expectRefusal(() => DelegationPeriod.create(start, start), 'DELEGATION_PERIOD_INVERTED');
+  });
+
+  it('lasts ninety days at most', () => {
+    expect(DelegationPeriod.create(start, new Date('2026-05-30T00:00:00.000Z')).endsAt).toEqual(
+      new Date('2026-05-30T00:00:00.000Z'),
+    );
+
+    expectRefusal(() => DelegationPeriod.create(start, new Date('2026-05-30T00:00:00.001Z')), 'DELEGATION_TOO_LONG', {
+      longestDays: 90,
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/delegation-revoked.publisher.spec.ts.tpl

@@ -0,0 +1,35 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { DelegationRevokedPublisher } from '{{alias.context}}/application/integration/publishers/delegation-revoked.publisher{{alias.ext}}';
+import { DelegationRevoked } from '{{alias.context}}/domain/events/delegation-revoked.event{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "delegation revoked" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.delegation.revoked, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new DelegationRevokedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new DelegationRevoked('delegation-1', at, { organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace' }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.delegation.revoked',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { delegationId: 'delegation-1', organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new DelegationRevokedPublisher(bus, new SequentialIdGenerator('event')).handle(new DelegationRevoked('delegation-1', at, { organisationId: 'acme', delegatorId: 'subject-ada', delegateId: 'subject-grace' }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/delegation.aggregate.spec.ts.tpl

@@ -0,0 +1,111 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { given } from '@ddd-ts-kit/testing';
+import { Delegation, type DelegationTerms } from '{{alias.context}}/domain/aggregates/delegation.aggregate{{alias.ext}}';
+import { DelegationPeriod } from '{{alias.context}}/domain/value-objects/delegation-period.vo{{alias.ext}}';
+import { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { aDelegation } from '{{alias.context}}/test/builders/delegation.builder{{alias.ext}}';
+
+const startsAt = new Date('2026-03-01T00:00:00.000Z');
+const endsAt = new Date('2026-03-15T00:00:00.000Z');
+const during = new Date('2026-03-05T00:00:00.000Z');
+const period = DelegationPeriod.create(startsAt, endsAt);
+const adminRights = OrganisationRights.of('acme', 'subject-ada', [MemberRight.ReadMembers, MemberRight.InviteMembers]);
+
+describe('Delegation', () => {
+  it('lends rights the delegator holds, for a period, and announces its terms', () => {
+    const granted = Delegation.grant('delegation-1', lending([MemberRight.InviteMembers]), startsAt);
+
+    expect(granted.isActiveAt(during)).toBe(true);
+
+    expect(granted.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.delegation.granted',
+        aggregateId: 'delegation-1',
+        occurredAt: startsAt,
+        facts: {
+          organisationId: 'acme',
+          delegatorId: 'subject-ada',
+          delegateId: 'subject-grace',
+          rights: [MemberRight.InviteMembers],
+          startsAt,
+          endsAt,
+        },
+      },
+    ]);
+  });
+
+  it('lends nothing beyond what the delegator holds, nothing to the delegator, and something', () => {
+    expect(() => Delegation.grant('d', lending([MemberRight.ManageMembers]), startsAt)).toThrow(
+      expect.objectContaining({ code: 'DELEGATION_BEYOND_RIGHTS', facts: { right: MemberRight.ManageMembers } }),
+    );
+
+    expect(() => Delegation.grant('d', lending([MemberRight.InviteMembers], 'subject-ada'), startsAt)).toThrow(
+      expect.objectContaining({ code: 'DELEGATION_TO_ONESELF' }),
+    );
+
+    expect(() => Delegation.grant('d', lending([]), startsAt)).toThrow(
+      expect.objectContaining({ code: 'DELEGATION_WITHOUT_RIGHTS' }),
+    );
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = aDelegation().build();
+    const loaded = Delegation.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});
+
+describe('A granted delegation', () => {
+  it('holds during its period only', () => {
+    const granted = aDelegation().between(startsAt, endsAt).build();
+
+    expect([granted.isActiveAt(startsAt), granted.isActiveAt(during), granted.isActiveAt(endsAt)]).toEqual([
+      true,
+      true,
+      false,
+    ]);
+  });
+
+  it('is revoked while it holds, and announces it', () => {
+    given(aDelegation().identifiedBy('delegation-1').between(startsAt, endsAt))
+      .when((delegation) => delegation.revoke(during))
+      .thenEvents([
+        {
+          name: '{{context.kebab}}.delegation.revoked',
+          aggregateId: 'delegation-1',
+          facts: { organisationId: 'acme', delegatorId: 'account-owner', delegateId: 'account-deputy' },
+        },
+      ])
+      .thenState((delegation) => expect(delegation.isActiveAt(during)).toBe(false));
+  });
+
+  it('is revoked no more once it ended', () => {
+    given(aDelegation().between(startsAt, endsAt))
+      .when((delegation) => delegation.revoke(endsAt))
+      .thenError('DELEGATION_NOT_ACTIVE');
+
+    const revoked = aDelegation().between(startsAt, endsAt).build();
+
+    revoked.revoke(during);
+
+    given(revoked)
+      .when((delegation) => delegation.revoke(during))
+      .thenError('DELEGATION_NOT_ACTIVE');
+  });
+
+  it('ends once with the standing it was granted under, and a second end changes nothing', () => {
+    given(aDelegation().between(startsAt, endsAt))
+      .when((delegation) => {
+        delegation.end(during);
+        delegation.end(during);
+      })
+      .thenEventNames(['{{context.kebab}}.delegation.revoked']);
+  });
+});
+
+function lending(rights: readonly MemberRight[], delegateId = 'subject-grace'): DelegationTerms {
+  return { organisationId: 'acme', delegatorId: 'subject-ada', delegateId, rights, period, held: adminRights };
+}

package/templates/presets/identity/context/test/unit/display-name.vo.spec.ts.tpl

@@ -0,0 +1,13 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { expectRefusal } from '@ddd-ts-kit/testing';
+import { DisplayName } from '{{alias.context}}/domain/value-objects/display-name.vo{{alias.ext}}';
+
+describe('DisplayName', () => {
+  it('is what the person wrote, without the spaces at its ends', () => {
+    expect(DisplayName.create('  Grace Hopper ').value).toBe('Grace Hopper');
+  });
+
+  it.each(['', '   ', 'x'.repeat(101)])('refuses a name of %s characters out of bounds', (raw) => {
+    expectRefusal(() => DisplayName.create(raw), 'INVALID_DISPLAY_NAME', { raw });
+  });
+});

package/templates/presets/identity/context/test/unit/email-address.vo.spec.ts.tpl

@@ -0,0 +1,24 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { expectRefusal } from '@ddd-ts-kit/testing';
+import { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+
+describe('EmailAddress', () => {
+  it('is one address whatever the case and the spaces around it', () => {
+    const typed = EmailAddress.create('  Ada.Lovelace@Example.ORG ');
+
+    expect(typed.value).toBe('ada.lovelace@example.org');
+    expect(typed.equals(EmailAddress.create('ada.lovelace@example.org'))).toBe(true);
+  });
+
+  it.each([
+    '',
+    'ada',
+    'ada@',
+    '@example.org',
+    'ada@example',
+    'ada lovelace@example.org',
+    `${'a'.repeat(250)}@example.org`,
+  ])('refuses "%s", which is no address', (raw) => {
+    expectRefusal(() => EmailAddress.create(raw), 'INVALID_EMAIL_ADDRESS', { raw });
+  });
+});

package/templates/presets/identity/context/test/unit/environment-identity-provider-connection.adapter.spec.ts.tpl

@@ -0,0 +1,41 @@
+import { afterEach, describe, expect, it } from '{{tests.module}}';
+import { EnvironmentIdentityProviderConnection } from '{{alias.context}}/infrastructure/external/environment-identity-provider-connection.adapter{{alias.ext}}';
+
+const VARIABLES = ['KEYCLOAK_URL', 'KEYCLOAK_REALM', 'IDENTITY_PROVIDER_ADMIN_CLIENT_ID', 'IDENTITY_PROVIDER_ADMIN_CLIENT_SECRET'];
+const saved = Object.fromEntries(VARIABLES.map((name) => [name, process.env[name]]));
+
+afterEach(() => {
+  for (const name of VARIABLES) {
+    const value = saved[name];
+
+    if (value === undefined) {
+      Reflect.deleteProperty(process.env, name);
+    } else {
+      process.env[name] = value;
+    }
+  }
+});
+
+describe('EnvironmentIdentityProviderConnection', () => {
+  it('reads the connection when a call needs it, the trailing slash of the address left out', async () => {
+    process.env['KEYCLOAK_URL'] = 'http://127.0.0.1:8080/';
+    process.env['KEYCLOAK_REALM'] = 'acme';
+    process.env['IDENTITY_PROVIDER_ADMIN_CLIENT_ID'] = 'identity-admin';
+    process.env['IDENTITY_PROVIDER_ADMIN_CLIENT_SECRET'] = 'local-secret';
+
+    await expect(new EnvironmentIdentityProviderConnection().settings()).resolves.toEqual({
+      baseUrl: 'http://127.0.0.1:8080',
+      realm: 'acme',
+      clientId: 'identity-admin',
+      clientSecret: 'local-secret',
+    });
+  });
+
+  it('names the variable that is missing, never a value', async () => {
+    for (const name of VARIABLES) {
+      Reflect.deleteProperty(process.env, name);
+    }
+
+    await expect(new EnvironmentIdentityProviderConnection().settings()).rejects.toThrow('KEYCLOAK_URL is not set');
+  });
+});

package/templates/presets/identity/context/test/unit/grant-delegation.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { GrantDelegationCommand } from '{{alias.context}}/application/commands/grant-delegation/grant-delegation.command{{alias.ext}}';
+import { GrantDelegationController } from '{{alias.context}}/presentation/http/organisations/grant-delegation/grant-delegation.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /organisations/:organisationId/delegations', () => {
+  it('answers 201 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme' }, query: {}, headers: {}, body: { delegateId: 'subject-grace', rights: ['invite-members'], startsAt: '2026-01-01T00:00:00.000Z', endsAt: '2026-01-15T00:00:00.000Z' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/organisations/:organisationId/delegations');
+    expect([response.status, response.body]).toEqual([201, { id: 'delegation-1' }]);
+    expect(sent).toMatchObject([{ organisationId: 'acme', terms: { delegateId: 'subject-grace', rights: ['invite-members'], startsAt: new Date('2026-01-01T00:00:00.000Z'), endsAt: new Date('2026-01-15T00:00:00.000Z') } }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme' }, query: {}, headers: {}, body: { delegateId: 'subject-grace', rights: ['rule-the-world'], startsAt: '2026-01-01T00:00:00.000Z', endsAt: '2026-01-15T00:00:00.000Z' }, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: GrantDelegationCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(GrantDelegationCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'delegation-1';
+    },
+  });
+
+  return { route: controllerRoute(new GrantDelegationController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/grant-delegation.handler.spec.ts.tpl

@@ -0,0 +1,66 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { GrantDelegationCommand } from '{{alias.context}}/application/commands/grant-delegation/grant-delegation.command{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const startsAt = new Date('2026-01-01T00:00:00.000Z');
+const endsAt = new Date('2026-01-15T00:00:00.000Z');
+
+describe('Grant delegation', () => {
+  it('lends a right of the role of the owner to another member for a period, and tells the other contexts', async () => {
+    const { application, members, delegations, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    const before = application.eventBus.published.length;
+
+    const id = await application.commandBus.execute(
+      new GrantDelegationCommand(as('subject-ada'), 'acme', lend(MemberRight.InviteMembers)),
+    );
+
+    expect((await delegations.findById(id))?.rights).toEqual([MemberRight.InviteMembers]);
+
+    expect(application.eventBus.published.slice(before)).toMatchObject([
+      {
+        type: '{{context.kebab}}.delegation.granted',
+        payload: { delegationId: id, delegatorId: 'subject-ada', delegateId: 'subject-grace', rights: ['invite-members'] },
+      },
+    ]);
+  });
+
+  it('refuses a delegate who is not a member, and a period too long', async () => {
+    const { application, members, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+
+    await expect(
+      application.commandBus.execute(new GrantDelegationCommand(as('subject-ada'), 'acme', lend(MemberRight.InviteMembers))),
+    ).rejects.toMatchObject({ code: 'MEMBER_NOT_FOUND' });
+
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    const longer = { ...lend(MemberRight.InviteMembers), endsAt: new Date('2026-06-01T00:00:00.000Z') };
+
+    await expect(
+      application.commandBus.execute(new GrantDelegationCommand(as('subject-ada'), 'acme', longer)),
+    ).rejects.toMatchObject({ code: 'DELEGATION_TOO_LONG' });
+  });
+
+  it('is refused to a member whose role does not delegate', async () => {
+    const { application, members, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Admin).build());
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    await expect(
+      application.commandBus.execute(new GrantDelegationCommand(as('subject-ada'), 'acme', lend(MemberRight.InviteMembers))),
+    ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+  });
+});
+
+function lend(...rights: MemberRight[]): GrantDelegationCommand['terms'] {
+  return { delegateId: 'subject-grace', rights, startsAt, endsAt };
+}

package/templates/presets/identity/context/test/unit/identity-application.ts.tpl

@@ -0,0 +1,79 @@
+import { RoleBasedAuthorizer } from '@ddd-ts-kit/auth';
+import { authorizationModule } from '@ddd-ts-kit/auth/di';
+import { anActor } from '@ddd-ts-kit/auth/testing';
+import { contextModule, createTestApplication, fake } from '@ddd-ts-kit/di';
+import type { Actor } from '@ddd-ts-kit/kernel';
+import * as {{context.camel}}Declarations from '{{alias.context}}/{{context.kebab}}.declarations{{alias.ext}}';
+import { platformTestModule } from '{{alias.platform}}/platform-test.module{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+import { InvitationTokens } from '{{alias.context}}/application/ports/invitation-tokens.port{{alias.ext}}';
+import { SearchMembersReader } from '{{alias.context}}/application/ports/search-members-reader.port{{alias.ext}}';
+import { AccountRepository } from '{{alias.context}}/domain/repositories/account.repository{{alias.ext}}';
+import { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import { InvitationRepository } from '{{alias.context}}/domain/repositories/invitation.repository{{alias.ext}}';
+import { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { OrganisationRepository } from '{{alias.context}}/domain/repositories/organisation.repository{{alias.ext}}';
+import { FakeAccountRepository } from '{{alias.context}}/test/fakes/account.repository.fake{{alias.ext}}';
+import { FakeDelegationRepository } from '{{alias.context}}/test/fakes/delegation.repository.fake{{alias.ext}}';
+import { FakeIdentityProviderAdmin } from '{{alias.context}}/test/fakes/identity-provider-admin.fake{{alias.ext}}';
+import { FakeInvitationRepository } from '{{alias.context}}/test/fakes/invitation.repository.fake{{alias.ext}}';
+import { FakeInvitationTokens } from '{{alias.context}}/test/fakes/invitation-tokens.fake{{alias.ext}}';
+import { FakeMemberRepository } from '{{alias.context}}/test/fakes/member.repository.fake{{alias.ext}}';
+import { FakeOrganisationRepository } from '{{alias.context}}/test/fakes/organisation.repository.fake{{alias.ext}}';
+import { FakeSearchMembersReader } from '{{alias.context}}/test/fakes/search-members-reader.fake{{alias.ext}}';
+
+/** The role every signed-in person holds in these specs: the platform grants it the permissions of the context. */
+const PERSON = 'person';
+
+const people = authorizationModule({
+  authorizer: new RoleBasedAuthorizer({ roles: { [PERSON]: Object.values({{context.camel}}Permissions) } }),
+});
+
+/**
+ * The context on fakes, behind an authorizer that grants its permissions to every signed-in
+ * person: inside an organisation, its own policies decide. `as(id)` is that person, `stranger`
+ * an actor the platform grants nothing.
+ */
+export function arrangeIdentity() {
+  const ports = {
+    accounts: new FakeAccountRepository(),
+    organisations: new FakeOrganisationRepository(),
+    members: new FakeMemberRepository(),
+    invitations: new FakeInvitationRepository(),
+    delegations: new FakeDelegationRepository(),
+    identityProvider: new FakeIdentityProviderAdmin(),
+    tokens: new FakeInvitationTokens(),
+    reader: new FakeSearchMembersReader(),
+  };
+
+  const application = createTestApplication({
+    modules: [platformTestModule, contextModule('{{context.kebab}}', {{context.camel}}Declarations), people],
+    fakes: [
+      fake(AccountRepository, ports.accounts),
+      fake(OrganisationRepository, ports.organisations),
+      fake(MemberRepository, ports.members),
+      fake(InvitationRepository, ports.invitations),
+      fake(DelegationRepository, ports.delegations),
+      fake(IdentityProviderAdmin, ports.identityProvider),
+      fake(InvitationTokens, ports.tokens),
+      fake(SearchMembersReader, ports.reader),
+    ],
+  });
+
+  const as = (id: string): Actor => anActor().named(id).withRole(PERSON).build();
+
+  return { application, ...ports, as, stranger: anActor().named('stranger').build() };
+}
+
+/**
+ * The same, started: its consumers listen, among them those that bring the identity provider in
+ * line with the facts the context publishes (`application/integration/handlers/`).
+ */
+export async function startedIdentity(): Promise<ReturnType<typeof arrangeIdentity>> {
+  const arranged = arrangeIdentity();
+
+  await arranged.application.start();
+
+  return arranged;
+}