ddd-ts-kit 0.13.0 → 0.15.0

package/templates/presets/identity/context/test/unit/invitation.aggregate.spec.ts.tpl

@@ -0,0 +1,118 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { given } from '@ddd-ts-kit/testing';
+import { Invitation } from '{{alias.context}}/domain/aggregates/invitation.aggregate{{alias.ext}}';
+import { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+import { InvitationStatus } from '{{alias.context}}/domain/vocabularies/invitation-status.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { anInvitation } from '{{alias.context}}/test/builders/invitation.builder{{alias.ext}}';
+
+const issuedAt = new Date('2026-02-01T00:00:00.000Z');
+const nextDay = new Date('2026-02-02T00:00:00.000Z');
+const weekLater = new Date('2026-02-08T00:00:00.000Z');
+const grace = { id: 'subject-grace', email: EmailAddress.create('grace@example.test') };
+const someoneElse = { id: 'subject-alan', email: EmailAddress.create('alan@example.test') };
+
+describe('Invitation', () => {
+  it('is issued to an address, in a role, for a week, keeping the digest of its token only', () => {
+    const terms = {
+      organisationId: 'acme',
+      email: grace.email,
+      role: MemberRole.Admin,
+      tokenHash: 'digest',
+      invitedBy: 'subject-ada',
+    };
+
+    const invitation = Invitation.issue('invitation-1', terms, issuedAt);
+
+    expect(invitation.status).toBe(InvitationStatus.Pending);
+    expect(invitation.expiresAt).toEqual(weekLater);
+
+    expect(invitation.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.invitation.issued',
+        aggregateId: 'invitation-1',
+        occurredAt: issuedAt,
+        facts: { organisationId: 'acme', email: 'grace@example.test', role: MemberRole.Admin, expiresAt: weekLater },
+      },
+    ]);
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = anInvitation().build();
+    const loaded = Invitation.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});
+
+describe('A pending invitation', () => {
+  it('is accepted by the person it is addressed to, before it expires', () => {
+    given(anInvitation().identifiedBy('invitation-1').to('acme').issuedAt(issuedAt))
+      .when((invitation) => invitation.accept(grace, nextDay))
+      .thenEvents([
+        {
+          name: '{{context.kebab}}.invitation.accepted',
+          aggregateId: 'invitation-1',
+          facts: { organisationId: 'acme', accountId: 'subject-grace' },
+        },
+      ])
+      .thenState((invitation) => expect(invitation.status).toBe(InvitationStatus.Accepted));
+  });
+
+  it('is declined by the person it is addressed to', () => {
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.decline(grace, nextDay))
+      .thenEventNames(['{{context.kebab}}.invitation.declined'])
+      .thenState((invitation) => expect(invitation.status).toBe(InvitationStatus.Declined));
+  });
+
+  it('is answered by nobody else', () => {
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.accept(someoneElse, nextDay))
+      .thenError('INVITATION_ADDRESSED_TO_ANOTHER');
+
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.decline(someoneElse, nextDay))
+      .thenError('INVITATION_ADDRESSED_TO_ANOTHER');
+  });
+
+  it('is answered no more once its week is over', () => {
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.accept(grace, weekLater))
+      .thenError('INVITATION_EXPIRED', { expiresAt: weekLater });
+  });
+
+  it('is taken back by the organisation, expired or not', () => {
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.revoke(new Date('2026-03-01T00:00:00.000Z')))
+      .thenEventNames(['{{context.kebab}}.invitation.revoked'])
+      .thenState((invitation) => expect(invitation.status).toBe(InvitationStatus.Revoked));
+  });
+});
+
+describe('An answered invitation', () => {
+  it('is answered once', () => {
+    const accepted = () => {
+      const invitation = anInvitation().issuedAt(issuedAt).build();
+
+      invitation.accept(grace, nextDay);
+
+      return invitation;
+    };
+
+    given(accepted())
+      .when((invitation) => invitation.accept(grace, nextDay))
+      .thenError('INVITATION_NOT_PENDING', {
+        status: InvitationStatus.Accepted,
+      });
+
+    given(accepted())
+      .when((invitation) => invitation.decline(grace, nextDay))
+      .thenError('INVITATION_NOT_PENDING');
+
+    given(accepted())
+      .when((invitation) => invitation.revoke(nextDay))
+      .thenError('INVITATION_NOT_PENDING');
+  });
+});

package/templates/presets/identity/context/test/unit/invite-member.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { InviteMemberCommand } from '{{alias.context}}/application/commands/invite-member/invite-member.command{{alias.ext}}';
+import { InviteMemberController } from '{{alias.context}}/presentation/http/organisations/invite-member/invite-member.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /organisations/:organisationId/invitations', () => {
+  it('answers 201 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme' }, query: {}, headers: {}, body: { email: 'grace@example.test', role: 'admin' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/organisations/:organisationId/invitations');
+    expect([response.status, response.body]).toEqual([201, { id: 'invitation-1', token: 'token-1' }]);
+    expect(sent).toMatchObject([{ organisationId: 'acme', invitee: { email: 'grace@example.test', role: 'admin' } }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme' }, query: {}, headers: {}, body: { email: 'grace@example.test', role: 'king' }, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: InviteMemberCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(InviteMemberCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return { id: 'invitation-1', token: 'token-1' };
+    },
+  });
+
+  return { route: controllerRoute(new InviteMemberController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/invite-member.handler.spec.ts.tpl

@@ -0,0 +1,110 @@
+import { describe, expect, it } from '{{tests.module}}';
+import type { DomainEvent } from '@ddd-ts-kit/kernel';
+import { InvitationIssued } from '{{alias.context}}/domain/events/invitation-issued.event{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { InviteMemberCommand } from '{{alias.context}}/application/commands/invite-member/invite-member.command{{alias.ext}}';
+import { aDelegation } from '{{alias.context}}/test/builders/delegation.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const grace = { email: 'grace@example.test', role: MemberRole.Member };
+
+describe('Invite member', () => {
+  it('issues the invitation and answers its token once, keeping only its digest', async () => {
+    const { application, members, invitations, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Admin).build());
+
+    const issued = await application.commandBus.execute(new InviteMemberCommand(as('subject-ada'), 'acme', grace));
+    const stored = await invitations.findById(issued.id);
+
+    expect(issued.token).toBe('token-1');
+
+    expect(stored?.toState()).toMatchObject({
+      organisationId: 'acme',
+      tokenHash: 'digest-of-token-1',
+      invitedBy: 'subject-ada',
+    });
+  });
+
+  it('lets a delegate invite with the right lent to them, in their own role, and names the delegation used', async () => {
+    const { application, members, delegations, invitations, as } = arrangeIdentity();
+    const now = application.clock.now();
+
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    await delegations.save(
+      aDelegation()
+        .identifiedBy('delegation-1')
+        .to('subject-grace')
+        .lending(MemberRight.InviteMembers)
+        .between(now, new Date(now.getTime() + 86_400_000))
+        .build(),
+    );
+
+    const issued: DomainEvent[] = [];
+
+    application.domainEvents.on(InvitationIssued.eventName, async (event) => {
+      issued.push(event);
+    });
+
+    await expect(
+      application.commandBus.execute(
+        new InviteMemberCommand(as('subject-grace'), 'acme', { ...grace, email: 'alan@example.test' }),
+      ),
+    ).resolves.toMatchObject({ token: 'token-1' });
+
+    expect(invitations.count()).toBe(1);
+    expect(issued).toMatchObject([{ facts: { organisationId: 'acme', delegationId: 'delegation-1' } }]);
+  });
+
+  it('never lets a delegation lift whom a member invites above their own role', async () => {
+    const { application, members, delegations, as } = arrangeIdentity();
+    const now = application.clock.now();
+
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    await delegations.save(
+      aDelegation()
+        .to('subject-grace')
+        .lending(MemberRight.InviteMembers)
+        .between(now, new Date(now.getTime() + 86_400_000))
+        .build(),
+    );
+
+    await expect(
+      application.commandBus.execute(
+        new InviteMemberCommand(as('subject-grace'), 'acme', { email: 'grace.second@example.test', role: MemberRole.Admin }),
+      ),
+    ).rejects.toMatchObject({ code: 'ABOVE_OWN_ROLE' });
+  });
+
+  it('is refused to a member whose role does not invite, and to a stranger to the organisation', async () => {
+    const { application, members, invitations, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-alan').as(MemberRole.Member).build());
+
+    for (const actor of [as('subject-alan'), as('subject-mallory')]) {
+      await expect(application.commandBus.execute(new InviteMemberCommand(actor, 'acme', grace))).rejects.toMatchObject(
+        {
+          code: 'FORBIDDEN',
+        },
+      );
+    }
+
+    expect(invitations.all()).toEqual([]);
+  });
+
+  it('lets an owner only invite an owner, and an admin no one above admin', async () => {
+    const { application, members, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Admin).build());
+
+    await expect(
+      application.commandBus.execute(
+        new InviteMemberCommand(as('subject-ada'), 'acme', { ...grace, role: MemberRole.Owner }),
+      ),
+    ).rejects.toMatchObject({ code: 'OWNERS_ONLY' });
+  });
+});

package/templates/presets/identity/context/test/unit/member-joined.integration-handler.spec.ts.tpl

@@ -0,0 +1,38 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { memberJoinedV1 } from '{{alias.context}}/published-language/member-joined.v1.integration-event{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const joining = memberJoinedV1.create(
+  { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-grace', role: MemberRole.Member },
+  { id: 'event-1', occurredAt: '2026-01-01T00:00:00.000Z' },
+);
+
+describe('When a member joins, the identity provider follows', () => {
+  it('adds the person to the organisation while the membership holds, once, and again after a failure', async () => {
+    const { application, members, identityProvider } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-grace').build());
+    await application.start();
+    identityProvider.failWith(new Error('provider unreachable'));
+
+    await expect(application.eventBus.publish([joining])).rejects.toThrow();
+
+    identityProvider.answerAgain();
+    await application.eventBus.publish([joining]);
+    await application.eventBus.publish([joining]);
+
+    expect(identityProvider.asked).toEqual(['add subject-grace to acme']);
+  });
+
+  it('takes the person out when the membership ended before a late delivery: a removal is never undone by a retry', async () => {
+    const { application, members, identityProvider } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-grace').removedAt(new Date('2026-01-01T00:00:00.000Z')).build());
+    await application.start();
+    await application.eventBus.publish([joining]);
+
+    expect(identityProvider.asked).toEqual(['remove subject-grace from acme']);
+  });
+});

package/templates/presets/identity/context/test/unit/member-joined.publisher.spec.ts.tpl

@@ -0,0 +1,36 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { MemberJoinedPublisher } from '{{alias.context}}/application/integration/publishers/member-joined.publisher{{alias.ext}}';
+import { MemberJoined } from '{{alias.context}}/domain/events/member-joined.event{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "member joined" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.member.joined, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new MemberJoinedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new MemberJoined('member-1', at, { organisationId: 'acme', accountId: 'subject-ada', role: MemberRole.Admin }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.member.joined',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-ada', role: 'admin' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new MemberJoinedPublisher(bus, new SequentialIdGenerator('event')).handle(new MemberJoined('member-1', at, { organisationId: 'acme', accountId: 'subject-ada', role: MemberRole.Admin }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/member-removed.integration-handler.spec.ts.tpl

@@ -0,0 +1,45 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { memberRemovedV1 } from '{{alias.context}}/published-language/member-removed.v1.integration-event{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity, startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const removal = memberRemovedV1.create(
+  { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-alan' },
+  { id: 'event-1', occurredAt: '2026-01-01T00:00:00.000Z' },
+);
+
+describe('When a member is removed, the identity provider follows', () => {
+  it('takes the person out of the organisation once, even when the fact is delivered twice', async () => {
+    const { application, identityProvider } = await startedIdentity();
+
+    await application.eventBus.publish([removal]);
+    await application.eventBus.publish([removal]);
+
+    expect(identityProvider.asked).toEqual(['remove subject-alan from acme']);
+  });
+
+  it('is asked again after a failure, until the provider is in line: the revocation is never lost', async () => {
+    const { application, identityProvider } = await startedIdentity();
+
+    identityProvider.failWith(new Error('provider unreachable'));
+
+    // The failure goes back to who delivered the fact (the outbox relay, the broker), which delivers it again later.
+    await expect(application.eventBus.publish([removal])).rejects.toThrow();
+    await expect(application.eventBus.publish([removal])).rejects.toThrow();
+
+    identityProvider.answerAgain();
+    await application.eventBus.publish([removal]);
+
+    expect(identityProvider.asked).toEqual(['remove subject-alan from acme']);
+  });
+
+  it('leaves in a person who joined the organisation again since: the context holds the membership now', async () => {
+    const { application, members, identityProvider } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-alan').build());
+    await application.start();
+    await application.eventBus.publish([removal]);
+
+    expect(identityProvider.asked).toEqual([]);
+  });
+});

package/templates/presets/identity/context/test/unit/member-removed.publisher.spec.ts.tpl

@@ -0,0 +1,35 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { MemberRemovedPublisher } from '{{alias.context}}/application/integration/publishers/member-removed.publisher{{alias.ext}}';
+import { MemberRemoved } from '{{alias.context}}/domain/events/member-removed.event{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "member removed" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.member.removed, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new MemberRemovedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new MemberRemoved('member-1', at, { organisationId: 'acme', accountId: 'subject-ada' }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.member.removed',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-ada' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new MemberRemovedPublisher(bus, new SequentialIdGenerator('event')).handle(new MemberRemoved('member-1', at, { organisationId: 'acme', accountId: 'subject-ada' }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/member-role-changed.publisher.spec.ts.tpl

@@ -0,0 +1,36 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { MemberRoleChangedPublisher } from '{{alias.context}}/application/integration/publishers/member-role-changed.publisher{{alias.ext}}';
+import { MemberRoleChanged } from '{{alias.context}}/domain/events/member-role-changed.event{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "member role changed" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.member.role-changed, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new MemberRoleChangedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new MemberRoleChanged('member-1', at, { organisationId: 'acme', accountId: 'subject-ada', from: MemberRole.Member, to: MemberRole.Admin }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.member.role-changed',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-ada', from: 'member', to: 'admin' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new MemberRoleChangedPublisher(bus, new SequentialIdGenerator('event')).handle(new MemberRoleChanged('member-1', at, { organisationId: 'acme', accountId: 'subject-ada', from: MemberRole.Member, to: MemberRole.Admin }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/member.aggregate.spec.ts.tpl

@@ -0,0 +1,142 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { given } from '@ddd-ts-kit/testing';
+import { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+
+const joinedAt = new Date('2026-02-01T00:00:00.000Z');
+const later = new Date('2026-02-02T00:00:00.000Z');
+const byAnOwner = { by: MemberRole.Owner, byAccount: 'subject-owner', delegationId: undefined, owners: 2 };
+const byAnAdmin = { by: MemberRole.Admin, byAccount: 'subject-admin', delegationId: undefined, owners: 2 };
+const byAMember = { by: MemberRole.Member, byAccount: 'subject-member', delegationId: 'delegation-1', owners: 2 };
+
+describe('Member', () => {
+  it('joins an organisation in a role, and announces it', () => {
+    const joined = Member.join(
+      'member-1',
+      { organisationId: 'acme', accountId: 'subject-ada', role: MemberRole.Admin },
+      joinedAt,
+    );
+
+    expect(joined.isActive).toBe(true);
+
+    expect(joined.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.member.joined',
+        aggregateId: 'member-1',
+        occurredAt: joinedAt,
+        facts: { organisationId: 'acme', accountId: 'subject-ada', role: MemberRole.Admin },
+      },
+    ]);
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = aMember().build();
+    const loaded = Member.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});
+
+describe('The role of a member', () => {
+  it('changes, and the change is announced with the role it leaves', () => {
+    given(aMember().identifiedBy('member-1').of('acme', 'subject-ada'))
+      .when((member) => member.changeRole(MemberRole.Admin, byAnAdmin, later))
+      .thenEvents([
+        {
+          name: '{{context.kebab}}.member.role-changed',
+          facts: { organisationId: 'acme', accountId: 'subject-ada', from: MemberRole.Member, to: MemberRole.Admin },
+        },
+      ])
+      .thenState((member) => expect(member.role).toBe(MemberRole.Admin));
+  });
+
+  it('stays as it is, silently, when it is asked again', () => {
+    given(aMember().as(MemberRole.Admin))
+      .when((member) => member.changeRole(MemberRole.Admin, byAnAdmin, later))
+      .thenNoEvent();
+  });
+
+  it('becomes, or stops being, owner only by the decision of an owner', () => {
+    given(aMember())
+      .when((member) => member.changeRole(MemberRole.Owner, byAnAdmin, later))
+      .thenError('OWNERS_ONLY');
+
+    given(aMember().as(MemberRole.Owner))
+      .when((member) => member.changeRole(MemberRole.Admin, byAnAdmin, later))
+      .thenError('OWNERS_ONLY');
+
+    given(aMember())
+      .when((member) => member.changeRole(MemberRole.Owner, byAnOwner, later))
+      .thenEventNames(['{{context.kebab}}.member.role-changed']);
+  });
+
+  it('stays owner when the organisation has no other owner', () => {
+    given(aMember().as(MemberRole.Owner))
+      .when((member) => member.changeRole(MemberRole.Admin, { ...byAnOwner, owners: 1 }, later))
+      .thenError('LAST_OWNER');
+  });
+
+  it('is never changed by the member themselves, nor above the role of who decides', () => {
+    given(aMember().of('acme', 'subject-ada').as(MemberRole.Admin))
+      .when((member) => member.changeRole(MemberRole.Member, { ...byAnOwner, byAccount: 'subject-ada' }, later))
+      .thenError('OWN_ROLE');
+
+    given(aMember())
+      .when((member) => member.changeRole(MemberRole.Admin, byAMember, later))
+      .thenError('ABOVE_OWN_ROLE');
+
+    given(aMember().as(MemberRole.Admin))
+      .when((member) => member.changeRole(MemberRole.Member, byAMember, later))
+      .thenError('ABOVE_OWN_ROLE');
+  });
+});
+
+describe('A member', () => {
+  it('is removed, and the removal is announced', () => {
+    given(aMember().identifiedBy('member-1').of('acme', 'subject-ada'))
+      .when((member) => member.remove(byAnAdmin, later))
+      .thenEvents([{ name: '{{context.kebab}}.member.removed', facts: { organisationId: 'acme', accountId: 'subject-ada' } }])
+      .thenState((member) => expect(member.isActive).toBe(false));
+  });
+
+  it('who owns the organisation is removed by an owner only, and never when they are its last owner', () => {
+    given(aMember().as(MemberRole.Owner))
+      .when((member) => member.remove(byAnAdmin, later))
+      .thenError('OWNERS_ONLY');
+
+    given(aMember().as(MemberRole.Owner))
+      .when((member) => member.remove({ ...byAnOwner, owners: 1 }, later))
+      .thenError('LAST_OWNER');
+  });
+
+  it('leaves by themselves, and is removed by no one below their role; the delegation used is named', () => {
+    given(aMember().of('acme', 'subject-ada').as(MemberRole.Admin))
+      .when((member) => member.remove({ ...byAMember, byAccount: 'subject-ada', by: MemberRole.Admin }, later))
+      .thenEventNames(['{{context.kebab}}.member.removed']);
+
+    given(aMember().as(MemberRole.Admin))
+      .when((member) => member.remove(byAMember, later))
+      .thenError('ABOVE_OWN_ROLE');
+
+    given(aMember().of('acme', 'subject-irene'))
+      .when((member) => member.remove(byAMember, later))
+      .thenEvents([
+        {
+          name: '{{context.kebab}}.member.removed',
+          facts: { organisationId: 'acme', accountId: 'subject-irene', delegationId: 'delegation-1' },
+        },
+      ]);
+  });
+
+  it('who was removed is not found any more', () => {
+    given(aMember().removedAt(joinedAt))
+      .when((member) => member.remove(byAnOwner, later))
+      .thenError('MEMBER_NOT_FOUND');
+
+    given(aMember().removedAt(joinedAt))
+      .when((member) => member.changeRole(MemberRole.Admin, byAnOwner, later))
+      .thenError('MEMBER_NOT_FOUND');
+  });
+});