ddd-ts-kit 0.13.0 → 0.15.0

package/templates/presets/identity/context/application/commands/remove-member/remove-member.handler.ts.tpl

@@ -0,0 +1,79 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import type { Organisation } from '{{alias.context}}/domain/aggregates/organisation.aggregate{{alias.ext}}';
+import { MemberError } from '{{alias.context}}/domain/errors/member.error{{alias.ext}}';
+import { OrganisationError } from '{{alias.context}}/domain/errors/organisation.error{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import type { OrganisationRepository } from '{{alias.context}}/domain/repositories/organisation.repository{{alias.ext}}';
+import { RoleRightsService, type HeldRights } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { RemoveMemberCommand } from '{{alias.context}}/application/commands/remove-member/remove-member.command{{alias.ext}}';
+
+@CommandHandler(RemoveMemberCommand)
+export class RemoveMemberHandler implements CommandHandler<RemoveMemberCommand> {
+  constructor(
+    private readonly organisationRepository: OrganisationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /**
+   * Within the role of who decides; the organisation is saved with the removal, unchanged, so that
+   * its version orders the changes of its owners. Every delegation the member gave or received in
+   * the organisation ends with the membership.
+   */
+  async execute({ actor, organisationId, accountId }: RemoveMemberCommand): Promise<string> {
+    const now = this.clock.now();
+    const held = await this.heldBy(organisationId, actor.id, now);
+    const rights = new RoleRightsService();
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['member.remove'], rights.rightsIn(organisationId, actor.id, held));
+
+    const { organisation, member } = await this.membershipIn(organisationId, accountId);
+    const delegationId = rights.delegationUsedFor(MemberRight.ManageMembers, held);
+    const owners = await this.memberRepository.countOwners(organisationId);
+
+    member.remove({ by: held.member?.role ?? MemberRole.Member, byAccount: actor.id, delegationId, owners }, now);
+    await this.organisationRepository.save(organisation);
+    await this.memberRepository.save(member);
+    await this.endDelegationsInvolving(organisationId, accountId, now);
+
+    return member.id;
+  }
+
+  private async heldBy(organisationId: string, accountId: string, now: Date): Promise<HeldRights> {
+    const member = await this.memberRepository.findOf(organisationId, accountId);
+
+    return { member, lent: await this.delegationRepository.findUnendedTo(organisationId, accountId), now };
+  }
+
+  /** The organisation, to be saved with the change, and the membership the change is about. */
+  private async membershipIn(organisationId: string, accountId: string): Promise<{ organisation: Organisation; member: Member }> {
+    const organisation = await this.organisationRepository.findById(organisationId);
+    const member = await this.memberRepository.findOf(organisationId, accountId);
+
+    if (organisation === undefined) {
+      throw OrganisationError.notFound(organisationId);
+    }
+
+    if (member === undefined) {
+      throw MemberError.notFound(organisationId, accountId);
+    }
+
+    return { organisation, member };
+  }
+
+  private async endDelegationsInvolving(organisationId: string, accountId: string, now: Date): Promise<void> {
+    for (const delegation of await this.delegationRepository.findUnendedInvolving(organisationId, accountId)) {
+      delegation.end(now);
+      await this.delegationRepository.save(delegation);
+    }
+  }
+}

package/templates/presets/identity/context/application/commands/revoke-delegation/revoke-delegation.command.ts.tpl

@@ -0,0 +1,15 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Ends a delegation of an organisation before its period. */
+@Requires({{context.camel}}Permissions['delegation.revoke'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class RevokeDelegationCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly delegationId: string,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/revoke-delegation/revoke-delegation.handler.ts.tpl

@@ -0,0 +1,39 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { DelegationError } from '{{alias.context}}/domain/errors/delegation.error{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { RoleRightsService } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { RevokeDelegationCommand } from '{{alias.context}}/application/commands/revoke-delegation/revoke-delegation.command{{alias.ext}}';
+
+@CommandHandler(RevokeDelegationCommand)
+export class RevokeDelegationHandler implements CommandHandler<RevokeDelegationCommand> {
+  constructor(
+    private readonly delegationRepository: DelegationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /** Whoever may grant delegations in the organisation revokes them; one of another organisation is not found here. */
+  async execute({ actor, organisationId, delegationId }: RevokeDelegationCommand): Promise<string> {
+    const now = this.clock.now();
+    const member = await this.memberRepository.findOf(organisationId, actor.id);
+    const rights = new RoleRightsService().rightsIn(organisationId, actor.id, { member, lent: [], now });
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['delegation.revoke'], rights);
+
+    const delegation = await this.delegationRepository.findById(delegationId);
+
+    if (delegation?.organisationId !== organisationId) {
+      throw DelegationError.notFound(delegationId);
+    }
+
+    delegation.revoke(now);
+    await this.delegationRepository.save(delegation);
+
+    return delegation.id;
+  }
+}

package/templates/presets/identity/context/application/commands/revoke-invitation/revoke-invitation.command.ts.tpl

@@ -0,0 +1,15 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Takes back an invitation of an organisation that was not answered. */
+@Requires({{context.camel}}Permissions['invitation.revoke'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class RevokeInvitationCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly invitationId: string,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/revoke-invitation/revoke-invitation.handler.ts.tpl

@@ -0,0 +1,42 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { InvitationError } from '{{alias.context}}/domain/errors/invitation.error{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { InvitationRepository } from '{{alias.context}}/domain/repositories/invitation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { RoleRightsService } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { RevokeInvitationCommand } from '{{alias.context}}/application/commands/revoke-invitation/revoke-invitation.command{{alias.ext}}';
+
+@CommandHandler(RevokeInvitationCommand)
+export class RevokeInvitationHandler implements CommandHandler<RevokeInvitationCommand> {
+  constructor(
+    private readonly invitationRepository: InvitationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /** Whoever may invite in the organisation takes back its invitations: an invitation of another organisation is not found here. */
+  async execute({ actor, organisationId, invitationId }: RevokeInvitationCommand): Promise<string> {
+    const now = this.clock.now();
+    const member = await this.memberRepository.findOf(organisationId, actor.id);
+    const lent = await this.delegationRepository.findUnendedTo(organisationId, actor.id);
+    const rights = new RoleRightsService().rightsIn(organisationId, actor.id, { member, lent, now });
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['invitation.revoke'], rights);
+
+    const invitation = await this.invitationRepository.findById(invitationId);
+
+    if (invitation?.organisationId !== organisationId) {
+      throw InvitationError.notFound();
+    }
+
+    invitation.revoke(now);
+    await this.invitationRepository.save(invitation);
+
+    return invitation.id;
+  }
+}

package/templates/presets/identity/context/application/integration/handlers/account-deactivated.integration-handler.ts.tpl

@@ -0,0 +1,19 @@
+import { IntegrationEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { accountDeactivatedV1, type AccountDeactivatedV1 } from '{{alias.context}}/published-language/account-deactivated.v1.integration-event{{alias.ext}}';
+import type { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+
+/**
+ * The provider disables the person: they sign in no more. Delivered at least once through the
+ * outbox, so a provider down at the time of the deactivation is asked again until it answers;
+ * disabling twice changes nothing.
+ */
+@IntegrationEventHandler(accountDeactivatedV1, { consumer: '{{context.kebab}}.provider-disables-account' })
+export class AccountDeactivatedIntegrationHandler {
+  static readonly eventType = accountDeactivatedV1.type;
+
+  constructor(private readonly identityProvider: IdentityProviderAdmin) {}
+
+  async handle(event: AccountDeactivatedV1): Promise<void> {
+    await this.identityProvider.disableAccount(event.payload.accountId);
+  }
+}

package/templates/presets/identity/context/application/integration/handlers/member-joined.integration-handler.ts.tpl

@@ -0,0 +1,33 @@
+import { IntegrationEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { memberJoinedV1, type MemberJoinedV1 } from '{{alias.context}}/published-language/member-joined.v1.integration-event{{alias.ext}}';
+import type { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+
+/**
+ * The provider follows the membership: delivered at least once and in no guaranteed order, so the
+ * handler brings the provider in line with what the context holds now rather than with the fact
+ * alone. A membership already ended (removed, or its account deactivated) is taken out again,
+ * so that a late retry of this fact never gives a removed person back their organisation.
+ */
+@IntegrationEventHandler(memberJoinedV1, { consumer: '{{context.kebab}}.provider-follows-joined-member' })
+export class MemberJoinedIntegrationHandler {
+  static readonly eventType = memberJoinedV1.type;
+
+  constructor(
+    private readonly memberRepository: MemberRepository,
+    private readonly identityProvider: IdentityProviderAdmin,
+  ) {}
+
+  async handle(event: MemberJoinedV1): Promise<void> {
+    const { organisationId, accountId } = event.payload;
+    const current = await this.memberRepository.findOf(organisationId, accountId);
+
+    if (current === undefined) {
+      await this.identityProvider.removeMember(organisationId, accountId);
+
+      return;
+    }
+
+    await this.identityProvider.addMember(organisationId, accountId);
+  }
+}

package/templates/presets/identity/context/application/integration/handlers/member-removed.integration-handler.ts.tpl

@@ -0,0 +1,30 @@
+import { IntegrationEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { memberRemovedV1, type MemberRemovedV1 } from '{{alias.context}}/published-language/member-removed.v1.integration-event{{alias.ext}}';
+import type { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+
+/**
+ * The provider takes the person out of the organisation: their next token no longer names it,
+ * and with tenants they reach its data no more. Delivered at least once through the outbox, so a
+ * provider down at the time of the removal is asked again until it answers; a person who joined
+ * again since is left in, the context holding the membership now.
+ */
+@IntegrationEventHandler(memberRemovedV1, { consumer: '{{context.kebab}}.provider-follows-removed-member' })
+export class MemberRemovedIntegrationHandler {
+  static readonly eventType = memberRemovedV1.type;
+
+  constructor(
+    private readonly memberRepository: MemberRepository,
+    private readonly identityProvider: IdentityProviderAdmin,
+  ) {}
+
+  async handle(event: MemberRemovedV1): Promise<void> {
+    const { organisationId, accountId } = event.payload;
+
+    if ((await this.memberRepository.findOf(organisationId, accountId)) !== undefined) {
+      return;
+    }
+
+    await this.identityProvider.removeMember(organisationId, accountId);
+  }
+}

package/templates/presets/identity/context/application/integration/handlers/organisation-opened.integration-handler.ts.tpl

@@ -0,0 +1,19 @@
+import { IntegrationEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { organisationOpenedV1, type OrganisationOpenedV1 } from '{{alias.context}}/published-language/organisation-opened.v1.integration-event{{alias.ext}}';
+import type { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+
+/**
+ * The provider learns the organisation under its slug, so that its tokens can name it. Driven by
+ * the fact the context published through its outbox, so delivered at least once: a provider that
+ * fails is asked again until it answers, and asking twice changes nothing (the adapter is idempotent).
+ */
+@IntegrationEventHandler(organisationOpenedV1, { consumer: '{{context.kebab}}.provider-opens-organisation' })
+export class OrganisationOpenedIntegrationHandler {
+  static readonly eventType = organisationOpenedV1.type;
+
+  constructor(private readonly identityProvider: IdentityProviderAdmin) {}
+
+  async handle(event: OrganisationOpenedV1): Promise<void> {
+    await this.identityProvider.openOrganisation({ id: event.payload.organisationId, name: event.payload.name });
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/account-deactivated.publisher.ts.tpl

@@ -0,0 +1,24 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { AccountDeactivated } from '{{alias.context}}/domain/events/account-deactivated.event{{alias.ext}}';
+import { accountDeactivatedV1 } from '{{alias.context}}/published-language/account-deactivated.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(AccountDeactivated, { name: AccountDeactivated.eventName })
+export class AccountDeactivatedPublisher implements DomainEventHandler<AccountDeactivated> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: AccountDeactivated): Promise<void> {
+    const published = accountDeactivatedV1.create(
+      {
+        accountId: event.aggregateId,
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+    await this.publisher.publish([published]);
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/delegation-granted.publisher.ts.tpl

@@ -0,0 +1,36 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { DelegationGranted } from '{{alias.context}}/domain/events/delegation-granted.event{{alias.ext}}';
+import { delegationGrantedV1 } from '{{alias.context}}/published-language/delegation-granted.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(DelegationGranted, { name: DelegationGranted.eventName })
+export class DelegationGrantedPublisher implements DomainEventHandler<DelegationGranted> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: DelegationGranted): Promise<void> {
+    const published = delegationGrantedV1.create(
+      {
+        delegationId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        delegatorId: event.facts.delegatorId,
+        delegateId: event.facts.delegateId,
+        rights: [...event.facts.rights],
+        startsAt: event.facts.startsAt.toISOString(),
+        endsAt: event.facts.endsAt.toISOString(),
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/delegation-revoked.publisher.ts.tpl

@@ -0,0 +1,33 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { DelegationRevoked } from '{{alias.context}}/domain/events/delegation-revoked.event{{alias.ext}}';
+import { delegationRevokedV1 } from '{{alias.context}}/published-language/delegation-revoked.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(DelegationRevoked, { name: DelegationRevoked.eventName })
+export class DelegationRevokedPublisher implements DomainEventHandler<DelegationRevoked> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: DelegationRevoked): Promise<void> {
+    const published = delegationRevokedV1.create(
+      {
+        delegationId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        delegatorId: event.facts.delegatorId,
+        delegateId: event.facts.delegateId,
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/member-joined.publisher.ts.tpl

@@ -0,0 +1,33 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { MemberJoined } from '{{alias.context}}/domain/events/member-joined.event{{alias.ext}}';
+import { memberJoinedV1 } from '{{alias.context}}/published-language/member-joined.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(MemberJoined, { name: MemberJoined.eventName })
+export class MemberJoinedPublisher implements DomainEventHandler<MemberJoined> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: MemberJoined): Promise<void> {
+    const published = memberJoinedV1.create(
+      {
+        memberId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        accountId: event.facts.accountId,
+        role: event.facts.role,
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/member-removed.publisher.ts.tpl

@@ -0,0 +1,33 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { MemberRemoved } from '{{alias.context}}/domain/events/member-removed.event{{alias.ext}}';
+import { memberRemovedV1 } from '{{alias.context}}/published-language/member-removed.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(MemberRemoved, { name: MemberRemoved.eventName })
+export class MemberRemovedPublisher implements DomainEventHandler<MemberRemoved> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: MemberRemoved): Promise<void> {
+    const published = memberRemovedV1.create(
+      {
+        memberId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        accountId: event.facts.accountId,
+        ...(event.facts.delegationId === undefined ? {} : { delegationId: event.facts.delegationId }),
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/member-role-changed.publisher.ts.tpl

@@ -0,0 +1,35 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { MemberRoleChanged } from '{{alias.context}}/domain/events/member-role-changed.event{{alias.ext}}';
+import { memberRoleChangedV1 } from '{{alias.context}}/published-language/member-role-changed.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(MemberRoleChanged, { name: MemberRoleChanged.eventName })
+export class MemberRoleChangedPublisher implements DomainEventHandler<MemberRoleChanged> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: MemberRoleChanged): Promise<void> {
+    const published = memberRoleChangedV1.create(
+      {
+        memberId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        accountId: event.facts.accountId,
+        from: event.facts.from,
+        to: event.facts.to,
+        ...(event.facts.delegationId === undefined ? {} : { delegationId: event.facts.delegationId }),
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/organisation-opened.publisher.ts.tpl

@@ -0,0 +1,32 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationOpened } from '{{alias.context}}/domain/events/organisation-opened.event{{alias.ext}}';
+import { organisationOpenedV1 } from '{{alias.context}}/published-language/organisation-opened.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(OrganisationOpened, { name: OrganisationOpened.eventName })
+export class OrganisationOpenedPublisher implements DomainEventHandler<OrganisationOpened> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: OrganisationOpened): Promise<void> {
+    const published = organisationOpenedV1.create(
+      {
+        organisationId: event.aggregateId,
+        name: event.facts.name,
+        openedBy: event.facts.openedBy,
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.aggregateId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/ports/identity-provider-admin.port.ts.tpl

@@ -0,0 +1,17 @@
+/**
+ * The administration API of the identity provider: it authenticates, and follows what this
+ * context decides, so that its tokens name the organisations of each person and a deactivated
+ * account signs in no more. Called by the consumers of the facts the context publishes through its
+ * outbox (`application/integration/handlers/`), so at least once and in no guaranteed order: every
+ * method is idempotent, and a failure is retried by whoever delivers the fact.
+ */
+export abstract class IdentityProviderAdmin {
+  /** The provider knows the organisation under its slug, which its tokens then name. */
+  abstract openOrganisation(organisation: { readonly id: string; readonly name: string }): Promise<void>;
+
+  abstract addMember(organisationId: string, accountId: string): Promise<void>;
+
+  abstract removeMember(organisationId: string, accountId: string): Promise<void>;
+
+  abstract disableAccount(accountId: string): Promise<void>;
+}

package/templates/presets/identity/context/application/ports/identity-provider-connection.port.ts.tpl

@@ -0,0 +1,14 @@
+/**
+ * Where the administration API of the identity provider is, and the client it is called as: the
+ * settings of `KeycloakIdentityProviderAdmin`. The default adapter reads them from the
+ * environment when a call is made; the platform may bind a value of its validated config instead.
+ */
+export abstract class IdentityProviderConnection {
+  /** `baseUrl` of the provider, its realm, and a confidential client allowed to manage users and organisations. */
+  abstract settings(): Promise<{
+    readonly baseUrl: string;
+    readonly realm: string;
+    readonly clientId: string;
+    readonly clientSecret: string;
+  }>;
+}

package/templates/presets/identity/context/application/ports/invitation-tokens.port.ts.tpl

@@ -0,0 +1,7 @@
+/** The tokens of the invitations: unguessable, sent to the person, never stored but as a digest. */
+export abstract class InvitationTokens {
+  /** A new token, and the digest the invitation keeps of it. */
+  abstract issue(): { readonly token: string; readonly digest: string };
+
+  abstract digestOf(token: string): string;
+}

package/templates/presets/identity/context/application/ports/search-members-reader.port.ts.tpl

@@ -0,0 +1,10 @@
+import type { PageRequest } from '@ddd-ts-kit/kernel';
+import type {
+  SearchMembersResult,
+  SearchMembersSort,
+} from '{{alias.context}}/application/queries/search-members/search-members.result{{alias.ext}}';
+
+export abstract class SearchMembersReader {
+  /** One page of the current members of an organisation, with the profile of their account, by the instant they joined then by id. */
+  abstract search(organisationId: string, page: PageRequest<SearchMembersSort>): Promise<SearchMembersResult>;
+}

package/templates/presets/identity/context/application/queries/search-members/search-members.handler.ts.tpl

@@ -0,0 +1,33 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { QueryHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { RoleRightsService } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import type { SearchMembersReader } from '{{alias.context}}/application/ports/search-members-reader.port{{alias.ext}}';
+import { SearchMembersQuery } from '{{alias.context}}/application/queries/search-members/search-members.query{{alias.ext}}';
+import type { SearchMembersResult } from '{{alias.context}}/application/queries/search-members/search-members.result{{alias.ext}}';
+
+@QueryHandler(SearchMembersQuery)
+export class SearchMembersHandler implements QueryHandler<SearchMembersQuery> {
+  constructor(
+    private readonly reader: SearchMembersReader,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /** The members of an organisation are read by its members, and by nobody else: the read names the organisation the right was decided on. */
+  async execute({ actor, organisationId, page }: SearchMembersQuery): Promise<SearchMembersResult> {
+    const now = this.clock.now();
+    const member = await this.memberRepository.findOf(organisationId, actor.id);
+    const lent = await this.delegationRepository.findUnendedTo(organisationId, actor.id);
+    const rights = new RoleRightsService().rightsIn(organisationId, actor.id, { member, lent, now });
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['member.search'], rights);
+
+    return this.reader.search(organisationId, page);
+  }
+}

package/templates/presets/identity/context/application/queries/search-members/search-members.query.ts.tpl

@@ -0,0 +1,19 @@
+import { AuthorizedQuery, type Actor, type PageRequest } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import type {
+  SearchMembersResult,
+  SearchMembersSort,
+} from '{{alias.context}}/application/queries/search-members/search-members.result{{alias.ext}}';
+
+/** One page of the current members of an organisation, for its members. */
+@Requires({{context.camel}}Permissions['member.search'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class SearchMembersQuery extends AuthorizedQuery<SearchMembersResult> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly page: PageRequest<SearchMembersSort>,
+  ) {
+    super(actor);
+  }
+}