ddd-ts-kit 0.14.0 → 0.15.0

package/templates/presets/identity/context/test/unit/environment-identity-provider-connection.adapter.spec.ts.tpl

@@ -0,0 +1,41 @@
+import { afterEach, describe, expect, it } from '{{tests.module}}';
+import { EnvironmentIdentityProviderConnection } from '{{alias.context}}/infrastructure/external/environment-identity-provider-connection.adapter{{alias.ext}}';
+
+const VARIABLES = ['KEYCLOAK_URL', 'KEYCLOAK_REALM', 'IDENTITY_PROVIDER_ADMIN_CLIENT_ID', 'IDENTITY_PROVIDER_ADMIN_CLIENT_SECRET'];
+const saved = Object.fromEntries(VARIABLES.map((name) => [name, process.env[name]]));
+
+afterEach(() => {
+  for (const name of VARIABLES) {
+    const value = saved[name];
+
+    if (value === undefined) {
+      Reflect.deleteProperty(process.env, name);
+    } else {
+      process.env[name] = value;
+    }
+  }
+});
+
+describe('EnvironmentIdentityProviderConnection', () => {
+  it('reads the connection when a call needs it, the trailing slash of the address left out', async () => {
+    process.env['KEYCLOAK_URL'] = 'http://127.0.0.1:8080/';
+    process.env['KEYCLOAK_REALM'] = 'acme';
+    process.env['IDENTITY_PROVIDER_ADMIN_CLIENT_ID'] = 'identity-admin';
+    process.env['IDENTITY_PROVIDER_ADMIN_CLIENT_SECRET'] = 'local-secret';
+
+    await expect(new EnvironmentIdentityProviderConnection().settings()).resolves.toEqual({
+      baseUrl: 'http://127.0.0.1:8080',
+      realm: 'acme',
+      clientId: 'identity-admin',
+      clientSecret: 'local-secret',
+    });
+  });
+
+  it('names the variable that is missing, never a value', async () => {
+    for (const name of VARIABLES) {
+      Reflect.deleteProperty(process.env, name);
+    }
+
+    await expect(new EnvironmentIdentityProviderConnection().settings()).rejects.toThrow('KEYCLOAK_URL is not set');
+  });
+});

package/templates/presets/identity/context/test/unit/grant-delegation.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { GrantDelegationCommand } from '{{alias.context}}/application/commands/grant-delegation/grant-delegation.command{{alias.ext}}';
+import { GrantDelegationController } from '{{alias.context}}/presentation/http/organisations/grant-delegation/grant-delegation.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /organisations/:organisationId/delegations', () => {
+  it('answers 201 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme' }, query: {}, headers: {}, body: { delegateId: 'subject-grace', rights: ['invite-members'], startsAt: '2026-01-01T00:00:00.000Z', endsAt: '2026-01-15T00:00:00.000Z' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/organisations/:organisationId/delegations');
+    expect([response.status, response.body]).toEqual([201, { id: 'delegation-1' }]);
+    expect(sent).toMatchObject([{ organisationId: 'acme', terms: { delegateId: 'subject-grace', rights: ['invite-members'], startsAt: new Date('2026-01-01T00:00:00.000Z'), endsAt: new Date('2026-01-15T00:00:00.000Z') } }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme' }, query: {}, headers: {}, body: { delegateId: 'subject-grace', rights: ['rule-the-world'], startsAt: '2026-01-01T00:00:00.000Z', endsAt: '2026-01-15T00:00:00.000Z' }, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: GrantDelegationCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(GrantDelegationCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'delegation-1';
+    },
+  });
+
+  return { route: controllerRoute(new GrantDelegationController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/grant-delegation.handler.spec.ts.tpl

@@ -0,0 +1,66 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { GrantDelegationCommand } from '{{alias.context}}/application/commands/grant-delegation/grant-delegation.command{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const startsAt = new Date('2026-01-01T00:00:00.000Z');
+const endsAt = new Date('2026-01-15T00:00:00.000Z');
+
+describe('Grant delegation', () => {
+  it('lends a right of the role of the owner to another member for a period, and tells the other contexts', async () => {
+    const { application, members, delegations, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    const before = application.eventBus.published.length;
+
+    const id = await application.commandBus.execute(
+      new GrantDelegationCommand(as('subject-ada'), 'acme', lend(MemberRight.InviteMembers)),
+    );
+
+    expect((await delegations.findById(id))?.rights).toEqual([MemberRight.InviteMembers]);
+
+    expect(application.eventBus.published.slice(before)).toMatchObject([
+      {
+        type: '{{context.kebab}}.delegation.granted',
+        payload: { delegationId: id, delegatorId: 'subject-ada', delegateId: 'subject-grace', rights: ['invite-members'] },
+      },
+    ]);
+  });
+
+  it('refuses a delegate who is not a member, and a period too long', async () => {
+    const { application, members, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+
+    await expect(
+      application.commandBus.execute(new GrantDelegationCommand(as('subject-ada'), 'acme', lend(MemberRight.InviteMembers))),
+    ).rejects.toMatchObject({ code: 'MEMBER_NOT_FOUND' });
+
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    const longer = { ...lend(MemberRight.InviteMembers), endsAt: new Date('2026-06-01T00:00:00.000Z') };
+
+    await expect(
+      application.commandBus.execute(new GrantDelegationCommand(as('subject-ada'), 'acme', longer)),
+    ).rejects.toMatchObject({ code: 'DELEGATION_TOO_LONG' });
+  });
+
+  it('is refused to a member whose role does not delegate', async () => {
+    const { application, members, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Admin).build());
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    await expect(
+      application.commandBus.execute(new GrantDelegationCommand(as('subject-ada'), 'acme', lend(MemberRight.InviteMembers))),
+    ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+  });
+});
+
+function lend(...rights: MemberRight[]): GrantDelegationCommand['terms'] {
+  return { delegateId: 'subject-grace', rights, startsAt, endsAt };
+}

package/templates/presets/identity/context/test/unit/identity-application.ts.tpl

@@ -0,0 +1,79 @@
+import { RoleBasedAuthorizer } from '@ddd-ts-kit/auth';
+import { authorizationModule } from '@ddd-ts-kit/auth/di';
+import { anActor } from '@ddd-ts-kit/auth/testing';
+import { contextModule, createTestApplication, fake } from '@ddd-ts-kit/di';
+import type { Actor } from '@ddd-ts-kit/kernel';
+import * as {{context.camel}}Declarations from '{{alias.context}}/{{context.kebab}}.declarations{{alias.ext}}';
+import { platformTestModule } from '{{alias.platform}}/platform-test.module{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+import { InvitationTokens } from '{{alias.context}}/application/ports/invitation-tokens.port{{alias.ext}}';
+import { SearchMembersReader } from '{{alias.context}}/application/ports/search-members-reader.port{{alias.ext}}';
+import { AccountRepository } from '{{alias.context}}/domain/repositories/account.repository{{alias.ext}}';
+import { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import { InvitationRepository } from '{{alias.context}}/domain/repositories/invitation.repository{{alias.ext}}';
+import { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { OrganisationRepository } from '{{alias.context}}/domain/repositories/organisation.repository{{alias.ext}}';
+import { FakeAccountRepository } from '{{alias.context}}/test/fakes/account.repository.fake{{alias.ext}}';
+import { FakeDelegationRepository } from '{{alias.context}}/test/fakes/delegation.repository.fake{{alias.ext}}';
+import { FakeIdentityProviderAdmin } from '{{alias.context}}/test/fakes/identity-provider-admin.fake{{alias.ext}}';
+import { FakeInvitationRepository } from '{{alias.context}}/test/fakes/invitation.repository.fake{{alias.ext}}';
+import { FakeInvitationTokens } from '{{alias.context}}/test/fakes/invitation-tokens.fake{{alias.ext}}';
+import { FakeMemberRepository } from '{{alias.context}}/test/fakes/member.repository.fake{{alias.ext}}';
+import { FakeOrganisationRepository } from '{{alias.context}}/test/fakes/organisation.repository.fake{{alias.ext}}';
+import { FakeSearchMembersReader } from '{{alias.context}}/test/fakes/search-members-reader.fake{{alias.ext}}';
+
+/** The role every signed-in person holds in these specs: the platform grants it the permissions of the context. */
+const PERSON = 'person';
+
+const people = authorizationModule({
+  authorizer: new RoleBasedAuthorizer({ roles: { [PERSON]: Object.values({{context.camel}}Permissions) } }),
+});
+
+/**
+ * The context on fakes, behind an authorizer that grants its permissions to every signed-in
+ * person: inside an organisation, its own policies decide. `as(id)` is that person, `stranger`
+ * an actor the platform grants nothing.
+ */
+export function arrangeIdentity() {
+  const ports = {
+    accounts: new FakeAccountRepository(),
+    organisations: new FakeOrganisationRepository(),
+    members: new FakeMemberRepository(),
+    invitations: new FakeInvitationRepository(),
+    delegations: new FakeDelegationRepository(),
+    identityProvider: new FakeIdentityProviderAdmin(),
+    tokens: new FakeInvitationTokens(),
+    reader: new FakeSearchMembersReader(),
+  };
+
+  const application = createTestApplication({
+    modules: [platformTestModule, contextModule('{{context.kebab}}', {{context.camel}}Declarations), people],
+    fakes: [
+      fake(AccountRepository, ports.accounts),
+      fake(OrganisationRepository, ports.organisations),
+      fake(MemberRepository, ports.members),
+      fake(InvitationRepository, ports.invitations),
+      fake(DelegationRepository, ports.delegations),
+      fake(IdentityProviderAdmin, ports.identityProvider),
+      fake(InvitationTokens, ports.tokens),
+      fake(SearchMembersReader, ports.reader),
+    ],
+  });
+
+  const as = (id: string): Actor => anActor().named(id).withRole(PERSON).build();
+
+  return { application, ...ports, as, stranger: anActor().named('stranger').build() };
+}
+
+/**
+ * The same, started: its consumers listen, among them those that bring the identity provider in
+ * line with the facts the context publishes (`application/integration/handlers/`).
+ */
+export async function startedIdentity(): Promise<ReturnType<typeof arrangeIdentity>> {
+  const arranged = arrangeIdentity();
+
+  await arranged.application.start();
+
+  return arranged;
+}

package/templates/presets/identity/context/test/unit/invitation.aggregate.spec.ts.tpl

@@ -0,0 +1,118 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { given } from '@ddd-ts-kit/testing';
+import { Invitation } from '{{alias.context}}/domain/aggregates/invitation.aggregate{{alias.ext}}';
+import { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+import { InvitationStatus } from '{{alias.context}}/domain/vocabularies/invitation-status.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { anInvitation } from '{{alias.context}}/test/builders/invitation.builder{{alias.ext}}';
+
+const issuedAt = new Date('2026-02-01T00:00:00.000Z');
+const nextDay = new Date('2026-02-02T00:00:00.000Z');
+const weekLater = new Date('2026-02-08T00:00:00.000Z');
+const grace = { id: 'subject-grace', email: EmailAddress.create('grace@example.test') };
+const someoneElse = { id: 'subject-alan', email: EmailAddress.create('alan@example.test') };
+
+describe('Invitation', () => {
+  it('is issued to an address, in a role, for a week, keeping the digest of its token only', () => {
+    const terms = {
+      organisationId: 'acme',
+      email: grace.email,
+      role: MemberRole.Admin,
+      tokenHash: 'digest',
+      invitedBy: 'subject-ada',
+    };
+
+    const invitation = Invitation.issue('invitation-1', terms, issuedAt);
+
+    expect(invitation.status).toBe(InvitationStatus.Pending);
+    expect(invitation.expiresAt).toEqual(weekLater);
+
+    expect(invitation.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.invitation.issued',
+        aggregateId: 'invitation-1',
+        occurredAt: issuedAt,
+        facts: { organisationId: 'acme', email: 'grace@example.test', role: MemberRole.Admin, expiresAt: weekLater },
+      },
+    ]);
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = anInvitation().build();
+    const loaded = Invitation.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});
+
+describe('A pending invitation', () => {
+  it('is accepted by the person it is addressed to, before it expires', () => {
+    given(anInvitation().identifiedBy('invitation-1').to('acme').issuedAt(issuedAt))
+      .when((invitation) => invitation.accept(grace, nextDay))
+      .thenEvents([
+        {
+          name: '{{context.kebab}}.invitation.accepted',
+          aggregateId: 'invitation-1',
+          facts: { organisationId: 'acme', accountId: 'subject-grace' },
+        },
+      ])
+      .thenState((invitation) => expect(invitation.status).toBe(InvitationStatus.Accepted));
+  });
+
+  it('is declined by the person it is addressed to', () => {
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.decline(grace, nextDay))
+      .thenEventNames(['{{context.kebab}}.invitation.declined'])
+      .thenState((invitation) => expect(invitation.status).toBe(InvitationStatus.Declined));
+  });
+
+  it('is answered by nobody else', () => {
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.accept(someoneElse, nextDay))
+      .thenError('INVITATION_ADDRESSED_TO_ANOTHER');
+
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.decline(someoneElse, nextDay))
+      .thenError('INVITATION_ADDRESSED_TO_ANOTHER');
+  });
+
+  it('is answered no more once its week is over', () => {
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.accept(grace, weekLater))
+      .thenError('INVITATION_EXPIRED', { expiresAt: weekLater });
+  });
+
+  it('is taken back by the organisation, expired or not', () => {
+    given(anInvitation().issuedAt(issuedAt))
+      .when((invitation) => invitation.revoke(new Date('2026-03-01T00:00:00.000Z')))
+      .thenEventNames(['{{context.kebab}}.invitation.revoked'])
+      .thenState((invitation) => expect(invitation.status).toBe(InvitationStatus.Revoked));
+  });
+});
+
+describe('An answered invitation', () => {
+  it('is answered once', () => {
+    const accepted = () => {
+      const invitation = anInvitation().issuedAt(issuedAt).build();
+
+      invitation.accept(grace, nextDay);
+
+      return invitation;
+    };
+
+    given(accepted())
+      .when((invitation) => invitation.accept(grace, nextDay))
+      .thenError('INVITATION_NOT_PENDING', {
+        status: InvitationStatus.Accepted,
+      });
+
+    given(accepted())
+      .when((invitation) => invitation.decline(grace, nextDay))
+      .thenError('INVITATION_NOT_PENDING');
+
+    given(accepted())
+      .when((invitation) => invitation.revoke(nextDay))
+      .thenError('INVITATION_NOT_PENDING');
+  });
+});

package/templates/presets/identity/context/test/unit/invite-member.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { InviteMemberCommand } from '{{alias.context}}/application/commands/invite-member/invite-member.command{{alias.ext}}';
+import { InviteMemberController } from '{{alias.context}}/presentation/http/organisations/invite-member/invite-member.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /organisations/:organisationId/invitations', () => {
+  it('answers 201 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme' }, query: {}, headers: {}, body: { email: 'grace@example.test', role: 'admin' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/organisations/:organisationId/invitations');
+    expect([response.status, response.body]).toEqual([201, { id: 'invitation-1', token: 'token-1' }]);
+    expect(sent).toMatchObject([{ organisationId: 'acme', invitee: { email: 'grace@example.test', role: 'admin' } }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme' }, query: {}, headers: {}, body: { email: 'grace@example.test', role: 'king' }, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: InviteMemberCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(InviteMemberCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return { id: 'invitation-1', token: 'token-1' };
+    },
+  });
+
+  return { route: controllerRoute(new InviteMemberController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/invite-member.handler.spec.ts.tpl

@@ -0,0 +1,110 @@
+import { describe, expect, it } from '{{tests.module}}';
+import type { DomainEvent } from '@ddd-ts-kit/kernel';
+import { InvitationIssued } from '{{alias.context}}/domain/events/invitation-issued.event{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { InviteMemberCommand } from '{{alias.context}}/application/commands/invite-member/invite-member.command{{alias.ext}}';
+import { aDelegation } from '{{alias.context}}/test/builders/delegation.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const grace = { email: 'grace@example.test', role: MemberRole.Member };
+
+describe('Invite member', () => {
+  it('issues the invitation and answers its token once, keeping only its digest', async () => {
+    const { application, members, invitations, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Admin).build());
+
+    const issued = await application.commandBus.execute(new InviteMemberCommand(as('subject-ada'), 'acme', grace));
+    const stored = await invitations.findById(issued.id);
+
+    expect(issued.token).toBe('token-1');
+
+    expect(stored?.toState()).toMatchObject({
+      organisationId: 'acme',
+      tokenHash: 'digest-of-token-1',
+      invitedBy: 'subject-ada',
+    });
+  });
+
+  it('lets a delegate invite with the right lent to them, in their own role, and names the delegation used', async () => {
+    const { application, members, delegations, invitations, as } = arrangeIdentity();
+    const now = application.clock.now();
+
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    await delegations.save(
+      aDelegation()
+        .identifiedBy('delegation-1')
+        .to('subject-grace')
+        .lending(MemberRight.InviteMembers)
+        .between(now, new Date(now.getTime() + 86_400_000))
+        .build(),
+    );
+
+    const issued: DomainEvent[] = [];
+
+    application.domainEvents.on(InvitationIssued.eventName, async (event) => {
+      issued.push(event);
+    });
+
+    await expect(
+      application.commandBus.execute(
+        new InviteMemberCommand(as('subject-grace'), 'acme', { ...grace, email: 'alan@example.test' }),
+      ),
+    ).resolves.toMatchObject({ token: 'token-1' });
+
+    expect(invitations.count()).toBe(1);
+    expect(issued).toMatchObject([{ facts: { organisationId: 'acme', delegationId: 'delegation-1' } }]);
+  });
+
+  it('never lets a delegation lift whom a member invites above their own role', async () => {
+    const { application, members, delegations, as } = arrangeIdentity();
+    const now = application.clock.now();
+
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    await delegations.save(
+      aDelegation()
+        .to('subject-grace')
+        .lending(MemberRight.InviteMembers)
+        .between(now, new Date(now.getTime() + 86_400_000))
+        .build(),
+    );
+
+    await expect(
+      application.commandBus.execute(
+        new InviteMemberCommand(as('subject-grace'), 'acme', { email: 'grace.second@example.test', role: MemberRole.Admin }),
+      ),
+    ).rejects.toMatchObject({ code: 'ABOVE_OWN_ROLE' });
+  });
+
+  it('is refused to a member whose role does not invite, and to a stranger to the organisation', async () => {
+    const { application, members, invitations, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-alan').as(MemberRole.Member).build());
+
+    for (const actor of [as('subject-alan'), as('subject-mallory')]) {
+      await expect(application.commandBus.execute(new InviteMemberCommand(actor, 'acme', grace))).rejects.toMatchObject(
+        {
+          code: 'FORBIDDEN',
+        },
+      );
+    }
+
+    expect(invitations.all()).toEqual([]);
+  });
+
+  it('lets an owner only invite an owner, and an admin no one above admin', async () => {
+    const { application, members, as } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-ada').as(MemberRole.Admin).build());
+
+    await expect(
+      application.commandBus.execute(
+        new InviteMemberCommand(as('subject-ada'), 'acme', { ...grace, role: MemberRole.Owner }),
+      ),
+    ).rejects.toMatchObject({ code: 'OWNERS_ONLY' });
+  });
+});

package/templates/presets/identity/context/test/unit/member-joined.integration-handler.spec.ts.tpl

@@ -0,0 +1,38 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { memberJoinedV1 } from '{{alias.context}}/published-language/member-joined.v1.integration-event{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const joining = memberJoinedV1.create(
+  { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-grace', role: MemberRole.Member },
+  { id: 'event-1', occurredAt: '2026-01-01T00:00:00.000Z' },
+);
+
+describe('When a member joins, the identity provider follows', () => {
+  it('adds the person to the organisation while the membership holds, once, and again after a failure', async () => {
+    const { application, members, identityProvider } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-grace').build());
+    await application.start();
+    identityProvider.failWith(new Error('provider unreachable'));
+
+    await expect(application.eventBus.publish([joining])).rejects.toThrow();
+
+    identityProvider.answerAgain();
+    await application.eventBus.publish([joining]);
+    await application.eventBus.publish([joining]);
+
+    expect(identityProvider.asked).toEqual(['add subject-grace to acme']);
+  });
+
+  it('takes the person out when the membership ended before a late delivery: a removal is never undone by a retry', async () => {
+    const { application, members, identityProvider } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-grace').removedAt(new Date('2026-01-01T00:00:00.000Z')).build());
+    await application.start();
+    await application.eventBus.publish([joining]);
+
+    expect(identityProvider.asked).toEqual(['remove subject-grace from acme']);
+  });
+});

package/templates/presets/identity/context/test/unit/member-joined.publisher.spec.ts.tpl

@@ -0,0 +1,36 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { MemberJoinedPublisher } from '{{alias.context}}/application/integration/publishers/member-joined.publisher{{alias.ext}}';
+import { MemberJoined } from '{{alias.context}}/domain/events/member-joined.event{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "member joined" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.member.joined, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new MemberJoinedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new MemberJoined('member-1', at, { organisationId: 'acme', accountId: 'subject-ada', role: MemberRole.Admin }));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.member.joined',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-ada', role: 'admin' },
+      },
+    ]);
+  });
+{{#if tenancy.any}}
+
+  it('names the organisation as the tenant of the fact, so that its consumers run in it', async () => {
+    const bus = new InMemoryEventBus();
+
+    await new MemberJoinedPublisher(bus, new SequentialIdGenerator('event')).handle(new MemberJoined('member-1', at, { organisationId: 'acme', accountId: 'subject-ada', role: MemberRole.Admin }));
+
+    expect(bus.published[0]?.tenantId).toBe('acme');
+  });
+{{/if}}
+});

package/templates/presets/identity/context/test/unit/member-removed.integration-handler.spec.ts.tpl

@@ -0,0 +1,45 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { memberRemovedV1 } from '{{alias.context}}/published-language/member-removed.v1.integration-event{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity, startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const removal = memberRemovedV1.create(
+  { memberId: 'member-1', organisationId: 'acme', accountId: 'subject-alan' },
+  { id: 'event-1', occurredAt: '2026-01-01T00:00:00.000Z' },
+);
+
+describe('When a member is removed, the identity provider follows', () => {
+  it('takes the person out of the organisation once, even when the fact is delivered twice', async () => {
+    const { application, identityProvider } = await startedIdentity();
+
+    await application.eventBus.publish([removal]);
+    await application.eventBus.publish([removal]);
+
+    expect(identityProvider.asked).toEqual(['remove subject-alan from acme']);
+  });
+
+  it('is asked again after a failure, until the provider is in line: the revocation is never lost', async () => {
+    const { application, identityProvider } = await startedIdentity();
+
+    identityProvider.failWith(new Error('provider unreachable'));
+
+    // The failure goes back to who delivered the fact (the outbox relay, the broker), which delivers it again later.
+    await expect(application.eventBus.publish([removal])).rejects.toThrow();
+    await expect(application.eventBus.publish([removal])).rejects.toThrow();
+
+    identityProvider.answerAgain();
+    await application.eventBus.publish([removal]);
+
+    expect(identityProvider.asked).toEqual(['remove subject-alan from acme']);
+  });
+
+  it('leaves in a person who joined the organisation again since: the context holds the membership now', async () => {
+    const { application, members, identityProvider } = arrangeIdentity();
+
+    await members.save(aMember().of('acme', 'subject-alan').build());
+    await application.start();
+    await application.eventBus.publish([removal]);
+
+    expect(identityProvider.asked).toEqual([]);
+  });
+});