ddd-ts-kit 0.14.0 → 0.15.0

package/templates/presets/identity/context/application/commands/open-organisation/open-organisation.handler.ts.tpl

@@ -0,0 +1,50 @@
+import type { Clock, IdGenerator } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import { Organisation } from '{{alias.context}}/domain/aggregates/organisation.aggregate{{alias.ext}}';
+import { AccountError } from '{{alias.context}}/domain/errors/account.error{{alias.ext}}';
+import { OrganisationError } from '{{alias.context}}/domain/errors/organisation.error{{alias.ext}}';
+import type { AccountRepository } from '{{alias.context}}/domain/repositories/account.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import type { OrganisationRepository } from '{{alias.context}}/domain/repositories/organisation.repository{{alias.ext}}';
+import { OrganisationName } from '{{alias.context}}/domain/value-objects/organisation-name.vo{{alias.ext}}';
+import { OrganisationSlug } from '{{alias.context}}/domain/value-objects/organisation-slug.vo{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { OpenOrganisationCommand } from '{{alias.context}}/application/commands/open-organisation/open-organisation.command{{alias.ext}}';
+
+@CommandHandler(OpenOrganisationCommand)
+export class OpenOrganisationHandler implements CommandHandler<OpenOrganisationCommand> {
+  constructor(
+    private readonly organisationRepository: OrganisationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly accountRepository: AccountRepository,
+    private readonly ids: IdGenerator,
+    private readonly clock: Clock,
+  ) {}
+
+  /** The account that opens the organisation is its first owner, in the same unit of work. */
+  async execute({ actor, organisation }: OpenOrganisationCommand): Promise<string> {
+    const slug = OrganisationSlug.create(organisation.slug);
+    const name = OrganisationName.create(organisation.name);
+    const opener = await this.accountRepository.findById(actor.id);
+
+    if (opener === undefined) {
+      throw AccountError.notFound(actor.id);
+    }
+
+    opener.assertActive();
+
+    if ((await this.organisationRepository.findById(slug.value)) !== undefined) {
+      throw OrganisationError.slugTaken(slug.value);
+    }
+
+    const now = this.clock.now();
+    const opened = Organisation.open(slug, { name, openedBy: opener.id }, now);
+    const owner = Member.join(this.ids.next(), { organisationId: opened.id, accountId: opener.id, role: MemberRole.Owner }, now);
+
+    await this.organisationRepository.save(opened);
+    await this.memberRepository.save(owner);
+
+    return opened.id;
+  }
+}

package/templates/presets/identity/context/application/commands/provision-account/provision-account.command.ts.tpl

@@ -0,0 +1,14 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Provisions the account of the person who signs in, from what their token says of them, or refreshes it at a later sign-in. */
+@Requires({{context.camel}}Permissions['account.provision'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class ProvisionAccountCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly profile: { readonly email: string; readonly emailVerified: boolean; readonly displayName: string },
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/provision-account/provision-account.handler.ts.tpl

@@ -0,0 +1,41 @@
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { Account } from '{{alias.context}}/domain/aggregates/account.aggregate{{alias.ext}}';
+import { AccountError } from '{{alias.context}}/domain/errors/account.error{{alias.ext}}';
+import type { AccountRepository } from '{{alias.context}}/domain/repositories/account.repository{{alias.ext}}';
+import { DisplayName } from '{{alias.context}}/domain/value-objects/display-name.vo{{alias.ext}}';
+import { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+import { ProvisionAccountCommand } from '{{alias.context}}/application/commands/provision-account/provision-account.command{{alias.ext}}';
+
+@CommandHandler(ProvisionAccountCommand)
+export class ProvisionAccountHandler implements CommandHandler<ProvisionAccountCommand> {
+  constructor(
+    private readonly accountRepository: AccountRepository,
+    private readonly clock: Clock,
+  ) {}
+
+  /**
+   * The actor is the person the provider authenticated: their subject names the account, at the
+   * first sign-in as at the next ones. The address must be one the provider verified, since the
+   * invitations of the organisations are answered by whoever holds it.
+   */
+  async execute({ actor, profile }: ProvisionAccountCommand): Promise<string> {
+    if (!profile.emailVerified) {
+      throw AccountError.emailNotVerified(actor.id);
+    }
+
+    const current = { email: EmailAddress.create(profile.email), displayName: DisplayName.create(profile.displayName) };
+    const known = await this.accountRepository.findById(actor.id);
+
+    if (known === undefined) {
+      await this.accountRepository.save(Account.provision(actor.id, current, this.clock.now()));
+
+      return actor.id;
+    }
+
+    known.refreshProfile(current);
+    await this.accountRepository.save(known);
+
+    return known.id;
+  }
+}

package/templates/presets/identity/context/application/commands/remove-member/remove-member.command.ts.tpl

@@ -0,0 +1,15 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Removes a member from an organisation. */
+@Requires({{context.camel}}Permissions['member.remove'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class RemoveMemberCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly accountId: string,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/remove-member/remove-member.handler.ts.tpl

@@ -0,0 +1,79 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import type { Organisation } from '{{alias.context}}/domain/aggregates/organisation.aggregate{{alias.ext}}';
+import { MemberError } from '{{alias.context}}/domain/errors/member.error{{alias.ext}}';
+import { OrganisationError } from '{{alias.context}}/domain/errors/organisation.error{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import type { OrganisationRepository } from '{{alias.context}}/domain/repositories/organisation.repository{{alias.ext}}';
+import { RoleRightsService, type HeldRights } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { RemoveMemberCommand } from '{{alias.context}}/application/commands/remove-member/remove-member.command{{alias.ext}}';
+
+@CommandHandler(RemoveMemberCommand)
+export class RemoveMemberHandler implements CommandHandler<RemoveMemberCommand> {
+  constructor(
+    private readonly organisationRepository: OrganisationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /**
+   * Within the role of who decides; the organisation is saved with the removal, unchanged, so that
+   * its version orders the changes of its owners. Every delegation the member gave or received in
+   * the organisation ends with the membership.
+   */
+  async execute({ actor, organisationId, accountId }: RemoveMemberCommand): Promise<string> {
+    const now = this.clock.now();
+    const held = await this.heldBy(organisationId, actor.id, now);
+    const rights = new RoleRightsService();
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['member.remove'], rights.rightsIn(organisationId, actor.id, held));
+
+    const { organisation, member } = await this.membershipIn(organisationId, accountId);
+    const delegationId = rights.delegationUsedFor(MemberRight.ManageMembers, held);
+    const owners = await this.memberRepository.countOwners(organisationId);
+
+    member.remove({ by: held.member?.role ?? MemberRole.Member, byAccount: actor.id, delegationId, owners }, now);
+    await this.organisationRepository.save(organisation);
+    await this.memberRepository.save(member);
+    await this.endDelegationsInvolving(organisationId, accountId, now);
+
+    return member.id;
+  }
+
+  private async heldBy(organisationId: string, accountId: string, now: Date): Promise<HeldRights> {
+    const member = await this.memberRepository.findOf(organisationId, accountId);
+
+    return { member, lent: await this.delegationRepository.findUnendedTo(organisationId, accountId), now };
+  }
+
+  /** The organisation, to be saved with the change, and the membership the change is about. */
+  private async membershipIn(organisationId: string, accountId: string): Promise<{ organisation: Organisation; member: Member }> {
+    const organisation = await this.organisationRepository.findById(organisationId);
+    const member = await this.memberRepository.findOf(organisationId, accountId);
+
+    if (organisation === undefined) {
+      throw OrganisationError.notFound(organisationId);
+    }
+
+    if (member === undefined) {
+      throw MemberError.notFound(organisationId, accountId);
+    }
+
+    return { organisation, member };
+  }
+
+  private async endDelegationsInvolving(organisationId: string, accountId: string, now: Date): Promise<void> {
+    for (const delegation of await this.delegationRepository.findUnendedInvolving(organisationId, accountId)) {
+      delegation.end(now);
+      await this.delegationRepository.save(delegation);
+    }
+  }
+}

package/templates/presets/identity/context/application/commands/revoke-delegation/revoke-delegation.command.ts.tpl

@@ -0,0 +1,15 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Ends a delegation of an organisation before its period. */
+@Requires({{context.camel}}Permissions['delegation.revoke'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class RevokeDelegationCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly delegationId: string,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/revoke-delegation/revoke-delegation.handler.ts.tpl

@@ -0,0 +1,39 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { DelegationError } from '{{alias.context}}/domain/errors/delegation.error{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { RoleRightsService } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { RevokeDelegationCommand } from '{{alias.context}}/application/commands/revoke-delegation/revoke-delegation.command{{alias.ext}}';
+
+@CommandHandler(RevokeDelegationCommand)
+export class RevokeDelegationHandler implements CommandHandler<RevokeDelegationCommand> {
+  constructor(
+    private readonly delegationRepository: DelegationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /** Whoever may grant delegations in the organisation revokes them; one of another organisation is not found here. */
+  async execute({ actor, organisationId, delegationId }: RevokeDelegationCommand): Promise<string> {
+    const now = this.clock.now();
+    const member = await this.memberRepository.findOf(organisationId, actor.id);
+    const rights = new RoleRightsService().rightsIn(organisationId, actor.id, { member, lent: [], now });
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['delegation.revoke'], rights);
+
+    const delegation = await this.delegationRepository.findById(delegationId);
+
+    if (delegation?.organisationId !== organisationId) {
+      throw DelegationError.notFound(delegationId);
+    }
+
+    delegation.revoke(now);
+    await this.delegationRepository.save(delegation);
+
+    return delegation.id;
+  }
+}

package/templates/presets/identity/context/application/commands/revoke-invitation/revoke-invitation.command.ts.tpl

@@ -0,0 +1,15 @@
+import { AuthorizedCommand, type Actor } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+
+/** Takes back an invitation of an organisation that was not answered. */
+@Requires({{context.camel}}Permissions['invitation.revoke'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class RevokeInvitationCommand extends AuthorizedCommand<string> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly invitationId: string,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/commands/revoke-invitation/revoke-invitation.handler.ts.tpl

@@ -0,0 +1,42 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { CommandHandler } from '@ddd-ts-kit/kernel/declarations';
+import { InvitationError } from '{{alias.context}}/domain/errors/invitation.error{{alias.ext}}';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { InvitationRepository } from '{{alias.context}}/domain/repositories/invitation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { RoleRightsService } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import { RevokeInvitationCommand } from '{{alias.context}}/application/commands/revoke-invitation/revoke-invitation.command{{alias.ext}}';
+
+@CommandHandler(RevokeInvitationCommand)
+export class RevokeInvitationHandler implements CommandHandler<RevokeInvitationCommand> {
+  constructor(
+    private readonly invitationRepository: InvitationRepository,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /** Whoever may invite in the organisation takes back its invitations: an invitation of another organisation is not found here. */
+  async execute({ actor, organisationId, invitationId }: RevokeInvitationCommand): Promise<string> {
+    const now = this.clock.now();
+    const member = await this.memberRepository.findOf(organisationId, actor.id);
+    const lent = await this.delegationRepository.findUnendedTo(organisationId, actor.id);
+    const rights = new RoleRightsService().rightsIn(organisationId, actor.id, { member, lent, now });
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['invitation.revoke'], rights);
+
+    const invitation = await this.invitationRepository.findById(invitationId);
+
+    if (invitation?.organisationId !== organisationId) {
+      throw InvitationError.notFound();
+    }
+
+    invitation.revoke(now);
+    await this.invitationRepository.save(invitation);
+
+    return invitation.id;
+  }
+}

package/templates/presets/identity/context/application/integration/handlers/account-deactivated.integration-handler.ts.tpl

@@ -0,0 +1,19 @@
+import { IntegrationEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { accountDeactivatedV1, type AccountDeactivatedV1 } from '{{alias.context}}/published-language/account-deactivated.v1.integration-event{{alias.ext}}';
+import type { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+
+/**
+ * The provider disables the person: they sign in no more. Delivered at least once through the
+ * outbox, so a provider down at the time of the deactivation is asked again until it answers;
+ * disabling twice changes nothing.
+ */
+@IntegrationEventHandler(accountDeactivatedV1, { consumer: '{{context.kebab}}.provider-disables-account' })
+export class AccountDeactivatedIntegrationHandler {
+  static readonly eventType = accountDeactivatedV1.type;
+
+  constructor(private readonly identityProvider: IdentityProviderAdmin) {}
+
+  async handle(event: AccountDeactivatedV1): Promise<void> {
+    await this.identityProvider.disableAccount(event.payload.accountId);
+  }
+}

package/templates/presets/identity/context/application/integration/handlers/member-joined.integration-handler.ts.tpl

@@ -0,0 +1,33 @@
+import { IntegrationEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { memberJoinedV1, type MemberJoinedV1 } from '{{alias.context}}/published-language/member-joined.v1.integration-event{{alias.ext}}';
+import type { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+
+/**
+ * The provider follows the membership: delivered at least once and in no guaranteed order, so the
+ * handler brings the provider in line with what the context holds now rather than with the fact
+ * alone. A membership already ended (removed, or its account deactivated) is taken out again,
+ * so that a late retry of this fact never gives a removed person back their organisation.
+ */
+@IntegrationEventHandler(memberJoinedV1, { consumer: '{{context.kebab}}.provider-follows-joined-member' })
+export class MemberJoinedIntegrationHandler {
+  static readonly eventType = memberJoinedV1.type;
+
+  constructor(
+    private readonly memberRepository: MemberRepository,
+    private readonly identityProvider: IdentityProviderAdmin,
+  ) {}
+
+  async handle(event: MemberJoinedV1): Promise<void> {
+    const { organisationId, accountId } = event.payload;
+    const current = await this.memberRepository.findOf(organisationId, accountId);
+
+    if (current === undefined) {
+      await this.identityProvider.removeMember(organisationId, accountId);
+
+      return;
+    }
+
+    await this.identityProvider.addMember(organisationId, accountId);
+  }
+}

package/templates/presets/identity/context/application/integration/handlers/member-removed.integration-handler.ts.tpl

@@ -0,0 +1,30 @@
+import { IntegrationEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { memberRemovedV1, type MemberRemovedV1 } from '{{alias.context}}/published-language/member-removed.v1.integration-event{{alias.ext}}';
+import type { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+
+/**
+ * The provider takes the person out of the organisation: their next token no longer names it,
+ * and with tenants they reach its data no more. Delivered at least once through the outbox, so a
+ * provider down at the time of the removal is asked again until it answers; a person who joined
+ * again since is left in, the context holding the membership now.
+ */
+@IntegrationEventHandler(memberRemovedV1, { consumer: '{{context.kebab}}.provider-follows-removed-member' })
+export class MemberRemovedIntegrationHandler {
+  static readonly eventType = memberRemovedV1.type;
+
+  constructor(
+    private readonly memberRepository: MemberRepository,
+    private readonly identityProvider: IdentityProviderAdmin,
+  ) {}
+
+  async handle(event: MemberRemovedV1): Promise<void> {
+    const { organisationId, accountId } = event.payload;
+
+    if ((await this.memberRepository.findOf(organisationId, accountId)) !== undefined) {
+      return;
+    }
+
+    await this.identityProvider.removeMember(organisationId, accountId);
+  }
+}

package/templates/presets/identity/context/application/integration/handlers/organisation-opened.integration-handler.ts.tpl

@@ -0,0 +1,19 @@
+import { IntegrationEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { organisationOpenedV1, type OrganisationOpenedV1 } from '{{alias.context}}/published-language/organisation-opened.v1.integration-event{{alias.ext}}';
+import type { IdentityProviderAdmin } from '{{alias.context}}/application/ports/identity-provider-admin.port{{alias.ext}}';
+
+/**
+ * The provider learns the organisation under its slug, so that its tokens can name it. Driven by
+ * the fact the context published through its outbox, so delivered at least once: a provider that
+ * fails is asked again until it answers, and asking twice changes nothing (the adapter is idempotent).
+ */
+@IntegrationEventHandler(organisationOpenedV1, { consumer: '{{context.kebab}}.provider-opens-organisation' })
+export class OrganisationOpenedIntegrationHandler {
+  static readonly eventType = organisationOpenedV1.type;
+
+  constructor(private readonly identityProvider: IdentityProviderAdmin) {}
+
+  async handle(event: OrganisationOpenedV1): Promise<void> {
+    await this.identityProvider.openOrganisation({ id: event.payload.organisationId, name: event.payload.name });
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/account-deactivated.publisher.ts.tpl

@@ -0,0 +1,24 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { AccountDeactivated } from '{{alias.context}}/domain/events/account-deactivated.event{{alias.ext}}';
+import { accountDeactivatedV1 } from '{{alias.context}}/published-language/account-deactivated.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(AccountDeactivated, { name: AccountDeactivated.eventName })
+export class AccountDeactivatedPublisher implements DomainEventHandler<AccountDeactivated> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: AccountDeactivated): Promise<void> {
+    const published = accountDeactivatedV1.create(
+      {
+        accountId: event.aggregateId,
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+    await this.publisher.publish([published]);
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/delegation-granted.publisher.ts.tpl

@@ -0,0 +1,36 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { DelegationGranted } from '{{alias.context}}/domain/events/delegation-granted.event{{alias.ext}}';
+import { delegationGrantedV1 } from '{{alias.context}}/published-language/delegation-granted.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(DelegationGranted, { name: DelegationGranted.eventName })
+export class DelegationGrantedPublisher implements DomainEventHandler<DelegationGranted> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: DelegationGranted): Promise<void> {
+    const published = delegationGrantedV1.create(
+      {
+        delegationId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        delegatorId: event.facts.delegatorId,
+        delegateId: event.facts.delegateId,
+        rights: [...event.facts.rights],
+        startsAt: event.facts.startsAt.toISOString(),
+        endsAt: event.facts.endsAt.toISOString(),
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/delegation-revoked.publisher.ts.tpl

@@ -0,0 +1,33 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { DelegationRevoked } from '{{alias.context}}/domain/events/delegation-revoked.event{{alias.ext}}';
+import { delegationRevokedV1 } from '{{alias.context}}/published-language/delegation-revoked.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(DelegationRevoked, { name: DelegationRevoked.eventName })
+export class DelegationRevokedPublisher implements DomainEventHandler<DelegationRevoked> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: DelegationRevoked): Promise<void> {
+    const published = delegationRevokedV1.create(
+      {
+        delegationId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        delegatorId: event.facts.delegatorId,
+        delegateId: event.facts.delegateId,
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/member-joined.publisher.ts.tpl

@@ -0,0 +1,33 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { MemberJoined } from '{{alias.context}}/domain/events/member-joined.event{{alias.ext}}';
+import { memberJoinedV1 } from '{{alias.context}}/published-language/member-joined.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(MemberJoined, { name: MemberJoined.eventName })
+export class MemberJoinedPublisher implements DomainEventHandler<MemberJoined> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: MemberJoined): Promise<void> {
+    const published = memberJoinedV1.create(
+      {
+        memberId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        accountId: event.facts.accountId,
+        role: event.facts.role,
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/member-removed.publisher.ts.tpl

@@ -0,0 +1,33 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { MemberRemoved } from '{{alias.context}}/domain/events/member-removed.event{{alias.ext}}';
+import { memberRemovedV1 } from '{{alias.context}}/published-language/member-removed.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(MemberRemoved, { name: MemberRemoved.eventName })
+export class MemberRemovedPublisher implements DomainEventHandler<MemberRemoved> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: MemberRemoved): Promise<void> {
+    const published = memberRemovedV1.create(
+      {
+        memberId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        accountId: event.facts.accountId,
+        ...(event.facts.delegationId === undefined ? {} : { delegationId: event.facts.delegationId }),
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/integration/publishers/member-role-changed.publisher.ts.tpl

@@ -0,0 +1,35 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { MemberRoleChanged } from '{{alias.context}}/domain/events/member-role-changed.event{{alias.ext}}';
+import { memberRoleChangedV1 } from '{{alias.context}}/published-language/member-role-changed.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(MemberRoleChanged, { name: MemberRoleChanged.eventName })
+export class MemberRoleChangedPublisher implements DomainEventHandler<MemberRoleChanged> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: MemberRoleChanged): Promise<void> {
+    const published = memberRoleChangedV1.create(
+      {
+        memberId: event.aggregateId,
+        organisationId: event.facts.organisationId,
+        accountId: event.facts.accountId,
+        from: event.facts.from,
+        to: event.facts.to,
+        ...(event.facts.delegationId === undefined ? {} : { delegationId: event.facts.delegationId }),
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.facts.organisationId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}