ddd-ts-kit 0.14.0 → 0.15.0

package/templates/presets/identity/context/application/integration/publishers/organisation-opened.publisher.ts.tpl

@@ -0,0 +1,32 @@
+import type { IdGenerator, IntegrationEventPublisher } from '@ddd-ts-kit/kernel';
+import { DomainEventHandler } from '@ddd-ts-kit/kernel/declarations';
+import { OrganisationOpened } from '{{alias.context}}/domain/events/organisation-opened.event{{alias.ext}}';
+import { organisationOpenedV1 } from '{{alias.context}}/published-language/organisation-opened.v1.integration-event{{alias.ext}}';
+
+/** Tells the other contexts, through the outbox, in the transaction of the fact. */
+@DomainEventHandler(OrganisationOpened, { name: OrganisationOpened.eventName })
+export class OrganisationOpenedPublisher implements DomainEventHandler<OrganisationOpened> {
+  constructor(
+    private readonly publisher: IntegrationEventPublisher,
+    private readonly ids: IdGenerator,
+  ) {}
+
+  async handle(event: OrganisationOpened): Promise<void> {
+    const published = organisationOpenedV1.create(
+      {
+        organisationId: event.aggregateId,
+        name: event.facts.name,
+        openedBy: event.facts.openedBy,
+      },
+      { id: this.ids.next(), occurredAt: event.occurredAt },
+    );
+
+{{#if tenancy.any}}
+    // The organisation is the tenant of the fact: its consumers run in it, whoever acted.
+    await this.publisher.publish([{ ...published, tenantId: event.aggregateId }]);
+{{/if}}
+{{#unless tenancy.any}}
+    await this.publisher.publish([published]);
+{{/unless}}
+  }
+}

package/templates/presets/identity/context/application/ports/identity-provider-admin.port.ts.tpl

@@ -0,0 +1,17 @@
+/**
+ * The administration API of the identity provider: it authenticates, and follows what this
+ * context decides, so that its tokens name the organisations of each person and a deactivated
+ * account signs in no more. Called by the consumers of the facts the context publishes through its
+ * outbox (`application/integration/handlers/`), so at least once and in no guaranteed order: every
+ * method is idempotent, and a failure is retried by whoever delivers the fact.
+ */
+export abstract class IdentityProviderAdmin {
+  /** The provider knows the organisation under its slug, which its tokens then name. */
+  abstract openOrganisation(organisation: { readonly id: string; readonly name: string }): Promise<void>;
+
+  abstract addMember(organisationId: string, accountId: string): Promise<void>;
+
+  abstract removeMember(organisationId: string, accountId: string): Promise<void>;
+
+  abstract disableAccount(accountId: string): Promise<void>;
+}

package/templates/presets/identity/context/application/ports/identity-provider-connection.port.ts.tpl

@@ -0,0 +1,14 @@
+/**
+ * Where the administration API of the identity provider is, and the client it is called as: the
+ * settings of `KeycloakIdentityProviderAdmin`. The default adapter reads them from the
+ * environment when a call is made; the platform may bind a value of its validated config instead.
+ */
+export abstract class IdentityProviderConnection {
+  /** `baseUrl` of the provider, its realm, and a confidential client allowed to manage users and organisations. */
+  abstract settings(): Promise<{
+    readonly baseUrl: string;
+    readonly realm: string;
+    readonly clientId: string;
+    readonly clientSecret: string;
+  }>;
+}

package/templates/presets/identity/context/application/ports/invitation-tokens.port.ts.tpl

@@ -0,0 +1,7 @@
+/** The tokens of the invitations: unguessable, sent to the person, never stored but as a digest. */
+export abstract class InvitationTokens {
+  /** A new token, and the digest the invitation keeps of it. */
+  abstract issue(): { readonly token: string; readonly digest: string };
+
+  abstract digestOf(token: string): string;
+}

package/templates/presets/identity/context/application/ports/search-members-reader.port.ts.tpl

@@ -0,0 +1,10 @@
+import type { PageRequest } from '@ddd-ts-kit/kernel';
+import type {
+  SearchMembersResult,
+  SearchMembersSort,
+} from '{{alias.context}}/application/queries/search-members/search-members.result{{alias.ext}}';
+
+export abstract class SearchMembersReader {
+  /** One page of the current members of an organisation, with the profile of their account, by the instant they joined then by id. */
+  abstract search(organisationId: string, page: PageRequest<SearchMembersSort>): Promise<SearchMembersResult>;
+}

package/templates/presets/identity/context/application/queries/search-members/search-members.handler.ts.tpl

@@ -0,0 +1,33 @@
+import type { Access } from '@ddd-ts-kit/auth';
+import type { Clock } from '@ddd-ts-kit/kernel';
+import { QueryHandler } from '@ddd-ts-kit/kernel/declarations';
+import type { DelegationRepository } from '{{alias.context}}/domain/repositories/delegation.repository{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { RoleRightsService } from '{{alias.context}}/domain/services/role-rights.service{{alias.ext}}';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import type { SearchMembersReader } from '{{alias.context}}/application/ports/search-members-reader.port{{alias.ext}}';
+import { SearchMembersQuery } from '{{alias.context}}/application/queries/search-members/search-members.query{{alias.ext}}';
+import type { SearchMembersResult } from '{{alias.context}}/application/queries/search-members/search-members.result{{alias.ext}}';
+
+@QueryHandler(SearchMembersQuery)
+export class SearchMembersHandler implements QueryHandler<SearchMembersQuery> {
+  constructor(
+    private readonly reader: SearchMembersReader,
+    private readonly memberRepository: MemberRepository,
+    private readonly delegationRepository: DelegationRepository,
+    private readonly access: Access,
+    private readonly clock: Clock,
+  ) {}
+
+  /** The members of an organisation are read by its members, and by nobody else: the read names the organisation the right was decided on. */
+  async execute({ actor, organisationId, page }: SearchMembersQuery): Promise<SearchMembersResult> {
+    const now = this.clock.now();
+    const member = await this.memberRepository.findOf(organisationId, actor.id);
+    const lent = await this.delegationRepository.findUnendedTo(organisationId, actor.id);
+    const rights = new RoleRightsService().rightsIn(organisationId, actor.id, { member, lent, now });
+
+    await this.access.authorize(actor, {{context.camel}}Permissions['member.search'], rights);
+
+    return this.reader.search(organisationId, page);
+  }
+}

package/templates/presets/identity/context/application/queries/search-members/search-members.query.ts.tpl

@@ -0,0 +1,19 @@
+import { AuthorizedQuery, type Actor, type PageRequest } from '@ddd-ts-kit/kernel';
+import { Requires } from '@ddd-ts-kit/kernel/declarations';
+import { {{context.camel}}Permissions } from '{{alias.context}}/application/authorization/{{context.kebab}}.permissions{{alias.ext}}';
+import type {
+  SearchMembersResult,
+  SearchMembersSort,
+} from '{{alias.context}}/application/queries/search-members/search-members.result{{alias.ext}}';
+
+/** One page of the current members of an organisation, for its members. */
+@Requires({{context.camel}}Permissions['member.search'], { resource: () => ({ type: 'context', id: '{{context.kebab}}' }) })
+export class SearchMembersQuery extends AuthorizedQuery<SearchMembersResult> {
+  constructor(
+    actor: Actor,
+    readonly organisationId: string,
+    readonly page: PageRequest<SearchMembersSort>,
+  ) {
+    super(actor);
+  }
+}

package/templates/presets/identity/context/application/queries/search-members/search-members.result.ts.tpl

@@ -0,0 +1,17 @@
+import type { Page } from '@ddd-ts-kit/kernel';
+import type { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+/** A current member of an organisation, with the profile of their account. */
+export interface SearchMembersItem {
+  readonly memberId: string;
+  readonly accountId: string;
+  readonly displayName: string;
+  readonly email: string;
+  readonly role: MemberRole;
+  readonly joinedAt: Date;
+}
+
+/** By the instant they joined, earliest first unless the client asks otherwise. */
+export type SearchMembersSort = 'joinedAt';
+
+export type SearchMembersResult = Page<SearchMembersItem>;

package/templates/presets/identity/context/domain/aggregates/account.aggregate.ts.tpl

@@ -0,0 +1,92 @@
+import { AggregateRoot } from '@ddd-ts-kit/kernel';
+import { AccountError } from '{{alias.context}}/domain/errors/account.error{{alias.ext}}';
+import { AccountDeactivated } from '{{alias.context}}/domain/events/account-deactivated.event{{alias.ext}}';
+import { AccountProvisioned } from '{{alias.context}}/domain/events/account-provisioned.event{{alias.ext}}';
+import type { DisplayName } from '{{alias.context}}/domain/value-objects/display-name.vo{{alias.ext}}';
+import type { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+import { AccountStatus } from '{{alias.context}}/domain/vocabularies/account-status.vocabulary{{alias.ext}}';
+
+/** What the identity provider says of a person, as the application keeps it: refreshed at each sign-in. */
+export interface AccountProfile {
+  readonly email: EmailAddress;
+  readonly displayName: DisplayName;
+}
+
+export interface AccountState extends AccountProfile {
+  readonly status: AccountStatus;
+  readonly provisionedAt: Date;
+  readonly deactivatedAt: Date | undefined;
+}
+
+/**
+ * One person as the application knows them, under the subject the identity provider gives them:
+ * the provider authenticates, the application keeps the profile and authorizes. No password is
+ * stored here, nor anything the provider owns.
+ */
+export class Account extends AggregateRoot<string> {
+  private constructor(
+    id: string,
+    private state: AccountState,
+  ) {
+    super(id);
+  }
+
+  /** At the first sign-in of a person: the account takes the subject of the provider as its identity. */
+  static provision(subject: string, profile: AccountProfile, now: Date): Account {
+    const status = AccountStatus.Active;
+    const provisioned = new Account(subject, { ...profile, status, provisionedAt: now, deactivatedAt: undefined });
+
+    provisioned.record(
+      new AccountProvisioned(subject, now, { email: profile.email.value, displayName: profile.displayName.value }),
+    );
+
+    return provisioned;
+  }
+
+  static rehydrate(id: string, state: AccountState): Account {
+    return new Account(id, state);
+  }
+
+  /** At a later sign-in: the profile the provider holds now replaces the one kept. */
+  refreshProfile(profile: AccountProfile): void {
+    this.assertActive();
+    this.state = { ...this.state, ...profile };
+  }
+
+  /** The person signs in no more; their memberships and their history stay. */
+  deactivate(now: Date): void {
+    if (!this.isActive) {
+      throw AccountError.alreadyDeactivated(this.id);
+    }
+
+    this.state = { ...this.state, status: AccountStatus.Deactivated, deactivatedAt: now };
+    this.record(new AccountDeactivated(this.id, now));
+  }
+
+  /** Refuses every intention of a deactivated account. */
+  assertActive(): void {
+    if (!this.isActive) {
+      throw AccountError.deactivated(this.id);
+    }
+  }
+
+  get isActive(): boolean {
+    return this.state.status === AccountStatus.Active;
+  }
+
+  get email(): EmailAddress {
+    return this.state.email;
+  }
+
+  get displayName(): DisplayName {
+    return this.state.displayName;
+  }
+
+  get provisionedAt(): Date {
+    return this.state.provisionedAt;
+  }
+
+  toState(): AccountState {
+    return { ...this.state };
+  }
+}

package/templates/presets/identity/context/domain/aggregates/delegation.aggregate.ts.tpl

@@ -0,0 +1,117 @@
+import { AggregateRoot } from '@ddd-ts-kit/kernel';
+import { DelegationError } from '{{alias.context}}/domain/errors/delegation.error{{alias.ext}}';
+import { DelegationGranted } from '{{alias.context}}/domain/events/delegation-granted.event{{alias.ext}}';
+import { DelegationRevoked } from '{{alias.context}}/domain/events/delegation-revoked.event{{alias.ext}}';
+import type { DelegationPeriod } from '{{alias.context}}/domain/value-objects/delegation-period.vo{{alias.ext}}';
+import type { OrganisationRights } from '{{alias.context}}/domain/value-objects/organisation-rights.vo{{alias.ext}}';
+import type { MemberRight } from '{{alias.context}}/domain/vocabularies/member-right.vocabulary{{alias.ext}}';
+
+export interface DelegationState {
+  readonly organisationId: string;
+  readonly delegatorId: string;
+  readonly delegateId: string;
+  readonly rights: readonly MemberRight[];
+  readonly period: DelegationPeriod;
+  readonly endedAt: Date | undefined;
+}
+
+/** What a delegation lends, and what its delegator may do by their role: a delegation lends nothing beyond it. */
+export interface DelegationTerms extends Omit<DelegationState, 'endedAt'> {
+  readonly held: OrganisationRights;
+}
+
+/**
+ * A member lends some of the rights of their role to another member of the organisation, for a
+ * bounded period: the delegate acts in their own name, with those rights, until the end of the
+ * period or until the delegation is revoked. Every grant and every end is a fact, and every use
+ * case is recorded in the audit trail of the project.
+ */
+export class Delegation extends AggregateRoot<string> {
+  private constructor(
+    id: string,
+    private state: DelegationState,
+  ) {
+    super(id);
+  }
+
+  static grant(id: string, { held, ...terms }: DelegationTerms, now: Date): Delegation {
+    assertLendable(terms, held);
+
+    const granted = new Delegation(id, { ...terms, endedAt: undefined });
+    const { organisationId, delegatorId, delegateId, rights, period } = terms;
+    const facts = { organisationId, delegatorId, delegateId, rights, startsAt: period.startsAt, endsAt: period.endsAt };
+
+    granted.record(new DelegationGranted(id, now, facts));
+
+    return granted;
+  }
+
+  static rehydrate(id: string, state: DelegationState): Delegation {
+    return new Delegation(id, state);
+  }
+
+  /** Withdrawn by hand while it holds or before it starts: an ended delegation cannot be. */
+  revoke(now: Date): void {
+    if (this.state.endedAt !== undefined || now.getTime() >= this.state.period.endsAt.getTime()) {
+      throw DelegationError.notActive(this.id);
+    }
+
+    this.end(now);
+  }
+
+  /** Ends because the delegator or the delegate no longer stands as it did when it was granted; already ended, nothing changes. */
+  end(now: Date): void {
+    if (this.state.endedAt !== undefined) {
+      return;
+    }
+
+    const { organisationId, delegatorId, delegateId } = this.state;
+
+    this.state = { ...this.state, endedAt: now };
+    this.record(new DelegationRevoked(this.id, now, { organisationId, delegatorId, delegateId }));
+  }
+
+  isActiveAt(instant: Date): boolean {
+    return this.state.endedAt === undefined && this.state.period.includes(instant);
+  }
+
+  get organisationId(): string {
+    return this.state.organisationId;
+  }
+
+  get delegatorId(): string {
+    return this.state.delegatorId;
+  }
+
+  get delegateId(): string {
+    return this.state.delegateId;
+  }
+
+  get rights(): readonly MemberRight[] {
+    return this.state.rights;
+  }
+
+  get period(): DelegationPeriod {
+    return this.state.period;
+  }
+
+  toState(): DelegationState {
+    return { ...this.state };
+  }
+}
+
+function assertLendable(terms: Omit<DelegationState, 'endedAt'>, held: OrganisationRights): void {
+  if (terms.delegateId === terms.delegatorId) {
+    throw DelegationError.toOneself(terms.delegatorId);
+  }
+
+  if (terms.rights.length === 0) {
+    throw DelegationError.withoutRights();
+  }
+
+  const beyond = terms.rights.find((right) => !held.includes(right));
+
+  if (beyond !== undefined) {
+    throw DelegationError.beyondRights(beyond);
+  }
+}

package/templates/presets/identity/context/domain/aggregates/invitation.aggregate.ts.tpl

@@ -0,0 +1,128 @@
+import { AggregateRoot } from '@ddd-ts-kit/kernel';
+import { InvitationError } from '{{alias.context}}/domain/errors/invitation.error{{alias.ext}}';
+import { InvitationAccepted } from '{{alias.context}}/domain/events/invitation-accepted.event{{alias.ext}}';
+import { InvitationDeclined } from '{{alias.context}}/domain/events/invitation-declined.event{{alias.ext}}';
+import { InvitationIssued } from '{{alias.context}}/domain/events/invitation-issued.event{{alias.ext}}';
+import { InvitationRevoked } from '{{alias.context}}/domain/events/invitation-revoked.event{{alias.ext}}';
+import type { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+import { InvitationStatus } from '{{alias.context}}/domain/vocabularies/invitation-status.vocabulary{{alias.ext}}';
+import type { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+/** How long an invitation can be answered: a week, then a new one is sent. */
+const VALIDITY_MS = 7 * 86_400_000;
+
+export interface InvitationState {
+  readonly organisationId: string;
+  readonly email: EmailAddress;
+  readonly role: MemberRole;
+  /** The digest of the token sent to the person: the token itself is never stored. */
+  readonly tokenHash: string;
+  readonly invitedBy: string;
+  readonly issuedAt: Date;
+  readonly expiresAt: Date;
+  readonly status: InvitationStatus;
+  readonly answeredAt: Date | undefined;
+}
+
+/** What an invitation is issued with. */
+export type InvitationTerms = Pick<InvitationState, 'organisationId' | 'email' | 'role' | 'tokenHash' | 'invitedBy'> & {
+  readonly delegationId?: string;
+};
+
+/** The person who answers an invitation: an account, with the email address its provider knows. */
+export interface Invitee {
+  readonly id: string;
+  readonly email: EmailAddress;
+}
+
+/** An organisation asks a person, by email address, to join it in a role; the answer is theirs alone. */
+export class Invitation extends AggregateRoot<string> {
+  private constructor(
+    id: string,
+    private state: InvitationState,
+  ) {
+    super(id);
+  }
+
+  /** `delegationId` names the delegation that lent the right to invite, when the role of the inviter does not grant it. */
+  static issue(id: string, terms: InvitationTerms, now: Date): Invitation {
+    const expiresAt = new Date(now.getTime() + VALIDITY_MS);
+    const pending = { status: InvitationStatus.Pending, issuedAt: now, expiresAt, answeredAt: undefined };
+    const { organisationId, email, role, tokenHash, invitedBy, delegationId } = terms;
+    const issued = new Invitation(id, { organisationId, email, role, tokenHash, invitedBy, ...pending });
+    const under = delegationId === undefined ? {} : { delegationId };
+
+    issued.record(new InvitationIssued(id, now, { organisationId, email: email.value, role, expiresAt, ...under }));
+
+    return issued;
+  }
+
+  static rehydrate(id: string, state: InvitationState): Invitation {
+    return new Invitation(id, state);
+  }
+
+  /** By the person it was addressed to, before it expires: they become a member (see `AcceptInvitationHandler`). */
+  accept(invitee: Invitee, now: Date): void {
+    this.assertAnswerableBy(invitee, now);
+    this.answer(InvitationStatus.Accepted, now);
+    this.record(new InvitationAccepted(this.id, now, { organisationId: this.organisationId, accountId: invitee.id }));
+  }
+
+  decline(invitee: Invitee, now: Date): void {
+    this.assertAnswerableBy(invitee, now);
+    this.answer(InvitationStatus.Declined, now);
+    this.record(new InvitationDeclined(this.id, now, { organisationId: this.organisationId }));
+  }
+
+  /** Taken back by the organisation while it waits for an answer, expired or not. */
+  revoke(now: Date): void {
+    if (this.state.status !== InvitationStatus.Pending) {
+      throw InvitationError.notPending(this.id, this.state.status);
+    }
+
+    this.answer(InvitationStatus.Revoked, now);
+    this.record(new InvitationRevoked(this.id, now, { organisationId: this.organisationId }));
+  }
+
+  get organisationId(): string {
+    return this.state.organisationId;
+  }
+
+  get email(): EmailAddress {
+    return this.state.email;
+  }
+
+  get role(): MemberRole {
+    return this.state.role;
+  }
+
+  get status(): InvitationStatus {
+    return this.state.status;
+  }
+
+  get expiresAt(): Date {
+    return this.state.expiresAt;
+  }
+
+  toState(): InvitationState {
+    return { ...this.state };
+  }
+
+  private assertAnswerableBy(invitee: Invitee, now: Date): void {
+    if (this.state.status !== InvitationStatus.Pending) {
+      throw InvitationError.notPending(this.id, this.state.status);
+    }
+
+    if (now.getTime() >= this.state.expiresAt.getTime()) {
+      throw InvitationError.expired(this.id, this.state.expiresAt);
+    }
+
+    if (!invitee.email.equals(this.state.email)) {
+      throw InvitationError.addressedToAnother(this.id);
+    }
+  }
+
+  private answer(status: InvitationStatus, now: Date): void {
+    this.state = { ...this.state, status, answeredAt: now };
+  }
+}

package/templates/presets/identity/context/domain/aggregates/member.aggregate.ts.tpl

@@ -0,0 +1,149 @@
+import { AggregateRoot } from '@ddd-ts-kit/kernel';
+import { MemberError } from '{{alias.context}}/domain/errors/member.error{{alias.ext}}';
+import { MemberJoined } from '{{alias.context}}/domain/events/member-joined.event{{alias.ext}}';
+import { MemberRemoved } from '{{alias.context}}/domain/events/member-removed.event{{alias.ext}}';
+import { MemberRoleChanged } from '{{alias.context}}/domain/events/member-role-changed.event{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+
+export interface MemberState {
+  readonly organisationId: string;
+  readonly accountId: string;
+  readonly role: MemberRole;
+  readonly joinedAt: Date;
+  readonly removedAt: Date | undefined;
+}
+
+/**
+ * Who asks for a change of membership: their account and their own role (never the rights a
+ * delegation lends them, so that nobody appoints above themselves), the delegation that lends
+ * them the right when their role does not grant it, and how many owners the organisation has.
+ */
+export interface MembershipChange {
+  readonly by: MemberRole;
+  readonly byAccount: string;
+  readonly delegationId: string | undefined;
+  readonly owners: number;
+}
+
+/** The roles from the least to the most: a member appoints, changes and removes no one above their own role. */
+const FROM_LEAST: readonly MemberRole[] = [MemberRole.Member, MemberRole.Admin, MemberRole.Owner];
+
+/** The membership of one account in one organisation, in a role. */
+export class Member extends AggregateRoot<string> {
+  private constructor(
+    id: string,
+    private state: MemberState,
+  ) {
+    super(id);
+  }
+
+  static join(id: string, terms: Pick<MemberState, 'organisationId' | 'accountId' | 'role'>, now: Date): Member {
+    const joined = new Member(id, { ...terms, joinedAt: now, removedAt: undefined });
+
+    joined.record(new MemberJoined(id, now, terms));
+
+    return joined;
+  }
+
+  static rehydrate(id: string, state: MemberState): Member {
+    return new Member(id, state);
+  }
+
+  /** Whoever invites or appoints in `role` holds that role or a higher one: only an owner makes an owner. */
+  static assertAppointable(organisationId: string, role: MemberRole, by: MemberRole): void {
+    if (!outranks(role, by)) {
+      return;
+    }
+
+    throw role === MemberRole.Owner ? MemberError.ownersOnly(organisationId) : MemberError.aboveOwnRole(organisationId);
+  }
+
+  /** Never one's own role, never above one's own role, and the last owner stays one. */
+  changeRole(role: MemberRole, change: MembershipChange, now: Date): void {
+    this.assertActive();
+
+    if (change.byAccount === this.state.accountId) {
+      throw MemberError.ownRole(this.state.organisationId);
+    }
+
+    if (role === this.state.role) {
+      return;
+    }
+
+    this.assertWithinRole(change.by, role);
+    this.assertOwnersKept(change, role);
+
+    const { organisationId, accountId, role: from } = this.state;
+
+    this.state = { ...this.state, role };
+    this.record(new MemberRoleChanged(this.id, now, { organisationId, accountId, from, to: role, ...under(change) }));
+  }
+
+  /** A member leaves, or is removed by someone of their role or above; the last owner stays. */
+  remove(change: MembershipChange, now: Date): void {
+    this.assertActive();
+
+    if (change.byAccount !== this.state.accountId) {
+      this.assertWithinRole(change.by, this.state.role);
+    }
+
+    this.assertOwnersKept(change, undefined);
+
+    const { organisationId, accountId } = this.state;
+
+    this.state = { ...this.state, removedAt: now };
+    this.record(new MemberRemoved(this.id, now, { organisationId, accountId, ...under(change) }));
+  }
+
+  get isActive(): boolean {
+    return this.state.removedAt === undefined;
+  }
+
+  get organisationId(): string {
+    return this.state.organisationId;
+  }
+
+  get accountId(): string {
+    return this.state.accountId;
+  }
+
+  get role(): MemberRole {
+    return this.state.role;
+  }
+
+  get joinedAt(): Date {
+    return this.state.joinedAt;
+  }
+
+  toState(): MemberState {
+    return { ...this.state };
+  }
+
+  private assertActive(): void {
+    if (!this.isActive) {
+      throw MemberError.notFound(this.state.organisationId, this.state.accountId);
+    }
+  }
+
+  /** The role the member holds, and the one they are given, are both within the role of who decides. */
+  private assertWithinRole(by: MemberRole, next: MemberRole): void {
+    Member.assertAppointable(this.state.organisationId, this.state.role, by);
+    Member.assertAppointable(this.state.organisationId, next, by);
+  }
+
+  /** `next` is the role after the change, none for a removal. */
+  private assertOwnersKept(change: MembershipChange, next: MemberRole | undefined): void {
+    if (this.state.role === MemberRole.Owner && next !== MemberRole.Owner && change.owners <= 1) {
+      throw MemberError.lastOwner(this.state.organisationId);
+    }
+  }
+}
+
+function outranks(role: MemberRole, other: MemberRole): boolean {
+  return FROM_LEAST.indexOf(role) > FROM_LEAST.indexOf(other);
+}
+
+/** The delegation a change was decided under, named in its fact so that the trail says whose rights were used. */
+function under(change: MembershipChange): { readonly delegationId?: string } {
+  return change.delegationId === undefined ? {} : { delegationId: change.delegationId };
+}