ddd-ts-kit 0.14.0 → 0.16.0

package/templates/presets/identity/context/test/integration/keycloak-identity-provider-admin.adapter.spec.ts.tpl

@@ -0,0 +1,123 @@
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from '{{tests.module}}';
+import type { IdentityProviderConnection } from '{{alias.context}}/application/ports/identity-provider-connection.port{{alias.ext}}';
+import { KeycloakIdentityProviderAdmin } from '{{alias.context}}/infrastructure/external/keycloak-identity-provider-admin.adapter{{alias.ext}}';
+
+/** What the realm was asked, as `<method> <path>` and the body it received. */
+interface Asked {
+  readonly call: string;
+  readonly body: string;
+}
+
+/** As many organizations as one read of the adapter lists. */
+const PAGE = 100;
+
+const asked: Asked[] = [];
+let server: Server;
+let admin: KeycloakIdentityProviderAdmin;
+
+beforeAll(async () => {
+  server = createServer((request, response) => void answer(request, response));
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+
+  const address = server.address();
+  const port = typeof address === 'object' && address !== null ? address.port : 0;
+
+  const connection: IdentityProviderConnection = {
+    settings: async () => ({
+      baseUrl: `http://127.0.0.1:${port}`,
+      realm: 'acme',
+      clientId: 'admin',
+      clientSecret: 'secret',
+    }),
+  };
+
+  admin = new KeycloakIdentityProviderAdmin(connection);
+});
+
+beforeEach(() => {
+  asked.length = 0;
+});
+
+afterAll(async () => {
+  await new Promise((resolve) => server.close(resolve));
+});
+
+describe('KeycloakIdentityProviderAdmin, against a realm of Keycloak 26', () => {
+  it('opens an organisation under its slug as alias, and an organisation already there is done', async () => {
+    await admin.openOrganisation({ id: 'acme', name: 'Acme' });
+    await admin.openOrganisation({ id: 'taken', name: 'Taken' });
+
+    expect(asked.filter((one) => one.call.startsWith('POST /admin'))).toEqual([
+      { call: 'POST /admin/realms/acme/organizations', body: '{"name":"Acme","alias":"acme","enabled":true}' },
+      { call: 'POST /admin/realms/acme/organizations', body: '{"name":"Taken","alias":"taken","enabled":true}' },
+    ]);
+  });
+
+  it('adds and removes a member by the id the realm gives the organisation, found by its alias on any page', async () => {
+    await admin.addMember('acme', 'subject-ada');
+    await admin.removeMember('acme', 'subject-ada');
+
+    expect(asked.map((one) => one.call).filter((call) => !call.includes('token'))).toEqual([
+      'GET /admin/realms/acme/organizations?briefRepresentation=true&first=0&max=100',
+      'GET /admin/realms/acme/organizations?briefRepresentation=true&first=100&max=100',
+      'POST /admin/realms/acme/organizations/org-acme/members',
+      'GET /admin/realms/acme/organizations?briefRepresentation=true&first=0&max=100',
+      'GET /admin/realms/acme/organizations?briefRepresentation=true&first=100&max=100',
+      'DELETE /admin/realms/acme/organizations/org-acme/members/subject-ada',
+    ]);
+  });
+
+  it('disables a user, with a token of the client credentials grant', async () => {
+    await admin.disableAccount('subject-ada');
+
+    expect(asked).toEqual([
+      {
+        call: 'POST /realms/acme/protocol/openid-connect/token',
+        body: 'grant_type=client_credentials&client_id=admin&client_secret=secret',
+      },
+      { call: 'PUT /admin/realms/acme/users/subject-ada', body: '{"enabled":false}' },
+    ]);
+  });
+
+  it('fails when the realm knows no organisation under the slug, or refuses a call', async () => {
+    await expect(admin.addMember('unknown', 'subject-ada')).rejects.toThrow('no organization under the alias unknown');
+    await expect(admin.disableAccount('refused')).rejects.toThrow('Keycloak answered 403 to PUT users/refused');
+  });
+});
+
+/** The few answers of a realm these calls need. */
+async function answer(request: IncomingMessage, response: ServerResponse): Promise<void> {
+  const chunks: Buffer[] = [];
+
+  for await (const chunk of request) {
+    chunks.push(Buffer.from(chunk));
+  }
+
+  const call = `${request.method ?? ''} ${request.url ?? ''}`;
+
+  asked.push({ call, body: Buffer.concat(chunks).toString('utf8') });
+  response.setHeader('content-type', 'application/json');
+
+  if (call.endsWith('/token')) {
+    response.end(JSON.stringify({ access_token: 'token-of-the-client' }));
+  } else if (call.startsWith('GET') && call.includes('first=0&')) {
+    // A full first page of other organizations, named like the one searched: Keycloak searches by name, never by alias.
+    response.end(JSON.stringify(Array.from({ length: PAGE }, (_, index) => ({ id: `org-${index}`, name: 'acme', alias: `other-${index}` }))));
+  } else if (call.startsWith('GET') && call.includes('first=100&')) {
+    response.end(JSON.stringify([{ id: 'org-acme', name: 'Acme', alias: 'acme' }]));
+  } else if (call.startsWith('GET')) {
+    response.end('[]');
+  } else {
+    response.statusCode = statusOf(call);
+    response.end();
+  }
+}
+
+function statusOf(call: string): number {
+  if (call.includes('/users/refused')) {
+    return 403;
+  }
+
+  return call.startsWith('POST') && asked.some((one) => one.body.includes('"alias":"taken"')) ? 409 : 204;
+}

package/templates/presets/identity/context/test/integration/member.repository.contract.spec.ts.tpl

@@ -0,0 +1,92 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from '{{tests.module}}';
+import { FixedClock, FixedExecutionScope, executionContext, type Actor } from '@ddd-ts-kit/kernel';
+import { repositoryContract } from '@ddd-ts-kit/testing/contracts';
+import type { Member } from '{{alias.context}}/domain/aggregates/member.aggregate{{alias.ext}}';
+import type { MemberRepository } from '{{alias.context}}/domain/repositories/member.repository{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}MemberRepository } from '{{alias.context}}/infrastructure/persistence/{{#if orm.knex}}knex{{/if}}{{#if orm.drizzle}}drizzle{{/if}}-member.repository{{alias.ext}}';
+import { openTestDatabase, type TestDatabase } from '{{alias.platform}}/database/open-test-database{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { FakeMemberRepository } from '{{alias.context}}/test/fakes/member.repository.fake{{alias.ext}}';
+
+const runner = { describe, it, expect, beforeEach, afterEach };
+const clock = new FixedClock(new Date('2026-01-01T00:00:00.000Z'));
+const actor: Actor = { id: 'subject-ada', type: 'user', roles: [], attributes: {} };
+const scope = new FixedExecutionScope(executionContext({ correlationId: 'contract-spec', actor, origin: 'test' }));
+
+const expectations = {
+  createAggregate: () => aMember().build(),
+  mutate: (changed: Member) => {
+    changed.changeRole(MemberRole.Admin, { by: MemberRole.Owner, byAccount: 'subject-owner', delegationId: undefined, owners: 2 }, new Date('2026-02-01T00:00:00.000Z'));
+  },
+  idOf: (subject: Member) => subject.id,
+  stateOf: (subject: Member) => subject.toState(),
+};
+
+let database: TestDatabase;
+
+beforeAll(async () => {
+  database = await openTestDatabase();
+});
+
+afterAll(async () => {
+  await database.close();
+});
+
+repositoryContract<Member>(runner, {
+  ...expectations,
+  name: 'FakeMemberRepository',
+  createRepository: () => new FakeMemberRepository(),
+});
+
+repositoryContract<Member>(runner, {
+  ...expectations,
+  name: '{{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}MemberRepository',
+  createRepository: async () => {
+    await database.reset();
+
+    return new {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}MemberRepository(database.persistence.database, scope, clock);
+  },
+});
+
+describe.each(adapters())('%s, read by what a use case needs', (_name, create) => {
+  it('finds the current membership of an account in an organisation, and counts its owners', async () => {
+    const repository = await create();
+
+    await repository.save(aMember().of('acme', 'subject-ada').as(MemberRole.Owner).build());
+    await repository.save(aMember().of('acme', 'subject-grace').as(MemberRole.Owner).removedAt(new Date('2026-02-01T00:00:00.000Z')).build());
+    await repository.save(aMember().of('globex', 'subject-alan').as(MemberRole.Owner).build());
+
+    expect((await repository.findOf('acme', 'subject-ada'))?.role).toBe(MemberRole.Owner);
+    expect(await repository.findOf('acme', 'subject-grace')).toBeUndefined();
+    expect(await repository.countOwners('acme')).toBe(1);
+  });
+
+  it('searches the current memberships of an account across organisations', async () => {
+    const repository = await create();
+
+    await repository.save(aMember().of('acme', 'subject-ada').build());
+    await repository.save(aMember().of('globex', 'subject-ada').as(MemberRole.Admin).build());
+    await repository.save(aMember().of('initech', 'subject-ada').removedAt(new Date('2026-02-01T00:00:00.000Z')).build());
+    await repository.save(aMember().of('acme', 'subject-alan').build());
+
+    const current = await repository.searchCurrentOf('subject-ada');
+
+    expect(current.map((member) => member.organisationId).sort()).toEqual(['acme', 'globex']);
+  });
+});
+
+/** The fake and the adapter, each given as the use cases get it. */
+function adapters(): [string, () => Promise<MemberRepository>][] {
+  return [
+    ['FakeMemberRepository', async () => new FakeMemberRepository()],
+    [
+      '{{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}MemberRepository',
+      async () => {
+        await database.reset();
+
+        return new {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}MemberRepository(database.persistence.database, scope, clock);
+      },
+    ],
+  ];
+}

package/templates/presets/identity/context/test/integration/organisation.repository.contract.spec.ts.tpl

@@ -0,0 +1,46 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from '{{tests.module}}';
+import { FixedClock, FixedExecutionScope, executionContext, type Actor } from '@ddd-ts-kit/kernel';
+import { repositoryContract } from '@ddd-ts-kit/testing/contracts';
+import type { Organisation } from '{{alias.context}}/domain/aggregates/organisation.aggregate{{alias.ext}}';
+import { {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}OrganisationRepository } from '{{alias.context}}/infrastructure/persistence/{{#if orm.knex}}knex{{/if}}{{#if orm.drizzle}}drizzle{{/if}}-organisation.repository{{alias.ext}}';
+import { openTestDatabase, type TestDatabase } from '{{alias.platform}}/database/open-test-database{{alias.ext}}';
+import { anOrganisation } from '{{alias.context}}/test/builders/organisation.builder{{alias.ext}}';
+import { FakeOrganisationRepository } from '{{alias.context}}/test/fakes/organisation.repository.fake{{alias.ext}}';
+
+const runner = { describe, it, expect, beforeEach, afterEach };
+const clock = new FixedClock(new Date('2026-01-01T00:00:00.000Z'));
+const actor: Actor = { id: 'subject-ada', type: 'user', roles: [], attributes: {} };
+const scope = new FixedExecutionScope(executionContext({ correlationId: 'contract-spec', actor, origin: 'test' }));
+
+const expectations = {
+  createAggregate: () => anOrganisation().build(),
+  mutate: () => undefined,
+  idOf: (subject: Organisation) => subject.id,
+  stateOf: (subject: Organisation) => subject.toState(),
+};
+
+let database: TestDatabase;
+
+beforeAll(async () => {
+  database = await openTestDatabase();
+});
+
+afterAll(async () => {
+  await database.close();
+});
+
+repositoryContract<Organisation>(runner, {
+  ...expectations,
+  name: 'FakeOrganisationRepository',
+  createRepository: () => new FakeOrganisationRepository(),
+});
+
+repositoryContract<Organisation>(runner, {
+  ...expectations,
+  name: '{{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}OrganisationRepository',
+  createRepository: async () => {
+    await database.reset();
+
+    return new {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}OrganisationRepository(database.persistence.database, scope, clock);
+  },
+});

package/templates/presets/identity/context/test/integration/search-members-reader.spec.ts.tpl

@@ -0,0 +1,86 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from '{{tests.module}}';
+import { FixedClock, FixedExecutionScope, executionContext, offsetPage, type Actor } from '@ddd-ts-kit/kernel';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}AccountRepository } from '{{alias.context}}/infrastructure/persistence/{{#if orm.knex}}knex{{/if}}{{#if orm.drizzle}}drizzle{{/if}}-account.repository{{alias.ext}}';
+import { {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}MemberRepository } from '{{alias.context}}/infrastructure/persistence/{{#if orm.knex}}knex{{/if}}{{#if orm.drizzle}}drizzle{{/if}}-member.repository{{alias.ext}}';
+import { {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}SearchMembersReader } from '{{alias.context}}/infrastructure/persistence/{{#if orm.knex}}knex{{/if}}{{#if orm.drizzle}}drizzle{{/if}}-search-members-reader.repository{{alias.ext}}';
+import { openTestDatabase, type TestDatabase } from '{{alias.platform}}/database/open-test-database{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+
+const clock = new FixedClock(new Date('2026-01-01T00:00:00.000Z'));
+const actor: Actor = { id: 'subject-ada', type: 'user', roles: [], attributes: {} };
+const scope = new FixedExecutionScope(executionContext({ correlationId: 'reader-spec', actor, origin: 'test' }));
+
+let database: TestDatabase;
+
+beforeAll(async () => {
+  database = await openTestDatabase();
+});
+
+beforeEach(async () => {
+  await database.reset();
+
+  const accounts = new {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}AccountRepository(database.persistence.database, scope, clock);
+  const members = new {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}MemberRepository(database.persistence.database, scope, clock);
+
+  for (const [id, name] of [
+    ['subject-ada', 'Ada'],
+    ['subject-grace', 'Grace'],
+    ['subject-alan', 'Alan'],
+  ] as const) {
+    await accounts.save(anAccount().identifiedBy(id).named(name).reachedAt(`${id}@example.test`).build());
+  }
+
+  await members.save(aMember().identifiedBy('member-1').of('acme', 'subject-ada').as(MemberRole.Owner).joinedOn(joined(1)).build());
+  await members.save(aMember().identifiedBy('member-2').of('acme', 'subject-grace').joinedOn(joined(2)).build());
+  await members.save(aMember().identifiedBy('member-3').of('acme', 'subject-alan').joinedOn(joined(3)).removedAt(joined(4)).build());
+  await members.save(aMember().identifiedBy('member-4').of('globex', 'subject-alan').joinedOn(joined(4)).build());
+});
+
+afterAll(async () => {
+  await database.close();
+});
+
+describe('{{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}SearchMembersReader', () => {
+  it('reads the current members of one organisation, with the profile of their account, earliest first', async () => {
+    const reader = new {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}SearchMembersReader(database.persistence.database);
+
+    const page = await reader.search('acme', offsetPage({ limit: 10 }));
+
+    expect(page).toEqual({
+      items: [
+        {
+          memberId: 'member-1',
+          accountId: 'subject-ada',
+          displayName: 'Ada',
+          email: 'subject-ada@example.test',
+          role: MemberRole.Owner,
+          joinedAt: joined(1),
+        },
+        {
+          memberId: 'member-2',
+          accountId: 'subject-grace',
+          displayName: 'Grace',
+          email: 'subject-grace@example.test',
+          role: MemberRole.Member,
+          joinedAt: joined(2),
+        },
+      ],
+      total: 2,
+    });
+  });
+
+  it('answers a page of them, latest first when asked, with the total', async () => {
+    const reader = new {{#if orm.knex}}Knex{{/if}}{{#if orm.drizzle}}Drizzle{{/if}}SearchMembersReader(database.persistence.database);
+
+    const page = await reader.search('acme', offsetPage({ limit: 1, offset: 1, sort: [{ field: 'joinedAt', direction: 'desc' }] }));
+
+    expect(page.items.map((item) => item.memberId)).toEqual(['member-1']);
+    expect(page.total).toBe(2);
+  });
+});
+
+function joined(day: number): Date {
+  return new Date(Date.UTC(2026, 0, day));
+}

package/templates/presets/identity/context/test/unit/accept-invitation.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { AcceptInvitationCommand } from '{{alias.context}}/application/commands/accept-invitation/accept-invitation.command{{alias.ext}}';
+import { AcceptInvitationController } from '{{alias.context}}/presentation/http/invitations/accept-invitation/accept-invitation.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('POST /invitations/acceptance', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: { token: 'token-1' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/invitations/acceptance');
+    expect([response.status, response.body]).toEqual([200, { id: 'invitation-1' }]);
+    expect(sent).toMatchObject([{ token: 'token-1' }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: {}, query: {}, headers: {}, body: {}, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: AcceptInvitationCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(AcceptInvitationCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'invitation-1';
+    },
+  });
+
+  return { route: controllerRoute(new AcceptInvitationController(commands)), sent };
+}

package/templates/presets/identity/context/test/unit/accept-invitation.handler.spec.ts.tpl

@@ -0,0 +1,69 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InvitationStatus } from '{{alias.context}}/domain/vocabularies/invitation-status.vocabulary{{alias.ext}}';
+import { MemberRole } from '{{alias.context}}/domain/vocabularies/member-role.vocabulary{{alias.ext}}';
+import { AcceptInvitationCommand } from '{{alias.context}}/application/commands/accept-invitation/accept-invitation.command{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+import { anInvitation } from '{{alias.context}}/test/builders/invitation.builder{{alias.ext}}';
+import { aMember } from '{{alias.context}}/test/builders/member.builder{{alias.ext}}';
+import { arrangeIdentity, startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+describe('Accept invitation', () => {
+  it('makes the person it was sent to a member, in its role, and tells the provider and the other contexts', async () => {
+    const { application, accounts, invitations, members, identityProvider, tokens, as } = await startedIdentity();
+    const token = tokens.issue();
+
+    await accounts.save(anAccount().identifiedBy('subject-grace').reachedAt('grace@example.test').build());
+
+    await invitations.save(
+      anInvitation().identifiedBy('invitation-1').to('acme').as(MemberRole.Admin).withTokenHash(token.digest).build(),
+    );
+
+    await application.commandBus.execute(new AcceptInvitationCommand(as('subject-grace'), token.token));
+
+    expect((await members.findOf('acme', 'subject-grace'))?.role).toBe(MemberRole.Admin);
+    expect((await invitations.findById('invitation-1'))?.status).toBe(InvitationStatus.Accepted);
+    expect(identityProvider.asked).toEqual(['add subject-grace to acme']);
+    expect(application.eventBus.published).toMatchObject([{ type: '{{context.kebab}}.member.joined' }]);
+  });
+
+  it('knows no token it did not issue, and no person who never signed in', async () => {
+    const { application, invitations, tokens, as } = arrangeIdentity();
+    const token = tokens.issue();
+
+    await invitations.save(anInvitation().withTokenHash(token.digest).build());
+
+    await expect(
+      application.commandBus.execute(new AcceptInvitationCommand(as('subject-grace'), 'forged')),
+    ).rejects.toMatchObject({
+      code: 'INVITATION_NOT_FOUND',
+    });
+
+    await expect(
+      application.commandBus.execute(new AcceptInvitationCommand(as('subject-ghost'), token.token)),
+    ).rejects.toMatchObject({
+      code: 'ACCOUNT_NOT_FOUND',
+    });
+  });
+
+  it('refuses another person than the one it was sent to, and a member already there', async () => {
+    const { application, accounts, invitations, members, tokens, as } = arrangeIdentity();
+    const token = tokens.issue();
+
+    await accounts.save(anAccount().identifiedBy('subject-alan').reachedAt('alan@example.test').build());
+    await accounts.save(anAccount().identifiedBy('subject-grace').reachedAt('grace@example.test').build());
+    await invitations.save(anInvitation().to('acme').withTokenHash(token.digest).build());
+    await members.save(aMember().of('acme', 'subject-grace').build());
+
+    await expect(
+      application.commandBus.execute(new AcceptInvitationCommand(as('subject-alan'), token.token)),
+    ).rejects.toMatchObject({
+      code: 'INVITATION_ADDRESSED_TO_ANOTHER',
+    });
+
+    await expect(
+      application.commandBus.execute(new AcceptInvitationCommand(as('subject-grace'), token.token)),
+    ).rejects.toMatchObject({
+      code: 'ALREADY_MEMBER',
+    });
+  });
+});

package/templates/presets/identity/context/test/unit/account-deactivated.integration-handler.spec.ts.tpl

@@ -0,0 +1,24 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { accountDeactivatedV1 } from '{{alias.context}}/published-language/account-deactivated.v1.integration-event{{alias.ext}}';
+import { startedIdentity } from '{{alias.context}}/test/unit/identity-application{{alias.ext}}';
+
+const deactivation = accountDeactivatedV1.create(
+  { accountId: 'subject-ada' },
+  { id: 'event-1', occurredAt: '2026-01-01T00:00:00.000Z' },
+);
+
+describe('When an account is deactivated, the identity provider follows', () => {
+  it('disables the person once, asked again after a failure until it answers: a deactivation is never lost', async () => {
+    const { application, identityProvider } = await startedIdentity();
+
+    identityProvider.failWith(new Error('provider unreachable'));
+
+    await expect(application.eventBus.publish([deactivation])).rejects.toThrow();
+
+    identityProvider.answerAgain();
+    await application.eventBus.publish([deactivation]);
+    await application.eventBus.publish([deactivation]);
+
+    expect(identityProvider.asked).toEqual(['disable subject-ada']);
+  });
+});

package/templates/presets/identity/context/test/unit/account-deactivated.publisher.spec.ts.tpl

@@ -0,0 +1,25 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { InMemoryEventBus, SequentialIdGenerator } from '@ddd-ts-kit/kernel';
+import { AccountDeactivatedPublisher } from '{{alias.context}}/application/integration/publishers/account-deactivated.publisher{{alias.ext}}';
+import { AccountDeactivated } from '{{alias.context}}/domain/events/account-deactivated.event{{alias.ext}}';
+
+const at = new Date('2026-01-01T00:00:00.000Z');
+
+describe('Publishing "account deactivated" to other contexts', () => {
+  it('publishes version 1 of {{context.kebab}}.account.deactivated, every field of its payload', async () => {
+    const bus = new InMemoryEventBus();
+    const publisher = new AccountDeactivatedPublisher(bus, new SequentialIdGenerator('event'));
+
+    await publisher.handle(new AccountDeactivated('subject-ada', at));
+
+    expect(bus.published).toMatchObject([
+      {
+        id: 'event-1',
+        type: '{{context.kebab}}.account.deactivated',
+        version: 1,
+        occurredAt: '2026-01-01T00:00:00.000Z',
+        payload: { accountId: 'subject-ada' },
+      },
+    ]);
+  });
+});

package/templates/presets/identity/context/test/unit/account.aggregate.spec.ts.tpl

@@ -0,0 +1,72 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { given } from '@ddd-ts-kit/testing';
+import { Account } from '{{alias.context}}/domain/aggregates/account.aggregate{{alias.ext}}';
+import { DisplayName } from '{{alias.context}}/domain/value-objects/display-name.vo{{alias.ext}}';
+import { EmailAddress } from '{{alias.context}}/domain/value-objects/email-address.vo{{alias.ext}}';
+import { anAccount } from '{{alias.context}}/test/builders/account.builder{{alias.ext}}';
+
+const signedIn = new Date('2026-02-01T00:00:00.000Z');
+const later = new Date('2026-02-02T00:00:00.000Z');
+const profile = { email: EmailAddress.create('ada@example.test'), displayName: DisplayName.create('Ada Lovelace') };
+
+describe('Account', () => {
+  it('is provisioned under the subject of the provider, active, and announces who it is', () => {
+    const account = Account.provision('subject-ada', profile, signedIn);
+
+    expect(account.id).toBe('subject-ada');
+    expect(account.isActive).toBe(true);
+
+    expect(account.pullEvents()).toEqual([
+      {
+        name: '{{context.kebab}}.account.provisioned',
+        aggregateId: 'subject-ada',
+        occurredAt: signedIn,
+        facts: { email: 'ada@example.test', displayName: 'Ada Lovelace' },
+      },
+    ]);
+  });
+
+  it('is rehydrated in its stored state without recording a new fact', () => {
+    const stored = anAccount().build();
+    const loaded = Account.rehydrate(stored.id, stored.toState());
+
+    expect(loaded.toState()).toEqual(stored.toState());
+    expect(loaded.pullEvents()).toEqual([]);
+  });
+});
+
+describe('An active account', () => {
+  it('takes the profile the provider holds at a later sign-in, silently', () => {
+    const renamed = { email: EmailAddress.create('ada@lovelace.test'), displayName: DisplayName.create('Countess') };
+
+    given(anAccount())
+      .when((account) => account.refreshProfile(renamed))
+      .thenNoEvent()
+      .thenState((account) => expect([account.email.value, account.displayName.value]).toEqual(['ada@lovelace.test', 'Countess']));
+  });
+
+  it('is deactivated once, and announces it', () => {
+    given(anAccount().identifiedBy('subject-ada'))
+      .when((account) => account.deactivate(later))
+      .thenEvents([{ name: '{{context.kebab}}.account.deactivated', aggregateId: 'subject-ada', occurredAt: later }])
+      .thenState((account) => expect(account.isActive).toBe(false));
+  });
+});
+
+describe('A deactivated account', () => {
+  it('refuses to be deactivated again', () => {
+    given(anAccount().deactivatedAt(signedIn))
+      .when((account) => account.deactivate(later))
+      .thenError('ACCOUNT_ALREADY_DEACTIVATED');
+  });
+
+  it('refuses a new profile, and every intention that asks it to be active', () => {
+    given(anAccount().deactivatedAt(signedIn))
+      .when((account) => account.refreshProfile(profile))
+      .thenError('ACCOUNT_DEACTIVATED');
+
+    given(anAccount().deactivatedAt(signedIn))
+      .when((account) => account.assertActive())
+      .thenError('ACCOUNT_DEACTIVATED');
+  });
+});

package/templates/presets/identity/context/test/unit/change-member-role.controller.spec.ts.tpl

@@ -0,0 +1,57 @@
+import { describe, expect, it } from '{{tests.module}}';
+import { controllerRoute, executeRoute } from '@ddd-ts-kit/http';
+import { InMemoryCommandBus, type Actor } from '@ddd-ts-kit/kernel';
+import { ChangeMemberRoleCommand } from '{{alias.context}}/application/commands/change-member-role/change-member-role.command{{alias.ext}}';
+import { ChangeMemberRoleController } from '{{alias.context}}/presentation/http/organisations/change-member-role/change-member-role.controller{{alias.ext}}';
+
+/** Who calls, as the authenticator of the platform makes them from the token. */
+const caller: Actor = {
+  id: 'subject-ada',
+  type: 'user',
+  roles: [],
+  attributes: { email: 'ada@example.test', username: 'ada' },
+};
+
+describe('PUT /organisations/:organisationId/members/:accountId/role', () => {
+  it('answers 200 with what the use case answered, and sends it what the request says', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme', accountId: 'subject-grace' }, query: {}, headers: {}, body: { role: 'member' }, raw: undefined },
+      { validateResponses: true, resolvePrincipal: () => caller },
+    );
+
+    expect(route.path).toBe('/organisations/:organisationId/members/:accountId/role');
+    expect([response.status, response.body]).toEqual([200, { id: 'member-1' }]);
+    expect(sent).toMatchObject([{ organisationId: 'acme', accountId: 'subject-grace', role: 'member' }]);
+  });
+
+  it('refuses with 422 a request its contract does not describe, and sends nothing', async () => {
+    const { route, sent } = arrange();
+
+    const response = await executeRoute(
+      route,
+      { params: { organisationId: 'acme', accountId: 'subject-grace' }, query: {}, headers: {}, body: { role: 'emperor' }, raw: undefined },
+      { resolvePrincipal: () => caller },
+    );
+
+    expect(response.status).toBe(422);
+    expect(sent).toEqual([]);
+  });
+});
+
+/** The route, on a bus that keeps what it was sent and answers as the use case would. */
+function arrange() {
+  const sent: ChangeMemberRoleCommand[] = [];
+
+  const commands = new InMemoryCommandBus().register(ChangeMemberRoleCommand, {
+    execute: async (command) => {
+      sent.push(command);
+
+      return 'member-1';
+    },
+  });
+
+  return { route: controllerRoute(new ChangeMemberRoleController(commands)), sent };
+}