refactor: move business logic out of presentation — ReadAssetFile, checksum, auth checks, MetadataValue conversions

crates/application/tests/organization/commands/manage_album_entries.rs

@@ -111,3 +111,23 @@ async fn rejects_duplicate_add() {
         .await;
     assert!(matches!(result, Err(DomainError::Conflict(_))));
 }
+
+#[tokio::test]
+async fn rejects_forbidden_access() {
+    let repo = Arc::new(InMemoryAlbumRepository::new());
+    let creator = SystemId::new();
+    let album_id = setup_album(&repo, creator).await;
+
+    let handler = ManageAlbumEntriesHandler::new(repo);
+    let other_user = SystemId::new();
+    let result = handler
+        .execute(ManageAlbumEntriesCommand {
+            album_id,
+            action: AlbumAction::Add {
+                asset_id: SystemId::new(),
+            },
+            user_id: other_user,
+        })
+        .await;
+    assert!(matches!(result, Err(DomainError::Forbidden(_))));
+}