domain: add Identity & Access entities (User, Role, Permission, Group)

crates/domain/tests/entities/group.rs

@@ -0,0 +1,41 @@
+use domain::entities::Group;
+use domain::errors::DomainError;
+use domain::value_objects::SystemId;
+
+#[test]
+fn owner_auto_member() {
+    let owner = SystemId::new();
+    let g = Group::new("team", owner);
+    assert!(g.is_member(&owner));
+    assert_eq!(g.members.len(), 1);
+}
+
+#[test]
+fn add_and_remove() {
+    let owner = SystemId::new();
+    let member = SystemId::new();
+    let mut g = Group::new("team", owner);
+    g.add_member(member).unwrap();
+    assert!(g.is_member(&member));
+    assert_eq!(g.members.len(), 2);
+    g.remove_member(member).unwrap();
+    assert!(!g.is_member(&member));
+}
+
+#[test]
+fn cannot_remove_owner() {
+    let owner = SystemId::new();
+    let mut g = Group::new("team", owner);
+    let result = g.remove_member(owner);
+    assert!(matches!(result, Err(DomainError::Validation(_))));
+}
+
+#[test]
+fn cannot_add_duplicate() {
+    let owner = SystemId::new();
+    let member = SystemId::new();
+    let mut g = Group::new("team", owner);
+    g.add_member(member).unwrap();
+    let result = g.add_member(member);
+    assert!(matches!(result, Err(DomainError::Conflict(_))));
+}