add 400+ unit tests for domain and application layers

Extract ReviewLogger trait to decouple import/integrations
from diary::log_review (cross-module coupling smell).

Add in-memory fakes for all repository ports, enabling
isolated testing of every use case module without a database.

Coverage: domain+application 22% → 80%, 427 tests.

crates/application/src/integrations/cleanup.rs

@@ -10,3 +10,7 @@ pub async fn execute(ctx: &AppContext) -> Result<u64, DomainError> {
         .delete_non_pending_older_than(cutoff)
         .await
 }
+
+#[cfg(test)]
+#[path = "tests/cleanup.rs"]
+mod tests;

crates/application/src/integrations/confirm.rs

@@ -7,7 +7,6 @@ use domain::{
 use crate::{
     context::AppContext,
     diary::commands::{LogReviewCommand, MovieInput},
-    diary::log_review,
     integrations::commands::ConfirmWatchEventsCommand,
 };
 
@@ -54,7 +53,7 @@ pub async fn execute(ctx: &AppContext, cmd: ConfirmWatchEventsCommand) -> Result
             watched_at: *event.watched_at(),
         };
 
-        log_review::execute(ctx, review_cmd).await?;
+        ctx.services.review_logger.log_review(review_cmd).await?;
 
         ctx.repos
             .watch_event
@@ -66,3 +65,7 @@ pub async fn execute(ctx: &AppContext, cmd: ConfirmWatchEventsCommand) -> Result
 
     Ok(confirmed)
 }
+
+#[cfg(test)]
+#[path = "tests/confirm.rs"]
+mod tests;

crates/application/src/integrations/dismiss.rs

@@ -39,3 +39,7 @@ pub async fn execute(ctx: &AppContext, cmd: DismissWatchEventsCommand) -> Result
 
     Ok(count as u32)
 }
+
+#[cfg(test)]
+#[path = "tests/dismiss.rs"]
+mod tests;

crates/application/src/integrations/generate_token.rs

@@ -36,3 +36,7 @@ pub fn hash_token(plaintext: &str) -> String {
     hasher.update(plaintext.as_bytes());
     hex::encode(hasher.finalize())
 }
+
+#[cfg(test)]
+#[path = "tests/generate_token.rs"]
+mod tests;

crates/application/src/integrations/get_queue.rs

@@ -9,3 +9,7 @@ pub async fn execute(
     let user_id = UserId::from_uuid(query.user_id);
     ctx.repos.watch_event.list_pending(&user_id).await
 }
+
+#[cfg(test)]
+#[path = "tests/get_queue.rs"]
+mod tests;

crates/application/src/integrations/get_tokens.rs

@@ -9,3 +9,7 @@ pub async fn execute(
     let user_id = UserId::from_uuid(query.user_id);
     ctx.repos.webhook_token.list_by_user(&user_id).await
 }
+
+#[cfg(test)]
+#[path = "tests/get_tokens.rs"]
+mod tests;

crates/application/src/integrations/ingest.rs

@@ -69,3 +69,7 @@ pub async fn execute(
 
     Ok(())
 }
+
+#[cfg(test)]
+#[path = "tests/ingest.rs"]
+mod tests;

crates/application/src/integrations/revoke_token.rs

@@ -10,3 +10,7 @@ pub async fn execute(ctx: &AppContext, cmd: RevokeWebhookTokenCommand) -> Result
     let token_id = WebhookTokenId::from_uuid(cmd.token_id);
     ctx.repos.webhook_token.delete(&token_id, &user_id).await
 }
+
+#[cfg(test)]
+#[path = "tests/revoke_token.rs"]
+mod tests;

crates/application/src/integrations/tests/cleanup.rs

@@ -0,0 +1,11 @@
+use crate::integrations::cleanup;
+use crate::test_helpers::TestContextBuilder;
+
+#[tokio::test]
+async fn returns_zero_when_nothing_to_clean() {
+    let ctx = TestContextBuilder::new().build();
+
+    let count = cleanup::execute(&ctx).await.unwrap();
+
+    assert_eq!(count, 0);
+}

crates/application/src/integrations/tests/confirm.rs

@@ -0,0 +1,372 @@
+use std::sync::Arc;
+
+use domain::models::{WatchEvent, WatchEventSource};
+use domain::ports::{MovieRepository, WatchEventRepository};
+use domain::testing::{InMemoryWatchEventRepository, NoopEventPublisher};
+use domain::value_objects::UserId;
+use uuid::Uuid;
+
+use crate::integrations::commands::{ConfirmWatchEventsCommand, WatchEventConfirmation};
+use crate::integrations::confirm;
+use crate::test_helpers::TestContextBuilder;
+
+#[tokio::test]
+async fn confirms_watch_event_via_review_logger() {
+    let watch_events = InMemoryWatchEventRepository::new();
+    let events = NoopEventPublisher::new();
+    let uid = Uuid::new_v4();
+
+    let event = WatchEvent::new(
+        UserId::from_uuid(uid),
+        "Test Movie".into(),
+        Some(2024),
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let event_id = event.id().value();
+    watch_events.save(&event).await.unwrap();
+
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&watch_events) as _)
+        .with_event_publisher(Arc::clone(&events) as _)
+        .build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: uid,
+            confirmations: vec![WatchEventConfirmation {
+                watch_event_id: event_id,
+                rating: 4,
+                comment: None,
+            }],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 1);
+}
+
+#[tokio::test]
+async fn empty_confirmations_returns_zero() {
+    let ctx = TestContextBuilder::new().build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: Uuid::new_v4(),
+            confirmations: vec![],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 0);
+}
+
+#[tokio::test]
+async fn confirms_event_with_external_metadata_id_and_no_movie_id() {
+    let watch_events = InMemoryWatchEventRepository::new();
+    let events = NoopEventPublisher::new();
+    let uid = Uuid::new_v4();
+
+    let event = WatchEvent::new(
+        UserId::from_uuid(uid),
+        "External Movie".into(),
+        Some(2023),
+        Some("tt1234567".into()),
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let event_id = event.id().value();
+    watch_events.save(&event).await.unwrap();
+
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&watch_events) as _)
+        .with_event_publisher(Arc::clone(&events) as _)
+        .build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: uid,
+            confirmations: vec![WatchEventConfirmation {
+                watch_event_id: event_id,
+                rating: 3,
+                comment: Some("Great film".into()),
+            }],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 1);
+}
+
+#[tokio::test]
+async fn rejects_other_users_event() {
+    let watch_events = InMemoryWatchEventRepository::new();
+    let owner = Uuid::new_v4();
+    let intruder = Uuid::new_v4();
+
+    let event = WatchEvent::new(
+        UserId::from_uuid(owner),
+        "Movie".into(),
+        None,
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let event_id = event.id().value();
+    watch_events.save(&event).await.unwrap();
+
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&watch_events) as _)
+        .build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: intruder,
+            confirmations: vec![WatchEventConfirmation {
+                watch_event_id: event_id,
+                rating: 3,
+                comment: None,
+            }],
+        },
+    )
+    .await;
+
+    assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn fails_when_event_not_found() {
+    let ctx = TestContextBuilder::new().build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: Uuid::new_v4(),
+            confirmations: vec![WatchEventConfirmation {
+                watch_event_id: Uuid::new_v4(),
+                rating: 4,
+                comment: None,
+            }],
+        },
+    )
+    .await;
+
+    assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn confirms_event_with_movie_id() {
+    let watch_events = InMemoryWatchEventRepository::new();
+    let events = NoopEventPublisher::new();
+    let uid = Uuid::new_v4();
+    let movie_uuid = Uuid::new_v4();
+
+    let event = WatchEvent::new(
+        UserId::from_uuid(uid),
+        "Movie With Id".into(),
+        Some(2024),
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        Some(domain::value_objects::MovieId::from_uuid(movie_uuid)),
+    );
+    let event_id = event.id().value();
+    watch_events.save(&event).await.unwrap();
+
+    // Also seed movie repo so review_logger can find it
+    let movies = domain::testing::InMemoryMovieRepository::new();
+    let movie = domain::models::Movie::from_persistence(
+        domain::value_objects::MovieId::from_uuid(movie_uuid),
+        None,
+        domain::value_objects::MovieTitle::new("Movie With Id".into()).unwrap(),
+        domain::value_objects::ReleaseYear::new(2024).unwrap(),
+        None,
+        None,
+    );
+    movies.upsert_movie(&movie).await.unwrap();
+
+    // Build a real review logger
+    let reviews = domain::testing::InMemoryReviewRepository::new();
+    let watchlist = domain::testing::InMemoryWatchlistRepository::new();
+    let review_logger = std::sync::Arc::new(crate::diary::review_logger::DefaultReviewLogger::new(
+        std::sync::Arc::clone(&movies) as _,
+        std::sync::Arc::clone(&reviews) as _,
+        std::sync::Arc::clone(&watchlist) as _,
+        std::sync::Arc::new(domain::testing::FakeMetadataClient) as _,
+        std::sync::Arc::clone(&events) as _,
+    ));
+
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(std::sync::Arc::clone(&watch_events) as _)
+        .with_event_publisher(std::sync::Arc::clone(&events) as _)
+        .with_movies(std::sync::Arc::clone(&movies) as _)
+        .with_review_logger(review_logger as _)
+        .build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: uid,
+            confirmations: vec![WatchEventConfirmation {
+                watch_event_id: event_id,
+                rating: 4,
+                comment: None,
+            }],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 1);
+}
+
+#[tokio::test]
+async fn confirms_event_without_movie_id_and_without_external_metadata_id() {
+    let watch_events = InMemoryWatchEventRepository::new();
+    let events = NoopEventPublisher::new();
+    let uid = Uuid::new_v4();
+
+    let event = WatchEvent::new(
+        UserId::from_uuid(uid),
+        "Title Only Movie".into(),
+        Some(2022),
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let event_id = event.id().value();
+    watch_events.save(&event).await.unwrap();
+
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&watch_events) as _)
+        .with_event_publisher(Arc::clone(&events) as _)
+        .build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: uid,
+            confirmations: vec![WatchEventConfirmation {
+                watch_event_id: event_id,
+                rating: 5,
+                comment: Some("Amazing".into()),
+            }],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 1);
+}
+
+#[tokio::test]
+async fn confirms_multiple_events() {
+    let watch_events = InMemoryWatchEventRepository::new();
+    let events = NoopEventPublisher::new();
+    let uid = Uuid::new_v4();
+
+    let event1 = WatchEvent::new(
+        UserId::from_uuid(uid),
+        "Movie One".into(),
+        Some(2020),
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let id1 = event1.id().value();
+
+    let event2 = WatchEvent::new(
+        UserId::from_uuid(uid),
+        "Movie Two".into(),
+        Some(2021),
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let id2 = event2.id().value();
+
+    watch_events.save(&event1).await.unwrap();
+    watch_events.save(&event2).await.unwrap();
+
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&watch_events) as _)
+        .with_event_publisher(Arc::clone(&events) as _)
+        .build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: uid,
+            confirmations: vec![
+                WatchEventConfirmation {
+                    watch_event_id: id1,
+                    rating: 3,
+                    comment: None,
+                },
+                WatchEventConfirmation {
+                    watch_event_id: id2,
+                    rating: 4,
+                    comment: None,
+                },
+            ],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 2);
+}
+
+#[tokio::test]
+async fn confirms_event_without_year() {
+    let watch_events = InMemoryWatchEventRepository::new();
+    let events = NoopEventPublisher::new();
+    let uid = Uuid::new_v4();
+
+    let event = WatchEvent::new(
+        UserId::from_uuid(uid),
+        "No Year Movie".into(),
+        None, // no year
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let event_id = event.id().value();
+    watch_events.save(&event).await.unwrap();
+
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&watch_events) as _)
+        .with_event_publisher(Arc::clone(&events) as _)
+        .build();
+
+    let result = confirm::execute(
+        &ctx,
+        ConfirmWatchEventsCommand {
+            user_id: uid,
+            confirmations: vec![WatchEventConfirmation {
+                watch_event_id: event_id,
+                rating: 3,
+                comment: None,
+            }],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 1);
+}

crates/application/src/integrations/tests/dismiss.rs

@@ -0,0 +1,95 @@
+use std::sync::Arc;
+
+use domain::models::{WatchEvent, WatchEventSource};
+use domain::ports::WatchEventRepository;
+use domain::testing::InMemoryWatchEventRepository;
+use domain::value_objects::UserId;
+use uuid::Uuid;
+
+use crate::integrations::{commands::DismissWatchEventsCommand, dismiss};
+use crate::test_helpers::TestContextBuilder;
+
+#[tokio::test]
+async fn dismisses_empty_list_returns_zero() {
+    let events = InMemoryWatchEventRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&events) as _)
+        .build();
+
+    let result = dismiss::execute(
+        &ctx,
+        DismissWatchEventsCommand {
+            user_id: Uuid::new_v4(),
+            event_ids: vec![],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 0);
+}
+
+#[tokio::test]
+async fn fails_when_event_not_found() {
+    let events = InMemoryWatchEventRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&events) as _)
+        .build();
+
+    let result = dismiss::execute(
+        &ctx,
+        DismissWatchEventsCommand {
+            user_id: Uuid::new_v4(),
+            event_ids: vec![Uuid::new_v4()],
+        },
+    )
+    .await;
+
+    assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn dismisses_existing_events() {
+    let watch_events = InMemoryWatchEventRepository::new();
+    let uid = Uuid::new_v4();
+    let user_id = UserId::from_uuid(uid);
+
+    let e1 = WatchEvent::new(
+        user_id.clone(),
+        "Movie A".into(),
+        Some(2024),
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let e2 = WatchEvent::new(
+        user_id,
+        "Movie B".into(),
+        Some(2023),
+        None,
+        WatchEventSource::Jellyfin,
+        chrono::Utc::now().naive_utc(),
+        None,
+    );
+    let id1 = e1.id().value();
+    let id2 = e2.id().value();
+    watch_events.save(&e1).await.unwrap();
+    watch_events.save(&e2).await.unwrap();
+
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&watch_events) as _)
+        .build();
+
+    let result = dismiss::execute(
+        &ctx,
+        DismissWatchEventsCommand {
+            user_id: uid,
+            event_ids: vec![id1, id2],
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(result, 2);
+}

crates/application/src/integrations/tests/generate_token.rs

@@ -0,0 +1,39 @@
+use std::sync::Arc;
+
+use domain::models::WatchEventSource;
+use domain::testing::InMemoryWebhookTokenRepository;
+use uuid::Uuid;
+
+use crate::integrations::{commands::GenerateWebhookTokenCommand, generate_token};
+use crate::test_helpers::TestContextBuilder;
+
+#[tokio::test]
+async fn generates_token_and_saves() {
+    let tokens = InMemoryWebhookTokenRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_webhook_tokens(Arc::clone(&tokens) as _)
+        .build();
+
+    let user_id = Uuid::new_v4();
+    let result = generate_token::execute(
+        &ctx,
+        GenerateWebhookTokenCommand {
+            user_id,
+            provider: WatchEventSource::Jellyfin,
+            label: None,
+        },
+    )
+    .await
+    .unwrap();
+
+    assert!(!result.token_plaintext.is_empty());
+
+    let saved = ctx
+        .repos
+        .webhook_token
+        .list_by_user(&domain::value_objects::UserId::from_uuid(user_id))
+        .await
+        .unwrap();
+    assert_eq!(saved.len(), 1);
+    assert_eq!(saved[0].id().value(), result.token.id().value());
+}

crates/application/src/integrations/tests/get_queue.rs

@@ -0,0 +1,56 @@
+use std::sync::Arc;
+
+use chrono::Utc;
+use domain::models::{WatchEvent, WatchEventSource};
+use domain::ports::WatchEventRepository;
+use domain::testing::InMemoryWatchEventRepository;
+use domain::value_objects::UserId;
+use uuid::Uuid;
+
+use crate::integrations::{get_queue, queries::GetWatchQueueQuery};
+use crate::test_helpers::TestContextBuilder;
+
+#[tokio::test]
+async fn returns_empty_when_no_events() {
+    let events = InMemoryWatchEventRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&events) as _)
+        .build();
+
+    let result = get_queue::execute(
+        &ctx,
+        GetWatchQueueQuery {
+            user_id: Uuid::new_v4(),
+        },
+    )
+    .await
+    .unwrap();
+
+    assert!(result.is_empty());
+}
+
+#[tokio::test]
+async fn returns_pending_events() {
+    let events = InMemoryWatchEventRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_watch_events(Arc::clone(&events) as _)
+        .build();
+
+    let user_id = Uuid::new_v4();
+    let event = WatchEvent::new(
+        UserId::from_uuid(user_id),
+        "Blade Runner 2049".into(),
+        Some(2017),
+        None,
+        WatchEventSource::Jellyfin,
+        Utc::now().naive_utc(),
+        None,
+    );
+    events.save(&event).await.unwrap();
+
+    let result = get_queue::execute(&ctx, GetWatchQueueQuery { user_id })
+        .await
+        .unwrap();
+
+    assert_eq!(result.len(), 1);
+}

crates/application/src/integrations/tests/get_tokens.rs

@@ -0,0 +1,68 @@
+use std::sync::Arc;
+
+use domain::models::WatchEventSource;
+use domain::testing::InMemoryWebhookTokenRepository;
+use uuid::Uuid;
+
+use crate::integrations::{
+    commands::GenerateWebhookTokenCommand, generate_token, get_tokens,
+    queries::GetWebhookTokensQuery,
+};
+use crate::test_helpers::TestContextBuilder;
+
+#[tokio::test]
+async fn returns_empty_when_no_tokens() {
+    let tokens = InMemoryWebhookTokenRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_webhook_tokens(Arc::clone(&tokens) as _)
+        .build();
+
+    let result = get_tokens::execute(
+        &ctx,
+        GetWebhookTokensQuery {
+            user_id: Uuid::new_v4(),
+        },
+    )
+    .await
+    .unwrap();
+
+    assert!(result.is_empty());
+}
+
+#[tokio::test]
+async fn returns_tokens_after_generate() {
+    let tokens = InMemoryWebhookTokenRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_webhook_tokens(Arc::clone(&tokens) as _)
+        .build();
+
+    let user_id = Uuid::new_v4();
+
+    generate_token::execute(
+        &ctx,
+        GenerateWebhookTokenCommand {
+            user_id,
+            provider: WatchEventSource::Jellyfin,
+            label: None,
+        },
+    )
+    .await
+    .unwrap();
+
+    generate_token::execute(
+        &ctx,
+        GenerateWebhookTokenCommand {
+            user_id,
+            provider: WatchEventSource::Plex,
+            label: Some("living room".into()),
+        },
+    )
+    .await
+    .unwrap();
+
+    let result = get_tokens::execute(&ctx, GetWebhookTokensQuery { user_id })
+        .await
+        .unwrap();
+
+    assert_eq!(result.len(), 2);
+}

crates/application/src/integrations/tests/ingest.rs

@@ -0,0 +1,76 @@
+use std::sync::Arc;
+
+use domain::models::WatchEventSource;
+use domain::testing::InMemoryWebhookTokenRepository;
+use uuid::Uuid;
+
+use crate::integrations::commands::GenerateWebhookTokenCommand;
+use crate::integrations::{commands::IngestWatchEventCommand, generate_token, ingest};
+use crate::test_helpers::TestContextBuilder;
+
+struct FakeParser;
+
+impl domain::ports::MediaServerParser for FakeParser {
+    fn parse_playback_event(
+        &self,
+        _: &[u8],
+    ) -> Result<Option<domain::models::ParsedPlaybackEvent>, domain::errors::DomainError> {
+        Ok(Some(domain::models::ParsedPlaybackEvent {
+            title: "Test".into(),
+            year: Some(2024),
+            tmdb_id: None,
+            imdb_id: None,
+        }))
+    }
+}
+
+#[tokio::test]
+async fn ingests_watch_event() {
+    let tokens = InMemoryWebhookTokenRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_webhook_tokens(Arc::clone(&tokens) as _)
+        .build();
+
+    let user_id = Uuid::new_v4();
+    let generated = generate_token::execute(
+        &ctx,
+        GenerateWebhookTokenCommand {
+            user_id,
+            provider: WatchEventSource::Jellyfin,
+            label: None,
+        },
+    )
+    .await
+    .unwrap();
+
+    let result = ingest::execute(
+        &ctx,
+        IngestWatchEventCommand {
+            token: generated.token_plaintext,
+            raw_payload: vec![],
+            source: WatchEventSource::Jellyfin,
+        },
+        &FakeParser,
+    )
+    .await;
+
+    assert!(result.is_ok());
+}
+
+#[tokio::test]
+async fn rejects_invalid_token() {
+    let ctx = TestContextBuilder::new().build();
+
+    let result = ingest::execute(
+        &ctx,
+        IngestWatchEventCommand {
+            token: "bad-token".into(),
+            raw_payload: vec![],
+            source: WatchEventSource::Jellyfin,
+        },
+        &FakeParser,
+    )
+    .await;
+
+    assert!(result.is_err());
+}

crates/application/src/integrations/tests/revoke_token.rs

@@ -0,0 +1,46 @@
+use std::sync::Arc;
+
+use domain::models::WatchEventSource;
+use domain::testing::InMemoryWebhookTokenRepository;
+use uuid::Uuid;
+
+use crate::integrations::{
+    commands::{GenerateWebhookTokenCommand, RevokeWebhookTokenCommand},
+    generate_token, get_tokens,
+    queries::GetWebhookTokensQuery,
+    revoke_token,
+};
+use crate::test_helpers::TestContextBuilder;
+
+#[tokio::test]
+async fn revokes_existing_token() {
+    let tokens = InMemoryWebhookTokenRepository::new();
+    let ctx = TestContextBuilder::new()
+        .with_webhook_tokens(Arc::clone(&tokens) as _)
+        .build();
+
+    let user_id = Uuid::new_v4();
+
+    let generated = generate_token::execute(
+        &ctx,
+        GenerateWebhookTokenCommand {
+            user_id,
+            provider: WatchEventSource::Jellyfin,
+            label: None,
+        },
+    )
+    .await
+    .unwrap();
+
+    let token_id = generated.token.id().value();
+
+    revoke_token::execute(&ctx, RevokeWebhookTokenCommand { user_id, token_id })
+        .await
+        .unwrap();
+
+    let remaining = get_tokens::execute(&ctx, GetWebhookTokensQuery { user_id })
+        .await
+        .unwrap();
+
+    assert!(remaining.is_empty());
+}