feat: complete auth/profile username migration and runtime safeguards

backend/src/v1/profile/dependencies.py

@@ -82,7 +82,9 @@ def get_current_user(authorization: str | None = Header(default=None)) -> Curren
         raise HTTPException(status_code=401, detail="Unauthorized")
 
     logger.debug("JWT validation successful", user_id=str(user_id))
-    return CurrentUser(id=user_id)
+    email = payload.get("email") if isinstance(payload.get("email"), str) else None
+    role = payload.get("role") if isinstance(payload.get("role"), str) else None
+    return CurrentUser(id=user_id, email=email, role=role)
 
 
 def get_profile_service(

backend/src/v1/profile/repository.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from typing import TYPE_CHECKING, Protocol
 from uuid import UUID
 
+from sqlalchemy import select
 from sqlalchemy.exc import SQLAlchemyError
 
 from core.db.base_repository import BaseRepository
@@ -54,7 +55,15 @@ class SQLAlchemyProfileRepository(BaseRepository[Profile]):
 
     async def get_by_username(self, username: str) -> Profile | None:
         try:
-            return await self.get_one(Profile.username == username)
+            stmt = (
+                select(Profile)
+                .where(Profile.username == username)
+                .where(Profile.deleted_at.is_(None))
+                .order_by(Profile.created_at.asc())
+                .limit(1)
+            )
+            result = await self._session.execute(stmt)
+            return result.scalar_one_or_none()
         except SQLAlchemyError:
             logger.exception("Profile lookup failed", username=username)
             raise

backend/src/v1/profile/schemas.py

@@ -1,18 +1,26 @@
 from __future__ import annotations
 
-from pydantic import AnyHttpUrl, BaseModel, Field, field_validator, model_validator
+from pydantic import (
+    AnyHttpUrl,
+    BaseModel,
+    ConfigDict,
+    Field,
+    field_validator,
+    model_validator,
+)
 
 
 class ProfileResponse(BaseModel):
     id: str
     username: str
-    display_name: str | None = None
     avatar_url: str | None = None
     bio: str | None = None
 
 
 class ProfileUpdateRequest(BaseModel):
-    display_name: str | None = Field(default=None, max_length=50)
+    model_config = ConfigDict(extra="forbid")
+
+    username: str | None = Field(default=None, min_length=3, max_length=30)
     avatar_url: str | None = Field(default=None)
     bio: str | None = Field(default=None, max_length=200)
 
@@ -28,6 +36,6 @@ class ProfileUpdateRequest(BaseModel):
 
     @model_validator(mode="after")
     def require_one_field(self) -> "ProfileUpdateRequest":
-        if self.display_name is None and self.avatar_url is None and self.bio is None:
+        if self.username is None and self.avatar_url is None and self.bio is None:
             raise ValueError("At least one field must be provided")
         return self

backend/src/v1/profile/service.py

@@ -51,7 +51,6 @@ class ProfileService(BaseService):
         return ProfileResponse(
             id=str(profile.id),
             username=profile.username,
-            display_name=profile.display_name,
             avatar_url=profile.avatar_url,
             bio=profile.bio,
         )
@@ -61,7 +60,7 @@ class ProfileService(BaseService):
         update_data: dict[str, str | None] = {
             key: value
             for key, value in {
-                "display_name": update.display_name,
+                "username": update.username,
                 "avatar_url": update.avatar_url,
                 "bio": update.bio,
             }.items()
@@ -84,7 +83,6 @@ class ProfileService(BaseService):
         return ProfileResponse(
             id=str(profile.id),
             username=profile.username,
-            display_name=profile.display_name,
             avatar_url=profile.avatar_url,
             bio=profile.bio,
         )
@@ -100,7 +98,6 @@ class ProfileService(BaseService):
         return ProfileResponse(
             id=str(profile.id),
             username=profile.username,
-            display_name=profile.display_name,
             avatar_url=profile.avatar_url,
             bio=profile.bio,
         )