feat: complete auth/profile username migration and runtime safeguards

backend/tests/unit/database/test_base_repository.py

@@ -4,7 +4,7 @@ from datetime import datetime, timezone
 from uuid import UUID, uuid4
 
 import pytest
-from sqlalchemy import String
+from sqlalchemy import Column, String, Table
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 from sqlalchemy.orm import Mapped, mapped_column
 
@@ -21,10 +21,19 @@ class Widget(SoftDeleteMixin, Base):
 
 @pytest.fixture
 async def db_engine():
+    auth_users = Table(
+        "users",
+        Base.metadata,
+        Column("id", String, primary_key=True),
+        schema="auth",
+        extend_existing=True,
+    )
     engine = create_async_engine("sqlite+aiosqlite:///:memory:", echo=False)
     async with engine.begin() as conn:
+        await conn.exec_driver_sql("ATTACH DATABASE ':memory:' AS auth")
         await conn.run_sync(Base.metadata.create_all)
     yield engine
+    Base.metadata.remove(auth_users)
     await engine.dispose()
 
 

backend/tests/unit/database/test_profile_migration_contract.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def test_drop_display_name_migration_exists_and_uses_username_metadata() -> None:
+    versions_dir = Path(__file__).resolve().parents[3] / "alembic" / "versions"
+    migration = (
+        versions_dir / "20260224_drop_profile_display_name_and_trigger_username.py"
+    )
+
+    assert migration.exists()
+
+    content = migration.read_text(encoding="utf-8")
+    assert "DROP COLUMN" in content and "display_name" in content
+    assert "raw_user_meta_data->>'username'" in content

backend/tests/unit/database/test_profile_models.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from uuid import uuid4
 
 import pytest
-from sqlalchemy import select
+from sqlalchemy import Column, String, Table, select
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
 
 from core.db.base import Base
@@ -13,13 +13,22 @@ from models.profile import Profile
 @pytest.fixture
 async def db_engine():
     """Create in-memory SQLite engine for testing."""
+    users_table = Table(
+        "users",
+        Base.metadata,
+        Column("id", String, primary_key=True),
+        schema="auth",
+        extend_existing=True,
+    )
     engine = create_async_engine(
         "sqlite+aiosqlite:///:memory:",
         echo=False,
     )
     async with engine.begin() as conn:
+        await conn.exec_driver_sql("ATTACH DATABASE ':memory:' AS auth")
         await conn.run_sync(Base.metadata.create_all)
     yield engine
+    Base.metadata.remove(users_table)
     await engine.dispose()
 
 
@@ -43,7 +52,6 @@ async def test_profile_model_create(db_session: AsyncSession) -> None:
     profile = Profile(
         id=profile_id,
         username="testuser",
-        display_name="Test User",
     )
     db_session.add(profile)
     await db_session.commit()
@@ -51,7 +59,6 @@ async def test_profile_model_create(db_session: AsyncSession) -> None:
 
     assert profile.id == profile_id
     assert profile.username == "testuser"
-    assert profile.display_name == "Test User"
     assert profile.created_at is not None
     assert profile.updated_at is not None
     assert profile.deleted_at is None
@@ -64,7 +71,6 @@ async def test_profile_model_get_by_id(db_session: AsyncSession) -> None:
     profile = Profile(
         id=profile_id,
         username="testuser",
-        display_name="Test User",
     )
     db_session.add(profile)
     await db_session.commit()
@@ -80,7 +86,6 @@ async def test_profile_model_get_by_username(db_session: AsyncSession) -> None:
     profile = Profile(
         id=uuid4(),
         username="testuser",
-        display_name="Test User",
     )
     db_session.add(profile)
     await db_session.commit()
@@ -99,16 +104,31 @@ async def test_profile_model_update(db_session: AsyncSession) -> None:
     profile = Profile(
         id=uuid4(),
         username="testuser",
-        display_name="Test User",
         bio="Old bio",
     )
     db_session.add(profile)
     await db_session.commit()
 
-    profile.display_name = "Updated User"
     profile.bio = "New bio"
     await db_session.commit()
     await db_session.refresh(profile)
 
-    assert profile.display_name == "Updated User"
     assert profile.bio == "New bio"
+
+
+@pytest.mark.asyncio
+async def test_profile_model_allows_duplicate_usernames(
+    db_session: AsyncSession,
+) -> None:
+    first = Profile(id=uuid4(), username="same_name")
+    second = Profile(id=uuid4(), username="same_name")
+
+    db_session.add(first)
+    db_session.add(second)
+    await db_session.commit()
+
+    result = await db_session.execute(
+        select(Profile).where(Profile.username == "same_name")
+    )
+    found = result.scalars().all()
+    assert len(found) == 2