feat: complete auth/profile username migration and runtime safeguards

backend/tests/unit/v1/auth/test_auth_models.py

@@ -14,7 +14,14 @@ from v1.auth.schemas import (
 
 def test_signup_requires_valid_email() -> None:
     with pytest.raises(ValidationError):
-        SignupRequest(email="not-an-email", password="secret123")
+        SignupRequest(username="demo", email="not-an-email", password="secret123")
+
+
+def test_signup_requires_username() -> None:
+    with pytest.raises(ValidationError):
+        SignupRequest.model_validate(
+            {"email": "user@example.com", "password": "secret123"}
+        )
 
 
 def test_login_requires_valid_email() -> None:

backend/tests/unit/v1/auth/test_auth_service.py

@@ -2,8 +2,10 @@ from __future__ import annotations
 
 import pytest
 
+import v1.auth.gateway as auth_gateway_module
 from v1.auth.schemas import (
     AuthTokenResponse,
+    AuthUserByEmailResponse,
     AuthUser,
     LoginRequest,
     RefreshRequest,
@@ -28,6 +30,14 @@ class FakeGateway(AuthServiceGateway):
     async def logout(self, refresh_token: str | None) -> None:
         return None
 
+    async def get_user_by_email(self, email: str) -> AuthUserByEmailResponse:
+        return AuthUserByEmailResponse(
+            id="user-1",
+            email=email,
+            created_at="2026-02-24T00:00:00Z",
+            email_confirmed_at=None,
+        )
+
 
 @pytest.mark.asyncio
 async def test_signup_maps_response() -> None:
@@ -42,7 +52,7 @@ async def test_signup_maps_response() -> None:
     service = AuthService(gateway=FakeGateway(token_response))
 
     result = await service.signup(
-        SignupRequest(email="user@example.com", password="secret123")
+        SignupRequest(username="demo", email="user@example.com", password="secret123")
     )
 
     assert result.access_token == "access"
@@ -66,9 +76,72 @@ class LogoutAssertingGateway(AuthServiceGateway):
     async def logout(self, refresh_token: str | None) -> None:
         assert refresh_token == self._expected_refresh_token
 
+    async def get_user_by_email(self, email: str) -> AuthUserByEmailResponse:
+        raise NotImplementedError
+
 
 @pytest.mark.asyncio
 async def test_logout_forwards_refresh_token() -> None:
     service = AuthService(gateway=LogoutAssertingGateway("refresh-token"))
 
     await service.logout("refresh-token")
+
+
+@pytest.mark.asyncio
+async def test_get_user_by_email_forwards_to_gateway() -> None:
+    user = AuthUser(id="user-1", email="user@example.com")
+    token_response = AuthTokenResponse(
+        access_token="access",
+        refresh_token="refresh",
+        expires_in=3600,
+        token_type="bearer",
+        user=user,
+    )
+    service = AuthService(gateway=FakeGateway(token_response))
+
+    result = await service.get_user_by_email("user@example.com")
+
+    assert result.email == "user@example.com"
+
+
+@pytest.mark.asyncio
+async def test_supabase_signup_passes_username_in_metadata(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    captured_payload: dict[str, object] = {}
+
+    class FakeSupabaseAuth:
+        def sign_up(self, payload: dict[str, object]) -> object:
+            captured_payload.update(payload)
+
+            class _User:
+                id = "user-1"
+                email = "user@example.com"
+
+            class _Session:
+                access_token = "access"
+                refresh_token = "refresh"
+                expires_in = 3600
+                token_type = "bearer"
+
+            class _Response:
+                user = _User()
+                session = _Session()
+
+            return _Response()
+
+    class FakeClient:
+        auth = FakeSupabaseAuth()
+
+    monkeypatch.setattr(auth_gateway_module, "create_client", lambda *_: FakeClient())
+
+    gateway = auth_gateway_module.SupabaseAuthGateway()
+    await gateway.signup(
+        SignupRequest(
+            username="demo",
+            email="user@example.com",
+            password="secret123",
+        )
+    )
+
+    assert captured_payload["data"] == {"username": "demo"}

backend/tests/unit/v1/profile/test_profile_service.py

@@ -16,7 +16,6 @@ from v1.profile.service import ProfileService
 def _create_mock_profile(
     user_id: UUID = UUID("00000000-0000-0000-0000-000000000001"),
     username: str = "demo",
-    display_name: str | None = "Demo User",
     avatar_url: str | None = None,
     bio: str | None = None,
 ) -> Profile:
@@ -24,7 +23,6 @@ def _create_mock_profile(
     profile = MagicMock(spec=Profile)
     profile.id = user_id
     profile.username = username
-    profile.display_name = display_name
     profile.avatar_url = avatar_url
     profile.bio = bio
     return profile
@@ -115,9 +113,9 @@ async def test_update_me_updates_fields(mock_session: AsyncMock) -> None:
         current_user=user,
     )
 
-    result = await service.update_me(ProfileUpdateRequest(display_name="Updated"))
+    result = await service.update_me(ProfileUpdateRequest(username="updated"))
 
-    assert result.display_name == "Updated"
+    assert result.username == "updated"
     mock_session.commit.assert_awaited_once()
 
 
@@ -134,7 +132,7 @@ async def test_update_me_no_fields_raises_400(mock_session: AsyncMock) -> None:
 
     # Create a request with all None values by bypassing validation
     update = MagicMock(spec=ProfileUpdateRequest)
-    update.display_name = None
+    update.username = None
     update.avatar_url = None
     update.bio = None
 

backend/tests/unit/v1/profile/test_schemas.py

@@ -10,7 +10,6 @@ def test_profile_response_maps_fields() -> None:
     response = ProfileResponse(
         id="user-1",
         username="demo",
-        display_name="Demo User",
         avatar_url=None,
         bio=None,
     )
@@ -56,6 +55,11 @@ def test_profile_update_rejects_data_url() -> None:
 
 
 def test_profile_update_accepts_none_avatar_url_with_other_field() -> None:
-    request = ProfileUpdateRequest(display_name="Test", avatar_url=None)
+    request = ProfileUpdateRequest(username="tester", avatar_url=None)
     assert request.avatar_url is None
-    assert request.display_name == "Test"
+    assert request.username == "tester"
+
+
+def test_profile_update_rejects_display_name_field() -> None:
+    with pytest.raises(ValidationError):
+        ProfileUpdateRequest.model_validate({"display_name": "legacy"})