feat: complete auth/profile username migration and runtime safeguards

backend/tests/unit/v1/auth/test_auth_models.py

@@ -14,7 +14,14 @@ from v1.auth.schemas import (
 
 def test_signup_requires_valid_email() -> None:
     with pytest.raises(ValidationError):
-        SignupRequest(email="not-an-email", password="secret123")
+        SignupRequest(username="demo", email="not-an-email", password="secret123")
+
+
+def test_signup_requires_username() -> None:
+    with pytest.raises(ValidationError):
+        SignupRequest.model_validate(
+            {"email": "user@example.com", "password": "secret123"}
+        )
 
 
 def test_login_requires_valid_email() -> None:

backend/tests/unit/v1/auth/test_auth_service.py

@@ -2,8 +2,10 @@ from __future__ import annotations
 
 import pytest
 
+import v1.auth.gateway as auth_gateway_module
 from v1.auth.schemas import (
     AuthTokenResponse,
+    AuthUserByEmailResponse,
     AuthUser,
     LoginRequest,
     RefreshRequest,
@@ -28,6 +30,14 @@ class FakeGateway(AuthServiceGateway):
     async def logout(self, refresh_token: str | None) -> None:
         return None
 
+    async def get_user_by_email(self, email: str) -> AuthUserByEmailResponse:
+        return AuthUserByEmailResponse(
+            id="user-1",
+            email=email,
+            created_at="2026-02-24T00:00:00Z",
+            email_confirmed_at=None,
+        )
+
 
 @pytest.mark.asyncio
 async def test_signup_maps_response() -> None:
@@ -42,7 +52,7 @@ async def test_signup_maps_response() -> None:
     service = AuthService(gateway=FakeGateway(token_response))
 
     result = await service.signup(
-        SignupRequest(email="user@example.com", password="secret123")
+        SignupRequest(username="demo", email="user@example.com", password="secret123")
     )
 
     assert result.access_token == "access"
@@ -66,9 +76,72 @@ class LogoutAssertingGateway(AuthServiceGateway):
     async def logout(self, refresh_token: str | None) -> None:
         assert refresh_token == self._expected_refresh_token
 
+    async def get_user_by_email(self, email: str) -> AuthUserByEmailResponse:
+        raise NotImplementedError
+
 
 @pytest.mark.asyncio
 async def test_logout_forwards_refresh_token() -> None:
     service = AuthService(gateway=LogoutAssertingGateway("refresh-token"))
 
     await service.logout("refresh-token")
+
+
+@pytest.mark.asyncio
+async def test_get_user_by_email_forwards_to_gateway() -> None:
+    user = AuthUser(id="user-1", email="user@example.com")
+    token_response = AuthTokenResponse(
+        access_token="access",
+        refresh_token="refresh",
+        expires_in=3600,
+        token_type="bearer",
+        user=user,
+    )
+    service = AuthService(gateway=FakeGateway(token_response))
+
+    result = await service.get_user_by_email("user@example.com")
+
+    assert result.email == "user@example.com"
+
+
+@pytest.mark.asyncio
+async def test_supabase_signup_passes_username_in_metadata(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    captured_payload: dict[str, object] = {}
+
+    class FakeSupabaseAuth:
+        def sign_up(self, payload: dict[str, object]) -> object:
+            captured_payload.update(payload)
+
+            class _User:
+                id = "user-1"
+                email = "user@example.com"
+
+            class _Session:
+                access_token = "access"
+                refresh_token = "refresh"
+                expires_in = 3600
+                token_type = "bearer"
+
+            class _Response:
+                user = _User()
+                session = _Session()
+
+            return _Response()
+
+    class FakeClient:
+        auth = FakeSupabaseAuth()
+
+    monkeypatch.setattr(auth_gateway_module, "create_client", lambda *_: FakeClient())
+
+    gateway = auth_gateway_module.SupabaseAuthGateway()
+    await gateway.signup(
+        SignupRequest(
+            username="demo",
+            email="user@example.com",
+            password="secret123",
+        )
+    )
+
+    assert captured_payload["data"] == {"username": "demo"}