Initial commit: site monorepo with API, web, and infra.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/tests/modules/users/test_avatar.py

@@ -0,0 +1,42 @@
+from tests.fixtures import make_test_png
+from tests.helpers import register_verify_login
+
+
+def test_upload_avatar_success(client):
+    headers = register_verify_login(client, "avatar@example.com")
+    response = client.post(
+        "/api/v1/users/me/avatar",
+        headers=headers,
+        files={"file": ("avatar.png", make_test_png(), "image/png")},
+    )
+    assert response.status_code == 200
+    avatar_url = response.json()["profile"]["avatar_url"]
+    assert avatar_url.startswith("/api/v1/media/files/avatars/")
+
+    media = client.get(avatar_url)
+    assert media.status_code == 200
+    assert media.headers["content-type"].startswith("image/")
+
+
+def test_upload_avatar_rejects_svg(client):
+    headers = register_verify_login(client, "svg@example.com")
+    svg = b"<svg xmlns='http://www.w3.org/2000/svg'><rect width='10' height='10'/></svg>"
+    response = client.post(
+        "/api/v1/users/me/avatar",
+        headers=headers,
+        files={"file": ("avatar.svg", svg, "image/svg+xml")},
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] in {"INVALID_MIME", "INVALID_IMAGE"}
+
+
+def test_upload_avatar_rejects_oversize(client):
+    headers = register_verify_login(client, "big@example.com")
+    oversized = make_test_png() + b"0" * (2 * 1024 * 1024)
+    response = client.post(
+        "/api/v1/users/me/avatar",
+        headers=headers,
+        files={"file": ("big.png", oversized, "image/png")},
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "FILE_TOO_LARGE"

apps/api/tests/modules/users/test_users_router.py

@@ -0,0 +1,30 @@
+from tests.helpers import register_verify_login
+
+
+def test_me_endpoint(client):
+    headers = register_verify_login(client, "me@example.com", "Valid123")
+    response = client.get("/api/v1/users/me", headers=headers)
+    assert response.status_code == 200
+    assert response.json()["user"]["email"] == "me@example.com"
+
+
+def test_patch_me_updates_display_name(client):
+    headers = register_verify_login(client, "display@example.com", "Valid123")
+    response = client.patch(
+        "/api/v1/users/me",
+        headers=headers,
+        json={"display_name": "Updated Name"},
+    )
+    assert response.status_code == 200
+    assert response.json()["profile"]["display_name"] == "Updated Name"
+
+
+def test_change_password_rejects_invalid_current(client):
+    headers = register_verify_login(client, "pwd@example.com", "Valid123")
+    response = client.post(
+        "/api/v1/users/me/password",
+        headers=headers,
+        json={"current_password": "Wrong123", "new_password": "NewValid1"},
+    )
+    assert response.status_code == 400
+    assert response.json()["detail"] == "INVALID_CURRENT_PASSWORD"