feat(mvp): complete M13 clean-up milestone (real usernames, avatar studio redesign, pause menu, audio manager)

backend/tests/test_social_friends.py

@@ -127,6 +127,26 @@ class TestFriendRequestFlow:
         again = client.delete(f"/api/friends/{a['id']}", headers=b["headers"])
         assert again.status_code == 404
 
+    def test_send_request_by_username_populates_requester_username(self):
+        client = TestClient(app)
+        a = _register(client, "fr_uname_a")
+        b = _register(client, "fr_uname_b")
+
+        resp = client.post(
+            "/api/friends/requests", json={"username": "fr_uname_b"}, headers=a["headers"]
+        )
+        assert resp.status_code == 201, resp.text
+        req_data = resp.json()
+        assert req_data["status"] == "pending"
+        assert req_data.get("requester_username") == "fr_uname_a"
+
+        incoming = client.get("/api/friends/requests", headers=b["headers"])
+        assert incoming.status_code == 200, incoming.text
+        reqs = incoming.json()["requests"]
+        matching = [r for r in reqs if r["id"] == req_data["id"]]
+        assert len(matching) == 1
+        assert matching[0]["requester_username"] == "fr_uname_a"
+
 
 class TestSelfAndDuplicateRejection:
     def test_self_request_rejected(self):
@@ -315,3 +335,27 @@ class TestDataIsolation:
         assert client.get("/api/friends/following").status_code == 401
         assert client.get("/api/friends/blocked").status_code == 401
         assert client.post("/api/friends/requests", json={"user_id": 1}).status_code == 401
+
+
+class TestUserSearchAndLookup:
+    def test_search_and_lookup_by_username(self):
+        client = TestClient(app)
+        u1 = _register(client, "usr_srch_1")
+        u2 = _register(client, "usr_srch_2")
+
+        # Search excludes current user
+        search_res = client.get("/api/users/search?q=usr_srch", headers=u1["headers"])
+        assert search_res.status_code == 200, search_res.text
+        names = [u["username"] for u in search_res.json()]
+        assert "usr_srch_2" in names
+        assert "usr_srch_1" not in names
+
+        # Lookup by username
+        lookup_res = client.get("/api/users/by-username/usr_srch_2", headers=u1["headers"])
+        assert lookup_res.status_code == 200, lookup_res.text
+        assert lookup_res.json()["username"] == "usr_srch_2"
+        assert lookup_res.json()["id"] == u2["id"]
+
+        # Lookup 404 for unknown user
+        missing = client.get("/api/users/by-username/nonexistent_usr_xyz", headers=u1["headers"])
+        assert missing.status_code == 404