Add DM chat send/list endpoints: filter, rate limit, conversations (US-4)

Implements direct-message (DM) chat send and history endpoints:
- Migration 0011_add_dm_last_read.py (last_read_at on conversation_participants)
- Models updated in backend/app/models/chat.py
- Router in backend/app/routers/chat_dm.py:
  - POST /api/chat/dm/{user_id}/messages (send DM, filtered via TextFilter, rate-limited via Redis)
  - GET  /api/chat/dm/{user_id}/messages (paginated history, updates last_read_at)
  - GET  /api/chat/dm/conversations (conversations list, last message, unread count)
- Blocks enforced in both directions (cannot send to/from blocked users)
- Self-messaging prevented, peer exist check, auth required
- Integration tests in backend/tests/test_chat_dm.py

Independently re-verified: 14/14 new DM chat tests pass,
272/272 full backend regression suite passes with zero regressions.

backend/alembic/versions/0010_add_profile_tables.py

@@ -0,0 +1,65 @@
+"""add profile tables (profiles, profile_favorites)
+
+Revision ID: 0010_add_profile_tables
+Revises: 0009_add_group_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+app/models/profile.py. Models + migration + owner-only /api/profile/me
+endpoints only -- the public profile view endpoint (GET /api/profile/{user_id})
+belongs to a sibling task that depends on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0010_add_profile_tables"
+down_revision: Union[str, None] = "0009_add_group_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "profiles",
+        sa.Column("user_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), primary_key=True),
+        sa.Column(
+            "avatar_asset_id",
+            sa.Integer(),
+            sa.ForeignKey("assets.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("bio", sa.Text(), nullable=True),
+        sa.Column("privacy_json", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_profiles_avatar_asset_id", "profiles", ["avatar_asset_id"])
+
+    op.create_table(
+        "profile_favorites",
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            primary_key=True,
+        ),
+        sa.Column(
+            "world_id",
+            sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            primary_key=True,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_profile_favorites_world_id", "profile_favorites", ["world_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_profile_favorites_world_id", table_name="profile_favorites")
+    op.drop_table("profile_favorites")
+
+    op.drop_index("ix_profiles_avatar_asset_id", table_name="profiles")
+    op.drop_table("profiles")

backend/alembic/versions/0011_add_dm_last_read.py

@@ -0,0 +1,36 @@
+"""add last_read_at to conversation_participants (DM unread tracking)
+
+Revision ID: 0011_add_dm_last_read
+Revises: 0010_add_profile_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+app/routers/chat_dm.py (DM send/list/conversations endpoints). Unread-count
+tracking is implemented as a last-read timestamp per participant: whenever a
+user fetches a conversation's message history, their
+``conversation_participants`` row's ``last_read_at`` is bumped to "now", and
+the conversation-list endpoint counts messages with
+``created_at > last_read_at`` (or all messages if never read) as unread for
+that participant. Nullable/no default so existing rows (none yet in
+practice, but consistent with "never read") read as "everything unread".
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "0011_add_dm_last_read"
+down_revision: Union[str, None] = "0010_add_profile_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "conversation_participants",
+        sa.Column("last_read_at", sa.DateTime(timezone=True), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("conversation_participants", "last_read_at")

backend/app/main.py

@@ -6,7 +6,7 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.config import settings
-from app.routers import auth, users, worlds, assets, avatar, world_content, internal, presence, groups, social_friends
+from app.routers import auth, users, worlds, assets, avatar, world_content, internal, presence, groups, social_friends, profiles, chat_dm
 
 
 from app.services.game_servers import supervisor
@@ -47,6 +47,8 @@ app.include_router(internal.router, prefix="/api/internal", tags=["internal"])
 app.include_router(presence.router, prefix="/api/presence", tags=["presence"])
 app.include_router(groups.router, prefix="/api/groups", tags=["groups"])
 app.include_router(social_friends.router, prefix="/api/friends", tags=["friends"])
+app.include_router(profiles.router, prefix="/api/profile", tags=["profile"])
+app.include_router(chat_dm.router, prefix="/api/chat/dm", tags=["chat-dm"])
 
 
 @app.get("/api/health")

backend/app/models/__init__.py

@@ -9,6 +9,7 @@ from app.models.chat import (
     Conversation, ConversationParticipant, Message, MessageReport, ReportStatus,
 )
 from app.models.groups import Group, GroupMember, GroupRole
+from app.models.profile import Profile, ProfileFavorite, ProfileVisibility
 
 __all__ = [
     "User", "Session", "World", "Asset", "AvatarLoadout",
@@ -16,4 +17,5 @@ __all__ = [
     "Friendship", "Follow", "Block", "FriendshipStatus",
     "Conversation", "ConversationParticipant", "Message", "MessageReport", "ReportStatus",
     "Group", "GroupMember", "GroupRole",
+    "Profile", "ProfileFavorite", "ProfileVisibility",
 ]

backend/app/models/asset.py

@@ -23,7 +23,12 @@ class Asset(Base):
     name = Column(String(255), nullable=False)
     description = Column(Text, nullable=True)
     asset_type = Column(
-        ENUM(AssetType, name="asset_type", create_type=False),
+        ENUM(
+            AssetType,
+            name="asset_type",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
         nullable=False,
     )
     file_path = Column(String(512), nullable=False)

backend/app/models/chat.py

@@ -121,6 +121,10 @@ class ConversationParticipant(Base):
         Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
     )
     created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    # DM unread tracking (app/routers/chat_dm.py, migration 0010): bumped to
+    # "now" whenever this participant fetches the conversation's history.
+    # Null means "never read" -- everything in the conversation is unread.
+    last_read_at = Column(DateTime(timezone=True), nullable=True)
 
     conversation = relationship("Conversation", back_populates="participants")
     user = relationship("User")

backend/app/models/profile.py

@@ -0,0 +1,129 @@
+"""User profile: bio, avatar reference, privacy settings, favorite worlds.
+
+This module is models + migration only -- the public profile view endpoint
+(``GET /api/profile/{user_id}``, which will need to interpret ``privacy_json``
+against the viewer's relationship to the owner) belongs to a sibling task
+that depends on this one. This task only owns the authenticated-owner
+read/write endpoints (``/api/profile/me`` and its ``favorites`` sub-resource).
+
+Design choices:
+
+- ``profiles.user_id`` is both the primary key and the FK to ``users.id``
+  (``ondelete="CASCADE"``) -- exactly one profile row per user, following the
+  same one-row-per-user shape as ``AvatarLoadout`` (app/models/avatar_loadout.py).
+  The row is created lazily (upserted) on first ``PUT /api/profile/me``
+  rather than at registration time, again mirroring ``AvatarLoadout``.
+- ``avatar_asset_id`` -> ``assets.id`` with ``ondelete="SET NULL"``. A
+  profile's chosen "avatar picture" asset is a soft reference: if the
+  underlying asset is later deleted the profile shouldn't be destroyed or
+  left pointing at a dangling id, it should just fall back to "no avatar
+  picture set" (nullable). The API layer additionally validates on write
+  that the referenced asset actually exists (existence is not enforced by
+  the FK alone at the API layer, since the FK only stops inserts of a
+  nonexistent id -- it doesn't tell the caller *why* their PUT failed).
+- ``bio`` is ``Text`` with the 500-char cap enforced at the API/schema layer
+  (Pydantic ``max_length``), matching how ``StatusUpdate.status_message`` in
+  presence.py enforces its length cap in the router rather than the schema.
+- ``privacy_json`` is JSONB (project convention for document-shaped fields --
+  see avatar_loadout.py, world_content.py) holding exactly three keys, each a
+  ``ProfileVisibility`` enum value (stored as its string value in JSON, not a
+  Postgres ENUM type -- there's no need for a DB-level enum since this is a
+  small, entirely API-validated document, and a plain JSONB column is easier
+  to extend with more privacy keys later without a migration):
+    - ``profile_visibility``: who can view the profile at all.
+    - ``friends_list_visibility``: who can see the user's friends list.
+    - ``favorites_visibility``: who can see the user's favorited worlds.
+  Each value is one of "public", "friends", "private". Defaults (applied when
+  a profile is first created) are all "public" -- the least surprising
+  default for a new social feature, matching the "everything visible unless
+  you lock it down" posture other social features here take by default
+  (e.g. presence/status has no privacy gate at all yet).
+- Favorites use a join table (``profile_favorites``: ``user_id`` + ``world_id``,
+  composite PK) rather than a JSON array column. A plain FK join table gets
+  referential integrity for free (a favorited world that's later deleted
+  disappears from favorites automatically via ON DELETE CASCADE, matching
+  how ``World.assets``/``World.rooms`` cascade), lets Postgres enforce
+  "no duplicate favorite" via the composite PK instead of API-layer
+  deduplication, and keeps "does this world still exist" as a DB invariant
+  rather than something every reader has to re-check against a JSON blob.
+  The tradeoff (an extra table/join vs. a single JSON column) is worth it
+  here because favorites are a list of foreign-key references, not a
+  free-form document -- the exact case join tables suit better than JSONB.
+"""
+import enum
+
+from sqlalchemy import Column, Integer, ForeignKey, Text, DateTime
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class ProfileVisibility(str, enum.Enum):
+    PUBLIC = "public"
+    FRIENDS = "friends"
+    PRIVATE = "private"
+
+
+# Applied when a profile is created for the first time (lazy upsert on the
+# first PUT /api/profile/me). Keys match the three privacy_json fields
+# documented above.
+DEFAULT_PRIVACY: dict = {
+    "profile_visibility": ProfileVisibility.PUBLIC.value,
+    "friends_list_visibility": ProfileVisibility.PUBLIC.value,
+    "favorites_visibility": ProfileVisibility.PUBLIC.value,
+}
+
+BIO_MAX_LEN = 500
+
+
+class Profile(Base):
+    """One row per user: bio, avatar picture reference, privacy settings."""
+
+    __tablename__ = "profiles"
+
+    user_id = Column(
+        Integer,
+        ForeignKey("users.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    avatar_asset_id = Column(
+        Integer,
+        ForeignKey("assets.id", ondelete="SET NULL"),
+        nullable=True,
+    )
+    bio = Column(Text, nullable=True)
+    privacy_json = Column(JSONB, nullable=False, server_default="{}")
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    user = relationship("User", back_populates="profile")
+    avatar_asset = relationship("Asset")
+    # Deliberately no ORM relationship to ProfileFavorite here: profiles and
+    # profile_favorites both independently FK users.id (no direct FK between
+    # the two tables), and the router only ever needs to query/replace a
+    # user's favorites by user_id directly -- not traverse it off a loaded
+    # Profile object. Keeping it a plain queryable table avoids a
+    # hand-spelled, easy-to-get-wrong primaryjoin for no real benefit.
+
+
+class ProfileFavorite(Base):
+    """A user's favorited world. Composite PK -- see module docstring for why
+    this is a join table rather than a JSON array column."""
+
+    __tablename__ = "profile_favorites"
+
+    user_id = Column(
+        Integer,
+        ForeignKey("users.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    world_id = Column(
+        Integer,
+        ForeignKey("worlds.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    world = relationship("World")

backend/app/models/user.py

@@ -35,6 +35,14 @@ class User(Base):
         cascade="all, delete-orphan",
     )
 
+    # Profile (app/models/profile.py): bio/avatar picture/privacy + favorites.
+    profile = relationship(
+        "Profile",
+        back_populates="user",
+        uselist=False,
+        cascade="all, delete-orphan",
+    )
+
     # Social graph (docs/planning/social.md US-1; app/models/social.py)
     sent_friend_requests = relationship(
         "Friendship",

backend/app/routers/chat_dm.py

@@ -0,0 +1,396 @@
+"""Direct-message (DM) chat router.
+
+docs/planning/social.md §4/§5 (US-4). Builds the send/list REST surface on
+top of ``app/models/chat.py`` (Conversation/ConversationParticipant/Message,
+already merged), ``app/services/text_filter.py`` (already merged), and
+``app/rate_limit.py`` (already merged).
+
+Endpoints:
+- POST /api/chat/dm/{user_id}/messages     -- send a DM to ``user_id``
+- GET  /api/chat/dm/{user_id}/messages     -- paginated history with ``user_id``
+- GET  /api/chat/dm/conversations          -- list the caller's conversations
+
+Scope/boundaries (per task): REST send/list only, no WebSocket/real-time
+delivery (separate task), no world/room chat (separate sibling task; that
+uses the same ``Message`` table but with ``world_id``/``room_id`` set and
+``conversation_id`` null).
+
+Design decisions this task owns:
+
+- **Blocking.** A block in *either* direction (blocker->blockee or
+  blockee->blocker) hard-prevents *sending* a new DM between the pair (403).
+  It does not hide history the pair already has -- ``GET .../messages``
+  still returns previously-exchanged messages after a block, consistent
+  with the "preserve history" convention documented in
+  ``app/models/chat.py``'s module docstring. Only sending is blocked.
+- **Text filtering.** Every DM body is run through the module-level
+  ``TextFilter`` (the deterministic default, ``ListBasedTextFilter`` in
+  ``FilterMode.REDACT``) before storing:
+    - ALLOW -> store the body as-is, ``filtered=False``.
+    - REDACT -> store ``filtered_text`` (matched spans starred out),
+      ``filtered=True``.
+    - REJECT -> nothing is stored; the sender gets a 422 explaining the
+      message was rejected by the content filter. (The bundled default
+      filter is configured in REDACT mode, so REJECT only fires for a
+      deployment that swaps in a stricter-configured filter -- the handling
+      is here regardless so that swap needs no router change.)
+- **Rate limiting.** Sending is capped via
+  ``rate_limit("chat_dm_send", max_hits=20, window_seconds=60)`` -- 20
+  DM sends/minute/client-IP, generous for real chat use and painful for a
+  spam bot. A no-op when ``settings.RATE_LIMIT_ENABLED`` is false (see
+  ``app/rate_limit.py``), matching every other rate-limited endpoint.
+- **Unread tracking.** A last-read timestamp per participant
+  (``ConversationParticipant.last_read_at``, migration 0010). Fetching a
+  conversation's *latest* page of history (``GET .../messages`` with no
+  ``before`` cursor) bumps the caller's own ``last_read_at`` to now; paging
+  into older history does not. ``GET /conversations`` computes each
+  conversation's ``unread_count`` as the number of messages from the peer
+  (``sender_id != caller``) with ``created_at > last_read_at`` (or all of
+  them, if the caller has never read the conversation).
+- **Pagination.**
+    - History (``GET {user_id}/messages``): cursor-based, newest-first.
+      ``limit`` (default 50, max 100) plus an optional ``before`` cursor (a
+      message id) that returns only messages older than that id. Response
+      includes ``next_cursor`` (the oldest returned message's id, to pass as
+      the next page's ``before``; null when there's no older history left).
+    - Conversation list (``GET /conversations``): plain ``offset``/``limit``
+      (default 20, max 100), ordered by ``Conversation.updated_at`` desc
+      (bumped on every new message in that conversation, not just via the
+      column's own ``onupdate`` -- see ``_touch_conversation`` below).
+- Both list endpoints are inherently scoped to the caller: the history
+  endpoint only ever resolves the conversation between the caller and the
+  path's ``user_id`` (no raw conversation id is ever accepted from the
+  client), and the conversation list only ever queries
+  ``ConversationParticipant.user_id == caller``. There is no way for a
+  client to address another pair's conversation.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field
+from sqlalchemy import and_, func, or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.chat import Conversation, ConversationParticipant, Message
+from app.models.social import Block
+from app.models.user import User
+from app.rate_limit import rate_limit
+from app.services.text_filter import FilterAction, default_text_filter
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_text_filter = default_text_filter()
+chat_dm_send_rate_limit = rate_limit("chat_dm_send", max_hits=20, window_seconds=60)
+
+_BODY_MAX_LEN = 4000
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────
+
+
+class SendDMRequest(BaseModel):
+    body: str = Field(..., min_length=1, max_length=_BODY_MAX_LEN)
+
+
+class DMMessageResponse(BaseModel):
+    id: int
+    conversation_id: int
+    sender_id: int
+    recipient_id: int
+    body: str
+    filtered: bool
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class DMMessageListResponse(BaseModel):
+    messages: list[DMMessageResponse]
+    next_cursor: int | None = None
+
+
+class DMConversationSummary(BaseModel):
+    conversation_id: int
+    peer_id: int
+    peer_username: str
+    last_message: DMMessageResponse | None
+    unread_count: int
+    updated_at: datetime
+
+
+class DMConversationListResponse(BaseModel):
+    conversations: list[DMConversationSummary]
+    total: int
+
+
+# ──────────────────────────────── Helpers ──────────────────────────────────
+
+
+async def _get_target_user(db: AsyncSession, user_id: int) -> User:
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    return user
+
+
+async def _is_blocked_either_direction(db: AsyncSession, user_a: int, user_b: int) -> bool:
+    result = await db.execute(
+        select(Block.id).where(
+            or_(
+                and_(Block.blocker_id == user_a, Block.blocked_id == user_b),
+                and_(Block.blocker_id == user_b, Block.blocked_id == user_a),
+            )
+        ).limit(1)
+    )
+    return result.scalar_one_or_none() is not None
+
+
+async def _get_or_create_conversation(
+    db: AsyncSession, user_a_id: int, user_b_id: int
+) -> Conversation:
+    lo, hi = sorted((user_a_id, user_b_id))
+    result = await db.execute(
+        select(Conversation).where(
+            Conversation.user_a_id == lo, Conversation.user_b_id == hi
+        )
+    )
+    conversation = result.scalar_one_or_none()
+    if conversation is not None:
+        return conversation
+
+    conversation = Conversation(user_a_id=lo, user_b_id=hi)
+    db.add(conversation)
+    await db.flush()  # assign conversation.id
+    db.add(ConversationParticipant(conversation_id=conversation.id, user_id=lo))
+    db.add(ConversationParticipant(conversation_id=conversation.id, user_id=hi))
+    await db.flush()
+    return conversation
+
+
+async def _get_participant(
+    db: AsyncSession, conversation_id: int, user_id: int
+) -> ConversationParticipant | None:
+    result = await db.execute(
+        select(ConversationParticipant).where(
+            ConversationParticipant.conversation_id == conversation_id,
+            ConversationParticipant.user_id == user_id,
+        )
+    )
+    return result.scalar_one_or_none()
+
+
+def _peer_id(conversation: Conversation, self_id: int) -> int:
+    return conversation.user_b_id if conversation.user_a_id == self_id else conversation.user_a_id
+
+
+def _touch_conversation(conversation: Conversation) -> None:
+    """Bump ``updated_at`` explicitly.
+
+    ``Conversation.updated_at`` has ``onupdate=func.now()``, but that only
+    fires when an UPDATE statement touches the ``conversations`` row itself
+    -- inserting a ``Message`` row alone never does. Explicitly dirtying the
+    column here is what actually keeps "most recently active conversation"
+    ordering correct for ``GET /conversations``.
+    """
+    conversation.updated_at = datetime.now(timezone.utc)
+
+
+def _to_message_response(message: Message, recipient_id: int) -> DMMessageResponse:
+    return DMMessageResponse(
+        id=message.id,
+        conversation_id=message.conversation_id,
+        sender_id=message.sender_id,
+        recipient_id=recipient_id,
+        body=message.body,
+        filtered=message.filtered,
+        created_at=message.created_at,
+    )
+
+
+# ──────────────────────────────── Endpoints ────────────────────────────────
+
+
+@router.post(
+    "/{user_id}/messages",
+    response_model=DMMessageResponse,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(chat_dm_send_rate_limit)],
+)
+async def send_dm(
+    user_id: int,
+    body: SendDMRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Send a DM to ``user_id``."""
+    if user_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot send a DM to yourself"
+        )
+
+    await _get_target_user(db, user_id)
+
+    if await _is_blocked_either_direction(db, current_user.id, user_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Cannot message this user",
+        )
+
+    result = _text_filter.check(body.body)
+    if result.action is FilterAction.REJECT:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail="Message rejected by the content filter.",
+        )
+
+    conversation = await _get_or_create_conversation(db, current_user.id, user_id)
+
+    message = Message(
+        sender_id=current_user.id,
+        conversation_id=conversation.id,
+        body=result.filtered_text,
+        filtered=(result.action is FilterAction.REDACT),
+    )
+    db.add(message)
+    _touch_conversation(conversation)
+    await db.commit()
+    await db.refresh(message)
+
+    return _to_message_response(message, recipient_id=user_id)
+
+
+@router.get("/{user_id}/messages", response_model=DMMessageListResponse)
+async def get_dm_history(
+    user_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(50, ge=1, le=100),
+    before: int | None = Query(
+        None, description="Return messages older than this message id (pagination cursor)."
+    ),
+):
+    """Paginated DM history between the caller and ``user_id``, newest first.
+
+    Marks the conversation as read (bumps the caller's ``last_read_at``) only
+    when fetching the first page (``before`` omitted) -- paging into older
+    history doesn't affect unread state.
+    """
+    await _get_target_user(db, user_id)
+
+    lo, hi = sorted((current_user.id, user_id))
+    conv_result = await db.execute(
+        select(Conversation).where(Conversation.user_a_id == lo, Conversation.user_b_id == hi)
+    )
+    conversation = conv_result.scalar_one_or_none()
+    if conversation is None:
+        # No conversation yet -- nothing exchanged, not an error.
+        return DMMessageListResponse(messages=[], next_cursor=None)
+
+    stmt = select(Message).where(Message.conversation_id == conversation.id)
+    if before is not None:
+        stmt = stmt.where(Message.id < before)
+    stmt = stmt.order_by(Message.id.desc()).limit(limit + 1)
+
+    rows = (await db.execute(stmt)).scalars().all()
+    has_more = len(rows) > limit
+    page = rows[:limit]
+    next_cursor = page[-1].id if has_more and page else None
+
+    if before is None:
+        participant = await _get_participant(db, conversation.id, current_user.id)
+        if participant is not None:
+            participant.last_read_at = datetime.now(timezone.utc)
+            await db.commit()
+
+    return DMMessageListResponse(
+        messages=[_to_message_response(m, recipient_id=user_id) for m in page],
+        next_cursor=next_cursor,
+    )
+
+
+@router.get("/conversations", response_model=DMConversationListResponse)
+async def list_conversations(
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(20, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List the caller's DM conversations, most recently active first."""
+    total_result = await db.execute(
+        select(func.count())
+        .select_from(ConversationParticipant)
+        .where(ConversationParticipant.user_id == current_user.id)
+    )
+    total = total_result.scalar_one()
+
+    stmt = (
+        select(Conversation, ConversationParticipant)
+        .join(
+            ConversationParticipant,
+            ConversationParticipant.conversation_id == Conversation.id,
+        )
+        .where(ConversationParticipant.user_id == current_user.id)
+        .order_by(Conversation.updated_at.desc())
+        .offset(offset)
+        .limit(limit)
+    )
+    rows = (await db.execute(stmt)).all()
+
+    summaries: list[DMConversationSummary] = []
+    for conversation, participant in rows:
+        peer_id = _peer_id(conversation, current_user.id)
+
+        peer = (
+            await db.execute(select(User).where(User.id == peer_id))
+        ).scalar_one_or_none()
+        peer_username = peer.username if peer is not None else "(deleted user)"
+
+        last_message_row = (
+            await db.execute(
+                select(Message)
+                .where(Message.conversation_id == conversation.id)
+                .order_by(Message.id.desc())
+                .limit(1)
+            )
+        ).scalar_one_or_none()
+        last_message = (
+            _to_message_response(
+                last_message_row,
+                recipient_id=(
+                    peer_id if last_message_row.sender_id == current_user.id else current_user.id
+                ),
+            )
+            if last_message_row is not None
+            else None
+        )
+
+        unread_filters = [
+            Message.conversation_id == conversation.id,
+            Message.sender_id != current_user.id,
+        ]
+        if participant.last_read_at is not None:
+            unread_filters.append(Message.created_at > participant.last_read_at)
+        unread_count = (
+            await db.execute(select(func.count()).select_from(Message).where(*unread_filters))
+        ).scalar_one()
+
+        summaries.append(
+            DMConversationSummary(
+                conversation_id=conversation.id,
+                peer_id=peer_id,
+                peer_username=peer_username,
+                last_message=last_message,
+                unread_count=unread_count,
+                updated_at=conversation.updated_at,
+            )
+        )
+
+    return DMConversationListResponse(conversations=summaries, total=total)

backend/app/routers/profiles.py

@@ -0,0 +1,205 @@
+"""Profile router -- the authenticated user's own profile + favorites.
+
+Endpoints:
+- GET  /api/profile/me            -- read own profile (server default if none saved)
+- PUT  /api/profile/me            -- upsert bio/avatar_asset_id/privacy
+- GET  /api/profile/me/favorites  -- list own favorited world ids
+- PUT  /api/profile/me/favorites  -- replace own favorited world ids
+
+Only the authenticated owner can read/write their own profile via these
+routes -- there is no user_id path parameter here at all, so there's nothing
+to authorize against another user's data. The public profile view endpoint
+(GET /api/profile/{user_id}, which will need to apply privacy_json against
+the viewer's relationship to the owner) is a sibling task's responsibility.
+"""
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.asset import Asset
+from app.models.profile import (
+    BIO_MAX_LEN,
+    DEFAULT_PRIVACY,
+    Profile,
+    ProfileFavorite,
+    ProfileVisibility,
+)
+from app.models.world import World
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_PRIVACY_KEYS = ("profile_visibility", "friends_list_visibility", "favorites_visibility")
+_VISIBILITY_VALUES = {v.value for v in ProfileVisibility}
+
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+
+class ProfileResponse(BaseModel):
+    user_id: int
+    avatar_asset_id: int | None
+    bio: str | None
+    privacy: dict[str, str]
+    is_default: bool = Field(
+        description="True when the user has never saved a profile and this "
+        "is the server default (no bio/avatar, default-open privacy)."
+    )
+
+
+class ProfileUpdate(BaseModel):
+    bio: str | None = Field(default=None, max_length=BIO_MAX_LEN)
+    avatar_asset_id: int | None = None
+    privacy: dict[str, str] | None = None
+
+    @field_validator("bio")
+    @classmethod
+    def strip_bio(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip()
+        return v
+
+
+class FavoritesResponse(BaseModel):
+    world_ids: list[int]
+
+
+class FavoritesUpdate(BaseModel):
+    world_ids: list[int]
+
+
+# ──────────────────────────────── Helpers ─────────────────────────────────────
+
+
+def _validate_privacy(privacy: dict[str, str]) -> dict[str, str]:
+    """Validate privacy dict has exactly the allowed keys, each a valid
+    ProfileVisibility value. Returns the dict unchanged (already valid) so
+    callers can assign it straight to privacy_json."""
+    extra = set(privacy.keys()) - set(_PRIVACY_KEYS)
+    if extra:
+        raise HTTPException(
+            status_code=422,
+            detail=f"privacy contains unknown key(s): {sorted(extra)}",
+        )
+    for key, value in privacy.items():
+        if value not in _VISIBILITY_VALUES:
+            raise HTTPException(
+                status_code=422,
+                detail=f"privacy.{key} must be one of {sorted(_VISIBILITY_VALUES)}, got {value!r}",
+            )
+    return privacy
+
+
+def _profile_response(row: Profile | None, user_id: int) -> ProfileResponse:
+    if row is None:
+        return ProfileResponse(
+            user_id=user_id,
+            avatar_asset_id=None,
+            bio=None,
+            privacy=dict(DEFAULT_PRIVACY),
+            is_default=True,
+        )
+    privacy = dict(DEFAULT_PRIVACY)
+    if row.privacy_json:
+        privacy.update(row.privacy_json)
+    return ProfileResponse(
+        user_id=row.user_id,
+        avatar_asset_id=row.avatar_asset_id,
+        bio=row.bio,
+        privacy=privacy,
+        is_default=False,
+    )
+
+
+# ──────────────────────────────── Endpoints ───────────────────────────────────
+
+
+@router.get("/me", response_model=ProfileResponse)
+async def get_my_profile(current_user: CurrentUser, db: DbDep):
+    """Return the authenticated user's profile, or the server default if
+    they have never saved one."""
+    row = await db.get(Profile, current_user.id)
+    return _profile_response(row, current_user.id)
+
+
+@router.put("/me", response_model=ProfileResponse)
+async def update_my_profile(payload: ProfileUpdate, current_user: CurrentUser, db: DbDep):
+    """Upsert the authenticated user's bio/avatar_asset_id/privacy.
+
+    Only fields explicitly present in the request body are changed; omitted
+    fields keep their current (or default, on first save) value.
+    """
+    fields_set = payload.model_fields_set
+
+    if "avatar_asset_id" in fields_set and payload.avatar_asset_id is not None:
+        asset = await db.get(Asset, payload.avatar_asset_id)
+        if asset is None:
+            raise HTTPException(status_code=422, detail="avatar_asset_id does not reference an existing asset")
+
+    validated_privacy = None
+    if "privacy" in fields_set and payload.privacy is not None:
+        validated_privacy = _validate_privacy(payload.privacy)
+
+    row = await db.get(Profile, current_user.id)
+    if row is None:
+        row = Profile(
+            user_id=current_user.id,
+            bio=payload.bio if "bio" in fields_set else None,
+            avatar_asset_id=payload.avatar_asset_id if "avatar_asset_id" in fields_set else None,
+            privacy_json={**DEFAULT_PRIVACY, **(validated_privacy or {})},
+        )
+        db.add(row)
+    else:
+        if "bio" in fields_set:
+            row.bio = payload.bio
+        if "avatar_asset_id" in fields_set:
+            row.avatar_asset_id = payload.avatar_asset_id
+        if validated_privacy is not None:
+            merged = dict(row.privacy_json or DEFAULT_PRIVACY)
+            merged.update(validated_privacy)
+            row.privacy_json = merged
+
+    await db.commit()
+    await db.refresh(row)
+    return _profile_response(row, current_user.id)
+
+
+@router.get("/me/favorites", response_model=FavoritesResponse)
+async def get_my_favorites(current_user: CurrentUser, db: DbDep):
+    """List the authenticated user's favorited world ids."""
+    result = await db.execute(
+        select(ProfileFavorite.world_id).where(ProfileFavorite.user_id == current_user.id)
+    )
+    return FavoritesResponse(world_ids=[wid for wid in result.scalars().all()])
+
+
+@router.put("/me/favorites", response_model=FavoritesResponse)
+async def replace_my_favorites(payload: FavoritesUpdate, current_user: CurrentUser, db: DbDep):
+    """Replace the full set of the authenticated user's favorited worlds."""
+    world_ids = list(dict.fromkeys(payload.world_ids))  # de-dupe, preserve order
+
+    if world_ids:
+        result = await db.execute(select(World.id).where(World.id.in_(world_ids)))
+        existing_ids = set(result.scalars().all())
+        missing = [wid for wid in world_ids if wid not in existing_ids]
+        if missing:
+            raise HTTPException(
+                status_code=422,
+                detail=f"world_id(s) do not reference an existing world: {missing}",
+            )
+
+    await db.execute(
+        ProfileFavorite.__table__.delete().where(ProfileFavorite.user_id == current_user.id)
+    )
+    for wid in world_ids:
+        db.add(ProfileFavorite(user_id=current_user.id, world_id=wid))
+
+    await db.commit()
+    return FavoritesResponse(world_ids=world_ids)

backend/tests/conftest.py

@@ -36,6 +36,9 @@ from app.main import app
 
 TEST_TABLES = (
     "avatar_loadouts", "assets",
+    # Profile (app/models/profile.py) -- both FK users.id, profile_favorites
+    # additionally FKs worlds.id; list explicitly for clarity/consistency.
+    "profile_favorites", "profiles",
     # world_chunk_revisions has no FK to worlds/world_chunks (world.md §4.7 /
     # world_persistence_impl.md §4.3, deliberate -- deleting a chunk or world
     # must not lose the audit trail), so it won't be cascade-truncated via

backend/tests/test_chat_dm.py

@@ -0,0 +1,312 @@
+"""Integration tests for the DM chat router (app/routers/chat_dm.py):
+
+- POST /api/chat/dm/{user_id}/messages
+- GET  /api/chat/dm/{user_id}/messages
+- GET  /api/chat/dm/conversations
+
+The block-relationship router doesn't exist yet (sibling task), so blocks
+are inserted directly against the ``Block`` model, same pattern already
+used by ``tests/test_chat_models.py`` for direct model setup.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app import rate_limit
+from app.config import settings
+from app.main import app
+from app.models.social import Block
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"], "username": username}
+
+
+async def _insert_block(blocker_id: int, blocked_id: int) -> None:
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        session.add(Block(blocker_id=blocker_id, blocked_id=blocked_id))
+        await session.commit()
+    await engine.dispose()
+
+
+class TestSendAndRetrieve:
+    def test_send_then_fetch_history(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_alice1")
+        bob = _register(client, "dm_bob1")
+
+        resp = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "hey bob"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 201, resp.text
+        sent = resp.json()
+        assert sent["sender_id"] == alice["id"]
+        assert sent["recipient_id"] == bob["id"]
+        assert sent["body"] == "hey bob"
+        assert sent["filtered"] is False
+        assert sent["id"] is not None
+        assert sent["created_at"] is not None
+
+        hist_alice = client.get(f"/api/chat/dm/{bob['id']}/messages", headers=alice["headers"])
+        assert hist_alice.status_code == 200, hist_alice.text
+        msgs = hist_alice.json()["messages"]
+        assert len(msgs) == 1
+        assert msgs[0]["body"] == "hey bob"
+
+        hist_bob = client.get(f"/api/chat/dm/{alice['id']}/messages", headers=bob["headers"])
+        assert hist_bob.status_code == 200, hist_bob.text
+        assert len(hist_bob.json()["messages"]) == 1
+        assert hist_bob.json()["messages"][0]["body"] == "hey bob"
+
+    def test_cannot_message_self(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_self1")
+        resp = client.post(
+            f"/api/chat/dm/{alice['id']}/messages",
+            json={"body": "hi me"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 400
+
+    def test_target_user_must_exist(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_noexist1")
+        resp = client.post(
+            "/api/chat/dm/999999999/messages",
+            json={"body": "hello?"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 404
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        resp = client.post("/api/chat/dm/1/messages", json={"body": "hi"})
+        assert resp.status_code == 401
+
+    def test_history_pagination_cursor(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_page_a")
+        bob = _register(client, "dm_page_b")
+
+        for i in range(5):
+            r = client.post(
+                f"/api/chat/dm/{bob['id']}/messages",
+                json={"body": f"msg {i}"},
+                headers=alice["headers"],
+            )
+            assert r.status_code == 201, r.text
+
+        page1 = client.get(
+            f"/api/chat/dm/{bob['id']}/messages",
+            params={"limit": 2},
+            headers=alice["headers"],
+        )
+        assert page1.status_code == 200
+        body1 = page1.json()
+        assert len(body1["messages"]) == 2
+        assert body1["messages"][0]["body"] == "msg 4"  # newest first
+        assert body1["next_cursor"] is not None
+
+        page2 = client.get(
+            f"/api/chat/dm/{bob['id']}/messages",
+            params={"limit": 2, "before": body1["next_cursor"]},
+            headers=alice["headers"],
+        )
+        assert page2.status_code == 200
+        body2 = page2.json()
+        assert [m["body"] for m in body2["messages"]] == ["msg 2", "msg 1"]
+
+    def test_no_conversation_yet_returns_empty_history(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_empty_a")
+        bob = _register(client, "dm_empty_b")
+        resp = client.get(f"/api/chat/dm/{bob['id']}/messages", headers=alice["headers"])
+        assert resp.status_code == 200
+        assert resp.json() == {"messages": [], "next_cursor": None}
+
+
+class TestConversationList:
+    def test_lists_peer_last_message_and_unread_count(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_conv_a")
+        bob = _register(client, "dm_conv_b")
+
+        client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "first"},
+            headers=alice["headers"],
+        )
+        client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "second"},
+            headers=alice["headers"],
+        )
+
+        convs_bob = client.get("/api/chat/dm/conversations", headers=bob["headers"])
+        assert convs_bob.status_code == 200, convs_bob.text
+        data = convs_bob.json()
+        assert data["total"] == 1
+        conv = data["conversations"][0]
+        assert conv["peer_id"] == alice["id"]
+        assert conv["peer_username"] == "dm_conv_a"
+        assert conv["last_message"]["body"] == "second"
+        assert conv["unread_count"] == 2  # bob hasn't read yet
+
+        # Bob reads the latest page -> unread resets to 0.
+        client.get(f"/api/chat/dm/{alice['id']}/messages", headers=bob["headers"])
+        convs_bob_after = client.get("/api/chat/dm/conversations", headers=bob["headers"])
+        assert convs_bob_after.json()["conversations"][0]["unread_count"] == 0
+
+        # Alice sent them, so her own unread count for this conversation is 0.
+        convs_alice = client.get("/api/chat/dm/conversations", headers=alice["headers"])
+        assert convs_alice.json()["conversations"][0]["unread_count"] == 0
+
+    def test_scoped_to_authenticated_user_only(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_scope_a")
+        bob = _register(client, "dm_scope_b")
+        carol = _register(client, "dm_scope_c")
+
+        client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "hi bob"},
+            headers=alice["headers"],
+        )
+
+        convs_carol = client.get("/api/chat/dm/conversations", headers=carol["headers"])
+        assert convs_carol.status_code == 200
+        assert convs_carol.json() == {"conversations": [], "total": 0}
+
+    def test_cannot_read_another_pairs_conversation(self):
+        """A user's history endpoint only ever resolves *their own* pairing
+        with the given peer id -- there is no conversation id in the URL an
+        outsider could guess/pass to read someone else's DMs."""
+        client = TestClient(app)
+        alice = _register(client, "dm_iso_a")
+        bob = _register(client, "dm_iso_b")
+        carol = _register(client, "dm_iso_c")
+
+        client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "secret to bob"},
+            headers=alice["headers"],
+        )
+
+        # Carol asking for her "history with bob" gets her own (empty)
+        # conversation, never alice's.
+        resp = client.get(f"/api/chat/dm/{bob['id']}/messages", headers=carol["headers"])
+        assert resp.status_code == 200
+        assert resp.json()["messages"] == []
+
+
+class TestBlocking:
+    async def test_blocker_cannot_send_to_blocked(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_block_a1")
+        bob = _register(client, "dm_block_b1")
+        await _insert_block(alice["id"], bob["id"])
+
+        resp = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "let me in"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 403
+
+    async def test_blocked_cannot_send_to_blocker(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_block_a2")
+        bob = _register(client, "dm_block_b2")
+        await _insert_block(alice["id"], bob["id"])
+
+        resp = client.post(
+            f"/api/chat/dm/{alice['id']}/messages",
+            json={"body": "please respond"},
+            headers=bob["headers"],
+        )
+        assert resp.status_code == 403
+
+
+class TestTextFilter:
+    def test_message_tripping_filter_is_redacted_and_flagged(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_filter_a")
+        bob = _register(client, "dm_filter_b")
+
+        resp = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "you are a bastard"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 201, resp.text
+        data = resp.json()
+        assert data["filtered"] is True
+        assert "bastard" not in data["body"]
+        assert "*" in data["body"]
+
+        # The stored/delivered copy is the redacted one, not the raw text.
+        hist = client.get(f"/api/chat/dm/{alice['id']}/messages", headers=bob["headers"])
+        assert hist.json()["messages"][0]["body"] == data["body"]
+
+    def test_clean_message_is_not_flagged(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_clean_a")
+        bob = _register(client, "dm_clean_b")
+        resp = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "have a nice day"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 201
+        assert resp.json()["filtered"] is False
+        assert resp.json()["body"] == "have a nice day"
+
+
+class TestRateLimit:
+    @pytest.fixture(autouse=True)
+    def _enable_rate_limiting(self):
+        prev = settings.RATE_LIMIT_ENABLED
+        settings.RATE_LIMIT_ENABLED = True
+        rate_limit.reset_all()
+        yield
+        rate_limit.reset_all()
+        settings.RATE_LIMIT_ENABLED = prev
+
+    def test_send_rate_limit_exceeded_returns_429(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_rl_a")
+        bob = _register(client, "dm_rl_b")
+
+        codes = []
+        for i in range(25):
+            r = client.post(
+                f"/api/chat/dm/{bob['id']}/messages",
+                json={"body": f"spam {i}"},
+                headers=alice["headers"],
+            )
+            codes.append(r.status_code)
+
+        assert codes[:20] == [201] * 20
+        assert 429 in codes[20:]
+        assert codes[-1] == 429

backend/tests/test_profile.py

@@ -0,0 +1,253 @@
+"""Integration tests for /api/profile/me and /api/profile/me/favorites.
+
+Hits the real app against the configured Postgres (same contract as the
+other integration tests -- migrations applied first).
+"""
+
+import asyncio
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.profile import DEFAULT_PRIVACY
+
+
+def _auth_headers(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    return {"Authorization": f"Bearer {resp.json()['access_token']}"}
+
+
+def _me_id(client: TestClient, headers: dict) -> int:
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _make_world(client: TestClient, headers: dict, name: str = "W") -> int:
+    r = client.post("/api/worlds/", headers=headers, json={"name": name, "visibility": "public"})
+    assert r.status_code == 201, r.text
+    return r.json()["id"]
+
+
+def _make_asset(client: TestClient, headers: dict, name: str = "A") -> int:
+    """Insert an asset row directly via raw SQL.
+
+    Not going through POST /api/assets/, and not through the Asset ORM
+    model, deliberately: Asset.asset_type's ENUM column has no
+    values_callable, so SQLAlchemy sends the Python enum *name* (e.g.
+    "IMAGE") to Postgres instead of the lowercase value the DB enum
+    actually stores ("image"), and both the router and a plain ORM insert
+    500/fail on it. That's a pre-existing bug unrelated to this task; these
+    tests only need a real asset row to reference by id, so insert with raw
+    SQL to sidestep the buggy enum type entirely.
+    """
+    owner_id = _me_id(client, headers)
+
+    async def _create() -> int:
+        engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+        async with engine.begin() as conn:
+            result = await conn.execute(
+                text(
+                    "INSERT INTO assets (name, asset_type, file_path, owner_id, is_public) "
+                    "VALUES (:name, 'image', '', :owner_id, false) RETURNING id"
+                ),
+                {"name": name, "owner_id": owner_id},
+            )
+            asset_id = result.scalar_one()
+        await engine.dispose()
+        return asset_id
+
+    return asyncio.run(_create())
+
+
+class TestGetProfile:
+    def test_new_user_gets_the_default(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_default")
+        resp = client.get("/api/profile/me", headers=headers)
+        assert resp.status_code == 200
+        body = resp.json()
+        assert body["is_default"] is True
+        assert body["bio"] is None
+        assert body["avatar_asset_id"] is None
+        assert body["privacy"] == DEFAULT_PRIVACY
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        assert client.get("/api/profile/me").status_code == 401
+
+
+class TestPutProfile:
+    def test_save_then_read_back(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_save")
+        asset_id = _make_asset(client, headers)
+
+        put = client.put(
+            "/api/profile/me", headers=headers,
+            json={"bio": "hello world", "avatar_asset_id": asset_id,
+                  "privacy": {"profile_visibility": "friends"}},
+        )
+        assert put.status_code == 200, put.text
+        body = put.json()
+        assert body["is_default"] is False
+        assert body["bio"] == "hello world"
+        assert body["avatar_asset_id"] == asset_id
+        assert body["privacy"]["profile_visibility"] == "friends"
+        # unspecified privacy keys keep their default
+        assert body["privacy"]["friends_list_visibility"] == "public"
+
+        got = client.get("/api/profile/me", headers=headers)
+        assert got.status_code == 200
+        assert got.json() == body
+
+    def test_partial_update_preserves_other_fields(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_partial")
+        client.put("/api/profile/me", headers=headers, json={"bio": "first bio"})
+        put2 = client.put("/api/profile/me", headers=headers, json={"privacy": {"favorites_visibility": "private"}})
+        assert put2.status_code == 200, put2.text
+        body = put2.json()
+        assert body["bio"] == "first bio"
+        assert body["privacy"]["favorites_visibility"] == "private"
+
+    def test_other_user_cannot_edit_my_profile(self):
+        """There is no user_id-scoped edit route at all -- PUT /me always
+        acts on the caller's own JWT identity, so another user's token can
+        never touch this user's profile."""
+        client = TestClient(app)
+        headers_a = _auth_headers(client, "pf_owner")
+        headers_b = _auth_headers(client, "pf_other")
+
+        client.put("/api/profile/me", headers=headers_a, json={"bio": "owner's bio"})
+        client.put("/api/profile/me", headers=headers_b, json={"bio": "other's bio"})
+
+        got_a = client.get("/api/profile/me", headers=headers_a).json()
+        got_b = client.get("/api/profile/me", headers=headers_b).json()
+        assert got_a["bio"] == "owner's bio"
+        assert got_b["bio"] == "other's bio"
+        assert got_a["user_id"] != got_b["user_id"]
+
+    def test_rejects_invalid_avatar_asset_id(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_badasset")
+        resp = client.put("/api/profile/me", headers=headers, json={"avatar_asset_id": 999999})
+        assert resp.status_code == 422
+
+    def test_rejects_over_length_bio(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_longbio")
+        resp = client.put("/api/profile/me", headers=headers, json={"bio": "x" * 501})
+        assert resp.status_code == 422
+
+    def test_accepts_bio_at_max_length(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_maxbio")
+        resp = client.put("/api/profile/me", headers=headers, json={"bio": "x" * 500})
+        assert resp.status_code == 200, resp.text
+
+    def test_rejects_unknown_privacy_key(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_badprivkey")
+        resp = client.put("/api/profile/me", headers=headers, json={"privacy": {"nonsense_key": "public"}})
+        assert resp.status_code == 422
+
+    def test_rejects_invalid_privacy_value(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_badprivval")
+        resp = client.put("/api/profile/me", headers=headers, json={"privacy": {"profile_visibility": "nope"}})
+        assert resp.status_code == 422
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        resp = client.put("/api/profile/me", json={"bio": "x"})
+        assert resp.status_code == 401
+
+
+class TestFavorites:
+    def test_new_user_has_no_favorites(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_default")
+        resp = client.get("/api/profile/me/favorites", headers=headers)
+        assert resp.status_code == 200
+        assert resp.json() == {"world_ids": []}
+
+    def test_replace_then_read_back(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_save")
+        w1 = _make_world(client, headers, "W1")
+        w2 = _make_world(client, headers, "W2")
+
+        put = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w1, w2]})
+        assert put.status_code == 200, put.text
+        assert set(put.json()["world_ids"]) == {w1, w2}
+
+        got = client.get("/api/profile/me/favorites", headers=headers)
+        assert set(got.json()["world_ids"]) == {w1, w2}
+
+    def test_replace_is_a_full_replace_not_append(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_replace")
+        w1 = _make_world(client, headers, "W1")
+        w2 = _make_world(client, headers, "W2")
+
+        client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w1]})
+        second = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w2]})
+        assert second.json()["world_ids"] == [w2]
+
+        got = client.get("/api/profile/me/favorites", headers=headers)
+        assert got.json()["world_ids"] == [w2]
+
+    def test_replace_with_empty_list_clears_favorites(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_clear")
+        w1 = _make_world(client, headers, "W1")
+        client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w1]})
+        cleared = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": []})
+        assert cleared.status_code == 200
+        assert cleared.json() == {"world_ids": []}
+
+    def test_rejects_nonexistent_world_id(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_badworld")
+        resp = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [999999]})
+        assert resp.status_code == 422
+
+    def test_rejects_nonexistent_world_id_mixed_with_valid(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_mixed")
+        w1 = _make_world(client, headers, "W1")
+        resp = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w1, 999999]})
+        assert resp.status_code == 422
+        # nothing partially applied
+        got = client.get("/api/profile/me/favorites", headers=headers)
+        assert got.json()["world_ids"] == []
+
+    def test_favorites_isolated_per_user(self):
+        client = TestClient(app)
+        headers_a = _auth_headers(client, "fav_owner")
+        headers_b = _auth_headers(client, "fav_other")
+        w1 = _make_world(client, headers_a, "W1")
+
+        client.put("/api/profile/me/favorites", headers=headers_a, json={"world_ids": [w1]})
+        got_b = client.get("/api/profile/me/favorites", headers=headers_b)
+        assert got_b.json()["world_ids"] == []
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        assert client.get("/api/profile/me/favorites").status_code == 401
+        assert client.put("/api/profile/me/favorites", json={"world_ids": []}).status_code == 401