feat: добавил отображение аватарки

backend/UniVerse.Api.Tests/Auth/AuthServiceTests.cs

@@ -91,6 +91,7 @@ public class AuthServiceTests
         var user = await db.Users.Include(u => u.TeacherProfile).SingleAsync();
         Assert.Equal("sso-sub-1", user.MicrosoftId);
         Assert.Equal("person-1", user.TeacherProfile?.ModeusId);
+        await microsoftAuth.Received(1).SaveTokenCacheAsync(10, Arg.Any<MicrosoftTokenResult>(), Arg.Any<CancellationToken>());
     }
 
     private static AppDbContext CreateDbContext()

backend/UniVerse.Api.Tests/Auth/EntraTokenCacheStoreTests.cs

@@ -0,0 +1,40 @@
+using System.Security.Cryptography;
+using Microsoft.Extensions.Configuration;
+using UniVerse.Infrastructure.ExternalServices;
+using Xunit;
+
+namespace UniVerse.Api.Tests.Auth;
+
+public class EntraTokenCacheStoreTests
+{
+    [Fact]
+    public async Task SaveReadRemove_EncryptsTokensAndRestoresAfterNewStoreInstance()
+    {
+        var directory = Path.Combine(Path.GetTempPath(), $"universe-cache-test-{Guid.NewGuid():N}");
+        try
+        {
+            var configuration = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["AzureAd:TokenCacheDirectory"] = directory,
+                ["AzureAd:TokenCacheKey"] = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32))
+            }).Build();
+            var store = new EntraTokenCacheStore(configuration);
+            var tokens = System.Text.Encoding.UTF8.GetBytes("sensitive-refresh-token");
+
+            await store.SaveAsync(7, "account-7", tokens, CancellationToken.None);
+
+            var file = File.ReadAllBytes(Path.Combine(directory, "user-7.bin"));
+            Assert.DoesNotContain("sensitive-refresh-token", System.Text.Encoding.UTF8.GetString(file));
+            var restored = await new EntraTokenCacheStore(configuration).ReadAsync(7, CancellationToken.None);
+            Assert.Equal("account-7", restored?.AccountId);
+            Assert.Equal(tokens, restored?.Cache);
+
+            await store.RemoveAsync(7);
+            Assert.Null(await store.ReadAsync(7, CancellationToken.None));
+        }
+        finally
+        {
+            if (Directory.Exists(directory)) Directory.Delete(directory, true);
+        }
+    }
+}

backend/UniVerse.Api.Tests/Auth/ProfilePhotoControllerTests.cs

@@ -0,0 +1,59 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using NSubstitute;
+using UniVerse.Api.Controllers;
+using UniVerse.Application.DTOs.Users;
+using UniVerse.Application.Interfaces;
+using UniVerse.Domain.Enums;
+using Xunit;
+
+namespace UniVerse.Api.Tests.Auth;
+
+public class ProfilePhotoControllerTests
+{
+    [Fact]
+    public async Task Get_UsesCurrentUserAndReturnsPhotoWithoutCaching()
+    {
+        var auth = Substitute.For<IAuthService>();
+        auth.GetCurrentUserAsync(7).Returns(new CurrentUserDto(
+            7, "user@sfedu.ru", "Test", null, [UserRole.Student], 0, 0, 1, DateTime.UtcNow));
+        var microsoft = Substitute.For<IMicrosoftAuthClient>();
+        microsoft.GetPhotoAsync(7, Arg.Any<CancellationToken>())
+            .Returns(new MicrosoftPhotoResult([1, 2, 3], "image/jpeg"));
+        var controller = CreateController(auth, microsoft, 7);
+
+        var result = await controller.Get(CancellationToken.None);
+
+        var file = Assert.IsType<FileContentResult>(result);
+        Assert.Equal([1, 2, 3], file.FileContents);
+        Assert.Equal("image/jpeg", file.ContentType);
+        Assert.Equal("private, no-store", controller.Response.Headers.CacheControl);
+        await microsoft.Received(1).GetPhotoAsync(7, Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Get_ReturnsNotFoundWhenPhotoIsUnavailable()
+    {
+        var auth = Substitute.For<IAuthService>();
+        auth.GetCurrentUserAsync(7).Returns(new CurrentUserDto(
+            7, "user@sfedu.ru", "Test", null, [UserRole.Student], 0, 0, 1, DateTime.UtcNow));
+        var controller = CreateController(auth, Substitute.For<IMicrosoftAuthClient>(), 7);
+
+        Assert.IsType<NotFoundResult>(await controller.Get(CancellationToken.None));
+    }
+
+    private static ProfilePhotoController CreateController(IAuthService auth, IMicrosoftAuthClient microsoft, int userId)
+    {
+        var controller = new ProfilePhotoController(auth, microsoft);
+        controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext
+            {
+                User = new ClaimsPrincipal(new ClaimsIdentity(
+                    [new Claim(ClaimTypes.NameIdentifier, userId.ToString())], "test"))
+            }
+        };
+        return controller;
+    }
+}

backend/UniVerse.Api.Tests/Authorization/EndpointAuthorizationTests.cs

@@ -43,6 +43,7 @@ public class EndpointAuthorizationTests : IClassFixture<ApiWebApplicationFactory
 
         // ── Users — current user ──────────────────────────────────────────────
         yield return E("users/me GET [AnyAuth]",           "GET",    "api/v1/users/me",       "Student");
+        yield return E("users/me/photo [AnyAuth]",        "GET",    "api/v1/users/me/photo", "Student");
         yield return E("users/me PUT [AnyAuth]",           "PUT",    "api/v1/users/me",       "Student",
             body: """{"displayName":"Test","avatarUrl":null}""");
         yield return E("users/me/stats [AnyAuth]",         "GET",    "api/v1/users/me/stats", "Student");