privacy/security: add PM privacy levels and improve session visibility

tests/test_auth_flow.py

@@ -43,6 +43,15 @@ async def test_register_verify_login_and_me(client, db_session):
     assert me_data["email"] == "alice@example.com"
     assert me_data["email_verified"] is True
 
+    sessions_response = await client.get(
+        "/api/v1/auth/sessions",
+        headers={"Authorization": f"Bearer {token_data['access_token']}"},
+    )
+    assert sessions_response.status_code == 200
+    sessions = sessions_response.json()
+    assert len(sessions) >= 1
+    assert any(item.get("token_type") == "access" for item in sessions)
+
 
 async def test_refresh_token_rotation(client, db_session):
     payload = {

tests/test_chat_message_flow.py

@@ -59,3 +59,40 @@ async def test_private_chat_message_lifecycle(client, db_session):
         headers={"Authorization": f"Bearer {u1['access_token']}"},
     )
     assert delete_message_response.status_code == 204
+
+
+async def test_private_chat_respects_contacts_only_policy(client, db_session):
+    u1 = await _create_verified_user(client, db_session, "pm_u1@example.com", "pm_user_one", "strongpass123")
+    u2 = await _create_verified_user(client, db_session, "pm_u2@example.com", "pm_user_two", "strongpass123")
+
+    me_u1 = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {u1['access_token']}"})
+    me_u2 = await client.get("/api/v1/auth/me", headers={"Authorization": f"Bearer {u2['access_token']}"})
+    u1_id = me_u1.json()["id"]
+    u2_id = me_u2.json()["id"]
+
+    update_privacy = await client.put(
+        "/api/v1/users/profile",
+        headers={"Authorization": f"Bearer {u2['access_token']}"},
+        json={"privacy_private_messages": "contacts"},
+    )
+    assert update_privacy.status_code == 200
+
+    create_chat_blocked = await client.post(
+        "/api/v1/chats",
+        headers={"Authorization": f"Bearer {u1['access_token']}"},
+        json={"type": ChatType.PRIVATE.value, "title": None, "member_ids": [u2_id]},
+    )
+    assert create_chat_blocked.status_code == 403
+
+    add_contact = await client.post(
+        f"/api/v1/users/{u1_id}/contacts",
+        headers={"Authorization": f"Bearer {u2['access_token']}"},
+    )
+    assert add_contact.status_code == 204
+
+    create_chat_allowed = await client.post(
+        "/api/v1/chats",
+        headers={"Authorization": f"Bearer {u1['access_token']}"},
+        json={"type": ChatType.PRIVATE.value, "title": None, "member_ids": [u2_id]},
+    )
+    assert create_chat_allowed.status_code == 200