diff --git a/frontends/nextjs/src/lib/db/auth/get-user-by-username.test.ts b/frontends/nextjs/src/lib/db/auth/get-user-by-username.test.ts
new file mode 100644
index 000000000..ca0bf022d
--- /dev/null
+++ b/frontends/nextjs/src/lib/db/auth/get-user-by-username.test.ts
@@ -0,0 +1,63 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const mockFindFirst = vi.fn()
+const mockAdapter = { findFirst: mockFindFirst }
+
+vi.mock('../dbal-client', () => ({
+  getAdapter: () => mockAdapter,
+}))
+
+import { getUserByUsername } from './get-user-by-username'
+
+describe('getUserByUsername', () => {
+  beforeEach(() => {
+    mockFindFirst.mockReset()
+  })
+
+  it('returns null when user not found', async () => {
+    mockFindFirst.mockResolvedValue(null)
+
+    const result = await getUserByUsername('missing')
+
+    expect(mockFindFirst).toHaveBeenCalledWith('User', { where: { username: 'missing' } })
+    expect(result).toBeNull()
+  })
+
+  it('returns user when found', async () => {
+    mockFindFirst.mockResolvedValue({
+      id: 'user_1',
+      username: 'alice',
+      email: 'alice@example.com',
+      role: 'admin',
+      profilePicture: null,
+      bio: 'Bio',
+      createdAt: BigInt(1000),
+      tenantId: null,
+      isInstanceOwner: false,
+    })
+
+    const result = await getUserByUsername('alice')
+
+    expect(result).toEqual({
+      id: 'user_1',
+      username: 'alice',
+      email: 'alice@example.com',
+      role: 'admin',
+      profilePicture: undefined,
+      bio: 'Bio',
+      createdAt: 1000,
+      tenantId: undefined,
+      isInstanceOwner: false,
+    })
+  })
+
+  it('includes tenant filter when provided', async () => {
+    mockFindFirst.mockResolvedValue(null)
+
+    await getUserByUsername('alice', { tenantId: 'tenant_1' })
+
+    expect(mockFindFirst).toHaveBeenCalledWith('User', {
+      where: { username: 'alice', tenantId: 'tenant_1' },
+    })
+  })
+})