diff --git a/apps/web/src/api/auth.test.ts b/apps/web/src/api/auth.test.ts
new file mode 100644
index 000000000..6af5fd15b
--- /dev/null
+++ b/apps/web/src/api/auth.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest';
+import { normalizeUser } from './auth';
+
+describe('normalizeUser', () => {
+  it('normalizes canonical API current-user fields', () => {
+    expect(
+      normalizeUser({
+        user_id: 'user-1',
+        email: 'user@example.com',
+        username: 'user',
+        display_name: 'User',
+        email_verified: true,
+      })
+    ).toEqual({
+      id: 'user-1',
+      user_id: 'user-1',
+      email: 'user@example.com',
+      username: 'user',
+      display_name: 'User',
+      is_email_verified: true,
+      email_verified: true,
+      created_at: undefined,
+    });
+  });
+
+  it('keeps compatibility with legacy UI-shaped user fields', () => {
+    expect(
+      normalizeUser({
+        id: 'user-2',
+        email: 'legacy@example.com',
+        username: 'legacy',
+        display_name: 'Legacy',
+        is_email_verified: false,
+        created_at: '2026-06-22T00:00:00Z',
+      })
+    ).toEqual({
+      id: 'user-2',
+      user_id: 'user-2',
+      email: 'legacy@example.com',
+      username: 'legacy',
+      display_name: 'Legacy',
+      is_email_verified: false,
+      email_verified: false,
+      created_at: '2026-06-22T00:00:00Z',
+    });
+  });
+});
diff --git a/apps/web/src/api/auth.ts b/apps/web/src/api/auth.ts
index be2e931f7..00e6774bc 100644
--- a/apps/web/src/api/auth.ts
+++ b/apps/web/src/api/auth.ts
@@ -38,7 +38,7 @@ export interface User {
   created_at?: string;
 }
 
-interface UserResponse {
+export interface UserResponse {
   id?: string;
   user_id?: string;
   email: string;
@@ -49,7 +49,7 @@ interface UserResponse {
   created_at?: string;
 }
 
-const normalizeUser = (data: UserResponse): User => {
+export const normalizeUser = (data: UserResponse): User => {
   const userId = data.id ?? data.user_id ?? '';
   const emailVerified = data.is_email_verified ?? data.email_verified ?? false;