added a user system

sentence_api/tests/test_api.py

@@ -38,13 +38,20 @@ def make_client(tmp_path):
         legacy_boundaries_file=index_path,
     )
     settings.ensure_directories()
-    return TestClient(
+    client = TestClient(
         create_app(
             BoundaryStore(index_path),
             settings=settings,
             repository=VideoRepository(settings.database_path),
         )
     )
+    response = client.post(
+        "/api/v1/auth/register",
+        json={"username": "tester", "password": "password-123"},
+    )
+    assert response.status_code == 201, response.text
+    client.headers.update({"Authorization": f"Bearer {response.json()['token']}"})
+    return client
 
 
 def test_lookup_returns_boundaries(tmp_path):

sentence_api/tests/test_assessment_api.py

@@ -90,7 +90,14 @@ def make_client(tmp_path, client_api_key="", transcriber=None):
         repository=repository,
         transcriber=transcriber or FakeTranscriber(),
     )
-    return TestClient(app)
+    client = TestClient(app)
+    response = client.post(
+        "/api/v1/auth/register",
+        json={"username": "tester", "password": "password-123"},
+    )
+    assert response.status_code == 201, response.text
+    client.headers.update({"Authorization": f"Bearer {response.json()['token']}"})
+    return client
 
 
 def test_assessment_returns_duration_and_content_breakdown(tmp_path):
@@ -202,19 +209,59 @@ def test_create_dub_share_aligns_audio_with_whisper_boundaries(tmp_path):
     assert calls[0].read_bytes() == b"aligned-audio"
 
 
-def test_assessment_client_key_is_enforced_when_configured(tmp_path):
+def test_assessment_requires_a_valid_user_session(tmp_path):
     client = make_client(tmp_path, client_api_key="tablet-key")
     endpoint = f"/api/v1/videos/{VIDEO_HASH}/sentences/0/assessments"
+    client.headers.clear()
 
     unauthorized = client.post(
         endpoint,
         files={"audio": ("reading.wav", make_wav(), "audio/wav")},
     )
+    login = client.post(
+        "/api/v1/auth/login",
+        json={"username": "tester", "password": "password-123"},
+    )
+    assert login.status_code == 200
     authorized = client.post(
         endpoint,
-        headers={"X-Client-Key": "tablet-key"},
+        headers={"Authorization": f"Bearer {login.json()['token']}"},
         files={"audio": ("reading.wav", make_wav(), "audio/wav")},
     )
 
     assert unauthorized.status_code == 401
     assert authorized.status_code == 200
+
+
+def test_user_enrollment_results_and_dub_shares_are_scoped(tmp_path):
+    client = make_client(tmp_path)
+
+    assert client.get("/api/v1/courses").status_code == 200
+    assert client.post(f"/api/v1/courses/{VIDEO_HASH}/enroll").status_code == 204
+    courses = client.get("/api/v1/courses").json()
+    assert courses[0]["enrolled"] is True
+
+    assessed = client.post(
+        f"/api/v1/videos/{VIDEO_HASH}/sentences/0/assessments",
+        files={"audio": ("reading.wav", make_wav(), "audio/wav")},
+        data={"language": "en"},
+    )
+    assert assessed.status_code == 200
+    results = client.get("/api/v1/me/results").json()
+    assert len(results) == 1
+    assert results[0]["course_title"] == "Lesson"
+
+    shared = client.post(
+        "/api/v1/dub-shares",
+        data={
+            "video_hash": VIDEO_HASH,
+            "segments": json.dumps([{"sentence_index": 0}]),
+            "scores": json.dumps([{"sentence_index": 0, "overall_score": 88}]),
+        },
+        files={"files": ("dub.wav", make_wav(), "audio/wav")},
+    )
+    assert shared.status_code == 201, shared.text
+    shares = client.get("/api/v1/me/dub-shares").json()
+    assert len(shares) == 1
+    assert shares[0]["segment_count"] == 1
+    assert shares[0]["average_score"] == 88