fixed some bugs

sentence_api/tests/test_assessment_api.py

@@ -239,3 +239,68 @@ def test_user_enrollment_results_and_dub_shares_are_scoped(tmp_path):
     assert len(shares) == 1
     assert shares[0]["segment_count"] == 1
     assert shares[0]["average_score"] == 88
+
+
+def test_user_can_delete_owned_result_and_dub_share(tmp_path):
+    client = make_client(tmp_path)
+    assessed = client.post(
+        f"/api/v1/videos/{VIDEO_HASH}/sentences/0/assessments",
+        files={"audio": ("reading.wav", make_wav(), "audio/wav")},
+    )
+    attempt_id = client.get("/api/v1/me/results").json()[0]["attempt_id"]
+    shared = client.post(
+        "/api/v1/dub-shares",
+        data={
+            "video_hash": VIDEO_HASH,
+            "segments": json.dumps([{"sentence_index": 0}]),
+        },
+        files={"files": ("dub.wav", make_wav(), "audio/wav")},
+    )
+    share_id = shared.json()["share_id"]
+
+    deleted_result = client.delete(f"/api/v1/me/results/{attempt_id}")
+    deleted_share = client.delete(f"/api/v1/me/dub-shares/{share_id}")
+
+    assert assessed.status_code == 200
+    assert shared.status_code == 201
+    assert deleted_result.status_code == 204
+    assert deleted_share.status_code == 204
+    assert client.get("/api/v1/me/results").json() == []
+    assert client.get("/api/v1/me/dub-shares").json() == []
+    assert client.get(f"/api/v1/dub-shares/{share_id}").status_code == 404
+
+
+def test_user_cannot_delete_another_users_history(tmp_path):
+    client = make_client(tmp_path)
+    client.post(
+        f"/api/v1/videos/{VIDEO_HASH}/sentences/0/assessments",
+        files={"audio": ("reading.wav", make_wav(), "audio/wav")},
+    )
+    attempt_id = client.get("/api/v1/me/results").json()[0]["attempt_id"]
+    shared = client.post(
+        "/api/v1/dub-shares",
+        data={
+            "video_hash": VIDEO_HASH,
+            "segments": json.dumps([{"sentence_index": 0}]),
+        },
+        files={"files": ("dub.wav", make_wav(), "audio/wav")},
+    )
+    share_id = shared.json()["share_id"]
+
+    other = TestClient(create_app(
+        BoundaryStore(tmp_path / "legacy.json"),
+        settings=replace(
+            Settings.from_env(),
+            data_dir=tmp_path / "data",
+            legacy_boundaries_file=tmp_path / "legacy.json",
+        ),
+    ))
+    registered = other.post(
+        "/api/v1/auth/register",
+        json={"username": "other", "password": "password-123"},
+    )
+    other.headers.update({"Authorization": f"Bearer {registered.json()['token']}"})
+
+    assert registered.status_code == 201
+    assert other.delete(f"/api/v1/me/results/{attempt_id}").status_code == 404
+    assert other.delete(f"/api/v1/me/dub-shares/{share_id}").status_code == 404