shemaobt
diff --git a/‎alembic/versions/20260608_0001_as_language_members_and_indexes.py‎
Lines changed: 144 additions & 0 deletions b/‎alembic/versions/20260608_0001_as_language_members_and_indexes.py‎
Lines changed: 144 additions & 0 deletions
diff --git a/‎app/api/annotation_studio/__init__.py‎
Lines changed: 2 additions & 1 deletion b/‎app/api/annotation_studio/__init__.py‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎app/api/annotation_studio/audio.py‎
Lines changed: 10 additions & 4 deletions b/‎app/api/annotation_studio/audio.py‎
Lines changed: 10 additions & 4 deletions
diff --git a/‎app/api/annotation_studio/export.py‎
Lines changed: 15 additions & 6 deletions b/‎app/api/annotation_studio/export.py‎
Lines changed: 15 additions & 6 deletions
diff --git a/‎app/api/annotation_studio/languages.py‎
Lines changed: 3 additions & 3 deletions b/‎app/api/annotation_studio/languages.py‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎app/api/annotation_studio/members.py‎
Lines changed: 49 additions & 0 deletions b/‎app/api/annotation_studio/members.py‎
Lines changed: 49 additions & 0 deletions
diff --git a/‎app/api/annotation_studio/results.py‎
Lines changed: 8 additions & 4 deletions b/‎app/api/annotation_studio/results.py‎
Lines changed: 8 additions & 4 deletions
diff --git a/‎app/api/annotation_studio/speakers.py‎
Lines changed: 13 additions & 5 deletions b/‎app/api/annotation_studio/speakers.py‎
Lines changed: 13 additions & 5 deletions
@@ -0,0 +1,144 @@
+"""annotation-studio: per-language membership + upload_status indexes
+
+Adds ``as_language_members`` (scopes facilitators to specific languages) and
+composite indexes on the recording/clip ``upload_status`` filters used by
+readiness and export. Seeds memberships so every existing annotation-studio user
+keeps access to every currently-active language (no lockout on deploy).
+
+Revision ID: 20260608_0001
+Revises: 20260603_0001
+Create Date: 2026-06-08 12:00:00.000000
+"""
+from __future__ import annotations
+
+import uuid
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision: str = "20260608_0001"
+down_revision: str | None = "20260603_0001"
+branch_labels = None
+depends_on = None
+
+AS_APP_KEY = "annotation-studio"
+_ACTIVE_DATA_TABLES = (
+    "as_speakers",
+    "as_tier_a_words",
+    "as_tier_b_pairs",
+    "as_tier_c_clips",
+    "as_exports",
+    "as_analysis_results",
+)
+
+
+def upgrade() -> None:
+    op.create_table(
+        "as_language_members",
+        sa.Column("id", sa.String(length=36), nullable=False),
+        sa.Column("language_id", sa.String(length=36), nullable=False),
+        sa.Column("user_id", sa.String(length=36), nullable=False),
+        sa.Column("granted_by", sa.String(length=36), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=False,
+        ),
+        sa.ForeignKeyConstraint(["language_id"], ["languages.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["granted_by"], ["users.id"], ondelete="SET NULL"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("language_id", "user_id", name="uq_as_language_member"),
+    )
+    op.create_index(
+        op.f("ix_as_language_members_language_id"),
+        "as_language_members",
+        ["language_id"],
+        unique=False,
+    )
+    op.create_index(
+        op.f("ix_as_language_members_user_id"),
+        "as_language_members",
+        ["user_id"],
+        unique=False,
+    )
+
+    # Composite indexes aligned with readiness/export filters (FK + upload_status).
+    op.create_index(
+        "ix_as_tier_a_recordings_word_status",
+        "as_tier_a_recordings",
+        ["word_id", "upload_status"],
+        unique=False,
+    )
+    op.create_index(
+        "ix_as_tier_b_recordings_pair_status",
+        "as_tier_b_recordings",
+        ["pair_id", "upload_status"],
+        unique=False,
+    )
+    op.create_index(
+        "ix_as_tier_c_clips_language_status",
+        "as_tier_c_clips",
+        ["language_id", "upload_status"],
+        unique=False,
+    )
+
+    _seed_existing_members()
+
+
+def _seed_existing_members() -> None:
+    """Grant every current annotation-studio user access to every active language.
+
+    Prevents a deploy from locking facilitators out of languages they were already
+    working on. Admins bypass membership, so seeding them is harmless.
+    """
+    bind = op.get_bind()
+    app_id = bind.execute(
+        sa.text("SELECT id FROM apps WHERE app_key = :app_key"),
+        {"app_key": AS_APP_KEY},
+    ).scalar()
+    if app_id is None:
+        return
+
+    user_ids = [
+        row[0]
+        for row in bind.execute(
+            sa.text(
+                "SELECT DISTINCT user_id FROM user_app_roles "
+                "WHERE app_id = :app_id AND revoked_at IS NULL"
+            ),
+            {"app_id": app_id},
+        ).all()
+    ]
+    if not user_ids:
+        return
+
+    language_ids: set[str] = set()
+    for table in _ACTIVE_DATA_TABLES:
+        for row in bind.execute(sa.text(f"SELECT DISTINCT language_id FROM {table}")).all():
+            if row[0] is not None:
+                language_ids.add(row[0])
+    if not language_ids:
+        return
+
+    insert = sa.text(
+        "INSERT INTO as_language_members (id, language_id, user_id) "
+        "VALUES (:id, :language_id, :user_id)"
+    )
+    for user_id in user_ids:
+        for language_id in language_ids:
+            bind.execute(
+                insert,
+                {"id": str(uuid.uuid4()), "language_id": language_id, "user_id": user_id},
+            )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_as_tier_c_clips_language_status", table_name="as_tier_c_clips")
+    op.drop_index("ix_as_tier_b_recordings_pair_status", table_name="as_tier_b_recordings")
+    op.drop_index("ix_as_tier_a_recordings_word_status", table_name="as_tier_a_recordings")
+    op.drop_index(op.f("ix_as_language_members_user_id"), table_name="as_language_members")
+    op.drop_index(op.f("ix_as_language_members_language_id"), table_name="as_language_members")
+    op.drop_table("as_language_members")
@@ -4,6 +4,7 @@
     audio,
     export,
     languages,
+    members,
     results,
     speakers,
     tier_a,
@@ -13,6 +14,6 @@
 
 router = APIRouter()
 
-for _sub in (languages, speakers, tier_a, tier_b, tier_c, export, results, audio):
+for _sub in (languages, members, speakers, tier_a, tier_b, tier_c, export, results, audio):
     for route in _sub.router.routes:
         router.routes.append(route)
@@ -1,12 +1,18 @@
 from fastapi import APIRouter
 
-from app.api.annotation_studio._deps import CurrentUser
-from app.services.annotation_studio import storage
+from app.api.annotation_studio._deps import CurrentUser, Db
+from app.services.annotation_studio import access, storage
 
 router = APIRouter()
 
 
 @router.get("/audio/url")
-async def audio_url(key: str, _: CurrentUser) -> dict[str, str]:
-    """A short-lived signed GET URL for client-side playback of a stored object."""
+async def audio_url(key: str, db: Db, user: CurrentUser) -> dict[str, str]:
+    """A short-lived signed GET URL for client-side playback of a stored object.
+
+    The key must belong to an annotation-studio resource in a language the user
+    can access — this blocks presigning arbitrary keys in the shared bucket.
+    """
+    language_id = await access.language_id_for_storage_key(db, key)
+    await access.assert_language_access(db, user, language_id)
     return {"url": storage.presign_get(key)}
@@ -6,7 +6,7 @@
 from app.api.annotation_studio._deps import CurrentUser, Db
 from app.core.exceptions import NotFoundError
 from app.models.annotation_studio import ExportDetail, ExportResponse
-from app.services.annotation_studio import export_service, readiness_service
+from app.services.annotation_studio import access, export_service, readiness_service
 
 router = APIRouter()
 
@@ -17,18 +17,22 @@
     status_code=status.HTTP_201_CREATED,
 )
 async def build_export(language_id: str, db: Db, user: CurrentUser) -> ExportResponse:
+    await access.assert_language_access(db, user, language_id)
     export = await export_service.build_export(db, language_id, user.id)
     return ExportResponse.model_validate(export)
 
 
 @router.get("/languages/{language_id}/exports", response_model=list[ExportResponse])
-async def list_exports(language_id: str, db: Db, _: CurrentUser) -> list[ExportResponse]:
+async def list_exports(language_id: str, db: Db, user: CurrentUser) -> list[ExportResponse]:
+    await access.assert_language_access(db, user, language_id)
     exports = await export_service.list_exports(db, language_id)
     return [ExportResponse.model_validate(e) for e in exports]
 
 
 @router.get("/exports/{export_id}", response_model=ExportDetail)
-async def export_detail(export_id: str, db: Db, _: CurrentUser) -> ExportDetail:
+async def export_detail(export_id: str, db: Db, user: CurrentUser) -> ExportDetail:
+    language_id = await access.language_id_for_export(db, export_id)
+    await access.assert_language_access(db, user, language_id)
     export = await export_service.get_export(db, export_id)
     detail = ExportDetail.model_validate(export)
     detail.manifest = json.loads(export.manifest_json) if export.manifest_json else None
@@ -39,18 +43,23 @@ async def export_detail(export_id: str, db: Db, _: CurrentUser) -> ExportDetail:
 
 
 @router.delete("/exports/{export_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_export(export_id: str, db: Db, _: CurrentUser) -> None:
+async def delete_export(export_id: str, db: Db, user: CurrentUser) -> None:
+    language_id = await access.language_id_for_export(db, export_id)
+    await access.assert_language_access(db, user, language_id)
     await export_service.delete_export(db, export_id)
 
 
 @router.get("/exports/{export_id}/download")
-async def download_export(export_id: str, db: Db, _: CurrentUser) -> RedirectResponse:
+async def download_export(export_id: str, db: Db, user: CurrentUser) -> RedirectResponse:
+    language_id = await access.language_id_for_export(db, export_id)
+    await access.assert_language_access(db, user, language_id)
     url = await export_service.download_url(db, export_id)
     if not url:
         raise NotFoundError("Export bundle is not ready")
     return RedirectResponse(url=url)
 
 
 @router.get("/languages/{language_id}/readiness")
-async def readiness(language_id: str, db: Db, _: CurrentUser) -> dict:
+async def readiness(language_id: str, db: Db, user: CurrentUser) -> dict:
+    await access.assert_language_access(db, user, language_id)
     return await readiness_service.compute_readiness(db, language_id)
@@ -8,6 +8,6 @@
 
 
 @router.get("/languages", response_model=list[AsLanguageSummary])
-async def list_active_languages(db: Db, _: CurrentUser) -> list[AsLanguageSummary]:
-    """Tripod languages that have studio data, each with collection readiness."""
-    return await dashboard_service.list_active_languages(db)
+async def list_active_languages(db: Db, user: CurrentUser) -> list[AsLanguageSummary]:
+    """Tripod languages the user may access that have studio data, with readiness."""
+    return await dashboard_service.list_active_languages(db, user)
@@ -0,0 +1,49 @@
+from fastapi import APIRouter, status
+
+from app.api.annotation_studio._deps import AdminUser, Db
+from app.models.annotation_studio import LanguageMemberCreate, LanguageMemberResponse
+from app.services.annotation_studio import member_service
+
+router = APIRouter()
+
+
+@router.get(
+    "/languages/{language_id}/members",
+    response_model=list[LanguageMemberResponse],
+)
+async def list_members(language_id: str, db: Db, _: AdminUser) -> list[LanguageMemberResponse]:
+    rows = await member_service.list_members(db, language_id)
+    return [
+        LanguageMemberResponse(
+            user_id=user.id,
+            email=user.email,
+            display_name=user.display_name,
+            created_at=member.created_at,
+        )
+        for member, user in rows
+    ]
+
+
+@router.post(
+    "/languages/{language_id}/members",
+    response_model=LanguageMemberResponse,
+    status_code=status.HTTP_201_CREATED,
+)
+async def add_member(
+    language_id: str, payload: LanguageMemberCreate, db: Db, admin: AdminUser
+) -> LanguageMemberResponse:
+    member, user = await member_service.add_member(db, language_id, payload.email, admin.id)
+    return LanguageMemberResponse(
+        user_id=user.id,
+        email=user.email,
+        display_name=user.display_name,
+        created_at=member.created_at,
+    )
+
+
+@router.delete(
+    "/languages/{language_id}/members/{user_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+)
+async def remove_member(language_id: str, user_id: str, db: Db, _: AdminUser) -> None:
+    await member_service.remove_member(db, language_id, user_id)
@@ -8,7 +8,7 @@
     ResultCreate,
     ResultResponse,
 )
-from app.services.annotation_studio import results_service
+from app.services.annotation_studio import access, results_service
 
 router = APIRouter()
 
@@ -31,24 +31,28 @@ def _to_response(result: AsAnalysisResult, plots: dict[str, str]) -> ResultRespo
     status_code=status.HTTP_201_CREATED,
 )
 async def create_result(
-    language_id: str, payload: ResultCreate, db: Db, _: CurrentUser
+    language_id: str, payload: ResultCreate, db: Db, user: CurrentUser
 ) -> ResultResponse:
+    await access.assert_language_access(db, user, language_id)
     result = await results_service.create_result(
         db, language_id, payload.results_json, payload.export_id
     )
     return _to_response(result, {})
 
 
 @router.get("/languages/{language_id}/results", response_model=list[ResultResponse])
-async def list_results(language_id: str, db: Db, _: CurrentUser) -> list[ResultResponse]:
+async def list_results(language_id: str, db: Db, user: CurrentUser) -> list[ResultResponse]:
+    await access.assert_language_access(db, user, language_id)
     results = await results_service.list_results(db, language_id)
     return [_to_response(r, results_service.plot_urls(r)) for r in results]
 
 
 @router.post("/results/{result_id}/plots", response_model=PlotPresignResponse)
 async def presign_plot(
-    result_id: str, payload: PlotPresignRequest, db: Db, _: CurrentUser
+    result_id: str, payload: PlotPresignRequest, db: Db, user: CurrentUser
 ) -> PlotPresignResponse:
+    language_id = await access.language_id_for_result(db, result_id)
+    await access.assert_language_access(db, user, language_id)
     presigned = await results_service.presign_plot(
         db, result_id, payload.name, payload.content_type
     )
 
@@ -2,13 +2,14 @@
 
 from app.api.annotation_studio._deps import CurrentUser, Db
 from app.models.annotation_studio import SpeakerCreate, SpeakerResponse, SpeakerUpdate
-from app.services.annotation_studio import speaker_service
+from app.services.annotation_studio import access, speaker_service
 
 router = APIRouter()
 
 
 @router.get("/languages/{language_id}/speakers", response_model=list[SpeakerResponse])
-async def list_speakers(language_id: str, db: Db, _: CurrentUser) -> list[SpeakerResponse]:
+async def list_speakers(language_id: str, db: Db, user: CurrentUser) -> list[SpeakerResponse]:
+    await access.assert_language_access(db, user, language_id)
     speakers = await speaker_service.list_speakers(db, language_id)
     return [SpeakerResponse.model_validate(s) for s in speakers]
 
@@ -19,8 +20,9 @@ async def list_speakers(language_id: str, db: Db, _: CurrentUser) -> list[Speake
     status_code=status.HTTP_201_CREATED,
 )
 async def create_speaker(
-    language_id: str, payload: SpeakerCreate, db: Db, _: CurrentUser
+    language_id: str, payload: SpeakerCreate, db: Db, user: CurrentUser
 ) -> SpeakerResponse:
+    await access.assert_language_access(db, user, language_id)
     speaker = await speaker_service.create_speaker(
         db, language_id, payload.label, payload.display_name
     )
@@ -29,12 +31,18 @@ async def create_speaker(
 
 @router.patch("/speakers/{speaker_id}", response_model=SpeakerResponse)
 async def update_speaker(
-    speaker_id: str, payload: SpeakerUpdate, db: Db, _: CurrentUser
+    speaker_id: str, payload: SpeakerUpdate, db: Db, user: CurrentUser
 ) -> SpeakerResponse:
+    await access.assert_language_access(
+        db, user, await access.language_id_for_speaker(db, speaker_id)
+    )
     speaker = await speaker_service.update_speaker(db, speaker_id, payload.display_name)
     return SpeakerResponse.model_validate(speaker)
 
 
 @router.delete("/speakers/{speaker_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_speaker(speaker_id: str, db: Db, _: CurrentUser) -> None:
+async def delete_speaker(speaker_id: str, db: Db, user: CurrentUser) -> None:
+    await access.assert_language_access(
+        db, user, await access.language_id_for_speaker(db, speaker_id)
+    )
     await speaker_service.delete_speaker(db, speaker_id)