Complete training workflow and acceptance hardening

backend/app/db/repo.py

@@ -1,5 +1,6 @@
 """Доступ к журналу. Всё, что не записано сюда, для оценки не существует."""
 
+from collections.abc import Callable
 from datetime import datetime
 from uuid import UUID
 
@@ -8,6 +9,12 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.db.models import Group, HintUse, InstructorNote, Session, Trainee, Utterance
 
+BeforeSessionCommit = Callable[[AsyncSession, Session], None]
+
+
+class SessionNodeConflict(PermissionError):
+    """The session is routed to a backend other than its persisted owner."""
+
 
 async def next_attempt(db: AsyncSession, trainee_id: UUID | None, scenario_id: str) -> int:
     """Номер попытки по этому сценарию. Отдельной таблицы попыток нет:
@@ -31,11 +38,14 @@ async def create_session(
     group_id: UUID | None = None,
     session_id: UUID | None = None,
     owner_login: str | None = None,
+    backend_node_id: str | None = None,
+    before_commit: BeforeSessionCommit | None = None,
 ) -> Session:
     session = Session(
         scenario_id=scenario_id,
         mode=mode,
         owner_login=owner_login,
+        backend_node_id=backend_node_id,
         trainee_id=trainee_id,
         group_id=group_id,
         attempt=await next_attempt(db, trainee_id, scenario_id),
@@ -43,6 +53,9 @@ async def create_session(
     if session_id is not None:
         session.id = session_id
     db.add(session)
+    if before_commit is not None:
+        await db.flush()
+        before_commit(db, session)
     await db.commit()
     return session
 
@@ -57,24 +70,49 @@ async def ensure_session(
     trainee_id: UUID | None = None,
     group_name: str | None = None,
     owner_login: str | None = None,
+    backend_node_id: str | None = None,
+    before_commit: BeforeSessionCommit | None = None,
 ) -> Session:
     """Занятие, запущенное с пульта, должно иметь строку в журнале.
 
     Иначе реплики, подсказки и пометки не к чему привязать: они уходят
     в нарушение внешнего ключа, а профиль курсанта остаётся пустым.
     """
-    existing = await db.get(Session, session_id)
+    existing = await db.scalar(
+        select(Session)
+        .where(Session.id == session_id)
+        .with_for_update()
+    )
     if existing is not None:
         if existing.owner_login != owner_login:
             raise PermissionError("занятие принадлежит другому преподавателю")
+        if (
+            existing.backend_node_id is not None
+            and backend_node_id is not None
+            and existing.backend_node_id != backend_node_id
+        ):
+            raise SessionNodeConflict("занятие закреплено за другим backend-узлом")
+        changed = False
+        if existing.backend_node_id is None and backend_node_id is not None:
+            existing.backend_node_id = backend_node_id
+            changed = True
+        if before_commit is not None:
+            before_commit(db, existing)
+            await db.commit()
+        elif changed:
+            await db.commit()
         return existing
 
     group = await ensure_group(db, group_name, owner_login=owner_login) if group_name else None
     trainee = await db.get(Trainee, trainee_id) if trainee_id else None
     if trainee_id and trainee is None:
         raise ValueError(f"курсант {trainee_id} не найден")
+    if trainee is not None:
+        await _assert_trainee_scope(db, trainee, owner_login)
     if trainee is None and trainee_name:
-        trainee = await ensure_trainee(db, trainee_name, group)
+        trainee = await ensure_trainee(
+            db, trainee_name, group, owner_login=owner_login
+        )
     return await create_session(
         db,
         scenario_id=scenario_id,
@@ -83,6 +121,8 @@ async def ensure_session(
         group_id=group.id if group else trainee.group_id if trainee else None,
         session_id=session_id,
         owner_login=owner_login,
+        backend_node_id=backend_node_id,
+        before_commit=before_commit,
     )
 
 
@@ -164,23 +204,51 @@ async def history(
 
 
 async def ensure_group(
-    db: AsyncSession, name: str, *, owner_login: str | None = None
+    db: AsyncSession, name: str, *, owner_login: str | None = None, commit: bool = True
 ) -> Group:
     group = await db.scalar(select(Group).where(Group.name == name))
     if group is None:
         group = Group(name=name, owner_login=owner_login)
         db.add(group)
-        await db.commit()
+        if commit:
+            await db.commit()
+        else:
+            await db.flush()
     elif group.owner_login != owner_login:
         raise PermissionError("группа принадлежит другому преподавателю или администратору")
     return group
 
 
-async def ensure_trainee(db: AsyncSession, name: str, group: Group | None = None) -> Trainee:
+async def ensure_trainee(
+    db: AsyncSession,
+    name: str,
+    group: Group | None = None,
+    *,
+    owner_login: str | None = None,
+    commit: bool = True,
+) -> Trainee:
     query = select(Trainee).where(Trainee.name == name)
     trainee = await db.scalar(query)
     if trainee is None:
+        if group is not None and owner_login is not None and group.owner_login != owner_login:
+            raise PermissionError("курсант относится к другой группе")
         trainee = Trainee(name=name, group_id=group.id if group else None)
         db.add(trainee)
-        await db.commit()
+        if commit:
+            await db.commit()
+        else:
+            await db.flush()
+    else:
+        await _assert_trainee_scope(db, trainee, owner_login)
     return trainee
+
+
+async def _assert_trainee_scope(
+    db: AsyncSession, trainee: Trainee, owner_login: str | None
+) -> None:
+    """Prevent lesson creation from attaching a learner owned by another teacher."""
+    if owner_login is None or trainee.group_id is None:
+        return
+    group = await db.get(Group, trainee.group_id)
+    if group is None or group.owner_login != owner_login:
+        raise PermissionError("курсант относится к другой учебной группе")