fix(speaker): let an enrolment name its own tenant again

The previous commit made the tenant a pure lookup on speakers.user_id, which
is right for a speaker that exists and wrong for /enroll/upload and
/enroll/batch, whose whole job is to create one. Enrolment started returning
404 "Speaker not found" for every new speaker.

The record still wins whenever there is one — an imported or re-owned speaker
keeps an id whose prefix disagrees with its column. Only when no such speaker
exists is the id's `user_{user_id}_...` prefix read, because that is currently
how a caller states the tenant on create.

That remains the weak contract the audit objects to. Retiring it means an
explicit user_id on the three enrol endpoints and on every caller: Chronicle's
speaker client, the speaker WebUI's Enrollment and Annotation pages, and
enroll_speaker.py / laptop_client.py. Left as its own change rather than
folded in here untested.

Author: AnkushMalaker

extras/speaker-recognition/src/simple_speaker_recognition/api/core/utils.py

@@ -106,30 +106,48 @@ def secure_temp_file(suffix: str = ".wav") -> tempfile._TemporaryFileWrapper:
 
 
 def extract_user_id_from_speaker_id(speaker_id: str) -> str:
-    """Return the tenant that owns ``speaker_id``, read from the speaker row.
-
-    Deliberately a lookup rather than a parse. The id is *conventionally*
-    ``user_{user_id}_speaker_{hex}``, but that convention is not the ownership
-    record — the ``speakers.user_id`` column is, and it stays right when a speaker is
-    imported, renamed, or created by a client that formats ids differently. The old
-    ``int(speaker_id.split("_")[1])`` also stopped working the moment a tenant became
-    a Chronicle ObjectId, which is not an integer.
+    """Return the tenant for ``speaker_id``: its recorded owner, else the id's prefix.
+
+    The stored ``speakers.user_id`` is the ownership record and wins whenever the
+    speaker exists — it stays right for a speaker that was imported, renamed, or
+    created by a client that formats ids differently, none of which the id convention
+    survives.
+
+    The convention ``user_{user_id}_speaker_{...}`` is only consulted when no such
+    speaker exists yet, because enrolment *creates* one and the id is currently how
+    the caller states the tenant. That is a weak contract and the reason the audit
+    says a tenant should not be inferred from a SpeakerId; removing it needs an
+    explicit ``user_id`` on /enroll/upload, /enroll/batch and /enroll/append and on
+    each of their callers (Chronicle's client, the speaker WebUI, and two scripts).
+
+    Returns a string either way. It used to return ``int(parts[1])``, which stopped
+    parsing the moment a tenant became a Chronicle ObjectId.
     """
 
-    # Imported here to avoid a circular import: database.queries imports the API
-    # models that this utils module is itself imported by.
+    # Imported here rather than at module scope: database.queries imports the API
+    # models that this module is itself imported by.
     from simple_speaker_recognition.database import get_db_session
     from simple_speaker_recognition.database.models import Speaker
 
     db = get_db_session()
     try:
         speaker = db.query(Speaker).filter(Speaker.id == speaker_id).first()
-        if speaker is None:
-            raise HTTPException(404, f"Speaker not found: {speaker_id}")
-        return str(speaker.user_id)
+        if speaker is not None:
+            return str(speaker.user_id)
     finally:
         db.close()
 
+    if not speaker_id.startswith("user_"):
+        raise HTTPException(
+            400,
+            "Unknown speaker and unrecognised id: expected "
+            f"'user_{{user_id}}_...', got: {speaker_id}",
+        )
+    parts = speaker_id.split("_")
+    if len(parts) < 3 or not parts[1]:
+        raise HTTPException(400, f"Cannot determine the owning user from: {speaker_id}")
+    return parts[1]
+
 
 def validate_confidence(confidence: Any, context: str = "") -> float:
     """Validate and sanitize confidence values from speaker identification.

extras/speaker-recognition/tests/test_tenant_isolation.py

@@ -18,6 +18,8 @@
 from sqlalchemy import create_engine
 from sqlalchemy.orm import sessionmaker
 
+from simple_speaker_recognition import database
+from simple_speaker_recognition.api.core import utils
 from simple_speaker_recognition.core import unified_speaker_db
 from simple_speaker_recognition.core.unified_speaker_db import UnifiedSpeakerDB
 from simple_speaker_recognition.database import Base
@@ -152,3 +154,27 @@ def test_two_tenants_coexist_on_a_cold_database(tmp_path):
     assert sorted(u.id for u in UserQueries.get_all_users(session)) == sorted(
         [ALICE, BOB]
     )
+
+
+def test_the_owning_tenant_comes_from_the_record_not_the_id(tmp_path, monkeypatch):
+    """A stored owner beats the id convention, which can disagree with it.
+
+    Enrolment creates the speaker, so on that path the id is the only statement of
+    the tenant and is honoured. Once a row exists the column is authoritative — an
+    imported or re-owned speaker keeps an id whose prefix is simply wrong.
+    """
+
+    engine = create_engine(f"sqlite:///{tmp_path/'owners.db'}")
+    Base.metadata.create_all(engine)
+    factory = sessionmaker(bind=engine)
+    monkeypatch.setattr(database, "get_db_session", factory, raising=False)
+
+    session = factory()
+    UserQueries.get_or_create_user(session, ALICE)
+    session.add(Speaker(id="user_1_legacy", name="Imported", user_id=ALICE))
+    session.commit()
+
+    # The id says tenant "1"; the record says ALICE. The record wins.
+    assert utils.extract_user_id_from_speaker_id("user_1_legacy") == ALICE
+    # An unknown speaker is being created, so its id states the tenant.
+    assert utils.extract_user_id_from_speaker_id(f"user_{ALICE}_speaker_ab12") == ALICE