Implement Google sign-in with Supabase and add related functionality

.env.example

@@ -8,3 +8,11 @@ SAWTAK_API_KEY=
 # Optional: a specific voice id from the Sawtak catalog.
 # Empty = the most liked ready Palestinian voice.
 SAWTAK_VOICE_ID=
+
+# Google sign-in through Supabase (Project Settings -> API Keys). Both values are public: the page gets them too.
+# Empty = no sign-in, the service is open. On Hugging Face these can be plain Space *variables*.
+SUPABASE_URL=
+SUPABASE_PUBLISHABLE_KEY=
+
+# Optional: the only Google accounts let in, separated by commas or spaces. Empty = any Google account.
+ALLOWED_EMAILS=

README.md

@@ -68,6 +68,41 @@ The teacher only needs that link. Free Spaces sleep after inactivity, so the fir
 
 `docker build -t ihki . && docker run -p 7860:7860 ihki` runs the same image anywhere.
 
+## Sign-in and progress (Supabase)
+
+Optional. With `SUPABASE_URL` and `SUPABASE_PUBLISHABLE_KEY` set, the page asks for a Google sign-in (through Supabase Auth) and the practice endpoints refuse calls without a session. `ALLOWED_EMAILS` limits entry to the listed accounts. Without the two values the service is open.
+
+Each scored recording is added to the table `attempts`, written with the student's own token so row-level security ties the row to them. Create it once in the Supabase SQL editor:
+
+```sql
+create table public.attempts (
+  id         bigint generated always as identity primary key,
+  user_id    uuid not null default auth.uid() references auth.users (id) on delete cascade,
+  cat        text not null,      -- the topic id, e.g. l1-verbs
+  phrase     text not null,      -- the Hebrew prompt
+  score      int  not null,      -- 0-100
+  unrelated  boolean not null default false,   -- "different sentence?"
+  created_at timestamptz not null default now()
+);
+create index attempts_user_time on public.attempts (user_id, created_at desc);
+
+alter table public.attempts enable row level security;
+grant select, insert on public.attempts to authenticated;
+create policy "students add their own attempts"  on public.attempts
+  for insert to authenticated with check (user_id = auth.uid());
+create policy "students read their own attempts" on public.attempts
+  for select to authenticated using (user_id = auth.uid());
+```
+
+The teacher's view, also in the SQL editor (it runs as the owner, so it sees every student):
+
+```sql
+select u.email, a.cat, count(distinct a.phrase) as phrases, count(*) as tries,
+       round(avg(a.score)) as average, max(a.created_at) as last_practice
+from public.attempts a join auth.users u on u.id = a.user_id
+group by u.email, a.cat order by u.email, a.cat;
+```
+
 ## Fine-tuning
 
 The base model was not trained on Palestinian Arabic, and it has heard few Hebrew-accented pharyngeals. Expect the zero-shot scores to be noisy until it is fine-tuned on matched data.

app/auth.py

@@ -0,0 +1,92 @@
+"""Sign-in: the page logs in with Google through Supabase and sends the session token with each call.
+
+The token is checked by asking Supabase who it belongs to (GET /auth/v1/user), so no signing key is
+kept here and a session revoked in Supabase stops working within CACHE_TTL.
+
+Progress: each scored recording is added to the Supabase table `attempts` with the student's own
+token, so row-level security ties the row to them (the table's SQL is in the README).
+
+Env:  SUPABASE_URL              (https://<project-ref>.supabase.co)
+      SUPABASE_PUBLISHABLE_KEY  (the publishable/anon key; it is public and also goes to the page)
+      ALLOWED_EMAILS            (optional: the only accounts let in, separated by commas or spaces)
+Without them the service is open, as before.
+"""
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import threading
+import time
+import urllib.error
+import urllib.request
+
+log = logging.getLogger("ihki.auth")
+TIMEOUT = 10
+CACHE_TTL = 300  # seconds a checked token is trusted without asking again
+CACHE_MAX = 2000
+
+
+class AuthUnavailable(RuntimeError):
+    pass
+
+
+class SupabaseAuth:
+    def __init__(self, url: str, key: str, allowed: frozenset[str] = frozenset()):
+        self.url, self.key = url.rstrip("/"), key
+        self.allowed = allowed  # lower-case emails; empty = every signed-in account
+        self._cache: dict[str, tuple[float, dict]] = {}
+        self._lock = threading.Lock()
+
+    def user(self, token: str) -> dict | None:
+        """The signed-in user of this access token ({"id", "email"}), or None when it is not valid."""
+        now = time.monotonic()
+        with self._lock:
+            hit = self._cache.get(token)
+        if hit and hit[0] > now:
+            return hit[1]
+        req = urllib.request.Request(
+            self.url + "/auth/v1/user",
+            headers={"Authorization": f"Bearer {token}", "apikey": self.key, "User-Agent": "ihki/1.0"},
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=TIMEOUT) as res:
+                data = json.load(res)
+        except urllib.error.HTTPError as e:
+            if e.code in (400, 401, 403):
+                return None
+            raise AuthUnavailable(f"supabase answered {e.code}") from e
+        except (urllib.error.URLError, TimeoutError, ValueError) as e:
+            raise AuthUnavailable(str(e)) from e
+        if not data.get("id"):
+            return None
+        user = {"id": data["id"], "email": data.get("email", "")}
+        with self._lock:
+            if len(self._cache) >= CACHE_MAX:
+                self._cache.clear()
+            self._cache[token] = (now + CACHE_TTL, user)
+        return user
+
+    def record(self, token: str, row: dict) -> None:
+        """Adds one row to `attempts` as the student of this token. A failure is logged, never raised."""
+        req = urllib.request.Request(
+            self.url + "/rest/v1/attempts", data=json.dumps(row).encode(), method="POST",
+            headers={"Authorization": f"Bearer {token}", "apikey": self.key, "Content-Type": "application/json",
+                     "Prefer": "return=minimal", "User-Agent": "ihki/1.0"},
+        )
+        try:
+            urllib.request.urlopen(req, timeout=TIMEOUT).close()
+        except (urllib.error.URLError, TimeoutError) as e:  # HTTPError is a URLError
+            log.warning("attempt not recorded: %s", e)
+
+
+def load_auth() -> SupabaseAuth | None:
+    url = os.environ.get("SUPABASE_URL", "").strip()
+    key = os.environ.get("SUPABASE_PUBLISHABLE_KEY", "").strip()
+    if not url or not key:
+        log.info("SUPABASE_URL / SUPABASE_PUBLISHABLE_KEY not set: no sign-in, the service is open")
+        return None
+    allowed = frozenset(re.split(r"[\s,;]+", os.environ.get("ALLOWED_EMAILS", "").strip().lower())) - {""}
+    log.info("sign-in on: %s", f"{len(allowed)} allowed accounts" if allowed else "any Google account")
+    return SupabaseAuth(url, key, allowed)

app/main.py

@@ -3,6 +3,7 @@
 Run:  uvicorn app.main:app --host 0.0.0.0 --port 7860
 Env:  MODEL_ID  (default facebook/wav2vec2-xlsr-53-espeak-cv-ft, or a path to a fine-tuned checkpoint)
       SAWTAK_API_KEY, SAWTAK_VOICE_ID  (model-answer playback, see app/tts.py)
+      SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, ALLOWED_EMAILS  (Google sign-in, see app/auth.py)
 A local .env file is loaded if present; real environment variables win over it.
 """
 from __future__ import annotations
@@ -17,10 +18,11 @@ from contextlib import asynccontextmanager
 from pathlib import Path
 
 from dotenv import load_dotenv
-from fastapi import FastAPI, File, Form, HTTPException, Query, UploadFile
+from fastapi import BackgroundTasks, Depends, FastAPI, File, Form, HTTPException, Query, Request, UploadFile
 from fastapi.responses import HTMLResponse, Response
 from fastapi.staticfiles import StaticFiles
 
+from .auth import AuthUnavailable, SupabaseAuth, load_auth
 from .phrases import CATEGORIES, LESSONS, PHRASES, public_phrases
 from .prompt_tts import ENGINES, PromptTTSUnavailable, hebrew_mp3
 from .reference import References
@@ -44,22 +46,51 @@ def build_version() -> str:
     return f"{h.hexdigest()[:7]} · {time.strftime('%Y-%m-%d %H:%M', time.gmtime(newest))} UTC"
 
 
-def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None) -> FastAPI:
+def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None,
+               auth: SupabaseAuth | None = None) -> FastAPI:
     @asynccontextmanager
     async def lifespan(app: FastAPI):
         app.state.scorer = scorer or load_scorer(MODEL_ID)
         app.state.tts = tts or load_tts()
         # the playback voices double as the native baseline of the scores (see reference.py)
         app.state.refs = References(app.state.scorer, app.state.tts, list(VOICES.values())) if app.state.tts else None
+        app.state.auth = auth or load_auth()
         yield
 
     app = FastAPI(title="ihki", lifespan=lifespan)
     app.mount("/static", StaticFiles(directory=STATIC), name="static")
 
+    def signed_in(request: Request) -> dict | None:
+        """The caller's user; 401 when sign-in is configured and the call carries no valid session token."""
+        a: SupabaseAuth | None = app.state.auth
+        if a is None:
+            return None
+        scheme, _, token = request.headers.get("authorization", "").partition(" ")
+        try:
+            user = a.user(token.strip()) if scheme.lower() == "bearer" and token.strip() else None
+        except AuthUnavailable as e:
+            raise HTTPException(503, f"sign-in check failed: {e}")
+        if user is None:
+            raise HTTPException(401, "sign in required")
+        if a.allowed and user["email"].lower() not in a.allowed:
+            raise HTTPException(403, "this account is not on the list")
+        return {**user, "token": token.strip()}
+
+    members = [Depends(signed_in)]
+
     @app.get("/")
     def index():
         html = (STATIC / "index.html").read_text(encoding="utf-8")
-        return HTMLResponse(html.replace("__VERSION__", build_version()), headers={"Cache-Control": "no-cache"})
+        a: SupabaseAuth | None = app.state.auth
+        for mark, value in (("__VERSION__", build_version()), ("__SUPABASE_URL__", a.url if a else ""),
+                            ("__SUPABASE_KEY__", a.key if a else "")):
+            html = html.replace(mark, value)
+        return HTMLResponse(html, headers={"Cache-Control": "no-cache"})
+
+    @app.get("/api/me")
+    def me(user: dict | None = Depends(signed_in)):
+        """Who is signed in; the page asks this right after sign-in to learn whether the account is let in."""
+        return {"email": user["email"] if user else ""}
 
     @app.get("/api/phrases")
     def phrases():
@@ -73,7 +104,7 @@ def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None) -> Fa
                 "references": app.state.refs is not None,
                 "phoneme_fallbacks": s.vocab.downgraded}
 
-    @app.get("/api/tts/{phrase_id}")
+    @app.get("/api/tts/{phrase_id}", dependencies=members)
     def tts_phrase(phrase_id: int, voice: str = Query("", max_length=64)):
         """The model answer (first variant) spoken by the TTS voice. 503 tells the page to use the device voice.
 
@@ -96,7 +127,7 @@ def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None) -> Fa
             "X-TTS-Voice-Id": urllib.parse.quote(used),
             "X-TTS-Voice-Name": urllib.parse.quote(names.get(used) or getattr(tts, "voice_name", ""))})
 
-    @app.get("/api/prompt-audio/{phrase_id}")
+    @app.get("/api/prompt-audio/{phrase_id}", dependencies=members)
     def prompt_audio(phrase_id: int, engine: str = "gtts"):
         """The Hebrew prompt read aloud (edge-tts or gTTS). 503 tells the page to stay silent."""
         if not 0 <= phrase_id < len(PHRASES):
@@ -111,7 +142,7 @@ def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None) -> Fa
         return Response(data, media_type="audio/mpeg", headers={
             "Cache-Control": "private, max-age=86400", "X-TTS-Engine": used})
 
-    @app.get("/api/say")
+    @app.get("/api/say", dependencies=members)
     def say(text: str = Query(..., min_length=1, max_length=400), engine: str = "gtts"):
         """A short Hebrew text read aloud: driving mode's spoken messages."""
         if engine not in ENGINES:
@@ -125,7 +156,8 @@ def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None) -> Fa
         return Response(data, media_type="audio/mpeg", headers={"Cache-Control": "no-store", "X-TTS-Engine": used})
 
     @app.post("/api/score")
-    def score(phrase_id: int = Form(...), audio: UploadFile = File(...)):
+    def score(tasks: BackgroundTasks, phrase_id: int = Form(...), audio: UploadFile = File(...),
+              user: dict | None = Depends(signed_in)):
         if not 0 <= phrase_id < len(PHRASES):
             raise HTTPException(404, "unknown phrase")
         data = audio.file.read(MAX_UPLOAD + 1)
@@ -139,7 +171,12 @@ def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None) -> Fa
             return {"error": "too_short", "message": "לא נשמע דיבור. נסו שוב, קרוב יותר למיקרופון."}
         phrase = PHRASES[phrase_id]
         refs = app.state.refs.get(phrase_id, phrase) if app.state.refs else []
-        return app.state.scorer.score(wav, phrase, refs)
+        result = app.state.scorer.score(wav, phrase, refs)
+        if user and result.get("score") is not None:   # the student's progress; sent after the answer
+            tasks.add_task(app.state.auth.record, user["token"], {
+                "cat": phrase["cat"], "phrase": phrase["he"], "score": round(result["score"]),
+                "unrelated": bool(result.get("unrelated"))})
+        return result
 
     return app
 

static/index.html

@@ -84,6 +84,9 @@ header{display:flex;align-items:baseline;gap:4px 12px;flex-wrap:wrap}
 .tips .what::after{content:" · "}
 .tips .what{font-weight:700}
 .tips .what .ar{font-family:var(--f-ar);font-size:14px;font-weight:400;color:var(--muted)}
+#denied{text-align:center;font:600 18px/1.5 var(--f-body);color:#1C241D;padding:0 20px}
+#denied button{display:block;margin:12px auto 0;font:600 16px/1 var(--f-body);padding:10px 22px;border-radius:10px;border:1px solid #4B6A2C;background:#fff;color:#4B6A2C;cursor:pointer}
+#logoutBtn{position:fixed;bottom:4px;right:6px;z-index:9;font:500 11px/1 var(--f-body);padding:3px 8px;border-radius:6px;border:1px solid var(--line);background:var(--surface);color:var(--muted);cursor:pointer}
 .version{position:fixed;bottom:4px;left:6px;z-index:9;font:500 11px/1 var(--f-ipa);direction:ltr;padding:3px 6px;border-radius:6px;background:var(--amber-bg);color:var(--amber);opacity:.85;pointer-events:none}
 header .sub{flex:1}
 .drive{font:700 15px var(--f-body);border-radius:999px;padding:6px 14px;cursor:pointer;border:1px solid var(--olive);background:transparent;color:var(--olive)}
@@ -103,13 +106,13 @@ body.driving .mic{width:84px;height:84px}
 #logo-splash{position:fixed;inset:0;z-index:9999;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:28px;background:white;transition:opacity .35s ease,visibility .35s ease}
 #logo-splash.done{opacity:0;visibility:hidden;pointer-events:none}
 #logo-splash img{width:min(82vw,620px);height:auto}
-#startBtn{font:400 24px/1 var(--f-display);padding:14px 34px;border-radius:14px;border:0;cursor:pointer;background:#4B6A2C;color:#fff;opacity:0;animation:start-in .45s ease-out 2.1s forwards}
+#startBtn,#loginBtn{font:400 24px/1 var(--f-display);padding:14px 34px;border-radius:14px;border:0;cursor:pointer;background:#4B6A2C;color:#fff;opacity:0;animation:start-in .45s ease-out 2.1s forwards}
 @keyframes start-in{from{opacity:0;transform:translateY(8px)}to{opacity:1;transform:none}}
-@media (prefers-reduced-motion:reduce){#startBtn{animation:none;opacity:1}#logo-splash{transition:none}}
+@media (prefers-reduced-motion:reduce){#startBtn,#loginBtn{animation:none;opacity:1}#logo-splash{transition:none}}
 </style>
 </head>
 <body>
-<div id="logo-splash"><img src="static/logo-intro.svg" alt="אהלא וסהלא, בית הספר ללימוד השפה הערבית" width="489" height="225"><button id="startBtn">יאללה נבלש</button></div>
+<div id="logo-splash"><img src="static/logo-intro.svg" alt="אהלא וסהלא, בית הספר ללימוד השפה הערבית" width="489" height="225"><button id="startBtn">יאללה נבלש</button><button id="loginBtn" hidden>כניסה עם Google</button><div id="denied" hidden>החשבון הזה אינו ברשימת התלמידים.<button id="switchBtn">כניסה עם חשבון אחר</button></div></div>
 <div class="wrap" id="wrap" inert>
   <header>
     <div class="brand">אהלא וסהלא</div>
@@ -160,9 +163,21 @@ body.driving .mic{width:84px;height:84px}
   <p class="note">הניתוח נעשה ברמת ההגה. ההשמעה נוצרת בקול של ערבית מדוברת מ-Sawtak Arabi; אם השירות אינו זמין, נעשה שימוש בקול הערבי של המכשיר.</p>
 </div>
 <div class="version" title="גרסת debug">v __VERSION__<span id="heInfo"></span><span id="ttsInfo"></span></div>
+<button id="logoutBtn" hidden>יציאה</button>
 
+<script src="https://cdn.jsdelivr.net/npm/@supabase/supabase-js@2"></script>
 <script>
 const $=id=>document.getElementById(id);
+/* Sign-in: Google through Supabase. The server fills the two values in; when they are empty (no project configured) the app is open. */
+const AUTH_URL="__SUPABASE_URL__", AUTH_KEY="__SUPABASE_KEY__";
+const sb=AUTH_URL&&window.supabase?supabase.createClient(AUTH_URL,AUTH_KEY):null;
+async function api(url,opts={}){   // fetch with the session token; a refused token goes back to the sign-in screen
+  if(!sb) return fetch(url,opts);
+  const {data}=await sb.auth.getSession();   // refreshes the token when it has expired
+  const res=await fetch(url,{...opts,headers:{...opts.headers,Authorization:"Bearer "+(data.session?data.session.access_token:"")}});
+  if(res.status===401){ await sb.auth.signOut({scope:"local"}); location.reload(); }
+  return res;
+}
 const store={get(k,d){try{const v=localStorage.getItem(k);return v?JSON.parse(v):d}catch{return d}},set(k,v){try{localStorage.setItem(k,JSON.stringify(v))}catch{}}};
 let driving=false;
 let LESSONS=[], lesson=null, CATS=[], PHRASES=[], cat=store.get("ihki.cat","meet"), best=store.get("ihki.best2",{}), order=[], pos=0, cur=null;
@@ -219,7 +234,7 @@ let heAudio=null, hePending=null, opened=false;   // opened: the sentence the ap
 async function promptUrl(id){
   if(!heUrls[id]){
     try{
-      const res=await fetch(`/api/prompt-audio/${id}?engine=${heEngine}`);
+      const res=await api(`/api/prompt-audio/${id}?engine=${heEngine}`);
       if(!res.ok) return null;
       heUrls[id]=URL.createObjectURL(await res.blob());
       $("heInfo").textContent=" · 🗣 "+(res.headers.get("X-TTS-Engine")==="edge"?"edge-tts":"gTTS");
@@ -421,7 +436,7 @@ async function startRec(auto){   // auto: started by the page for the sentence o
     mic.disabled=true; $("status").textContent="מנתח…";
     try{
       const fd=new FormData(); fd.append("phrase_id",id); fd.append("audio",blob,"rec");
-      const res=await fetch("/api/score",{method:"POST",body:fd});
+      const res=await api("/api/score",{method:"POST",body:fd});
       if(!res.ok) throw new Error(res.status);
       const r=await res.json();
       if(cur.id!==id){ mic.disabled=false; finishRec({kind:"cancel"}); recordWhenReady(); return; }   // moved on while it was analysed
@@ -461,7 +476,7 @@ async function answerAudio(id){   // {url,label} of the Sawtak answer, or null w
   ttsVoice="";
   if(!ttsOff && !ttsUrls[key]){
     try{
-      const res=await fetch("/api/tts/"+id+(voice?"?voice="+encodeURIComponent(voice):""));
+      const res=await api("/api/tts/"+id+(voice?"?voice="+encodeURIComponent(voice):""));
       if(res.ok){
         const h=k=>decodeURIComponent(res.headers.get(k)||""), name=h("X-TTS-Voice-Name");
         ttsUrls[key]={url:URL.createObjectURL(await res.blob()),
@@ -507,7 +522,7 @@ function speakLocal(text,lang){   // device voice, when the server could not spe
 }
 async function sayHe(text){
   try{
-    const res=await fetch(`/api/say?engine=${heEngine}&text=${encodeURIComponent(text)}`);
+    const res=await api(`/api/say?engine=${heEngine}&text=${encodeURIComponent(text)}`);
     if(res.ok){ const url=URL.createObjectURL(await res.blob()); await playUrl(url); URL.revokeObjectURL(url); return; }
   }catch{}
   await speakLocal(text,"he-IL");
@@ -576,6 +591,32 @@ $("startBtn").onclick=()=>{
   $("wrap").inert=false; splash.classList.add("done"); setTimeout(()=>splash.remove(),400);
 };
 $("startBtn").focus({preventScroll:true});
+/* With sign-in configured, the start button waits behind the Google button. */
+if(AUTH_URL){
+  const start=$("startBtn"), login=$("loginBtn"), logout=$("logoutBtn");
+  start.hidden=true; login.hidden=false;
+  if(!sb){ login.disabled=true; login.textContent="הכניסה לא זמינה כרגע"; }
+  else{
+    const denied=$("denied");
+    let asked="";   // the account whose permission was already asked; token refreshes do not ask again
+    login.onclick=()=>sb.auth.signInWithOAuth({provider:"google",
+      options:{redirectTo:location.origin+location.pathname,queryParams:{prompt:"select_account"}}});
+    logout.onclick=$("switchBtn").onclick=async()=>{ await sb.auth.signOut(); location.reload(); };
+    sb.auth.onAuthStateChange((_e,session)=>{
+      login.hidden=!!session; logout.hidden=!session;
+      logout.title=session?session.user.email||"":"";
+      if(!session){ asked=""; start.hidden=true; denied.hidden=true; login.focus({preventScroll:true}); return; }
+      if(asked===session.user.id) return;
+      asked=session.user.id;
+      setTimeout(async()=>{   // outside this callback: api() asks supabase for the session
+        const res=await api("/api/me").catch(()=>null);
+        const ok=!res||res.status!==403;   // a server that cannot be reached is not a refusal
+        start.hidden=!ok; denied.hidden=ok;
+        if(ok) start.focus({preventScroll:true});
+      },0);
+    });
+  }
+}
 </script>
 </body>
 </html>

static/privacy.html

@@ -0,0 +1,41 @@
+<!doctype html>
+<html lang="he" dir="rtl">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>מדיניות פרטיות · אהלא וסהלא</title>
+<style>
+body{background:#EEF0E8;color:#1C241D;font:400 17px/1.6 "Assistant",system-ui,"Segoe UI",Arial,sans-serif;margin:0;padding:24px 16px}
+main{max-width:680px;margin:0 auto;background:#FAFBF6;border:1px solid #D5DACB;border-radius:14px;padding:20px 24px}
+h1{font-size:26px;margin:0 0 4px} h2{font-size:19px;margin:22px 0 4px}
+.muted{color:#5E685C;font-size:14px} [lang=en]{direction:ltr;text-align:left}
+</style>
+</head>
+<body>
+<main>
+<h1>מדיניות פרטיות</h1>
+<p class="muted">אהלא וסהלא (ihki) · עודכן ב-9 באוקטובר 2026</p>
+
+<h2>כניסה עם Google</h2>
+<p>הכניסה לאפליקציה נעשית באמצעות חשבון Google. בעת הכניסה אנחנו מקבלים מ-Google את השם, כתובת הדוא"ל ותמונת הפרופיל שלכם, ושומרים אותם בשירות Supabase שמנהל עבורנו את החשבונות. הסיסמה שלכם ב-Google אינה מגיעה אלינו.</p>
+
+<h2>הקלטות</h2>
+<p>כשאתם מקליטים משפט, ההקלטה נשלחת לשרת כדי לנתח את ההגייה ולהחזיר ציון. ההקלטה אינה נשמרת בשרת לאחר הניתוח.</p>
+
+<h2>התקדמות בלימוד</h2>
+<p>לאחר כל הקלטה נשמרים ב-Supabase, תחת החשבון שלכם, המשפט שתרגלתם, הציון והמועד. המורה יכול לראות את הנתונים האלה כדי לעקוב אחר ההתקדמות שלכם.</p>
+
+<h2>מה נשמר במכשיר שלכם</h2>
+<p>הציונים הטובים ביותר וההעדפות שלכם (שיעור, קול) נשמרים בדפדפן שלכם בלבד, יחד עם פרטי ההתחברות.</p>
+
+<h2>שיתוף עם צדדים שלישיים</h2>
+<p>איננו מוכרים או משתפים את הפרטים שלכם. השירותים שבהם האפליקציה משתמשת: Google (כניסה), Supabase (ניהול חשבונות) ו-Hugging Face (אירוח).</p>
+
+<h2>מחיקה ויצירת קשר</h2>
+<p>למחיקת החשבון והפרטים שלכם, או לכל שאלה, כתבו אל <a href="mailto:wzwzchatgpt@gmail.com">wzwzchatgpt@gmail.com</a>.</p>
+
+<h2 lang="en">Summary in English</h2>
+<p lang="en">Sign-in uses your Google account: we receive your name, email address and profile picture, stored with Supabase, which manages accounts for us. Recordings are sent to the server only to score pronunciation and are not kept afterwards. For each recording we store the phrase practised, the score and the time under your account, and your teacher can see them to follow your progress. Best scores and preferences stay in your browser. We do not sell or share your data. To delete your account or ask a question, write to <a href="mailto:wzwzchatgpt@gmail.com">wzwzchatgpt@gmail.com</a>.</p>
+</main>
+</body>
+</html>

tests/conftest.py

@@ -0,0 +1,4 @@
+"""Tests run without sign-in whatever the local .env says: set before app.main loads it."""
+import os
+
+os.environ["SUPABASE_URL"] = ""

tests/test_scoring.py

@@ -405,3 +405,52 @@ def test_workbook_lesson_2():
     assert by["l2-say", "אני ישבתי עם חברי לפני יומיים ואכלנו פיצה בסלון."]["he_say"].split()[3] == "חֲבֵרִי"
     assert "וַחֲבֵרִי" in by["l2-say", "מי ישב בבית השיח'? אני וחברי ישבנו בבית השיח'."]["he_say"]
     assert by["l2-dual", "שבוע, שבועיים"]["he_say"] == "שָׁבוּעַ, שבועיים"   # not "shvua"
+
+
+def test_sign_in_guards_the_practice_endpoints():
+    from fastapi.testclient import TestClient
+
+    from app.main import create_app
+
+    class FakeAuth:
+        url, key, allowed = "https://proj.supabase.co", "sb_publishable_x", frozenset()
+
+        def __init__(self):
+            self.rows = []
+
+        def user(self, token):
+            return {"id": "u1", "email": "A@b.c"} if token == "good" else None
+
+        def record(self, token, row):
+            self.rows.append((token, row))
+
+    with TestClient(create_app(scorer_for(emissions(["w"])), auth=FakeAuth())) as c:
+        page = c.get("/").text
+        assert 'AUTH_URL="https://proj.supabase.co"' in page and 'AUTH_KEY="sb_publishable_x"' in page
+        assert c.get("/api/phrases").status_code == 200   # the phrase list stays public
+        assert c.get("/api/prompt-audio/0").status_code == 401
+        assert c.get("/api/tts/0", headers={"Authorization": "Bearer bad"}).status_code == 401
+        assert c.get("/api/tts/0", headers={"Authorization": "Bearer good"}).status_code == 503   # in, but no TTS key
+        good = {"Authorization": "Bearer good"}
+        assert c.get("/api/me", headers=good).json() == {"email": "A@b.c"}
+        c.app.state.auth.allowed = frozenset({"other@b.c"})   # a list without this account
+        assert c.get("/api/me", headers=good).status_code == 403 and c.get("/api/tts/0", headers=good).status_code == 403
+        c.app.state.auth.allowed = frozenset({"a@b.c"})   # case does not matter
+        assert c.get("/api/me", headers=good).status_code == 200
+    # a scored recording is recorded as the student's attempt
+    auth, pid = FakeAuth(), PHRASES.index(TOILET)
+    buf = io.BytesIO()
+    with wave.open(buf, "wb") as w:
+        w.setnchannels(1); w.setsampwidth(2); w.setframerate(16000)
+        w.writeframes((0.3 * np.sin(2 * np.pi * 220 * np.arange(16000) / 16000) * 32767).astype("<i2").tobytes())
+    logp = emissions(["w", "eː", "n", "i", "l", "χ", "a", "m", "aː", "m"])
+    with TestClient(create_app(scorer_for(logp), auth=auth)) as c:
+        files = {"audio": ("a.wav", buf.getvalue(), "audio/wav")}
+        assert c.post("/api/score", data={"phrase_id": pid}, files=files).status_code == 401 and not auth.rows
+        r = c.post("/api/score", data={"phrase_id": pid}, files=files, headers={"Authorization": "Bearer good"})
+        assert r.status_code == 200, r.text
+        (token, row), = auth.rows
+        assert token == "good" and row["phrase"] == TOILET["he"] and row["cat"] == TOILET["cat"]
+        assert row["score"] == round(r.json()["score"]) and row["unrelated"] is False
+    with TestClient(create_app(scorer_for(emissions(["w"])))) as c:   # not configured: open, as before
+        assert 'AUTH_URL=""' in c.get("/").text and c.get("/api/tts/0").status_code == 503