fix: reject unconfirmed Telegram tests and invalid update responses

tests/account-request.test.mjs

@@ -36,3 +36,16 @@ test('late private account responses and explicit cancellation do not reach the
   await assert.rejects(accountRequest('/state',{signal:controller.signal}),{name:'AbortError'});
  } finally {globalThis.fetch=original;if(storage)Object.defineProperty(globalThis,'localStorage',storage);else delete globalThis.localStorage;}
 });
+
+test('Telegram test does not report success without a provider receipt or retry an ambiguous response',async()=>{
+ const {telegramTest}=await import('../src/services/account.js');
+ const original=globalThis.fetch;let calls=0;
+ try{
+  globalThis.fetch=async()=>{calls++;return Response.json({success:true});};
+  await assert.rejects(telegramTest(),/kabulü doğrulanamadı/);assert.equal(calls,1);
+  globalThis.fetch=async()=>Response.json({success:true,id:'123:42'});
+  assert.equal((await telegramTest()).id,'123:42');
+  globalThis.fetch=async()=>Response.json({success:false,error:'Telegram hizmeti etkin değil.'},{status:503});
+  await assert.rejects(telegramTest(),/etkin değil/);
+ }finally{globalThis.fetch=original;}
+});

tests/http-state.test.mjs

@@ -7,6 +7,7 @@ import {join} from 'node:path';
 import {randomBytes} from 'node:crypto';
 import {createServer} from 'node:net';
 const dir=mkdtempSync(join(tmpdir(),'ihaleist-http-'));
+process.env.IHALEIST_USER_DATA_DIR=dir;
 process.env.AUTH_SECRET=randomBytes(32).toString('hex');
 const {signToken}=await import('../server/auth.mjs');
 const token=signToken({email:'qa@example.test',name:'QA'});
@@ -19,7 +20,7 @@ const request=async(path,method='GET',body,auth=token)=>{
 before(async()=>{
  const socket=createServer();await new Promise(r=>socket.listen(0,'127.0.0.1',r));const port=socket.address().port;await new Promise(r=>socket.close(r));
  base='http://127.0.0.1:'+port;
- child=spawn(process.execPath,['server/index.js'],{cwd:new URL('..',import.meta.url),env:{...process.env,NODE_ENV:'test',PORT:String(port),IHALEIST_USER_DATA_DIR:dir,IHALEIST_SHARED_DATA_DIR:join(dir,'shared'),UYUM_GOMME:'0'},stdio:'ignore'});
+ child=spawn(process.execPath,['server/index.js'],{cwd:new URL('..',import.meta.url),env:{...process.env,NODE_ENV:'test',TELEGRAM_BOT_TOKEN:'',PORT:String(port),IHALEIST_USER_DATA_DIR:dir,IHALEIST_SHARED_DATA_DIR:join(dir,'shared'),UYUM_GOMME:'0'},stdio:'ignore'});
  for(let i=0;i<100;i++){try{await fetch(base+'/api/auth/google/config');return;}catch{await new Promise(r=>setTimeout(r,50));}}
  throw new Error('QA API did not start');
 });
@@ -294,3 +295,15 @@ test('Telegram cannot be linked through generic data writes or legacy client cod
  assert.equal((await request('/api/me/telegram','PATCH',{})).status,405);
  assert.equal((await request('/api/me/telegram','POST',{islem:'kod'},null)).status,401);
 });
+
+test('saved Telegram link does not imply an unconfigured test message was sent',async()=>{
+ const {createTelegramLinker}=await import('../server/telegram-link.mjs');
+ // Parent and HTTP child use the same disposable database; no real provider credentials.
+ const tgStore=await import('../server/user-store.mjs');
+ const linker=createTelegramLinker(tgStore),email='telegram-http@example.test';
+ const challenge=linker.issue(email);await linker.link(email,challenge.kod,async()=>({chatId:'123',ad:'Synthetic'}));
+ const session=signToken({email,name:'Telegram Test'});
+ const result=await request('/api/me/telegram','POST',{islem:'test'},session);
+ assert.equal(result.status,503);assert.equal(result.data.success,false);
+ assert.equal(result.data.id,undefined);
+});

tests/telegram-link.test.mjs

@@ -54,3 +54,15 @@ test('matching accepts only a fresh exact code from a private non-bot sender',as
   updates=[{message:{...good,text:'/start '+code}}];assert.equal((await kodIleBagla(code,window)).ad,'QA');
  } finally {globalThis.fetch=oldFetch;if(oldToken===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=oldToken;}
 });
+
+test('provider errors and malformed updates are not treated as code-not-found results',async()=>{
+ const oldFetch=globalThis.fetch,oldToken=process.env.TELEGRAM_BOT_TOKEN;
+ process.env.TELEGRAM_BOT_TOKEN='synthetic-token';
+ const window={issuedAt:1000000,expiresAt:1600000,now:1100000};
+ try {
+  for(const [ok,body] of [[false,{ok:true,result:[]}],[true,{ok:true}],[true,{ok:true,result:{}}],[true,{ok:'true',result:[]}]]){
+   globalThis.fetch=async()=>({ok,json:async()=>body});
+   await assert.rejects(kodIleBagla('a'.repeat(48),window),/yanıtı doğrulanamadı/);
+  }
+ }finally{globalThis.fetch=oldFetch;if(oldToken===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=oldToken;}
+});