Keep vault state and file transfers within their originating session

tests/document-session.test.mjs

@@ -0,0 +1,24 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {uploadDocument,downloadDocument} from '../src/services/account.js';
+
+test('account switch during file reading prevents upload and download delivery',async()=>{
+ const storage=Object.getOwnPropertyDescriptor(globalThis,'localStorage');
+ const originalFetch=globalThis.fetch, originalReader=globalThis.FileReader;
+ let token='first', calls=0;
+ Object.defineProperty(globalThis,'localStorage',{configurable:true,value:{getItem:()=>token}});
+ try {
+  globalThis.FileReader=class {
+   readAsDataURL(){token='second';this.result='data:text/plain;base64,VGVzdA==';this.onload();}
+  };
+  globalThis.fetch=async()=>{calls++;return Response.json({success:true});};
+  await assert.rejects(uploadDocument({name:'test.txt',type:'text/plain'},'Test'),/Oturum değişti/);
+  assert.equal(calls,0);
+  token='first';
+  globalThis.fetch=async()=>({ok:true,blob:async()=>{token='second';return new Blob(['private document']);}});
+  await assert.rejects(downloadDocument('id','test.txt'),/Oturum değişti/);
+ } finally {
+  globalThis.fetch=originalFetch;globalThis.FileReader=originalReader;
+  if(storage) Object.defineProperty(globalThis,'localStorage',storage);else delete globalThis.localStorage;
+ }
+});