Fix API key error states and verify revocation lifecycle

tests/api-keys-client.test.mjs

@@ -0,0 +1,36 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { apiKeyRequest } from '../src/services/apiKeys.js';
+
+test('API key client distinguishes failure, malformed data, and a genuinely empty list', async () => {
+  const original = globalThis.fetch;
+  try {
+    globalThis.fetch = async () => new Response(JSON.stringify({success:true,anahtarlar:[],limit:0}));
+    assert.deepEqual((await apiKeyRequest()).anahtarlar, []);
+    globalThis.fetch = async () => new Response(JSON.stringify({success:false,error:'Depo erişilemiyor'}),{status:503});
+    await assert.rejects(apiKeyRequest(), /Depo erişilemiyor/);
+    globalThis.fetch = async () => new Response(JSON.stringify({success:true,anahtarlar:null}));
+    await assert.rejects(apiKeyRequest(), /eksik veya geçersiz/);
+    globalThis.fetch = async () => new Response('<html>502</html>');
+    await assert.rejects(apiKeyRequest(), /geçerli anahtar bilgisi/);
+  } finally { globalThis.fetch = original; }
+});
+
+test('API key client rejects late private responses after session change and does not retry uncertain creation', async () => {
+  const original = globalThis.fetch, storage = globalThis.localStorage;
+  let token = 'account-a', calls = 0;
+  globalThis.localStorage = {getItem:()=>token};
+  try {
+    globalThis.fetch = async () => {
+      token = 'account-b';
+      return new Response(JSON.stringify({success:true,anahtar:{id:'qa',anahtar:'ih_live_qa'}}));
+    };
+    await assert.rejects(apiKeyRequest('POST',{ad:'QA'}), /Oturum değişti/);
+    globalThis.fetch = async (_url, options) => {
+      calls++;
+      return new Promise((_resolve,reject)=>options.signal.addEventListener('abort',()=>reject(options.signal.reason),{once:true}));
+    };
+    await assert.rejects(apiKeyRequest('POST',{ad:'QA',timeoutMs:5}), /sunucuda gerçekleşmiş olabilir/);
+    assert.equal(calls,1);
+  } finally { globalThis.fetch=original; globalThis.localStorage=storage; }
+});

tests/http-state.test.mjs

@@ -134,3 +134,24 @@ test('shared item extraction requires an owned tender document and matching tend
  await request('/api/me/documents?id='+company.data.id,'DELETE');
  await request('/api/me/documents?id='+tender.data.id,'DELETE');
 });
+
+test('HTTP API key creation, private listing, MCP use and revocation form a complete lifecycle', async () => {
+ const admin=signToken({email:'keys@example.test',name:'Key QA',isAdmin:true});
+ const created=await request('/api/me/apikeys','POST',{ad:'QA integration'},admin);
+ assert.equal(created.status,200);
+ const {id,anahtar}=created.data.anahtar;
+ const listed=await request('/api/me/apikeys','GET',null,admin);
+ assert.equal(listed.data.anahtarlar.length,1);
+ assert.equal(listed.data.anahtarlar[0].anahtar,undefined);
+ assert.equal(listed.data.anahtarlar[0].hash,undefined);
+ assert.equal((await request('/api/me/apikeys?id='+id,'DELETE',null,other)).status,404);
+ const rpc={jsonrpc:'2.0',id:1,method:'initialize',params:{}};
+ assert.equal((await request('/mcp','POST',rpc,anahtar)).status,200);
+ const used=await request('/api/me/apikeys','GET',null,admin);
+ assert.ok(used.data.anahtarlar[0].son_kullanim);
+ const revoked=await request('/api/me/apikeys?id='+id,'DELETE',null,admin);
+ assert.equal(revoked.status,200);
+ assert.equal(revoked.data.limit,listed.data.limit);
+ assert.deepEqual(revoked.data.anahtarlar,[]);
+ assert.equal((await request('/mcp','POST',rpc,anahtar)).status,401);
+});