Fix API key error states and verify revocation lifecycle

tests/http-state.test.mjs

@@ -134,3 +134,24 @@ test('shared item extraction requires an owned tender document and matching tend
  await request('/api/me/documents?id='+company.data.id,'DELETE');
  await request('/api/me/documents?id='+tender.data.id,'DELETE');
 });
+
+test('HTTP API key creation, private listing, MCP use and revocation form a complete lifecycle', async () => {
+ const admin=signToken({email:'keys@example.test',name:'Key QA',isAdmin:true});
+ const created=await request('/api/me/apikeys','POST',{ad:'QA integration'},admin);
+ assert.equal(created.status,200);
+ const {id,anahtar}=created.data.anahtar;
+ const listed=await request('/api/me/apikeys','GET',null,admin);
+ assert.equal(listed.data.anahtarlar.length,1);
+ assert.equal(listed.data.anahtarlar[0].anahtar,undefined);
+ assert.equal(listed.data.anahtarlar[0].hash,undefined);
+ assert.equal((await request('/api/me/apikeys?id='+id,'DELETE',null,other)).status,404);
+ const rpc={jsonrpc:'2.0',id:1,method:'initialize',params:{}};
+ assert.equal((await request('/mcp','POST',rpc,anahtar)).status,200);
+ const used=await request('/api/me/apikeys','GET',null,admin);
+ assert.ok(used.data.anahtarlar[0].son_kullanim);
+ const revoked=await request('/api/me/apikeys?id='+id,'DELETE',null,admin);
+ assert.equal(revoked.status,200);
+ assert.equal(revoked.data.limit,listed.data.limit);
+ assert.deepEqual(revoked.data.anahtarlar,[]);
+ assert.equal((await request('/mcp','POST',rpc,anahtar)).status,401);
+});