fix: preserve bid drafts and align tender source data

tests/http-state.test.mjs

@@ -0,0 +1,40 @@
+import {test,before,after} from 'node:test';
+import assert from 'node:assert/strict';
+import {spawn} from 'node:child_process';
+import {mkdtempSync,rmSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {randomBytes} from 'node:crypto';
+import {createServer} from 'node:net';
+const dir=mkdtempSync(join(tmpdir(),'ihaleist-http-'));
+process.env.AUTH_SECRET=randomBytes(32).toString('hex');
+const {signToken}=await import('../server/auth.mjs');
+const token=signToken({email:'qa@example.test',name:'QA'});
+const other=signToken({email:'other@example.test',name:'Other'});
+let child,base;
+const request=async(path,method='GET',body,auth=token)=>{
+ const r=await fetch(base+path,{method,headers:{'Content-Type':'application/json',...(auth?{Authorization:'Bearer '+auth}:{})},body:body?JSON.stringify(body):undefined});
+ return {status:r.status,data:await r.json()};
+};
+before(async()=>{
+ const socket=createServer();await new Promise(r=>socket.listen(0,'127.0.0.1',r));const port=socket.address().port;await new Promise(r=>socket.close(r));
+ base='http://127.0.0.1:'+port;
+ child=spawn(process.execPath,['server/index.js'],{cwd:new URL('..',import.meta.url),env:{...process.env,NODE_ENV:'test',PORT:String(port),IHALEIST_USER_DATA_DIR:dir,UYUM_GOMME:'0'},stdio:'ignore'});
+ for(let i=0;i<100;i++){try{await fetch(base+'/api/auth/google/config');return;}catch{await new Promise(r=>setTimeout(r,50));}}
+ throw new Error('QA API did not start');
+});
+after(async()=>{if(child){child.kill();await new Promise(r=>child.once('exit',r));}rmSync(dir,{recursive:true,force:true});});
+test('HTTP preparation requires auth, persists draft and rejects stale revisions',async()=>{
+ assert.equal((await request('/api/me/tender-state','GET',null,null)).status,401);
+ const draft={firma:{firmaUnvan:'QA Laboratuvar'},fiyatlar:{0:'12.50'},gecerlilikGun:'120'};
+ const data={key:'2026/1582991',patch:{takipte:true,gorev:{kontrolListesi:[]},bidDraft:draft},snapshot:{id:'ilan-qa',ikn:'2026/1582991'},version:0};
+ assert.equal((await request('/api/me/tender-state','PUT',data)).status,200);
+ const read=await request('/api/me/tender-state');assert.deepEqual(read.data.records[data.key].data.bidDraft,draft);
+ assert.equal((await request('/api/me/tender-state','PUT',data)).status,409);
+ assert.deepEqual((await request('/api/me/tender-state','GET',null,other)).data.records,{});
+});
+test('HTTP documents and API keys expose empty successful state, not endless load errors',async()=>{
+ const docs=await request('/api/me/documents');assert.equal(docs.status,200);assert.deepEqual(docs.data.belgeler,[]);
+ const keys=await request('/api/me/apikeys');assert.equal(keys.status,200);assert.deepEqual(keys.data.anahtarlar,[]);
+ const data=await request('/api/me/data');assert.equal(data.status,200);assert.deepEqual(data.data.veri,{});
+});