test API security headers

tests/http-state.test.mjs

@@ -15,7 +15,7 @@ const other=signToken({email:'other@example.test',name:'Other'});
 let child,base;
 const request=async(path,method='GET',body,auth=token)=>{
  const r=await fetch(base+path,{method,headers:{'Content-Type':'application/json',...(auth?{Authorization:'Bearer '+auth}:{})},body:body?JSON.stringify(body):undefined});
- return {status:r.status,data:await r.json()};
+ return {status:r.status,data:await r.json(),headers:r.headers};
 };
 before(async()=>{
  const socket=createServer();await new Promise(r=>socket.listen(0,'127.0.0.1',r));const port=socket.address().port;await new Promise(r=>socket.close(r));
@@ -26,7 +26,10 @@ before(async()=>{
 });
 after(async()=>{if(child){child.kill();await new Promise(r=>child.once('exit',r));}rmSync(dir,{recursive:true,force:true});});
 test('HTTP preparation requires auth, persists draft and rejects stale revisions',async()=>{
- assert.equal((await request('/api/me/tender-state','GET',null,null)).status,401);
+ const unauthorized=await request('/api/me/tender-state','GET',null,null);
+ assert.equal(unauthorized.status,401);
+ assert.equal(unauthorized.headers.get('x-content-type-options'),'nosniff');
+ assert.equal(unauthorized.headers.get('referrer-policy'),'no-referrer');
  const draft={firma:{firmaUnvan:'QA Laboratuvar'},priceSchema:1,pricesBySource:{kit1:'12.50'},gecerlilikGun:'120',checks:{products:{kit1:{product:'Test kit',status:'suitable',source:'Teknik 3.2'}},documents:{doc1:{status:'verified',evidence:'Test v1'}}},manualDocuments:[{document:'Yetki',note:'7.1',mandatory:true}],analysisSource:{itemsAndSpecs:[{name:'Kit',quantity:'2 adet'}],documentChecklist:[]}};
  const data={key:'2026/1582991',patch:{takipte:true,gorev:{kontrolListesi:[]},bidDraft:draft,checklist:[{key:'collect-documents',sourceSnapshot:'source-v1',done:true}]},snapshot:{id:'ilan-qa',ikn:'2026/1582991'},version:0};
  assert.equal((await request('/api/me/tender-state','PUT',data)).status,200);