feat: validate preparation against owned document files

tests/http-state.test.mjs

@@ -39,3 +39,19 @@ test('HTTP documents and API keys expose empty successful state, not endless loa
  const keys=await request('/api/me/apikeys');assert.equal(keys.status,200);assert.deepEqual(keys.data.anahtarlar,[]);
  const data=await request('/api/me/data');assert.equal(data.status,200);assert.deepEqual(data.data.veri,{});
 });
+
+test('HTTP file upload, owned download, metadata update and deletion operate on actual bytes',async()=>{
+ const bytes=Buffer.from('QA belge — Türkçe içerik, yalnız izole test.');
+ const uploaded=await request('/api/me/documents','POST',{ad:'qa.txt',mime:'text/plain',icerikBase64:bytes.toString('base64'),kategori:'Firma',sonKullanma:'2026-12-31'});
+ assert.equal(uploaded.status,200);
+ const id=uploaded.data.id;
+ const list=await request('/api/me/documents');const file=list.data.belgeler.find(f=>f.id===id);
+ assert.equal(file.erisilebilir,true);assert.equal(file.boyut,bytes.length);assert.equal(file.dosya,undefined);
+ const downloaded=await fetch(base+'/api/me/documents/download?id='+id,{headers:{Authorization:'Bearer '+token}});
+ assert.equal(downloaded.status,200);assert.deepEqual(Buffer.from(await downloaded.arrayBuffer()),bytes);
+ assert.equal((await request('/api/me/documents/download?id='+id,'GET',null,other)).status,404);
+ assert.equal((await request('/api/me/documents/meta','PATCH',{id,sonKullanma:'2027-01-01'})).status,200);
+ const changed=await request('/api/me/documents');assert.equal(changed.data.belgeler.find(f=>f.id===id).son_kullanma,'2027-01-01');
+ assert.equal((await request('/api/me/documents?id='+id,'DELETE')).status,200);
+ assert.equal((await request('/api/me/documents/download?id='+id)).status,404);
+});

tests/preparation-checks.test.mjs

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import {preparationBlockers,documentKey,HEALTH_CHECKS} from '../src/services/preparationChecks.js';
+import {preparationBlockers,documentKey,HEALTH_CHECKS,documentRevision,documentLinkProblem} from '../src/services/preparationChecks.js';
 const rows=[{priceKey:'kit1',name:'Kit'}];
 const docs=[{document:'Yetki belgesi',mandatory:true,note:'Şartname 7.1'}];
 const complete=()=>({documents:{[documentKey(docs[0])]:{status:'verified',evidence:'Yetki v2, süre kontrol edildi, 7.1'}},products:{kit1:{product:'QA model',source:'Teknik 3.2, katalog s4',status:'suitable',...Object.fromEntries(HEALTH_CHECKS.map(([key])=>[key,{status:'notApplicable',evidence:'Doküman ilgili maddesi kapsamında uygulanmıyor'}]))}}});
@@ -17,3 +17,15 @@ test('changed requirement and changed product row require new checks',()=>{
  assert.ok(preparationBlockers(rows,[{...docs[0],note:'Zeyilname 2'}],complete()).length>0);
  assert.ok(preparationBlockers([{...rows[0],priceKey:'kit2'}],docs,complete()).length>0);
 });
+
+test('linked file must exist, match reviewed metadata and remain valid at tender deadline',()=>{
+ const file={id:'f1',olusturma:'2026-09-01',boyut:100,son_kullanma:'2026-09-10',erisilebilir:true};
+ const c={documentId:file.id,documentRevision:documentRevision(file)};
+ assert.equal(documentLinkProblem(c,[file],'2026-09-10'),null);
+ assert.ok(documentLinkProblem(c,[],'2026-09-10'));
+ assert.ok(documentLinkProblem(c,[{...file,erisilebilir:false}],'2026-09-10'));
+ assert.ok(documentLinkProblem(c,[{...file,boyut:101}],'2026-09-10'));
+ assert.ok(documentLinkProblem(c,[file],'2026-09-11'));
+ const invalid={...file,son_kullanma:'2026-02-31'};
+ assert.ok(documentLinkProblem({...c,documentRevision:documentRevision(invalid)},[invalid],'2026-01-01'));
+});