feat: validate preparation against owned document files

tests/http-state.test.mjs

@@ -39,3 +39,19 @@ test('HTTP documents and API keys expose empty successful state, not endless loa
  const keys=await request('/api/me/apikeys');assert.equal(keys.status,200);assert.deepEqual(keys.data.anahtarlar,[]);
  const data=await request('/api/me/data');assert.equal(data.status,200);assert.deepEqual(data.data.veri,{});
 });
+
+test('HTTP file upload, owned download, metadata update and deletion operate on actual bytes',async()=>{
+ const bytes=Buffer.from('QA belge — Türkçe içerik, yalnız izole test.');
+ const uploaded=await request('/api/me/documents','POST',{ad:'qa.txt',mime:'text/plain',icerikBase64:bytes.toString('base64'),kategori:'Firma',sonKullanma:'2026-12-31'});
+ assert.equal(uploaded.status,200);
+ const id=uploaded.data.id;
+ const list=await request('/api/me/documents');const file=list.data.belgeler.find(f=>f.id===id);
+ assert.equal(file.erisilebilir,true);assert.equal(file.boyut,bytes.length);assert.equal(file.dosya,undefined);
+ const downloaded=await fetch(base+'/api/me/documents/download?id='+id,{headers:{Authorization:'Bearer '+token}});
+ assert.equal(downloaded.status,200);assert.deepEqual(Buffer.from(await downloaded.arrayBuffer()),bytes);
+ assert.equal((await request('/api/me/documents/download?id='+id,'GET',null,other)).status,404);
+ assert.equal((await request('/api/me/documents/meta','PATCH',{id,sonKullanma:'2027-01-01'})).status,200);
+ const changed=await request('/api/me/documents');assert.equal(changed.data.belgeler.find(f=>f.id===id).son_kullanma,'2027-01-01');
+ assert.equal((await request('/api/me/documents?id='+id,'DELETE')).status,200);
+ assert.equal((await request('/api/me/documents/download?id='+id)).status,404);
+});