fix: isolate account state and ignore stale session responses

tests/session-isolation.test.mjs

@@ -0,0 +1,33 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {restoreSession,setSession,getStoredUser,getToken,clearSession} from '../src/services/auth.js';
+import {publicTender,USER_STATE_FIELDS,applyTenderStates} from '../src/services/tenderState.js';
+test('late session restore cannot replace or clear a newer account',async()=>{
+ const savedStorage=globalThis.localStorage,savedFetch=globalThis.fetch;
+ const values=new Map();
+ globalThis.localStorage={getItem:k=>values.get(k)??null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)};
+ try {
+   for(const response of [{ok:false},{ok:true,json:async()=>({success:true,user:{email:'a@test'}})}]) {
+     setSession('session-a',{email:'a@test'});
+     let resolve;globalThis.fetch=()=>new Promise(r=>resolve=r);
+     const pending=restoreSession();
+     setSession('session-b',{email:'b@test'});
+     resolve(response);
+     assert.equal((await pending).email,'b@test');
+     assert.equal(getToken(),'session-b');assert.equal(getStoredUser().email,'b@test');
+   }
+   setSession('session-a',{email:'a@test'});
+   let resolve;globalThis.fetch=()=>new Promise(r=>resolve=r);
+   const pending=restoreSession();clearSession();
+   resolve({ok:true,json:async()=>({success:true,user:{email:'a@test'}})});
+   assert.equal(await pending,null);assert.equal(getToken(),null);
+ }finally{globalThis.localStorage=savedStorage;globalThis.fetch=savedFetch;}
+});
+test('shared tender cache contains no preparation state and account changes clear previous state',()=>{
+ const source={id:'x',ikn:'2026/x',baslik:'Lab',items:[{ad:'Kit'}]};
+ const a={...source,...Object.fromEntries(USER_STATE_FIELDS.map(k=>[k,'private-a']))};
+ assert.deepEqual(publicTender(a),source);
+ assert.deepEqual(applyTenderStates([a].map(publicTender),{}),[source]);
+ const b=applyTenderStates([a].map(publicTender),{'2026/x':{data:{notes:['private-b']}}});
+ assert.deepEqual(b[0].notes,['private-b']);assert.equal(b[0].bidDraft,undefined);
+});