fix: separate private company documents from shared tender item imports

tests/http-state.test.mjs

@@ -69,3 +69,22 @@ test('HTTP file upload, owned download, metadata update and deletion operate on
  assert.equal((await request('/api/me/documents?id='+id,'DELETE')).status,200);
  assert.equal((await request('/api/me/documents/download?id='+id)).status,404);
 });
+
+test('shared item extraction requires an owned tender document and matching tender',async()=>{
+ const body={ad:'scope.txt',icerikBase64:Buffer.from('Yalnız test dokümanı, cetvel yok.').toString('base64'),ikn:'2026/123456'};
+ const company=await request('/api/me/documents','POST',body);
+ assert.equal(company.status,200);
+ assert.equal(company.data.belgeler.find(d=>d.id===company.data.id).tur,'firma');
+ const extract=id=>({documentId:id,ikn:body.ikn,metin:'Cetvel yok.'});
+ assert.equal((await request('/api/kalem/cikar','POST',extract(company.data.id))).status,403);
+ await request('/api/me/documents/meta','PATCH',{id:company.data.id,kategori:'İhale Dokümanı'});
+ assert.equal((await request('/api/kalem/cikar','POST',extract(company.data.id))).status,403);
+ const tender=await request('/api/me/documents','POST',{...body,documentType:'ihale'});
+ assert.equal(tender.status,200);
+ assert.equal((await request('/api/kalem/cikar','POST',extract(tender.data.id),other)).status,403);
+ assert.equal((await request('/api/kalem/cikar','POST',{...extract(tender.data.id),ikn:'2026/999999'})).status,403);
+ assert.equal((await request('/api/kalem/cikar','POST',extract(tender.data.id))).status,200);
+ assert.equal((await request('/api/kalem/cikar','POST',{ikn:body.ikn,metin:'test'})).status,403);
+ await request('/api/me/documents?id='+company.data.id,'DELETE');
+ await request('/api/me/documents?id='+tender.data.id,'DELETE');
+});

tests/user-store.test.mjs

@@ -15,11 +15,12 @@ after(() => rmSync(dir, { recursive: true, force: true }));
 test('old volume migrates before indexing, preserves files and migration is repeatable', () => {
   for (let i = 0; i < 2; i++) {
     const db = store.openDb();
-    assert.equal(db.prepare('SELECT COUNT(*) n FROM schema_migrations').get().n, 1);
+    assert.equal(db.prepare('SELECT COUNT(*) n FROM schema_migrations').get().n, 2);
     assert.ok(db.prepare('PRAGMA table_info(belgeler)').all().some(c => c.name === 'ikn'));
     db.close();
   }
   assert.equal(store.listDocuments('a@example.test')[0].ad, 'Eski belge');
+  assert.equal(store.listDocuments('a@example.test')[0].tur, 'firma');
   assert.deepEqual(store.listDocuments('b@example.test'), []);
 });
 test('five preparation records persist across DB close/reopen and stay account scoped', () => {