fix: separate private company documents from shared tender item imports

tests/http-state.test.mjs

@@ -69,3 +69,22 @@ test('HTTP file upload, owned download, metadata update and deletion operate on
  assert.equal((await request('/api/me/documents?id='+id,'DELETE')).status,200);
  assert.equal((await request('/api/me/documents/download?id='+id)).status,404);
 });
+
+test('shared item extraction requires an owned tender document and matching tender',async()=>{
+ const body={ad:'scope.txt',icerikBase64:Buffer.from('Yalnız test dokümanı, cetvel yok.').toString('base64'),ikn:'2026/123456'};
+ const company=await request('/api/me/documents','POST',body);
+ assert.equal(company.status,200);
+ assert.equal(company.data.belgeler.find(d=>d.id===company.data.id).tur,'firma');
+ const extract=id=>({documentId:id,ikn:body.ikn,metin:'Cetvel yok.'});
+ assert.equal((await request('/api/kalem/cikar','POST',extract(company.data.id))).status,403);
+ await request('/api/me/documents/meta','PATCH',{id:company.data.id,kategori:'İhale Dokümanı'});
+ assert.equal((await request('/api/kalem/cikar','POST',extract(company.data.id))).status,403);
+ const tender=await request('/api/me/documents','POST',{...body,documentType:'ihale'});
+ assert.equal(tender.status,200);
+ assert.equal((await request('/api/kalem/cikar','POST',extract(tender.data.id),other)).status,403);
+ assert.equal((await request('/api/kalem/cikar','POST',{...extract(tender.data.id),ikn:'2026/999999'})).status,403);
+ assert.equal((await request('/api/kalem/cikar','POST',extract(tender.data.id))).status,200);
+ assert.equal((await request('/api/kalem/cikar','POST',{ikn:body.ikn,metin:'test'})).status,403);
+ await request('/api/me/documents?id='+company.data.id,'DELETE');
+ await request('/api/me/documents?id='+tender.data.id,'DELETE');
+});