fix: harden auth and investment synchronization

Resolve A01-A10 and C01-C07 from the backend audit.
Preserve auth failures, forced candle reconciliation and forecast freshness.
Validate MOEX responses and nested HTTP errors; remove unused legacy paths.

Verified: 209 unit tests, 262 SQLite e2e tests on Linux, OpenAPI and durability.
Record the remaining macOS native SQLite abort in the audit.

src/integrations/moex/moex.client.spec.ts

@@ -1,5 +1,11 @@
 import { MoexClient } from './moex.client';
 
+const emptyEvents = {
+  coupons: { columns: ['coupondate', 'value', 'faceunit'], data: [] },
+  offers: { columns: ['offerdate'], data: [] },
+  description: { columns: ['name', 'value'], data: [] },
+};
+
 describe('MoexClient', () => {
   afterEach(() => jest.restoreAllMocks());
   it('uses effective yield only for the exact ISIN and board and preserves its own price and date', async () => {
@@ -92,17 +98,174 @@ describe('MoexClient', () => {
       expect(result?.value ?? null).toBe(value === null ? null : '0');
     },
   );
-  it('treats a successful response without the requested block as no events', async () => {
-    const fetchMock = jest.spyOn(global, 'fetch').mockResolvedValue({
-      ok: true,
-      json: () =>
-        Promise.resolve({
-          description: { columns: ['name', 'value'], data: [] },
-          boards: { columns: ['secid'], data: [] },
-        }),
-    } as Response);
-
+  it('accepts confirmed empty blocks', async () => {
+    jest
+      .spyOn(global, 'fetch')
+      .mockImplementation(() => Promise.resolve(Response.json(emptyEvents)));
     await expect(new MoexClient().bondEvents('BOND')).resolves.toEqual([]);
-    fetchMock.mockRestore();
   });
+
+  it('preserves not-found semantics independently of malformed HTTP 200', async () => {
+    jest
+      .spyOn(global, 'fetch')
+      .mockImplementation(() =>
+        Promise.resolve(new Response(null, { status: 404 })),
+      );
+    const client = new MoexClient();
+    await expect(client.bondEvents('MISSING')).resolves.toEqual([]);
+    await expect(
+      client.bondYield('MISSING', 'ISIN', 'TQOB'),
+    ).resolves.toBeNull();
+  });
+
+  it.each([
+    ['missing block', { coupons: undefined }],
+    ['missing columns', { coupons: { data: [] } }],
+    ['invalid column', { coupons: { columns: [null], data: [] } }],
+    ['invalid row', { coupons: { columns: ['coupondate'], data: [null] } }],
+    [
+      'short row',
+      { coupons: { columns: ['coupondate', 'value'], data: [['2099-02-01']] } },
+    ],
+    [
+      'long row',
+      { coupons: { columns: ['coupondate'], data: [['2099-02-01', 2]] } },
+    ],
+    [
+      'empty cursor',
+      {
+        'coupons.cursor': { columns: ['INDEX', 'TOTAL', 'PAGESIZE'], data: [] },
+      },
+    ],
+    [
+      'missing cursor field',
+      { 'coupons.cursor': { columns: ['INDEX', 'TOTAL'], data: [[0, 1]] } },
+    ],
+    [
+      'null cursor index',
+      {
+        'coupons.cursor': {
+          columns: ['INDEX', 'TOTAL', 'PAGESIZE'],
+          data: [[null, 0, 1]],
+        },
+      },
+    ],
+    [
+      'boolean cursor total',
+      {
+        'coupons.cursor': {
+          columns: ['INDEX', 'TOTAL', 'PAGESIZE'],
+          data: [[0, false, 1]],
+        },
+      },
+    ],
+    [
+      'empty cursor total',
+      {
+        'coupons.cursor': {
+          columns: ['INDEX', 'TOTAL', 'PAGESIZE'],
+          data: [[0, '', 1]],
+        },
+      },
+    ],
+    [
+      'short page',
+      {
+        'coupons.cursor': {
+          columns: ['INDEX', 'TOTAL', 'PAGESIZE'],
+          data: [[0, 1, 1]],
+        },
+      },
+    ],
+  ])(
+    'rejects %s without returning a partial calendar',
+    async (_name, invalid) => {
+      jest
+        .spyOn(global, 'fetch')
+        .mockImplementation(() =>
+          Promise.resolve(Response.json({ ...emptyEvents, ...invalid })),
+        );
+      await expect(new MoexClient().bondEvents('BOND')).rejects.toMatchObject({
+        response: { code: 'MOEX_UNAVAILABLE' },
+      });
+    },
+  );
+
+  it.each([0, -1])(
+    'rejects nonpositive page size %s before repeating a fetch',
+    async (pageSize) => {
+      const starts: string[] = [];
+      jest.spyOn(global, 'fetch').mockImplementation((input) => {
+        const url = new URL(input instanceof Request ? input.url : input);
+        if (url.searchParams.get('iss.only')?.startsWith('coupons,')) {
+          starts.push(url.searchParams.get('start') ?? '');
+          if (starts.length > 1)
+            return Promise.reject(new Error('Repeated page'));
+        }
+        return Promise.resolve(
+          Response.json({
+            ...emptyEvents,
+            'coupons.cursor': {
+              columns: ['INDEX', 'TOTAL', 'PAGESIZE'],
+              data: [[0, 1, pageSize]],
+            },
+          }),
+        );
+      });
+      await expect(new MoexClient().bondEvents('BOND')).rejects.toMatchObject({
+        response: { code: 'MOEX_UNAVAILABLE' },
+      });
+      expect(starts).toEqual(['0']);
+    },
+  );
+
+  it.each([false, true])(
+    'reads all cursor pages and rejects a repeated index: %s',
+    async (repeatIndex) => {
+      const starts: string[] = [];
+      jest.spyOn(global, 'fetch').mockImplementation((input) => {
+        const url = new URL(input instanceof Request ? input.url : input);
+        const start = Number(url.searchParams.get('start'));
+        if (url.searchParams.get('iss.only')?.startsWith('coupons,')) {
+          starts.push(String(start));
+          if (starts.length > 2)
+            return Promise.reject(new Error('Repeated page'));
+        }
+        return Promise.resolve(
+          Response.json({
+            ...emptyEvents,
+            coupons: {
+              columns: ['coupondate', 'value', 'faceunit'],
+              data: [[`2099-02-0${start + 1}`, '2.000000001', 'SUR']],
+            },
+            'coupons.cursor': {
+              columns: ['INDEX', 'TOTAL', 'PAGESIZE'],
+              data: [[repeatIndex ? 0 : start, 2, 1]],
+            },
+          }),
+        );
+      });
+      const result = new MoexClient().bondEvents('BOND');
+      if (repeatIndex)
+        await expect(result).rejects.toMatchObject({
+          response: { code: 'MOEX_UNAVAILABLE' },
+        });
+      else
+        await expect(result).resolves.toEqual([
+          {
+            type: 'coupon',
+            date: '2099-02-01',
+            value: '2.000000001',
+            currency: 'RUB',
+          },
+          {
+            type: 'coupon',
+            date: '2099-02-02',
+            value: '2.000000001',
+            currency: 'RUB',
+          },
+        ]);
+      expect(starts).toEqual(['0', '1']);
+    },
+  );
 });

src/integrations/moex/moex.client.ts

@@ -123,22 +123,26 @@ export class MoexClient {
       rows.push(...current);
       if (!paginated) return rows;
       const cursorBlock = response[`${block}.cursor`];
-      if (!cursorBlock) {
+      if (cursorBlock === undefined) {
         if (current.length < FALLBACK_PAGE_SIZE) return rows;
         start += FALLBACK_PAGE_SIZE;
         continue;
       }
-      const cursor = parseRows(cursorBlock)[0];
+      const cursors = parseRows(cursorBlock);
+      const cursor = cursors[0];
       const index = integer(cursor?.index);
       const total = integer(cursor?.total);
       const pageSize = integer(cursor?.pagesize);
       if (
-        index === null ||
+        cursors.length !== 1 ||
+        index !== start ||
         total === null ||
         pageSize === null ||
-        index + pageSize >= total
+        pageSize === 0 ||
+        current.length !== Math.min(pageSize, total - start)
       )
-        return rows;
+        throw new ServiceUnavailableException({ code: 'MOEX_UNAVAILABLE' });
+      if (index + pageSize >= total) return rows;
       start = index + pageSize;
     }
   }
@@ -161,14 +165,13 @@ export class MoexClient {
 }
 
 function parseRows(block: IssBlock | undefined): Record<string, unknown>[] {
-  if (!block) return [];
-  if (!Array.isArray(block.columns) || !Array.isArray(block.data))
+  if (!Array.isArray(block?.columns) || !Array.isArray(block?.data))
     throw new ServiceUnavailableException({ code: 'MOEX_UNAVAILABLE' });
   const columns = block.columns;
   if (!columns.every((column) => typeof column === 'string'))
     throw new ServiceUnavailableException({ code: 'MOEX_UNAVAILABLE' });
   return block.data.map((values) => {
-    if (!Array.isArray(values))
+    if (!Array.isArray(values) || values.length !== columns.length)
       throw new ServiceUnavailableException({ code: 'MOEX_UNAVAILABLE' });
     return Object.fromEntries(
       columns.map((column, index) => [column.toLowerCase(), values[index]]),
@@ -191,6 +194,6 @@ function currencyText(value: unknown): string | null {
 }
 
 function integer(value: unknown): number | null {
-  const result = Number(value);
+  const result = Number(numberText(value) ?? NaN);
   return Number.isSafeInteger(result) && result >= 0 ? result : null;
 }