diff --git a/package.json b/package.json
index 6d72719..4ff0607 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.91",
+  "version": "0.5.92",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {
diff --git a/v2/server.js b/v2/server.js
index db81d99..0f40145 100644
--- a/v2/server.js
+++ b/v2/server.js
@@ -65,9 +65,11 @@ function createV2Router() {
   // ── GET /v2/ ─────────────────────────────────────────────────────────────
   router.get('/', (req, res) => res.redirect('/v2/app'));
 
-  // ── /v2/test/api — тестовый эндпоинт для CRUD
-  const { createTestRouter } = require('./src/test');
-  router.use('/test', createTestRouter());
+  // ── /v2/test — тестовый эндпоинт (отключить: ENABLE_TEST_API=false) ──
+  if (process.env.ENABLE_TEST_API !== 'false') {
+    const { createTestRouter } = require('./src/test');
+    router.use('/test', createTestRouter());
+  }
 
   // ── GET /v2/logout ───────────────────────────────────────────────────────
 
diff --git a/v2/src/config/index.js b/v2/src/config/index.js
index 6274583..84f0cc8 100644
--- a/v2/src/config/index.js
+++ b/v2/src/config/index.js
@@ -6,7 +6,7 @@
 // ═══════════════════════════════════════════════════════════════════════════════
 
 module.exports = {
-  version: '0.5.91',
+  version: '0.5.92',
   iamUrl:  process.env.V2_IAM_API_URL || 'https://auth-api.ngcloud.ru',
   appUrl:  process.env.V2_APP_URL      || 'https://whitelist.nodejsk8s.services.ngcloud.ru',
 };
diff --git a/v2/src/test/index.js b/v2/src/test/index.js
index f2f0e72..a6205d6 100644
--- a/v2/src/test/index.js
+++ b/v2/src/test/index.js
@@ -84,6 +84,52 @@ function createTestRouter() {
           return res.json({ ok: true });
         }
 
+        // ── USERFLOW — полная эмуляция юзера через все слои ──
+        case 'userFlow': {
+          const sub = req.query.sub;          // add | edit | delete | list
+          const cidr = req.query.cidr || '';
+          const comment = req.query.comment || '';
+          const entryId = parseInt(req.query.id) || null;
+
+          // Мок сессии + контекст (как после KC+IAM+resolveContext)
+          req.session = req.session || {};
+          req.session.user = {
+            email, clientId, activeClientId: clientId,
+            allClientIds: [clientId], companyName: clientId,
+            isAdmin: user.isAdmin || false,
+            profiles: [{ client_id: clientId, company_name: clientId }],
+            fio: 'Test User'
+          };
+          req.email = email;
+          req.clientId = clientId;
+          req.companyName = clientId;
+          req.isAdmin = user.isAdmin || false;
+          req.profiles = [{ client_id: clientId, company_name: clientId }];
+          req.impersonatedBy = impBy;
+
+          try {
+            if (sub === 'add') {
+              const r = await crud.add(clientId, cidr, comment, email, impBy);
+              return res.json({ ok: true, layer: 'user→crud→db', action: 'add', entry: r.entry, wasNormalized: r.wasNormalized });
+            }
+            if (sub === 'edit' && entryId) {
+              const r = await crud.edit(entryId, clientId, cidr, comment, email, impBy);
+              return res.json({ ok: true, layer: 'user→crud→db', action: 'edit', entry: r.entry, wasNormalized: r.wasNormalized });
+            }
+            if (sub === 'delete' && entryId) {
+              await crud.remove(entryId, clientId, email, impBy);
+              return res.json({ ok: true, layer: 'user→crud→db', action: 'delete' });
+            }
+            if (sub === 'list') {
+              const { entries, used, limit } = await crud.list(clientId);
+              return res.json({ ok: true, layer: 'user→crud→db', action: 'list', entries, count: entries.length, used, limit });
+            }
+            return res.json({ ok: false, error: 'userFlow sub: add|edit|delete|list (id для edit/delete)' });
+          } catch (e) {
+            return res.json({ ok: false, layer: 'user→crud→db', error: e.message });
+          }
+        }
+
         default:
           return res.json({ ok: false, error: 'unknown action: ' + action });
       }