feat: complete oneshot admin UI lockdown and tests

Co-authored-by: MinecraftFuns <25814618+MinecraftFuns@users.noreply.github.com>
Agent-Logs-Url: https://github.com/BTreeMap/OneShot/sessions/ea07d94d-5875-4bb9-92b6-20551f2697bb

Author: Copilot

api/app/uploads/router.py

@@ -32,15 +32,29 @@
 LOCAL_UPLOAD_DIR = Path(os.getenv("LOCAL_UPLOAD_DIR", "./uploads"))
 ONESHOT_PUBLIC_DOMAIN = os.getenv("ONESHOT_PUBLIC_DOMAIN", "localhost:5173")
 SMTP_HOST = os.getenv("ONESHOT_SMTP_HOST", "")
-SMTP_PORT = int(os.getenv("ONESHOT_SMTP_PORT", "587"))
 SMTP_USERNAME = os.getenv("ONESHOT_SMTP_USERNAME", "")
 SMTP_PASSWORD = os.getenv("ONESHOT_SMTP_PASSWORD", "")
 SMTP_FROM = os.getenv("ONESHOT_SMTP_FROM", "no-reply@oneshot.local")
+SMTP_USE_SSL = os.getenv("ONESHOT_SMTP_USE_SSL", "false").lower() in {
+    "1",
+    "true",
+    "yes",
+}
+SMTP_TIMEOUT_SECONDS = float(os.getenv("ONESHOT_SMTP_TIMEOUT", "10"))
 
 router = APIRouter()
 logger = logging.getLogger(__name__)
 
 
+def _smtp_port() -> int:
+    raw = os.getenv("ONESHOT_SMTP_PORT", "587")
+    try:
+        return int(raw)
+    except ValueError:
+        logger.warning("Invalid ONESHOT_SMTP_PORT=%r; falling back to 587", raw)
+        return 587
+
+
 class CreateOneShotTokenRequest(BaseModel):
     target_email: str | None = None
 
@@ -73,10 +87,10 @@ def _oneshot_link(token_id: str) -> str:
     return f"https://{ONESHOT_PUBLIC_DOMAIN}/oneshot#token={token_id}"
 
 
-async def _send_oneshot_email(target_email: str, link: str) -> None:
+async def _send_oneshot_email(target_email: str, link: str) -> bool:
     if not SMTP_HOST:
         logger.warning("OneShot email dispatch skipped: ONESHOT_SMTP_HOST is not configured")
-        return
+        return False
 
     message = EmailMessage()
     message["Subject"] = "Secure OneShot Upload Link"
@@ -92,13 +106,33 @@ async def _send_oneshot_email(target_email: str, link: str) -> None:
     )
 
     try:
-        with smtplib.SMTP(SMTP_HOST, SMTP_PORT, timeout=10) as smtp:
-            smtp.starttls()
+        if SMTP_USE_SSL:
+            smtp_ctx = smtplib.SMTP_SSL(
+                SMTP_HOST,
+                _smtp_port(),
+                timeout=SMTP_TIMEOUT_SECONDS,
+            )
+        else:
+            smtp_ctx = smtplib.SMTP(
+                SMTP_HOST,
+                _smtp_port(),
+                timeout=SMTP_TIMEOUT_SECONDS,
+            )
+
+        with smtp_ctx as smtp:
+            if not SMTP_USE_SSL:
+                code, _message = smtp.starttls()
+                if code not in {220, 250}:
+                    raise smtplib.SMTPException(
+                        f"STARTTLS handshake failed with SMTP code {code}"
+                    )
             if SMTP_USERNAME and SMTP_PASSWORD:
                 smtp.login(SMTP_USERNAME, SMTP_PASSWORD)
             smtp.send_message(message)
+        return True
     except Exception:
         logger.exception("Failed to dispatch OneShot email to %s", target_email)
+        return False
 
 
 @router.post(

web/src/pages/Admin.tsx

@@ -18,12 +18,14 @@ export function Admin() {
   const [isLoading, setIsLoading] = useState(false);
   const [generatedLink, setGeneratedLink] = useState<string | null>(null);
   const [successMessage, setSuccessMessage] = useState<string | null>(null);
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
 
   const onGenerate = async (e: FormEvent) => {
     e.preventDefault();
     setIsLoading(true);
     setGeneratedLink(null);
     setSuccessMessage(null);
+    setErrorMessage(null);
     try {
       const response = await fetch("/api/admin/oneshot-tokens", {
         method: "POST",
@@ -33,9 +35,13 @@ export function Admin() {
       const data = (await response.json()) as {
         sent?: boolean;
         link?: string;
+        detail?: string;
       };
       if (!response.ok) {
-        throw new Error("Failed to generate one-shot link");
+        throw new Error(
+          data.detail ??
+            `Failed to generate one-shot link (status: ${response.status})`,
+        );
       }
       if (data.sent) {
         setSuccessMessage("Link successfully dispatched to user email.");
@@ -44,8 +50,12 @@ export function Admin() {
       if (data.link) {
         setGeneratedLink(data.link);
       }
-    } catch {
-      // Keep UI state unchanged on failure; generate flow can be retried.
+    } catch (e) {
+      setErrorMessage(
+        e instanceof Error
+          ? e.message
+          : "Failed to generate one-shot link. Please try again.",
+      );
     } finally {
       setIsLoading(false);
     }
@@ -97,6 +107,7 @@ export function Admin() {
         </CardHeader>
         <CardContent className="space-y-4">
           {successMessage && <Alert variant="success">{successMessage}</Alert>}
+          {errorMessage && <Alert variant="error">{errorMessage}</Alert>}
           <form onSubmit={onGenerate} className="space-y-4">
             <Input
               id="target-email"