test(e2e): replace legacy specs with oneshot flow coverage

Co-authored-by: MinecraftFuns <25814618+MinecraftFuns@users.noreply.github.com>
Agent-Logs-Url: https://github.com/BTreeMap/OneShot/sessions/9608e356-3f93-462c-8250-5a88f68f2acf

Author: Copilot

.github/workflows/ci.yml

@@ -37,18 +37,39 @@ jobs:
 
   web-tests:
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: oneshot
+          POSTGRES_PASSWORD: oneshot
+          POSTGRES_DB: oneshot_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U oneshot"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=10
+    env:
+      H4CKATH0N_DATABASE_URL: postgresql+asyncpg://oneshot:oneshot@localhost:5432/oneshot_test
     defaults:
       run:
         working-directory: web
     steps:
       - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
+      - run: uv sync
+        working-directory: api
       - run: npm ci
       - run: npm run test
+      - run: npx playwright install --with-deps chromium
+      - run: npx playwright test
 
   container-packaging:
     runs-on: ubuntu-latest

api/app/uploads/router.py

@@ -51,6 +51,10 @@ class OneShotUploadResponse(BaseModel):
     file_id: str
 
 
+class OneShotTokenStatusResponse(BaseModel):
+    valid: bool
+
+
 class OneShotTokenAuditItem(BaseModel):
     id: str
     target_email: str | None
@@ -234,6 +238,24 @@ async def oneshot_upload(
         await file.close()
 
 
+@router.get("/oneshot/token-status", response_model=OneShotTokenStatusResponse)
+async def oneshot_token_status(
+    authorization: str | None = Header(default=None),
+    db: AsyncSession = Depends(_db_dep),
+) -> OneShotTokenStatusResponse:
+    token_id = _extract_bearer_token(authorization)
+    valid = (
+        await db.execute(
+            select(func.count(OneShotToken.id)).where(
+                OneShotToken.id == token_id,
+                OneShotToken.is_used.is_(False),
+                OneShotToken.expires_at > func.now(),
+            )
+        )
+    ).scalar_one()
+    return OneShotTokenStatusResponse(valid=bool(valid))
+
+
 @router.get("/admin/oneshot-tokens", response_model=list[OneShotTokenAuditItem])
 async def list_oneshot_tokens(
     db: AsyncSession = Depends(_db_dep),

web/e2e/oneshot.spec.ts

@@ -0,0 +1,119 @@
+import { expect, test } from "@playwright/test";
+import { promises as fs } from "node:fs";
+
+const ADMIN_USERNAME = process.env.E2E_ADMIN_USERNAME ?? "admin";
+const ADMIN_PASSWORD = process.env.E2E_ADMIN_PASSWORD ?? "admin";
+
+function toLocalOneShotUrl(issuedLink: string, baseURL: string): string {
+  const parsed = new URL(issuedLink);
+  const token = new URLSearchParams(parsed.hash.replace(/^#/, "")).get("token");
+  if (!token) {
+    throw new Error(`Missing token in generated link: ${issuedLink}`);
+  }
+  return new URL(`/oneshot#token=${token}`, baseURL).toString();
+}
+
+async function loginAsAdmin(page: import("@playwright/test").Page): Promise<void> {
+  await page.goto("/login");
+  await page.getByTestId("login-username-input").fill(ADMIN_USERNAME);
+  await page.getByTestId("login-password-input").fill(ADMIN_PASSWORD);
+  await page.getByTestId("login-password-btn").click();
+  await expect(page).toHaveURL(/\/dashboard/, { timeout: 20_000 });
+  await page.goto("/admin");
+  await expect(page.getByRole("heading", { name: "Admin Panel" })).toBeVisible();
+}
+
+async function generateOneShotLink(
+  page: import("@playwright/test").Page,
+  baseURL: string,
+): Promise<string> {
+  await page.getByTestId("admin-generate-link").click();
+  const linkInput = page.getByTestId("admin-generated-link-input");
+  await expect(linkInput).toHaveValue(/#token=/, { timeout: 10_000 });
+  const issuedLink = await linkInput.inputValue();
+  return toLocalOneShotUrl(issuedLink, baseURL);
+}
+
+test.describe("OneShot E2E lifecycle", () => {
+  test("full lifecycle: generate link, external upload, admin audit + download", async ({
+    page,
+    browser,
+    baseURL,
+  }) => {
+    test.skip(!baseURL, "Playwright baseURL is required for URL normalization.");
+    await loginAsAdmin(page);
+    const oneShotUrl = await generateOneShotLink(page, baseURL!);
+
+    const fileName = "oneshot-e2e-upload.txt";
+    const fileContent = "oneshot e2e dummy payload";
+
+    const externalContext = await browser.newContext();
+    try {
+      const externalPage = await externalContext.newPage();
+      await externalPage.goto(oneShotUrl);
+      await expect(externalPage.getByLabel("Upload File")).toBeVisible();
+      await externalPage.setInputFiles('input[type="file"]', {
+        name: fileName,
+        mimeType: "text/plain",
+        buffer: Buffer.from(fileContent, "utf8"),
+      });
+      await externalPage.getByRole("button", { name: "Upload" }).click();
+      await expect(externalPage.getByText("Upload complete")).toBeVisible();
+    } finally {
+      await externalContext.close();
+    }
+
+    await page.reload();
+    await page.getByTestId("admin-audit-logs-tab").click();
+    const fileRow = page.locator("tr", { hasText: fileName }).first();
+    await expect(fileRow).toBeVisible({ timeout: 20_000 });
+
+    const downloadPromise = page.waitForEvent("download");
+    await fileRow.getByRole("button", { name: "Download" }).click();
+    const download = await downloadPromise;
+    expect(download.suggestedFilename()).toBe(fileName);
+
+    const outPath = test.info().outputPath(fileName);
+    await download.saveAs(outPath);
+    const downloaded = await fs.readFile(outPath, "utf8");
+    expect(downloaded).toBe(fileContent);
+  });
+
+  test("ephemerality lockout: reused link shows expired state and blocks file selection", async ({
+    page,
+    browser,
+    baseURL,
+  }) => {
+    test.skip(!baseURL, "Playwright baseURL is required for URL normalization.");
+    await loginAsAdmin(page);
+    const oneShotUrl = await generateOneShotLink(page, baseURL!);
+
+    const firstContext = await browser.newContext();
+    try {
+      const firstPage = await firstContext.newPage();
+      await firstPage.goto(oneShotUrl);
+      await expect(firstPage.getByLabel("Upload File")).toBeVisible();
+      await firstPage.setInputFiles('input[type="file"]', {
+        name: "oneshot-first-use.txt",
+        mimeType: "text/plain",
+        buffer: Buffer.from("first upload", "utf8"),
+      });
+      await firstPage.getByRole("button", { name: "Upload" }).click();
+      await expect(firstPage.getByText("Upload complete")).toBeVisible();
+    } finally {
+      await firstContext.close();
+    }
+
+    const secondContext = await browser.newContext();
+    try {
+      const secondPage = await secondContext.newPage();
+      await secondPage.goto(oneShotUrl);
+      await expect(secondPage.getByText("Link Expired or Invalid")).toBeVisible({
+        timeout: 15_000,
+      });
+      await expect(secondPage.getByLabel("Upload File")).toBeDisabled();
+    } finally {
+      await secondContext.close();
+    }
+  });
+});