feat(boxstore): add configurable expiry for one-time downloads

Introduces a new configuration setting `one_time_download_expiry_seconds` to allow administrators to define a default expiration period for one-time downloads.

The retention logic in `boxstore` has been updated to use this global expiry value when a box is marked as a one-time download and no specific retention period is defined in the manifest.

lib/boxstore/store.go

@@ -31,8 +31,9 @@ const (
 )
 
 var (
-	uploadRoot = filepath.Join("data", "uploads")
-	manifestMu sync.Mutex
+	uploadRoot            = filepath.Join("data", "uploads")
+	oneTimeDownloadExpiry int64
+	manifestMu            sync.Mutex
 )
 
 var retentionOptions = []models.RetentionOption{
@@ -70,6 +71,10 @@ func SetUploadRoot(path string) {
 	uploadRoot = filepath.Clean(path)
 }
 
+func SetOneTimeDownloadExpiry(seconds int64) {
+	oneTimeDownloadExpiry = seconds
+}
+
 func UploadRoot() string {
 	return uploadRoot
 }
@@ -638,7 +643,17 @@ func startRetentionIfTerminalUnlocked(manifest *models.BoxManifest) {
 	if !manifest.ExpiresAt.IsZero() || len(manifest.Files) == 0 {
 		return
 	}
-	if manifest.OneTimeDownload {
+
+	seconds := manifest.RetentionSecs
+	if seconds <= 0 {
+		if manifest.OneTimeDownload {
+			seconds = oneTimeDownloadExpiry
+		} else {
+			seconds = normalizeRetentionOption(manifest.RetentionKey).Seconds
+		}
+	}
+
+	if manifest.OneTimeDownload && seconds <= 0 {
 		return
 	}
 
@@ -648,10 +663,7 @@ func startRetentionIfTerminalUnlocked(manifest *models.BoxManifest) {
 		}
 	}
 
-	seconds := manifest.RetentionSecs
-	if seconds <= 0 {
-		seconds = normalizeRetentionOption(manifest.RetentionKey).Seconds
-	}
+	// seconds is already handled above
 
 	// Retention starts after uploads settle so slow or very large uploads do
 	// not expire before users get a real chance to open the box.