Deploy backend updates

backend/.env.example

@@ -0,0 +1,19 @@
+# Gmail SMTP settings for contact-form delivery.
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=virdiakash77@gmail.com
+# Use a Google App Password (16 characters), not your normal Gmail password.
+SMTP_PASSWORD=replace_with_google_app_password
+SMTP_FROM=virdiakash77@gmail.com
+CONTACT_EMAIL_TO=virdiakash77@gmail.com
+
+# Razorpay payment gateway settings.
+# Use test keys first. Never expose RAZORPAY_KEY_SECRET in frontend code.
+RAZORPAY_KEY_ID=rzp_test_replace_with_key_id
+RAZORPAY_KEY_SECRET=replace_with_razorpay_key_secret
+# Razorpay amount is in paise: 99900 = ₹999.00, 100 = ₹1.00 for testing
+PRO_PLAN_AMOUNT_PAISE=99900
+PRO_PLAN_CURRENCY=INR
+PRO_PLAN_NAME=FakeShield Pro Shield
+# 120 days is roughly 4 months.
+PRO_PLAN_DURATION_DAYS=120

backend/app/config.py

@@ -12,6 +12,7 @@ class Settings(BaseSettings):
     SMTP_USER:           str  = ""
     SMTP_PASSWORD:       str  = ""
     SMTP_FROM:           str  = "fakeshield@yourproject.com"
+    CONTACT_EMAIL_TO:    str  = "virdiakash77@gmail.com"
 
     # App
     ENVIRONMENT: str = "development"

backend/app/database.py

@@ -29,6 +29,7 @@ video_results_collection = DummyCollection("video_forensics")
 audio_results_collection = DummyCollection("audio_forensics")
 image_results_collection = DummyCollection("image_forensics")
 text_results_collection = DummyCollection("text_forensics")
+activity_logs_collection = DummyCollection("activity_logs")
 
 try:
     # Create the Async MongoDB Client with a short timeout
@@ -41,6 +42,7 @@ try:
     audio_results_collection = db.get_collection("audio_forensics")
     image_results_collection = db.get_collection("image_forensics")
     text_results_collection = db.get_collection("text_forensics")
+    activity_logs_collection = db.get_collection("activity_logs")
     print("[DB] MongoDB Client Initialized (Proxied).")
 except Exception as e:
     print(f"[DB] Initial setup error: {e}")
@@ -58,7 +60,7 @@ async def init_db():
         collections = [
             users_collection, video_results_collection, 
             audio_results_collection, image_results_collection, 
-            text_results_collection
+            text_results_collection, activity_logs_collection
         ]
         
         for col in collections:

backend/app/dependencies.py

@@ -1,11 +1,50 @@
 from fastapi import Header, HTTPException, Depends
 import jwt
 import os
+from datetime import datetime, timezone
 from app.database import users_collection
 
 SECRET_KEY = os.getenv("JWT_SECRET", "super-secret-fakeshield-key-for-project")
 ALGORITHM = "HS256"
 
+def _as_utc_datetime(value):
+    if value is None:
+        return None
+    if isinstance(value, datetime):
+        return value.replace(tzinfo=timezone.utc) if value.tzinfo is None else value.astimezone(timezone.utc)
+    if isinstance(value, str):
+        try:
+            normalized = value.replace("Z", "+00:00")
+            parsed = datetime.fromisoformat(normalized)
+            return parsed.replace(tzinfo=timezone.utc) if parsed.tzinfo is None else parsed.astimezone(timezone.utc)
+        except ValueError:
+            return None
+    return None
+
+def is_subscription_active(user: dict) -> bool:
+    if user.get("subscription_tier") != "paid":
+        return False
+
+    expires_at = _as_utc_datetime(user.get("subscription_expires_at"))
+    if not expires_at:
+        return False
+
+    return expires_at > datetime.now(timezone.utc)
+
+def serialize_subscription_expires_at(user: dict):
+    expires_at = _as_utc_datetime(user.get("subscription_expires_at"))
+    return expires_at.isoformat().replace("+00:00", "Z") if expires_at else None
+
+def public_user_payload(user: dict) -> dict:
+    active = is_subscription_active(user)
+    return {
+        "name": user.get("fullName") or user.get("name") or user.get("full_name"),
+        "email": user.get("email"),
+        "subscription_tier": "paid" if active else "free",
+        "subscription_expires_at": serialize_subscription_expires_at(user) if active else None,
+        "profile_pic": user.get("profile_pic"),
+    }
+
 async def get_current_user(authorization: str = Header(None)):
     if not authorization:
         raise HTTPException(status_code=401, detail="Authorization header missing")
@@ -22,8 +61,7 @@ async def get_current_user(authorization: str = Header(None)):
     try:
         user = await users_collection.find_one({"email": email})
         if user is None:
-            # Bypass for Offline Mode / Development
-            print(f"[AUTH] User {email} not in DB. Granting Guest access.")
+            print(f"[AUTH] User {email} not in DB. Granting limited guest access.")
             return {
                 "email": email, 
                 "full_name": "Guest User", 
@@ -32,18 +70,18 @@ async def get_current_user(authorization: str = Header(None)):
             }
         return user
     except Exception as e:
-        print(f"[AUTH] DB Error during auth: {e}. Granting Guest access.")
+        print(f"[AUTH] DB Error during auth: {e}. Granting limited guest access.")
         return {
-            "email": "offline_user@fakeshield.local", 
-            "full_name": "Offline Tester", 
-            "subscription_tier": "paid", # Grant pro for testing
+            "email": email,
+            "full_name": "Offline Tester",
+            "subscription_tier": "free",
             "is_offline": True
         }
 
 async def verify_paid_tier(user: dict = Depends(get_current_user)):
-    if user.get("subscription_tier") != "paid":
+    if not is_subscription_active(user):
         raise HTTPException(
             status_code=403, 
-            detail="This feature requires a Pro subscription. Please upgrade to access."
+            detail="This feature requires an active Pro subscription. Please upgrade to access."
         )
     return user

backend/app/main.py

@@ -90,8 +90,11 @@ def robust_print(msg, **kwargs):
 import transformers
 transformers.logging.set_verbosity_error()
 
+from pathlib import Path
 from dotenv import load_dotenv
-load_dotenv()
+
+BACKEND_DIR = Path(__file__).resolve().parents[1]
+load_dotenv(BACKEND_DIR / ".env")
 
 import os
 import importlib
@@ -136,6 +139,7 @@ from app.routers.video_router import router as video_router
 from app.routers.audio_router import router as audio_router
 from app.routers.auth_router import router as auth_router
 from app.routers.dashboard_router import router as dashboard_router
+from app.routers.contact_router import router as contact_router
 # Forensic warm-up functions moved to background task to prevent startup hangs
 # (Imports moved inside the task below)
 
@@ -161,6 +165,7 @@ app.include_router(video_router, prefix="/api/v1")
 app.include_router(audio_router, prefix="/api/v1")
 app.include_router(auth_router)
 app.include_router(dashboard_router)
+app.include_router(contact_router)
 
 import asyncio
 

backend/app/models/suggestion_engine.py

@@ -0,0 +1,102 @@
+from typing import Any, Dict, List
+from app.config import settings
+
+
+def _build_rule_suggestions(verdict: str, indicators: List[str], word_count: int) -> List[str]:
+    verdict = verdict.upper()
+    suggestions: List[str] = []
+
+    if verdict in ("AI GENERATED", "LIKELY AI"):
+        suggestions = [
+            "Add personal anecdotes, first-person details, and real-world context to break the synthetic pattern.",
+            "Vary sentence length and structure to avoid uniform AI-style rhythm.",
+            "Use conversational phrasing, contractions, and less formal wording.",
+            "Introduce subtle human emotion, sensory detail, or a personal opinion to make the writing feel more authentic."
+        ]
+
+        if any("Low perplexity" in ind for ind in indicators):
+            suggestions.insert(1, "Increase lexical diversity and avoid repetitive or predictable phrasing.")
+        if any("Uniform sentence rhythm" in ind for ind in indicators):
+            suggestions.insert(2, "Introduce more irregular sentence flow with natural pauses and variation.")
+        if any("Binoculars zero-shot" in ind for ind in indicators):
+            suggestions.append("Shift away from statistical-sounding phrasing toward concrete, humanized language.")
+
+    elif verdict == "UNCERTAIN":
+        suggestions = [
+            "If you want a more human voice, add unique details, varied tone, and irregular sentence cadence.",
+            "If you want a polished AI-style tone, make the language more consistent and formal.",
+            "Use vivid examples and conversational transitions to reduce ambiguity.",
+            "Balance structure with occasional human-style breaks such as rhetorical questions or shorter sentences."
+        ]
+
+    else:
+        suggestions = [
+            "Preserve your natural voice and sentence variety; this supports a human writing profile.",
+            "Use concrete examples, specific context, and varied punctuation for authentic human style.",
+            "Keep the dynamic rhythm and lexical richness that make the text feel organic.",
+            "Avoid overly formal or repetitive phrases unless you want a polished editorial tone."
+        ]
+
+        if any("High linguistic entropy" in ind for ind in indicators):
+            suggestions.insert(1, "Keep the rich vocabulary and creative phrasing that signal human authorship.")
+        if any("Dynamic rhythmic variance" in ind for ind in indicators):
+            suggestions.append("Preserve the irregular sentence cadence that gives this text a natural flow.")
+
+    if word_count < 150:
+        suggestions.append("Use more than 150 words for a more reliable forensic assessment.")
+
+    return suggestions
+
+
+def _generate_ai_suggestions(text: str, verdict: str, indicators: List[str]) -> List[str]:
+    if not settings.GEMINI_API_KEY or len(text.strip()) < 80:
+        return []
+
+    try:
+        import google.generativeai as genai
+        genai.configure(api_key=settings.GEMINI_API_KEY)
+
+        model_name = settings.GEMINI_MODEL or "gemini-2.0-flash"
+        model = genai.GenerativeModel(model_name)
+
+        prompt = (
+            "You are a practical writing assistant. Based on the following text verdict and indicators, "
+            "provide 4 short improvement suggestions. Return only a JSON array of strings.\n\n"
+            f"Verdict: {verdict}\n"
+            f"Indicators: {', '.join(indicators) or 'none'}\n"
+            "Text sample: """" + text[:1200] + """"\n"
+            "JSON:" 
+        )
+
+        response = model.generate_content(
+            prompt,
+            generation_config={"max_output_tokens": 180, "temperature": 0.7}
+        )
+
+        raw = response.text.strip()
+        raw = raw.replace('```json', '').replace('```', '').strip()
+
+        import json
+        suggestions = json.loads(raw)
+        if isinstance(suggestions, list) and all(isinstance(item, str) for item in suggestions):
+            return suggestions
+    except Exception:
+        pass
+
+    return []
+
+
+def generate_text_improvement_suggestions(result: Dict[str, Any], text: str = "") -> List[str]:
+    verdict = str(result.get("verdict", "UNCERTAIN")).upper()
+    indicators = result.get("indicators") or []
+    if not isinstance(indicators, list):
+        indicators = [str(indicators)]
+
+    word_count = result.get("word_count") or len(text.split())
+    suggestions = _build_rule_suggestions(verdict, [str(i) for i in indicators], word_count)
+
+    ai_suggestions = _generate_ai_suggestions(text, verdict, [str(i) for i in indicators])
+    if ai_suggestions:
+        return ai_suggestions
+
+    return suggestions

backend/app/models/text_classifier_ensemble.py

@@ -19,6 +19,7 @@ from transformers import AutoTokenizer, AutoModelForSequenceClassification, GPT2
 from sentence_transformers import SentenceTransformer
 from scipy.spatial.distance import cosine
 from app.config import settings
+from app.models.suggestion_engine import generate_text_improvement_suggestions
 
 # --- Internal Engines ---
 from app.models.binoculars import Binoculars
@@ -453,6 +454,15 @@ def ensemble_predict(text: str, mode: str = "v14") -> Dict[str, Any]:
             "perplexity": float(gpt2_res["raw_perplexity"]) # Global proxy
         })
 
+    improvement_suggestions = generate_text_improvement_suggestions(
+        {
+            "verdict": verdict,
+            "indicators": indicators,
+            "word_count": word_count,
+        },
+        text
+    )
+
     return {
         "scan_id": f"fs-v14-{os.urandom(4).hex()}",
         "verdict": verdict,
@@ -467,6 +477,7 @@ def ensemble_predict(text: str, mode: str = "v14") -> Dict[str, Any]:
         "word_count": word_count,
         "engine_version": "v14.0-Elite-Classic",
         "sentence_highlights": highlights,
+        "improvement_suggestions": improvement_suggestions,
         "structural_details": {
             "avg_depth": 0, "depth_variance": round(depth_variance, 2),
             "structural_entropy": round(gpt2_res["raw_perplexity"], 2),

backend/app/routers/auth_router.py

@@ -1,22 +1,76 @@
-from fastapi import APIRouter, HTTPException, Depends, status
+from fastapi import APIRouter, HTTPException, Depends, status, Request
 from pymongo.errors import ServerSelectionTimeoutError
 
 from pydantic import BaseModel, EmailStr
 from typing import Optional
 from passlib.context import CryptContext
 from datetime import datetime, timedelta
+from pathlib import Path
 import jwt
 import os
 import httpx
-from app.database import users_collection
-from app.dependencies import get_current_user
+import hmac
+import hashlib
+import secrets
+import aiosmtplib
+import asyncio
+from email.mime.multipart import MIMEMultipart
+from email.mime.text import MIMEText
+from dotenv import load_dotenv
+from app.database import (
+    users_collection, 
+    activity_logs_collection,
+    video_results_collection,
+    audio_results_collection,
+    image_results_collection,
+    text_results_collection
+)
+from app.dependencies import get_current_user, public_user_payload
+
+BACKEND_DIR = Path(__file__).resolve().parents[2]
+load_dotenv(BACKEND_DIR / ".env")
 
 router = APIRouter(prefix="/api/v1/auth", tags=["Authentication"])
 
 pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
 SECRET_KEY = os.getenv("JWT_SECRET", "super-secret-fakeshield-key-for-project")
 ALGORITHM = "HS256"
-ACCESS_TOKEN_EXPIRE_MINUTES = 60 * 24 * 7 # 7 days
+ACCESS_TOKEN_EXPIRE_MINUTES = 60 * 24 * 7   # 7 days  (normal)
+REMEMBER_ME_EXPIRE_MINUTES  = 60 * 24 * 30  # 30 days (remember-me)
+OTP_EXPIRE_MINUTES = 15
+
+# ── Universal SMTP Email Configuration (12-Factor App Standard) ──
+SMTP_HOST     = os.getenv("SMTP_HOST",     "smtp.gmail.com")
+SMTP_PORT     = int(os.getenv("SMTP_PORT", "587"))
+SMTP_USER     = os.getenv("SMTP_USER",     "")
+SMTP_PASSWORD = os.getenv("SMTP_PASSWORD", "")
+SMTP_FROM     = os.getenv("SMTP_FROM",     SMTP_USER)
+
+async def send_email(to_email: str, subject: str, html_body: str):
+    """Industry-standard async SMTP delivery."""
+    if not SMTP_USER or not SMTP_PASSWORD:
+        print(f"[MAIL WARN] SMTP credentials missing. To: {to_email} | Sub: {subject}")
+        print(f"[MAIL CONSOLE DEV MODE]\n{html_body}\n")
+        return
+
+    msg = MIMEMultipart("alternative")
+    msg["Subject"] = subject
+    msg["From"] = f"FakeShield <{SMTP_FROM}>"
+    msg["To"] = to_email
+    msg.attach(MIMEText(html_body, "html"))
+
+    try:
+        await aiosmtplib.send(
+            msg,
+            hostname=SMTP_HOST,
+            port=SMTP_PORT,
+            start_tls=True,
+            username=SMTP_USER,
+            password=SMTP_PASSWORD,
+        )
+        print(f"[MAIL LOG] Successfully delivered email to {to_email}")
+    except Exception as e:
+        print(f"[MAIL ERROR] Failed to send email via SMTP: {e}")
 
 class UserSignup(BaseModel):
     fullName: str
@@ -26,6 +80,19 @@ class UserSignup(BaseModel):
 class UserLogin(BaseModel):
     email: EmailStr
     password: str
+    remember_me: bool = False
+
+class ForgotPasswordRequest(BaseModel):
+    email: EmailStr
+
+class ResetPasswordRequest(BaseModel):
+    token: str
+    new_password: str
+
+class UpdatePreferencesRequest(BaseModel):
+    email_scan_complete: bool
+    email_suspicious_login: bool
+    email_monthly_report: bool
 
 class OAuthLogin(BaseModel):
     provider: str
@@ -34,15 +101,29 @@ class OAuthLogin(BaseModel):
     profile_pic: Optional[str] = None
     code: Optional[str] = None
 
+class UpdateProfileRequest(BaseModel):
+    fullName: Optional[str] = None
+    email: Optional[EmailStr] = None
+
+class ChangePasswordConfirmRequest(BaseModel):
+    new_password: str
+    otp: str
+
+class RazorpayVerifyRequest(BaseModel):
+    razorpay_order_id: str
+    razorpay_payment_id: str
+    razorpay_signature: str
+
 def verify_password(plain_password, hashed_password):
     return pwd_context.verify(plain_password, hashed_password)
 
 def get_password_hash(password):
     return pwd_context.hash(password)
 
-def create_access_token(data: dict):
+def create_access_token(data: dict, remember_me: bool = False):
     to_encode = data.copy()
-    expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
+    minutes = REMEMBER_ME_EXPIRE_MINUTES if remember_me else ACCESS_TOKEN_EXPIRE_MINUTES
+    expire = datetime.utcnow() + timedelta(minutes=minutes)
     to_encode.update({"exp": expire})
     encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
     if isinstance(encoded_jwt, bytes):
@@ -50,8 +131,8 @@ def create_access_token(data: dict):
     return encoded_jwt
 
 def get_subscription_tier(email: str):
-    paid_emails = ["virdisaab419@gmail.com", "virdiakash77@gmail.com"]
-    return "paid" if email.lower() in paid_emails else "free"
+    # New accounts start free. Pro is activated only after Razorpay verification.
+    return "free"
 
 @router.post("/signup")
 async def signup(user: UserSignup):
@@ -82,6 +163,27 @@ async def signup(user: UserSignup):
     
     await users_collection.insert_one(user_dict)
     
+    # Send Welcome Email
+    welcome_body = f"""
+    <div style="font-family:Arial,sans-serif;max-width:480px;margin:auto;padding:32px;border-radius:2rem;background:#0f1117;color:#e2e8f0;border:1px solid #1e293b;text-align:center">
+      <div style="width:56px;height:56px;border-radius:1rem;background:linear-gradient(135deg, #00E5CC, #8b5cf6);margin:0 auto 20px auto;color:#ffffff;font-size:24px;font-weight:bold;line-height:56px">FS</div>
+      <h2 style="color:#00E5CC;margin-bottom:12px">Welcome to FakeShield!</h2>
+      <p style="color:#94a3b8;font-size:14px;line-height:1.6;margin-bottom:24px">
+        Hey <strong>{user.fullName}</strong>, thank you for joining the FakeShield Forensic Suite. Your account associated with <strong>{user.email}</strong> is now active.
+      </p>
+      <div style="background:#1e2130;border-radius:1rem;padding:20px;text-align:left;font-size:13px;color:#cbd5e1">
+         <div style="margin-bottom:8px"><strong>🛡️ Forensic Tools Available:</strong></div>
+         <ul style="margin:0;padding-left:16px;color:#94a3b8;line-height:1.5">
+           <li>Deepfake Video &amp; Audio Detection</li>
+           <li>Metadata &amp; Forensic Lens analysis</li>
+           <li>Detailed PDF Reports generation</li>
+         </ul>
+      </div>
+      <p style="margin-top:24px;color:#64748b;font-size:11px">If you did not create this account, please contact support immediately.</p>
+    </div>
+    """
+    asyncio.create_task(send_email(user.email, "Welcome to FakeShield!", welcome_body))
+    
     # Generate token
     access_token = create_access_token(data={"sub": user.email})
     return {
@@ -94,22 +196,65 @@ async def signup(user: UserSignup):
         }
     }
 
+def parse_user_agent(ua_string: str) -> str:
+    ua = ua_string.lower()
+    os_name = "Unknown"
+    browser = "Unknown"
+    if "windows" in ua: os_name = "Windows"
+    elif "mac" in ua: os_name = "macOS"
+    elif "linux" in ua: os_name = "Linux"
+    elif "iphone" in ua or "ipad" in ua: os_name = "iOS"
+    elif "android" in ua: os_name = "Android"
+    
+    if "edg" in ua: browser = "Edge"
+    elif "chrome" in ua: browser = "Chrome"
+    elif "safari" in ua and "chrome" not in ua: browser = "Safari"
+    elif "firefox" in ua: browser = "Firefox"
+    
+    if os_name == "Unknown" and browser == "Unknown":
+        return "Unknown Device"
+    return f"{browser} on {os_name}"
+
+async def log_user_activity(email: str, event: str, request: Request):
+    ip = request.client.host if request and request.client else "Unknown IP"
+    if ip in ["127.0.0.1", "::1", "localhost", "Unknown IP"]:
+        location = "Local Network"
+    else:
+        location = "Mumbai, IN"  # Mock default for public IPs mapped in demo
+        
+    ua_raw = request.headers.get("user-agent", "")
+    device_os = parse_user_agent(ua_raw)
+    
+    activity = {
+        "email": email,
+        "event": event,
+        "ip": ip,
+        "device": device_os,
+        "location": location,
+        "timestamp": datetime.utcnow()
+    }
+    try:
+        await activity_logs_collection.insert_one(activity)
+    except:
+        pass
+
 @router.post("/login")
-async def login(user: UserLogin):
+async def login(user: UserLogin, request: Request):
     try:
         db_user = await users_collection.find_one({"email": user.email})
     except Exception as e:
         # DB offline — issue an offline JWT so the user can still use the app
         print(f"[AUTH] DB offline during login: {e}. Issuing offline token.", flush=True)
         tier = get_subscription_tier(user.email)
-        access_token = create_access_token(data={"sub": user.email})
+        access_token = create_access_token(data={"sub": user.email}, remember_me=user.remember_me)
         return {
             "access_token": access_token,
             "token_type": "bearer",
+            "remember_me": user.remember_me,
             "user": {
                 "name": user.email.split("@")[0].title(),
                 "email": user.email,
-                "subscription_tier": "paid"  # Grant full access in offline mode
+                "subscription_tier": "free"
             }
         }
 
@@ -128,10 +273,32 @@ async def login(user: UserLogin):
         except:
             pass
 
-    access_token = create_access_token(data={"sub": db_user["email"]})
+    # Send Successful Login Alert
+    login_time = datetime.utcnow().strftime("%Y-%m-%d %H:%M:%S")
+    login_body = f"""
+    <div style="font-family:Arial,sans-serif;max-width:480px;margin:auto;padding:32px;border-radius:2rem;background:#0f1117;color:#e2e8f0;border:1px solid #1e293b">
+      <div style="width:56px;height:56px;border-radius:1rem;background:linear-gradient(135deg, #00E5CC, #8b5cf6);margin:0 auto 20px auto;color:#ffffff;font-size:24px;font-weight:bold;line-height:56px;text-align:center">FS</div>
+      <h2 style="color:#00E5CC;margin-bottom:12px;text-align:center">Successful Login Security Alert</h2>
+      <p style="color:#94a3b8;font-size:14px;line-height:1.6;margin-bottom:24px;text-align:center">
+        We detected a successful login to your FakeShield account (<strong>{db_user["email"]}</strong>).
+      </p>
+      <div style="background:#1e2130;border-radius:1rem;padding:20px;font-size:13px;color:#cbd5e1">
+         <div style="margin-bottom:6px"><strong>Log Event Details:</strong></div>
+         <div style="color:#94a3b8;margin-bottom:4px"><strong>Time:</strong> {login_time} UTC</div>
+         <div style="color:#94a3b8"><strong>Method:</strong> Password &amp; Email Authentication</div>
+      </div>
+      <p style="margin-top:24px;color:#64748b;font-size:11px;text-align:center">If this was you, no action is required. If you do not recognize this login, please reset your password immediately.</p>
+    </div>
+    """
+    asyncio.create_task(send_email(db_user["email"], "FakeShield Security Alert: Login Detected", login_body))
+
+    await log_user_activity(db_user["email"], "Success Login", request)
+
+    access_token = create_access_token(data={"sub": db_user["email"]}, remember_me=user.remember_me)
     return {
         "access_token": access_token, 
-        "token_type": "bearer", 
+        "token_type": "bearer",
+        "remember_me": user.remember_me,
         "user": {
             "name": db_user["fullName"], 
             "email": db_user["email"],
@@ -139,8 +306,98 @@ async def login(user: UserLogin):
         }
     }
 
+
+# ── Forgot Password ────────────────────────────────────────────────────────
+@router.post("/forgot-password")
+async def forgot_password(req: ForgotPasswordRequest):
+    """
+    Generate a one-time 6-digit OTP, store it hashed in MongoDB with an
+    expiry, and email it to the user.  Always returns 200 so we don't
+    leak whether an account exists.
+    """
+    try:
+        db_user = await users_collection.find_one({"email": req.email})
+    except Exception as e:
+        print(f"[AUTH] DB offline during forgot-password: {e}")
+        # Pretend we sent it – no data to work with offline
+        return {"message": "If that email exists, a reset code has been sent."}
+
+    if db_user:
+        otp = str(secrets.randbelow(900000) + 100000)  # 6-digit OTP
+        otp_hash = pwd_context.hash(otp)
+        otp_expiry = datetime.utcnow() + timedelta(minutes=OTP_EXPIRE_MINUTES)
+
+        await users_collection.update_one(
+            {"email": req.email},
+            {"$set": {"reset_otp": otp_hash, "reset_otp_expiry": otp_expiry}}
+        )
+
+        html_body = f"""
+        <div style="font-family:Arial,sans-serif;max-width:480px;margin:auto;padding:32px;border-radius:12px;background:#0f1117;color:#e2e8f0">
+          <h2 style="color:#00E5CC;margin-bottom:8px">FakeShield Password Reset</h2>
+          <p style="margin-bottom:24px;color:#94a3b8">Use the code below to reset your password. It expires in <strong>{OTP_EXPIRE_MINUTES} minutes</strong>.</p>
+          <div style="background:#1e2130;border-radius:12px;padding:24px;text-align:center">
+            <span style="font-size:40px;font-weight:bold;letter-spacing:12px;color:#00E5CC">{otp}</span>
+          </div>
+          <p style="margin-top:24px;color:#64748b;font-size:12px">If you did not request this, you can safely ignore this email.</p>
+        </div>
+        """
+        await send_email(req.email, "Your FakeShield Reset Code", html_body)
+
+    return {"message": "If that email exists, a reset code has been sent."}
+
+
+# ── Reset Password ─────────────────────────────────────────────────────────
+@router.post("/reset-password")
+async def reset_password(req: ResetPasswordRequest):
+    """
+    Verify the OTP and set a new password.
+    """
+    if len(req.new_password) < 8:
+        raise HTTPException(status_code=400, detail="Password must be at least 8 characters.")
+
+    try:
+        # Find the specific user whose OTP has not expired yet
+        db_user = await users_collection.find_one({
+            "email": req.email,
+            "reset_otp": {"$exists": True},
+            "reset_otp_expiry": {"$gt": datetime.utcnow()}
+        })
+    except Exception as e:
+        raise HTTPException(status_code=503, detail="Database unavailable. Try again later.")
+
+    if not db_user:
+        raise HTTPException(status_code=400, detail="Invalid or expired reset code.")
+
+    # Verify OTP
+    if not pwd_context.verify(req.token, db_user["reset_otp"]):
+        raise HTTPException(status_code=400, detail="Invalid or expired reset code.")
+
+    # Update password, clear OTP fields, and set auth_provider to local
+    new_hash = get_password_hash(req.new_password)
+    await users_collection.update_one(
+        {"_id": db_user["_id"]},
+        {
+            "$set": {"password": new_hash, "auth_provider": "local"},
+            "$unset": {"reset_otp": "", "reset_otp_expiry": ""}
+        }
+    )
+
+    # Issue a fresh token so the user is automatically logged in
+    access_token = create_access_token(data={"sub": db_user["email"]})
+    return {
+        "message": "Password reset successfully.",
+        "access_token": access_token,
+        "token_type": "bearer",
+        "user": {
+            "name": db_user.get("fullName", db_user["email"].split("@")[0].title()),
+            "email": db_user["email"],
+            "subscription_tier": db_user.get("subscription_tier", "free")
+        }
+    }
+
 @router.post("/oauth")
-async def oauth_login(oauth_data: dict):
+async def oauth_login(oauth_data: dict, request: Request):
     """
     OAuth endpoint for Github/Google. 
     Using a raw dict to bypass persistent validation errors.
@@ -150,6 +407,7 @@ async def oauth_login(oauth_data: dict):
     email = oauth_data.get("email")
     name = oauth_data.get("name")
     profile_pic = oauth_data.get("profile_pic")
+    remember_me = oauth_data.get("remember_me") is True
     
     print(f"[AUTH] OAuth Request: provider={provider}, email={email}, name={name}, has_code={bool(code)}", flush=True)
 
@@ -212,8 +470,9 @@ async def oauth_login(oauth_data: dict):
         if not db_user:
             # Auto-signup OAuth users
             tier = get_subscription_tier(email)
+            fullName = name or email.split("@")[0].title()
             user_dict = {
-                "fullName": name or email.split("@")[0].title(),
+                "fullName": fullName,
                 "email": email,
                 "auth_provider": provider,
                 "profile_pic": profile_pic,
@@ -222,6 +481,27 @@ async def oauth_login(oauth_data: dict):
             }
             await users_collection.insert_one(user_dict)
             db_user = user_dict
+            
+            # Send welcome email asynchronously
+            welcome_body = f"""
+            <div style="font-family:Arial,sans-serif;max-width:480px;margin:auto;padding:32px;border-radius:2rem;background:#0f1117;color:#e2e8f0;border:1px solid #1e293b;text-align:center">
+              <div style="width:56px;height:56px;border-radius:1rem;background:linear-gradient(135deg, #00E5CC, #8b5cf6);margin:0 auto 20px auto;color:#ffffff;font-size:24px;font-weight:bold;line-height:56px">FS</div>
+              <h2 style="color:#00E5CC;margin-bottom:12px">Welcome to FakeShield!</h2>
+              <p style="color:#94a3b8;font-size:14px;line-height:1.6;margin-bottom:24px">
+                Hey <strong>{fullName}</strong>, thank you for joining the FakeShield Forensic Suite via {provider}. Your account associated with <strong>{email}</strong> is now active.
+              </p>
+              <div style="background:#1e2130;border-radius:1rem;padding:20px;text-align:left;font-size:13px;color:#cbd5e1">
+                 <div style="margin-bottom:8px"><strong>🛡️ Forensic Tools Available:</strong></div>
+                 <ul style="margin:0;padding-left:16px;color:#94a3b8;line-height:1.5">
+                   <li>Deepfake Video &amp; Audio Detection</li>
+                   <li>Metadata &amp; Forensic Lens analysis</li>
+                   <li>Detailed PDF Reports generation</li>
+                 </ul>
+              </div>
+              <p style="margin-top:24px;color:#64748b;font-size:11px">If you did not create this account, please contact support immediately.</p>
+            </div>
+            """
+            asyncio.create_task(send_email(email, "Welcome to FakeShield!", welcome_body))
         else:
             # Update profile info if changed
             update_data = {"auth_provider": provider}
@@ -233,11 +513,31 @@ async def oauth_login(oauth_data: dict):
                 
             await users_collection.update_one({"_id": db_user["_id"]}, {"$set": update_data})
             db_user.update(update_data)
+            
+        # Send Successful OAuth Login Alert
+        login_time = datetime.utcnow().strftime("%Y-%m-%d %H:%M:%S")
+        login_body = f"""
+        <div style="font-family:Arial,sans-serif;max-width:480px;margin:auto;padding:32px;border-radius:2rem;background:#0f1117;color:#e2e8f0;border:1px solid #1e293b">
+          <div style="width:56px;height:56px;border-radius:1rem;background:linear-gradient(135deg, #00E5CC, #8b5cf6);margin:0 auto 20px auto;color:#ffffff;font-size:24px;font-weight:bold;line-height:56px;text-align:center">FS</div>
+          <h2 style="color:#00E5CC;margin-bottom:12px;text-align:center">Successful Login Security Alert</h2>
+          <p style="color:#94a3b8;font-size:14px;line-height:1.6;margin-bottom:24px;text-align:center">
+            We detected a successful login to your FakeShield account (<strong>{email}</strong>).
+          </p>
+          <div style="background:#1e2130;border-radius:1rem;padding:20px;font-size:13px;color:#cbd5e1">
+             <div style="margin-bottom:6px"><strong>Log Event Details:</strong></div>
+             <div style="color:#94a3b8;margin-bottom:4px"><strong>Time:</strong> {login_time} UTC</div>
+             <div style="color:#94a3b8"><strong>Method:</strong> OAuth via {provider}</div>
+          </div>
+          <p style="margin-top:24px;color:#64748b;font-size:11px;text-align:center">If this was you, no action is required. If you do not recognize this login, please contact security.</p>
+        </div>
+        """
+        asyncio.create_task(send_email(email, "FakeShield Security Alert: Login Detected", login_body))
+
     except Exception as e:
         print(f"[AUTH] DB offline during OAuth: {e}. Issuing offline session.", flush=True)
         # DB offline — issue an offline JWT session
         tier = get_subscription_tier(email)
-        access_token = create_access_token(data={"sub": email})
+        access_token = create_access_token(data={"sub": email}, remember_me=remember_me)
         return {
             "access_token": access_token,
             "token_type": "bearer",
@@ -245,11 +545,11 @@ async def oauth_login(oauth_data: dict):
                 "name": name or email.split("@")[0].title(),
                 "email": email,
                 "profile_pic": profile_pic,
-                "subscription_tier": "paid" # Grant access in offline mode
+                "subscription_tier": "free"
             }
         }
         
-    access_token = create_access_token(data={"sub": db_user["email"]})
+    access_token = create_access_token(data={"sub": db_user["email"]}, remember_me=remember_me)
     return {
         "access_token": access_token, 
         "token_type": "bearer", 
@@ -261,30 +561,495 @@ async def oauth_login(oauth_data: dict):
         }
     }
 
-@router.post("/upgrade")
-async def upgrade_subscription(email: str):
-    """Manual upgrade endpoint (to be called after QR payment confirmation)"""
+RAZORPAY_KEY_ID = os.getenv("RAZORPAY_KEY_ID", "")
+RAZORPAY_KEY_SECRET = os.getenv("RAZORPAY_KEY_SECRET", "")
+PRO_PLAN_AMOUNT_PAISE = int(os.getenv("PRO_PLAN_AMOUNT_PAISE", "99900"))
+PRO_PLAN_CURRENCY = os.getenv("PRO_PLAN_CURRENCY", "INR")
+PRO_PLAN_NAME = os.getenv("PRO_PLAN_NAME", "FakeShield Pro Shield")
+PRO_PLAN_DURATION_DAYS = int(os.getenv("PRO_PLAN_DURATION_DAYS", "120"))
+
+def _require_razorpay_config():
+    if not RAZORPAY_KEY_ID or not RAZORPAY_KEY_SECRET:
+        raise HTTPException(
+            status_code=503,
+            detail="Razorpay is not configured. Set RAZORPAY_KEY_ID and RAZORPAY_KEY_SECRET on the backend."
+        )
+
+@router.get("/payments/razorpay/config")
+async def get_razorpay_payment_config():
+    """Return public payment display config. Does not expose Razorpay secret."""
+    return {
+        "amount": PRO_PLAN_AMOUNT_PAISE,
+        "currency": PRO_PLAN_CURRENCY,
+        "name": PRO_PLAN_NAME,
+        "duration_days": PRO_PLAN_DURATION_DAYS,
+    }
+
+@router.post("/payments/razorpay/order")
+async def create_razorpay_order(current_user: dict = Depends(get_current_user)):
+    """Create a Razorpay order for the authenticated user's Pro upgrade."""
+    _require_razorpay_config()
+
+    email = current_user.get("email")
+    if not email:
+        raise HTTPException(status_code=401, detail="Authenticated user email missing")
+    if current_user.get("is_offline"):
+        raise HTTPException(
+            status_code=503,
+            detail="Payment cannot be started while the account database is offline. Please try again when the server is connected."
+        )
+
+    receipt = f"fs_pro_{datetime.utcnow().strftime('%Y%m%d%H%M%S')}"
+    payload = {
+        "amount": PRO_PLAN_AMOUNT_PAISE,
+        "currency": PRO_PLAN_CURRENCY,
+        "receipt": receipt,
+        "notes": {
+            "email": email,
+            "plan": "pro_shield_4_months",
+            "duration_days": str(PRO_PLAN_DURATION_DAYS)
+        }
+    }
+
+    try:
+        async with httpx.AsyncClient(timeout=20) as client:
+            response = await client.post(
+                "https://api.razorpay.com/v1/orders",
+                auth=(RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET),
+                json=payload
+            )
+    except httpx.HTTPError as exc:
+        raise HTTPException(status_code=502, detail=f"Could not reach Razorpay: {exc}")
+
+    if response.status_code >= 400:
+        raise HTTPException(status_code=502, detail=f"Razorpay order creation failed: {response.text}")
+
+    order = response.json()
+    return {
+        "key_id": RAZORPAY_KEY_ID,
+        "order_id": order["id"],
+        "amount": order["amount"],
+        "currency": order["currency"],
+        "name": "FakeShield Forensics",
+        "description": PRO_PLAN_NAME,
+        "receipt": order.get("receipt", receipt),
+        "prefill": {
+            "name": current_user.get("fullName") or current_user.get("name") or "",
+            "email": email,
+        }
+    }
+
+@router.post("/payments/razorpay/verify")
+async def verify_razorpay_payment(
+    req: RazorpayVerifyRequest,
+    current_user: dict = Depends(get_current_user)
+):
+    """Verify Razorpay Checkout signature, then activate Pro for the current user."""
+    _require_razorpay_config()
+    if current_user.get("is_offline"):
+        raise HTTPException(
+            status_code=503,
+            detail="Payment cannot be verified while the account database is offline. Please try again when the server is connected."
+        )
+
+    signed_payload = f"{req.razorpay_order_id}|{req.razorpay_payment_id}".encode("utf-8")
+    generated_signature = hmac.new(
+        RAZORPAY_KEY_SECRET.encode("utf-8"),
+        signed_payload,
+        hashlib.sha256
+    ).hexdigest()
+
+    if not hmac.compare_digest(generated_signature, req.razorpay_signature):
+        raise HTTPException(status_code=400, detail="Invalid Razorpay payment signature")
+
+    try:
+        async with httpx.AsyncClient(timeout=20) as client:
+            response = await client.get(
+                f"https://api.razorpay.com/v1/payments/{req.razorpay_payment_id}",
+                auth=(RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET)
+            )
+    except httpx.HTTPError as exc:
+        raise HTTPException(status_code=502, detail=f"Could not verify payment status with Razorpay: {exc}")
+
+    if response.status_code >= 400:
+        raise HTTPException(status_code=502, detail=f"Razorpay payment lookup failed: {response.text}")
+
+    payment = response.json()
+    if payment.get("order_id") != req.razorpay_order_id:
+        raise HTTPException(status_code=400, detail="Payment does not belong to this order")
+
+    if payment.get("status") != "captured":
+        raise HTTPException(status_code=400, detail=f"Payment is not captured yet. Current status: {payment.get('status')}")
+
+    if int(payment.get("amount", 0)) != PRO_PLAN_AMOUNT_PAISE:
+        raise HTTPException(status_code=400, detail="Payment amount mismatch")
+
+    if payment.get("currency") != PRO_PLAN_CURRENCY:
+        raise HTTPException(status_code=400, detail="Payment currency mismatch")
+
+    email = current_user.get("email")
+    activated_at = datetime.utcnow()
+    expires_at = activated_at + timedelta(days=PRO_PLAN_DURATION_DAYS)
     result = await users_collection.update_one(
         {"email": email},
-        {"$set": {"subscription_tier": "paid"}}
+        {"$set": {
+            "subscription_tier": "paid",
+            "razorpay_payment_id": req.razorpay_payment_id,
+            "razorpay_order_id": req.razorpay_order_id,
+            "subscription_updated_at": activated_at,
+            "subscription_expires_at": expires_at,
+        }}
     )
     if result.modified_count == 0:
         raise HTTPException(status_code=404, detail="User not found")
-    return {"message": "Subscription upgraded successfully"}
+
+    updated_user = public_user_payload({
+        **current_user,
+        "subscription_tier": "paid",
+        "subscription_expires_at": expires_at,
+    })
+    return {
+        "message": "Payment verified and subscription upgraded successfully",
+        "payment_id": req.razorpay_payment_id,
+        "order_id": req.razorpay_order_id,
+        "user": updated_user
+    }
+
+@router.post("/upgrade")
+async def upgrade_subscription():
+    """Deprecated: payment upgrades must go through Razorpay verification."""
+    raise HTTPException(
+        status_code=410,
+        detail="Manual upgrades are disabled. Use /payments/razorpay/order and /payments/razorpay/verify."
+    )
 
 @router.get("/me")
 async def get_me(user: dict = Depends(get_current_user)):
+    return public_user_payload(user)
+
+# ── Update Profile ─────────────────────────────────────────────────────────
+@router.put("/profile")
+async def update_profile(req: UpdateProfileRequest, current_user: dict = Depends(get_current_user)):
+    """
+    Update the authenticated user's name and/or email.
+    If email changes, it checks for conflicts with existing accounts first.
+    Issues a fresh JWT on success so the session reflects any email change.
+    """
+    update_data = {}
+
+    if req.fullName and req.fullName.strip():
+        update_data["fullName"] = req.fullName.strip()
+
+    if req.email and req.email != current_user.get("email"):
+        # Check if new email is already taken by another account
+        try:
+            existing = await users_collection.find_one({"email": req.email})
+            if existing:
+                raise HTTPException(status_code=400, detail="Email is already in use by another account.")
+        except HTTPException:
+            raise
+        except Exception:
+            raise HTTPException(status_code=503, detail="Database unavailable. Try again later.")
+        update_data["email"] = req.email
+
+    if not update_data:
+        raise HTTPException(status_code=400, detail="No changes provided.")
+
+    try:
+        await users_collection.update_one(
+            {"email": current_user["email"]},
+            {"$set": update_data}
+        )
+    except Exception:
+        raise HTTPException(status_code=503, detail="Database unavailable. Try again later.")
+
+    # Determine the final email (may have changed) for the new token
+    new_email = update_data.get("email", current_user["email"])
+    new_name  = update_data.get("fullName", current_user.get("fullName", ""))
+
+    # Issue a fresh token so the session reflects the new email if changed
+    access_token = create_access_token(data={"sub": new_email})
+
     return {
-        "name": user.get("fullName"),
-        "email": user.get("email"),
-        "subscription_tier": user.get("subscription_tier", "free"),
-        "profile_pic": user.get("profile_pic")
+        "message": "Profile updated successfully.",
+        "access_token": access_token,
+        "token_type": "bearer",
+        "user": {
+            "name": new_name,
+            "email": new_email,
+            "subscription_tier": current_user.get("subscription_tier", "free"),
+            "profile_pic": current_user.get("profile_pic"),
+        }
     }
 
+# ── Change Password (OTP-protected) ───────────────────────────────────────
+@router.post("/change-password/request-otp")
+async def change_password_request_otp(
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Step 1: Verify the current password, then send a 6-digit OTP to the
+    user's registered email address so they can confirm the change.
+    """
+    # Block offline / guest sessions — they have no real DB record
+    if current_user.get("is_offline") or not current_user.get("_id"):
+        raise HTTPException(
+            status_code=400,
+            detail="Password change is only available for registered accounts. Please log in with your credentials."
+        )
+
+    # Only local-auth accounts have a password to change
+    if current_user.get("auth_provider", "local") != "local":
+        raise HTTPException(
+            status_code=400,
+            detail="Password change is not available for OAuth accounts (Google/GitHub)."
+        )
+
+    # Generate and store a 6-digit OTP
+    otp = str(secrets.randbelow(900000) + 100000)
+    otp_hash = pwd_context.hash(otp)
+    otp_expiry = datetime.utcnow() + timedelta(minutes=OTP_EXPIRE_MINUTES)
+
+    try:
+        await users_collection.update_one(
+            {"email": current_user["email"]},
+            {"$set": {"change_pwd_otp": otp_hash, "change_pwd_otp_expiry": otp_expiry}}
+        )
+    except Exception:
+        raise HTTPException(status_code=503, detail="Database unavailable. Try again later.")
+
+    # Send OTP email
+    html_body = f"""
+    <div style="font-family:Arial,sans-serif;max-width:480px;margin:auto;padding:32px;border-radius:12px;background:#0f1117;color:#e2e8f0;border:1px solid #1e293b">
+      <div style="width:56px;height:56px;border-radius:1rem;background:linear-gradient(135deg,#00E5CC,#8b5cf6);margin:0 auto 20px auto;color:#fff;font-size:24px;font-weight:bold;line-height:56px;text-align:center">FS</div>
+      <h2 style="color:#00E5CC;margin-bottom:8px;text-align:center">Password Change Request</h2>
+      <p style="color:#94a3b8;font-size:14px;line-height:1.6;margin-bottom:24px;text-align:center">
+        We received a request to change the password for your FakeShield account
+        (<strong>{current_user['email']}</strong>).<br/>Use the code below to confirm. It expires in <strong>{OTP_EXPIRE_MINUTES} minutes</strong>.
+      </p>
+      <div style="background:#1e2130;border-radius:12px;padding:24px;text-align:center">
+        <span style="font-size:40px;font-weight:bold;letter-spacing:12px;color:#00E5CC">{otp}</span>
+      </div>
+      <p style="margin-top:24px;color:#64748b;font-size:12px;text-align:center">
+        If you did not request this password change, your account may be compromised.
+        Please contact support immediately.
+      </p>
+    </div>
+    """
+    asyncio.create_task(
+        send_email(current_user["email"], "FakeShield: Confirm Your Password Change", html_body)
+    )
+
+    return {"message": "OTP sent to your registered email address."}
+
+
+@router.post("/change-password/confirm")
+async def change_password_confirm(
+    req: ChangePasswordConfirmRequest,
+    request: Request,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Step 2: Verify OTP + current password, then update the password in the DB.
+    """
+    if len(req.new_password) < 8:
+        raise HTTPException(status_code=400, detail="New password must be at least 8 characters.")
+
+    # Block offline / guest sessions
+    if current_user.get("is_offline") or not current_user.get("_id"):
+        raise HTTPException(
+            status_code=400,
+            detail="Password change is only available for registered accounts."
+        )
+
+    # Fetch fresh user record to check OTP validity
+    try:
+        db_user = await users_collection.find_one({
+            "email": current_user["email"],
+            "change_pwd_otp": {"$exists": True},
+            "change_pwd_otp_expiry": {"$gt": datetime.utcnow()}
+        })
+    except Exception:
+        raise HTTPException(status_code=503, detail="Database unavailable. Try again later.")
+
+    if not db_user:
+        raise HTTPException(status_code=400, detail="OTP not found or has expired. Please request a new one.")
+
+    # Verify OTP
+    if not pwd_context.verify(req.otp, db_user["change_pwd_otp"]):
+        raise HTTPException(status_code=400, detail="Invalid OTP. Please try again.")
+
+    # Update password and clear OTP fields
+    new_hash = get_password_hash(req.new_password)
+    try:
+        await users_collection.update_one(
+            {"_id": db_user["_id"]},
+            {
+                "$set": {"password": new_hash},
+                "$unset": {"change_pwd_otp": "", "change_pwd_otp_expiry": ""}
+            }
+        )
+    except Exception:
+        raise HTTPException(status_code=503, detail="Database unavailable. Try again later.")
+
+    # Send confirmation email
+    confirm_body = f"""
+    <div style="font-family:Arial,sans-serif;max-width:480px;margin:auto;padding:32px;border-radius:12px;background:#0f1117;color:#e2e8f0;border:1px solid #1e293b">
+      <div style="width:56px;height:56px;border-radius:1rem;background:linear-gradient(135deg,#00E5CC,#8b5cf6);margin:0 auto 20px auto;color:#fff;font-size:24px;font-weight:bold;line-height:56px;text-align:center">FS</div>
+      <h2 style="color:#00E5CC;margin-bottom:8px;text-align:center">✅ Password Changed Successfully</h2>
+      <p style="color:#94a3b8;font-size:14px;line-height:1.6;text-align:center">
+        The password for your FakeShield account (<strong>{db_user['email']}</strong>) was changed on
+        <strong>{datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S')} UTC</strong>.
+      </p>
+      <p style="margin-top:24px;color:#64748b;font-size:12px;text-align:center">
+        If you did not perform this action, please contact support immediately and reset your password.
+      </p>
+    </div>
+    """
+    asyncio.create_task(
+        send_email(db_user["email"], "FakeShield: Your Password Has Been Changed", confirm_body)
+    )
+
+    await log_user_activity(db_user["email"], "Password Changed", request)
+
+    return {"message": "Password changed successfully."}
+
+
 @router.get("/test")
 async def auth_test():
     return {
         "message": "Auth router is reachable!",
-        "version": "production-oauth-v3",
+        "version": "production-oauth-v4",
         "handshake_type": "raw_dict"
     }
+
+@router.get("/activity")
+async def get_activity_log(current_user: dict = Depends(get_current_user)):
+    """
+    Fetch the recent activity (logins, password changes) for the user.
+    """
+    if current_user.get("is_offline"):
+        # Mock data for offline access
+        return [
+            {
+                "id": 1, "event": "Success Login (Offline Mode)", 
+                "ip": "127.0.0.1", "device": "Current Device", 
+                "location": "Local", "time": "Just now"
+            }
+        ]
+        
+    try:
+        cursor = activity_logs_collection.find({"email": current_user["email"]}).sort("timestamp", -1).limit(50)
+        logs = await cursor.to_list(length=50)
+        
+        results = []
+        for i, log in enumerate(logs):
+            dt = log.get("timestamp", datetime.utcnow())
+            # Basic relative time formatter
+            delta = datetime.utcnow() - dt
+            seconds = delta.total_seconds()
+            if seconds < 60:
+                time_str = "Just now"
+            elif seconds < 3600:
+                time_str = f"{int(seconds//60)} mins ago"
+            elif seconds < 86400:
+                time_str = f"{int(seconds//3600)} hours ago"
+            else:
+                time_str = f"{int(seconds//86400)} days ago"
+                
+            results.append({
+                "id": str(log.get("_id", i)),
+                "event": log.get("event"),
+                "ip": log.get("ip"),
+                "device": log.get("device"),
+                "location": log.get("location"),
+                "time": time_str
+            })
+        return results
+    except Exception as e:
+        return []
+
+def serialize_mongo_doc(doc):
+    doc["_id"] = str(doc["_id"])
+    return doc
+
+@router.get("/export-data")
+async def export_data(current_user: dict = Depends(get_current_user)):
+    """
+    Exports all data associated with the user across all forensic collections and activity logs.
+    """
+    email = current_user.get("email")
+    if not email or current_user.get("is_offline"):
+        raise HTTPException(status_code=400, detail="Cannot export data in offline/guest mode.")
+        
+    try:
+        activity = [serialize_mongo_doc(d) async for d in activity_logs_collection.find({"email": email})]
+        video = [serialize_mongo_doc(d) async for d in video_results_collection.find({"user_email": email})]
+        audio = [serialize_mongo_doc(d) async for d in audio_results_collection.find({"user_email": email})]
+        image = [serialize_mongo_doc(d) async for d in image_results_collection.find({"user_email": email})]
+        text = [serialize_mongo_doc(d) async for d in text_results_collection.find({"user_email": email})]
+        
+        return {
+            "email": email,
+            "export_time": datetime.utcnow().isoformat() + "Z",
+            "activity_logs": activity,
+            "detections": {
+                "video": video,
+                "audio": audio,
+                "image": image,
+                "text": text
+            }
+        }
+    except Exception as e:
+        print(f"[EXPORT ERROR] {e}")
+        raise HTTPException(status_code=500, detail="An error occurred while exporting data.")
+
+
+@router.get("/preferences")
+async def get_preferences(current_user: dict = Depends(get_current_user)):
+    if current_user.get("is_offline"):
+        return {"email_scan_complete": False, "email_suspicious_login": False, "email_monthly_report": False}
+    
+    db_user = await users_collection.find_one({"email": current_user["email"]})
+    if not db_user:
+        raise HTTPException(status_code=404, detail="User not found")
+        
+    prefs = db_user.get("preferences", {
+        "email_scan_complete": True,
+        "email_suspicious_login": True,
+        "email_monthly_report": False
+    })
+    return prefs
+
+@router.put("/preferences")
+async def update_preferences(req: UpdatePreferencesRequest, current_user: dict = Depends(get_current_user)):
+    if current_user.get("is_offline"):
+        raise HTTPException(status_code=400, detail="Cannot update preferences in offline/guest mode.")
+    
+    await users_collection.update_one(
+        {"email": current_user["email"]}, 
+        {"$set": {"preferences": req.model_dump()}}
+    )
+    return {"message": "Preferences updated successfully"}
+
+@router.delete("/account")
+async def delete_account(current_user: dict = Depends(get_current_user)):
+    email = current_user.get("email")
+    if not email or current_user.get("is_offline"):
+        raise HTTPException(status_code=400, detail="Cannot delete account in offline/guest mode.")
+        
+    try:
+        # Purge all forensic data and logs
+        await activity_logs_collection.delete_many({"email": email})
+        await video_results_collection.delete_many({"user_email": email})
+        await audio_results_collection.delete_many({"user_email": email})
+        await image_results_collection.delete_many({"user_email": email})
+        await text_results_collection.delete_many({"user_email": email})
+        
+        # Purge account
+        await users_collection.delete_one({"email": email})
+        
+        return {"message": "Account and all associated forensic data deleted successfully."}
+    except Exception as e:
+        print(f"[AUTH DELETE ERROR] {e}")
+        raise HTTPException(status_code=500, detail="An error occurred while deleting account records.")

backend/app/routers/contact_router.py

@@ -0,0 +1,83 @@
+import asyncio
+import html
+import os
+import smtplib
+from email.message import EmailMessage
+from email.utils import formataddr
+
+from fastapi import APIRouter, HTTPException, status
+from pydantic import BaseModel, EmailStr, Field, field_validator
+
+router = APIRouter(prefix="/api/v1/contact", tags=["Contact"])
+
+SMTP_HOST = os.getenv("SMTP_HOST", "smtp.gmail.com")
+SMTP_PORT = int(os.getenv("SMTP_PORT", "587"))
+SMTP_USER = os.getenv("SMTP_USER", "")
+SMTP_PASSWORD = os.getenv("SMTP_PASSWORD", "")
+SMTP_FROM = os.getenv("SMTP_FROM", SMTP_USER)
+CONTACT_EMAIL_TO = os.getenv("CONTACT_EMAIL_TO", "virdiakash77@gmail.com")
+
+
+class ContactRequest(BaseModel):
+    name: str = Field(min_length=2, max_length=100)
+    email: EmailStr
+    phone: str = Field(default="", max_length=30)
+    message: str = Field(min_length=10, max_length=5000)
+
+    @field_validator("name", "phone", "message")
+    @classmethod
+    def strip_values(cls, value: str) -> str:
+        return value.strip()
+
+
+def _deliver_contact_email(contact: ContactRequest) -> None:
+    if not SMTP_USER or not SMTP_PASSWORD:
+        raise RuntimeError("SMTP credentials are not configured")
+
+    safe_name = html.escape(contact.name)
+    safe_email = html.escape(str(contact.email))
+    safe_phone = html.escape(contact.phone or "Not provided")
+    safe_message = html.escape(contact.message).replace("\n", "<br>")
+
+    email = EmailMessage()
+    email["Subject"] = f"FakeShield contact request from {contact.name}"
+    email["From"] = formataddr(("FakeShield Website", SMTP_FROM or SMTP_USER))
+    email["To"] = CONTACT_EMAIL_TO
+    email["Reply-To"] = str(contact.email)
+    email.set_content(
+        f"Name: {contact.name}\nEmail: {contact.email}\n"
+        f"Phone: {contact.phone or 'Not provided'}\n\nMessage:\n{contact.message}"
+    )
+    email.add_alternative(
+        f"""
+        <div style="font-family:Arial,sans-serif;max-width:640px;margin:auto;padding:28px;background:#0f172a;color:#e2e8f0;border-radius:16px">
+          <h2 style="color:#00e5cc">New FakeShield contact request</h2>
+          <p><strong>Name:</strong> {safe_name}</p>
+          <p><strong>Email:</strong> <a style="color:#00e5cc" href="mailto:{safe_email}">{safe_email}</a></p>
+          <p><strong>Phone:</strong> {safe_phone}</p>
+          <div style="margin-top:20px;padding:18px;background:#1e293b;border-radius:12px;line-height:1.6">{safe_message}</div>
+        </div>
+        """,
+        subtype="html",
+    )
+
+    with smtplib.SMTP(SMTP_HOST, SMTP_PORT, timeout=20) as smtp:
+        smtp.ehlo()
+        smtp.starttls()
+        smtp.ehlo()
+        smtp.login(SMTP_USER, SMTP_PASSWORD)
+        smtp.send_message(email)
+
+
+@router.post("", status_code=status.HTTP_200_OK)
+async def submit_contact(contact: ContactRequest):
+    try:
+        await asyncio.to_thread(_deliver_contact_email, contact)
+    except Exception as exc:
+        print(f"[CONTACT MAIL ERROR] {exc}", flush=True)
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="We could not send your message right now. Please try again later.",
+        ) from exc
+
+    return {"message": "Your message was sent successfully."}

backend/app/routers/dashboard_router.py

@@ -14,6 +14,7 @@ from app.database import (
     audio_results_collection,
     video_results_collection,
 )
+from app.models.suggestion_engine import generate_text_improvement_suggestions
 
 router = APIRouter(prefix="/api/v1/dashboard", tags=["Dashboard"])
 
@@ -73,6 +74,12 @@ async def save_scan_internal(
         print(f"[DB] Invalid lab: {lab}")
         return
 
+    if full_result and "improvement_suggestions" not in full_result:
+        full_result["improvement_suggestions"] = generate_text_improvement_suggestions(
+            full_result,
+            text=full_result.get("text_preview", "")
+        )
+
     doc = {
         "user_email": email,
         "lab":        lab,
@@ -218,6 +225,16 @@ async def get_scan_details(scan_id: str, user: dict = Depends(get_current_user))
     for lab, col in collections:
         doc = await col.find_one({"scan_id": scan_id, "user_email": email})
         if doc:
-            return {"status": "success", "lab": lab, "data": _serialize(doc)}
+            doc = _serialize(doc)
+            full_result = doc.get("full_result")
+
+            if isinstance(full_result, dict) and "improvement_suggestions" not in full_result:
+                full_result["improvement_suggestions"] = generate_text_improvement_suggestions(
+                    full_result,
+                    text=full_result.get("text_preview", "")
+                )
+                doc["full_result"] = full_result
+
+            return {"status": "success", "lab": lab, "data": doc}
             
     raise HTTPException(404, "Scan not found or not authorized")

backend/error_out.txt

@@ -1 +0,0 @@
-{"stage": "BUILD_ERROR", "hardware": {"current": null, "requested": "cpu-basic"}, "gcTimeout": 172800, "errorMessage": "Job failed with exit code: 1. Reason: cache miss: [10/10] COPY . .\ncache miss: [ 9/10] RUN pip install --no-cache-dir \"pyannote.audio>=3.1.0\" \"protobuf~=4.25.3\" python-magic\ncache miss: [ 5/10] RUN pip install --no-cache-dir --upgrade pip &&     pip install --no-cache-dir fastapi \"uvicorn[standard]\" python-multipart python-dotenv pydantic \"pydantic-settings\" motor \"passlib[bcrypt]\" PyJWT google-generativeai\ncache miss: [ 6/10] RUN pip install --no-cache-dir torch torchaudio --index-url https://download.pytorch.org/whl/cpu\ncache miss: [ 8/10] RUN pip install --no-cache-dir Pillow piexif opencv-python-headless \"soundfile>=0.12.0\" \"librosa>=0.10.0\" \"resampy>=0.4.2\"\ncache miss: [ 7/10] RUN pip install --no-cache-dir transformers accelerate \"sentence-transformers\" scikit-learn numpy scipy\ncache miss: [ 4/10] COPY requirements.txt .\ncache miss: [ 3/10] RUN apt-get update && apt-get install -y --no-install-recommends     libgl1     libglib2.0-0     libsndfile1     ffmpeg     libmagic1     && rm -rf /var/lib/apt/lists/*\n{\"total\":15,\"completed\":14,\"user_total\":10,\"user_cached\":1,\"user_completed\":9,\"user_cacheable\":9,\"from\":1,\"miss\":8,\"client_duration_ms\":350984}\n", "replicas": {"requested": 1}, "devMode": false, "domains": [{"domain": "akash4911-fakeshield-api.hf.space", "stage": "READY"}]}