added correct unsubscribe_token logic

app.py

@@ -26,7 +26,7 @@ load_dotenv()
 DB_URL = os.getenv("DB_URL")
 GMAIL_USER = os.getenv("GMAIL_USER")
 HF_URL = os.getenv("HF_URL")
-ADMIN_SECRET = os.getenv("ADMIN_SECRET")
+# ADMIN_SECRET = os.getenv("ADMIN_SECRET")
 XSRF_TOKEN = os.getenv("XSRF_TOKEN")
 BIP_SESSION = os.getenv("BIP_SESSION")
 BIP_API = "https://bip.bitsathy.ac.in/nova-api/student-activity-masters"
@@ -54,8 +54,6 @@ def get_db():
         raise
 
 
-# ================= COOKIES =================
-
 # ================= COOKIES =================
 
 def load_cookies():
@@ -63,30 +61,12 @@ def load_cookies():
     if not XSRF_TOKEN or not BIP_SESSION:
         raise Exception("XSRF_TOKEN and BIP_SESSION must be set in environment variables")
     
-    # Clean the values - remove any cookie header prefixes
-    xsrf_value = XSRF_TOKEN.strip()
-    session_value = BIP_SESSION.strip()
-    
-    # Remove "XSRF-TOKEN=" prefix if present
-    if xsrf_value.startswith("XSRF-TOKEN="):
-        xsrf_value = xsrf_value[12:]  # Remove "XSRF-TOKEN="
-    
-    # Remove "bip_session=" prefix if present
-    if session_value.startswith("bip_session="):
-        session_value = session_value[12:]  # Remove "bip_session="
-    
-    # Remove any trailing cookie parts (like "; other_cookie=...")
-    if ";" in xsrf_value:
-        xsrf_value = xsrf_value.split(";")[0]
-    
-    if ";" in session_value:
-        session_value = session_value.split(";")[0]
-    
     return {
-        "XSRF-TOKEN": xsrf_value,
-        "bip_session": session_value
+        "XSRF-TOKEN": XSRF_TOKEN,
+        "bip_session": BIP_SESSION
     }
 
+
 # ================= GMAIL =================
 
 def create_token():
@@ -344,6 +324,7 @@ def log_page1_to_file():
 # ================= SUBSCRIBE =================
 
 def subscribe(email):
+
     if not email or not email.endswith("@bitsathy.ac.in"):
         return "❌ Use college email only"
 
@@ -351,90 +332,102 @@ def subscribe(email):
         db = get_db()
         cur = db.cursor()
 
-        # Check if user already exists and is verified
+        # Check existing user
         cur.execute("""
-            SELECT email_verified, unsubscribed 
-            FROM users 
+            SELECT email_verified, unsubscribed
+            FROM users
             WHERE email=%s
         """, (email,))
 
-        existing_user = cur.fetchone()
+        row = cur.fetchone()
 
-        if existing_user:
-            verified, unsubscribed = existing_user
-            
-            if verified and not unsubscribed:
+        # -----------------------------
+        # EXISTING USER
+        # -----------------------------
+        if row:
+            verified, unsub = row
+
+            # Already active
+            if verified and not unsub:
                 cur.close()
                 db.close()
-                return "✅ You're already subscribed to BIP alerts"
-            
-            elif verified and unsubscribed:
-                # Re-subscribe previously unsubscribed user
+                return "✅ You're already subscribed"
+
+            # Re-subscribe user
+            if verified and unsub:
+                new_unsub_token = uuid.uuid4().hex
+
                 cur.execute("""
-                    UPDATE users 
-                    SET unsubscribed=false 
+                    UPDATE users
+                    SET unsubscribed=false,
+                        unsubscribe_token=%s
                     WHERE email=%s
-                """, (email,))
+                """, (new_unsub_token, email))
                 db.commit()
                 cur.close()
                 db.close()
-                return "✅ Successfully re-subscribed to BIP alerts"
-            
-            elif not verified:
-                # User exists but not verified - generate new token and resend
-                token = uuid.uuid4().hex
+                return "✅ Successfully re-subscribed"
+
+            # Not verified yet → resend verification
+            if not verified:
+                verification_token = uuid.uuid4().hex
+
                 cur.execute("""
-                    UPDATE users 
-                    SET verification_token=%s 
+                    UPDATE users
+                    SET verification_token=%s
                     WHERE email=%s
-                """, (token, email))
+                """, (verification_token, email))
+
                 db.commit()
-                
-                link = f"{HF_URL}?verify={token}"
-                
-                if send_email(
+
+                verify_link = f"{HF_URL}?verify={verification_token}"
+
+                send_email(
                     email,
                     "Verify BIP Alerts",
-                    f"Click <a href='{link}'>here</a> to verify"
-                ):
-                    result = "📩 New verification email sent (previous one expired)"
-                else:
-                    result = "❌ Failed to send verification email"
-                
+                    f"Click <a href='{verify_link}'>here</a> to verify"
+                )
+
                 cur.close()
                 db.close()
-                return result
+                return "📩 Verification email re-sent"
 
-        # New user - create account and send verification
-        token = uuid.uuid4().hex
+        # -----------------------------
+        # NEW USER
+        # -----------------------------
+        verification_token = uuid.uuid4().hex
+        unsubscribe_token = uuid.uuid4().hex
 
         cur.execute("""
-            INSERT INTO users(email, verification_token)
-            VALUES(%s, %s)
-        """, (email, token))
+            INSERT INTO users(
+                email,
+                email_verified,
+                verification_token,
+                unsubscribe_token,
+                unsubscribed
+            )
+            VALUES(%s, false, %s, %s, false)
+        """, (email, verification_token, unsubscribe_token))
 
         db.commit()
 
-        link = f"{HF_URL}?verify={token}"
+        verify_link = f"{HF_URL}?verify={verification_token}"
 
-        if send_email(
+        send_email(
             email,
             "Verify BIP Alerts",
-            f"Click <a href='{link}'>here</a> to verify"
-        ):
-            result = "📩 Verification sent to your email"
-        else:
-            result = "❌ Failed to send verification email"
+            f"Click <a href='{verify_link}'>here</a> to verify"
+        )
 
         cur.close()
         db.close()
 
-        return result
+        return "📩 Verification sent"
 
     except Exception as e:
-        print(f"❌ Subscribe error: {e}")
+        print("❌ Subscribe error:", e)
         return f"❌ Error: {str(e)}"
-
+    
 # ================= VERIFY =================
 
 def verify_user(token):
@@ -447,16 +440,17 @@ def verify_user(token):
 
         cur.execute("""
             UPDATE users
-            SET email_verified=true,
-                verification_token=NULL,
-                unsubscribed=false
-            WHERE verification_token=%s
+            SET email_verified = true,
+                verification_token = NULL,
+                unsubscribed = false
+            WHERE verification_token = %s
+            AND email_verified = false
         """, (token,))
 
-        if cur.rowcount > 0:
-            result = "✅ Email verified successfully!"
+        if cur.rowcount == 0:
+            result = "❌ Invalid or expired verification link"
         else:
-            result = "❌ Invalid verification token"
+            result = "✅ Email verified successfully!"
 
         db.commit()
         cur.close()
@@ -465,12 +459,10 @@ def verify_user(token):
         return result
 
     except Exception as e:
-        print(f"❌ Verify error: {e}")
+        print("❌ Verify error:", e)
         return f"❌ Verification failed: {str(e)}"
 
-
 # ================= UNSUBSCRIBE =================
-
 def unsubscribe_user(token):
     if not token:
         return ""
@@ -480,17 +472,16 @@ def unsubscribe_user(token):
         cur = db.cursor()
 
         cur.execute("""
-            UPDATE users 
-            SET unsubscribed=true
-            WHERE verification_token=%s OR email IN (
-                SELECT email FROM users WHERE verification_token=%s
-            )
-        """, (token, token))
+            UPDATE users
+            SET unsubscribed = true
+            WHERE unsubscribe_token = %s
+            AND email_verified = true
+        """, (token,))
 
-        if cur.rowcount > 0:
-            result = "✅ Successfully unsubscribed from BIP alerts"
+        if cur.rowcount == 0:
+            result = "❌ Invalid or expired unsubscribe link"
         else:
-            result = "❌ Invalid unsubscribe link"
+            result = "✅ Successfully unsubscribed from BIP alerts"
 
         db.commit()
         cur.close()
@@ -499,10 +490,9 @@ def unsubscribe_user(token):
         return result
 
     except Exception as e:
-        print(f"❌ Unsubscribe error: {e}")
+        print("❌ Unsubscribe error:", e)
         return f"❌ Unsubscribe failed: {str(e)}"
 
-
 # ================= EMAIL STATUS =================
 
 def check_email_status(email):
@@ -607,7 +597,7 @@ def send_notifications_for_events(new_events):
         cur = db.cursor()
 
         cur.execute("""
-            SELECT id,email,verification_token
+            SELECT id,email,unsubscribe_token
             FROM users
             WHERE email_verified=true
             AND unsubscribed=false
@@ -633,6 +623,7 @@ def send_notifications_for_events(new_events):
               <li><b>Organizer:</b> {event['organizer']}</li>
               <li><b>Date:</b> {event['start_date']}</li>
               <li><b>Category:</b> {event['event_category']}</li>
+              <li><b>BIP URL:</b> <a href="https://bip.bitsathy.ac.in/nova/resources/student-achievement-loggers">Logger Link</a></li>
               <li><b>Location:</b> {event['location']}</li>
               <li><b>View:</b> <a href="{event['web_url']}">Link</a></li>
             </ul>
@@ -642,14 +633,14 @@ def send_notifications_for_events(new_events):
 
         total_sent = 0
 
-        for uid, mail, token in users:
+        for uid, mail, unsubscribe_token in users:
 
             html = f"""
             <h2>📢 New BIP Events Alert</h2>
             <p>{len(new_events)} new events have been added:</p>
             {events_html}
             <hr>
-            <a href="{HF_URL}?unsubscribe={token}">Unsubscribe</a>
+            <a href="{HF_URL}?unsubscribe={unsubscribe_token}">Unsubscribe</a>
             """
 
             if send_email(mail, subject, html):