Fix: datetime naive/aware crash across embed-token, access-repo, superadmin, expiry-task + friendly no-subscription UI

app/admin/router.py

@@ -662,24 +662,27 @@ async def get_embed_token(
     from app.models.client_access import ClientAccess
     from app.core.access.token_crypto import create_subscription_token
 
-    now = datetime.now(timezone.utc)  # R-051: timezone-aware UTC
+    now = datetime.now(timezone.utc)
+    now_naive = now.replace(tzinfo=None)  # For comparisons with naive DB datetimes
+
     result = await db.execute(
         select(ClientAccess)
         .where(
             ClientAccess.author_id == current_user.id,
             ClientAccess.is_revoked == False,
-            ClientAccess.expires_at > now,
+            ClientAccess.expires_at > now_naive,
         )
         .order_by(ClientAccess.expires_at.desc())
         .limit(1)
     )
     access = result.scalar_one_or_none()
     if not access:
-        from fastapi import HTTPException
-        raise HTTPException(
-            status_code=403,
-            detail="No active subscription. Contact your administrator to get access."
-        )
+        # Return clean 200 with active=False instead of 403 so UI can show a proper message
+        return {
+            "active": False,
+            "token": None,
+            "message": "No active subscription. Contact your administrator to activate your chatbot.",
+        }
 
     token = create_subscription_token(
         author_id=current_user.id,
@@ -688,15 +691,16 @@ async def get_embed_token(
         expires_at=access.expires_at,
     )
 
-    # Calculate days remaining safely (both naive)
+    # Normalize expiry to naive UTC for subtraction
     exp = access.expires_at
     if exp and exp.tzinfo is not None:
         exp = exp.replace(tzinfo=None)
-    days_remaining = max(0, (exp - now).days) if exp else 0
+    days_remaining = max(0, (exp - now_naive).days) if exp else 0
 
     from app.services.token_budget import tokens_remaining
 
     return {
+        "active": True,
         "token": token,
         "grant_id": access.id,
         "plan": access.plan,

app/admin/templates/admin.html

@@ -1277,6 +1277,20 @@ async function generateEmbedCode() {
     if (codeEl) codeEl.textContent = '⏳ Preparing your embed code...';
     try {
       const data = await apiGet(`/admin/${authorSlug}/embed-token`);
+
+      // No active subscription — show friendly UI, not an error
+      if (!data.active || !data.token) {
+        if (statusEl) statusEl.innerHTML = `
+          <div style="padding:14px;background:var(--yellow-bg);border:1px solid var(--yellow);border-radius:8px;">
+            <strong style="color:var(--yellow-dark);">⚠️ No active subscription</strong><br>
+            <span style="font-size:12px;color:var(--text2);">Your chatbot is ready but needs a subscription plan to go live.
+            Contact your administrator to activate your account.</span>
+          </div>`;
+        if (codeEl) codeEl.textContent = '⚠️ Chatbot not active yet — contact your administrator to get a subscription plan.';
+        if (liveStatus) liveStatus.innerHTML = `<span style="color:var(--yellow-dark);">⚠️ Chatbot preview unavailable — no active subscription</span>`;
+        return;
+      }
+
       _cachedEmbedToken = data.token;
       if (statusEl) {
         const d = data.days_remaining || 0;
@@ -1284,14 +1298,15 @@ async function generateEmbedCode() {
         statusEl.innerHTML = `<span style="color:var(--green);font-weight:600;">✅ Your chatbot is active</span> — ${d} days remaining, ${t} tokens left`;
       }
     } catch(e) {
-      if (codeEl) codeEl.textContent = '❌ ' + (e.message || 'Your account is not active yet. Please contact support.');
-      if (statusEl) statusEl.innerHTML = `<span style="color:var(--red);">❌ Not active yet — please contact your administrator to activate your chatbot</span>`;
-      if (liveStatus) liveStatus.innerHTML = `<span style="color:var(--red);">❌ Cannot preview — your account needs to be activated first</span>`;
+      if (codeEl) codeEl.textContent = '❌ Failed to load embed code: ' + (e.message || 'Unknown error');
+      if (statusEl) statusEl.innerHTML = `<span style="color:var(--red);">❌ ${e.message || 'Could not load subscription info'}</span>`;
+      if (liveStatus) liveStatus.innerHTML = `<span style="color:var(--red);">❌ Preview unavailable</span>`;
       return;
     }
   }
 
   const tok = _cachedEmbedToken;
+  if (!tok) return;
   if (codeEl) codeEl.textContent = buildEmbedSnippet(origin, tok, authorSlug, theme, pos);
   mountLiveWidgetPreview(origin, tok, theme, pos);
   if (!document.getElementById('platform-instructions')?.innerHTML) showPlatform('wordpress');

app/repositories/access_repo.py

@@ -24,7 +24,7 @@ class AccessRepository(BaseRepository[ClientAccess]):
         Returns:
             Active ClientAccess record or None.
         """
-        now = datetime.now(timezone.utc)
+        now = datetime.now(timezone.utc).replace(tzinfo=None)  # SQLite stores naive datetimes
         result = await self.session.execute(
             select(ClientAccess).where(
                 ClientAccess.author_id == author_id,

app/superadmin/router.py

@@ -603,8 +603,8 @@ async def get_author_embed_token(
         if not user:
             raise HTTPException(404, "Author not found")
 
-        # R-051: Use timezone-aware UTC datetime
-        now = datetime.now(timezone.utc)
+        # R-051: Use naive UTC — SQLite stores naive datetimes
+        now = datetime.now(timezone.utc).replace(tzinfo=None)
         result = await db.execute(
             select(ClientAccess)
             .where(

app/tasks/expiry_check_task.py

@@ -27,7 +27,7 @@ async def _run():
     from app.services.email_service import EmailService
 
     email = EmailService()
-    now = datetime.now(timezone.utc)
+    now = datetime.now(timezone.utc).replace(tzinfo=None)  # SQLite stores naive datetimes
     warning_days = [7, 1]
 
     async with _get_session_factory()() as db:
@@ -44,7 +44,8 @@ async def _run():
 
         sent = 0
         for access, user in records:
-            days_left = (access.expires_at - now).days
+            expires = access.expires_at.replace(tzinfo=None) if access.expires_at.tzinfo else access.expires_at
+            days_left = (expires - now).days
             if days_left in warning_days:
                 try:
                     email.send_subscription_expiry_warning(