fix: naive vs aware datetime error in grants/extend/embed-token, grant button loading state + 15s timeout + token display modal

app/admin/router.py

@@ -662,11 +662,11 @@ async def get_embed_token(
     Token is regenerated from stored grant data — never stored in plaintext.
     """
     from sqlalchemy import select
-    from datetime import datetime, timezone
+    from datetime import datetime
     from app.models.client_access import ClientAccess
     from app.core.access.token_crypto import create_subscription_token
 
-    now = datetime.now(timezone.utc)
+    now = datetime.utcnow()  # naive — matches SQLite stored datetimes
     result = await db.execute(
         select(ClientAccess)
         .where(
@@ -692,12 +692,18 @@ async def get_embed_token(
         expires_at=access.expires_at,
     )
 
+    # Calculate days remaining safely (both naive)
+    exp = access.expires_at
+    if exp and exp.tzinfo is not None:
+        exp = exp.replace(tzinfo=None)
+    days_remaining = max(0, (exp - now).days) if exp else 0
+
     return {
         "token": token,
         "grant_id": access.id,
         "plan": access.plan,
         "expires_at": access.expires_at.isoformat(),
-        "days_remaining": max(0, (access.expires_at - now).days),
+        "days_remaining": days_remaining,
         "tokens_remaining": max(0, (access.token_budget + access.bonus_tokens) - access.tokens_used),
     }
 

app/services/superadmin_service.py

@@ -330,8 +330,12 @@ class SuperAdminService:
             raise ValueError("Cannot extend a revoked subscription — create a new grant instead")
 
         # Extend from NOW if already expired, otherwise from current expiry
-        now = datetime.now(timezone.utc)
-        base = access.expires_at if access.expires_at > now else now
+        # Use naive utcnow() to match SQLite naive datetimes
+        now = datetime.utcnow()
+        exp = access.expires_at
+        if exp and exp.tzinfo is not None:
+            exp = exp.replace(tzinfo=None)  # strip tz if stored as aware
+        base = exp if (exp and exp > now) else now
         new_expiry = base + timedelta(days=extend_days)
 
         updated = await self._access_repo.update(grant_id, access.author_id, {

app/superadmin/router.py

@@ -439,7 +439,7 @@ async def list_all_grants(
         from sqlalchemy import select
         from app.models.client_access import ClientAccess
         from app.models.user import User
-        from datetime import datetime, timezone
+        from datetime import datetime
 
         result = await db.execute(
             select(ClientAccess, User)
@@ -449,12 +449,17 @@ async def list_all_grants(
         )
         rows = result.all()
 
-        now = datetime.now(timezone.utc)
+        now = datetime.utcnow()  # naive — matches SQLite stored datetimes
         grants = []
         for access, user in rows:
             total_budget = access.token_budget + access.bonus_tokens
             pct = round((access.tokens_used / total_budget * 100), 1) if total_budget > 0 else 0
-            is_expired = access.expires_at < now if access.expires_at else True
+            exp = access.expires_at
+            # Strip tz if aware (defensive: handle both naive and aware)
+            if exp and exp.tzinfo is not None:
+                from datetime import timezone
+                exp = exp.replace(tzinfo=None)
+            is_expired = exp < now if exp else True
             grants.append({
                 "grant_id": access.id,
                 "author_id": access.author_id,
@@ -513,15 +518,15 @@ async def get_author_embed_token(
         from app.models.client_access import ClientAccess
         from app.models.user import User
         from app.core.access.token_crypto import create_subscription_token
-        from datetime import datetime, timezone
+        from datetime import datetime
 
         # Get author info
         user = await db.get(User, author_id)
         if not user:
             raise HTTPException(404, "Author not found")
 
-        # Get their active grant
-        now = datetime.now(timezone.utc)
+        # Get their active grant — use naive utcnow to match SQLite naive datetimes
+        now = datetime.utcnow()
         result = await db.execute(
             select(ClientAccess)
             .where(

app/superadmin/templates/superadmin.html

@@ -773,26 +773,65 @@ document.getElementById('token-modal').addEventListener('click', e => { if (e.ta
 
 /* GRANT ACCESS */
 document.getElementById('grant-btn').onclick = async () => {
-  const email = document.getElementById('g-email').value;
-  if (!email) { toast('Email is required', 'error'); return; }
+  const email = document.getElementById('g-email').value.trim();
+  if (!email) { toast('Author email is required', 'error'); return; }
   const btn = document.getElementById('grant-btn');
+  const originalText = btn.textContent;
   btn.disabled = true;
+  btn.textContent = '⏳ Granting access...';
+
+  // 15 second timeout to prevent infinite hang
+  const controller = new AbortController();
+  const timeout = setTimeout(() => { controller.abort(); }, 15000);
+
   try {
-    await apiPost('/super/grant', {
-      author_email: email,
-      plan: document.getElementById('g-plan').value,
-      duration_days: parseInt(document.getElementById('g-duration').value),
-      token_budget: parseInt(document.getElementById('g-tokens').value),
-      bonus_tokens: parseInt(document.getElementById('g-bonus').value),
-      notes: document.getElementById('g-notes').value,
+    const res = await fetch(API + '/super/grant', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + token },
+      body: JSON.stringify({
+        author_email: email,
+        plan: document.getElementById('g-plan').value,
+        duration_days: parseInt(document.getElementById('g-duration').value),
+        token_budget: parseInt(document.getElementById('g-tokens').value),
+        bonus_tokens: parseInt(document.getElementById('g-bonus').value) || 0,
+        notes: document.getElementById('g-notes').value,
+      }),
+      signal: controller.signal,
     });
-    toast(`Access granted to ${email}!`, 'success');
+    clearTimeout(timeout);
+    if (res.status === 401 || res.status === 403) { localStorage.removeItem('sa_token'); location.reload(); return; }
+    const data = await res.json();
+    if (!res.ok) throw new Error(data.detail || `HTTP ${res.status}`);
+
+    // Show the token in a modal so admin can copy it
+    const tok = data.token || '';
+    showModal('✅ Access Granted!',
+      `<div style="margin-bottom:12px;font-size:14px;">Access granted to <strong>${esc(email)}</strong></div>
+       <div style="margin-bottom:8px;font-size:13px;font-weight:600;color:var(--muted);">Subscription Token (share with author):</div>
+       <div style="background:#0d1117;color:#e6edf3;border-radius:8px;padding:14px;font-size:11px;font-family:monospace;word-break:break-all;line-height:1.6;max-height:120px;overflow-y:auto;">${esc(tok)}</div>
+       <div style="margin-top:10px;font-size:12px;color:var(--muted);">⚠️ This token is auto-injected into the author's Embed page. They don't need to copy it manually.</div>`,
+      `<button class="btn btn-secondary" onclick="navigator.clipboard.writeText('${tok.replace(/'/g,"\\'")}');toast('Token copied!','success');">📋 Copy Token</button><button class="btn btn-primary" onclick="closeModal()">Done</button>`
+    );
+
+    // Clear form
     document.getElementById('g-email').value = '';
     document.getElementById('g-notes').value = '';
-  } catch(e) { toast(e.message, 'error'); }
-  finally { btn.disabled = false; }
+    document.getElementById('g-tokens').value = '500000';
+    document.getElementById('g-bonus').value = '0';
+  } catch(e) {
+    clearTimeout(timeout);
+    if (e.name === 'AbortError') {
+      toast('Request timed out — server may still be processing. Check Subscriptions page.', 'error');
+    } else {
+      toast(e.message || 'Grant failed', 'error');
+    }
+  } finally {
+    btn.disabled = false;
+    btn.textContent = originalText;
+  }
 };
 
+
 /* PLATFORM ANALYTICS */
 async function loadPlatformAnalytics() {
   try {