Fix token display for unsubscribed authors and add SuperAdmin author removal.

Token usage now reads only active grants; admin shows a no-subscription banner. SuperAdmin can permanently delete author accounts with confirmation.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/admin/router.py

@@ -756,23 +756,13 @@ async def get_token_usage(
     current_user=Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
-    """Return token budget and consumption."""
-    from sqlalchemy import select
-    from app.models.client_access import ClientAccess
-
-    result = await db.execute(
-        select(ClientAccess)
-        .where(ClientAccess.author_id == current_user.id)
-        .order_by(ClientAccess.granted_at.desc())
-        .limit(1)
-    )
-    access = result.scalar_one_or_none()
-    if not access:
-        return {"budget": 0, "used": 0, "remaining": 0, "percent_used": 0}
-
-    from app.services.token_budget import usage_summary
+    """Return token budget and consumption for the active subscription only."""
+    from app.repositories.access_repo import AccessRepository
+    from app.services.token_budget import usage_summary_or_empty
 
-    return usage_summary(access)
+    access_repo = AccessRepository(db)
+    access = await access_repo.get_active_for_author(current_user.id)
+    return usage_summary_or_empty(access)
 
 
 # ══════════════════════════════════════════════════════════════════════════════

app/admin/templates/admin.html

@@ -535,6 +535,9 @@
     <!-- ═══ TOKEN USAGE ═══ -->
     <div class="page" id="page-tokens">
       <div class="page-header"><h1 class="page-title">Token Usage <span class="info-tip">ℹ<span class="tip-text">Tracks your AI token consumption. Each chatbot response uses tokens from your budget. When your budget is exhausted, the chatbot will show a friendly "recharging" message until tokens are replenished.</span></span></h1><p class="page-sub">Monitor your AI token budget and consumption</p></div>
+      <div id="token-subscription-banner" class="hidden" style="margin-bottom:16px;padding:14px 18px;border-radius:10px;background:var(--yellow-bg);border:1px solid var(--yellow);font-size:13px;color:var(--text2);">
+        ⚠️ <strong>No active subscription.</strong> Contact your platform administrator to get a package before using the chatbot.
+      </div>
       <div class="grid-2">
         <div class="card" style="text-align:center;padding:40px;">
           <div style="position:relative;width:180px;height:180px;margin:0 auto 20px;">
@@ -1168,14 +1171,23 @@ async function loadAnalytics(days = 30) {
 async function loadTokenUsage() {
   try {
     const data = await apiGet(`/admin/${authorSlug}/token-usage`);
-    const budget = data.budget || 0;
-    const used = data.used || 0;
-    const remaining = data.remaining || 0;
-    const pct = data.percent_used || 0;
-    document.getElementById('token-pct').textContent = pct + '%';
-    document.getElementById('token-budget').textContent = budget.toLocaleString();
+    const banner = document.getElementById('token-subscription-banner');
+    const hasSub = data.has_active_subscription !== false && data.subscription_status === 'active';
+
+    if (banner) {
+      if (hasSub) banner.classList.add('hidden');
+      else banner.classList.remove('hidden');
+    }
+
+    const budget = hasSub ? (data.budget || 0) : 0;
+    const used = hasSub ? (data.used || 0) : 0;
+    const remaining = hasSub ? (data.remaining || 0) : 0;
+    const pct = hasSub ? (data.percent_used || 0) : 0;
+
+    document.getElementById('token-pct').textContent = hasSub ? (pct + '%') : '—';
+    document.getElementById('token-budget').textContent = hasSub ? budget.toLocaleString() : 'No plan';
     document.getElementById('token-used').textContent = used.toLocaleString();
-    document.getElementById('token-remaining').textContent = remaining.toLocaleString();
+    document.getElementById('token-remaining').textContent = hasSub ? remaining.toLocaleString() : '—';
     // Gauge
     const canvas = document.getElementById('chart-token-gauge');
     if (canvas) {
@@ -1183,8 +1195,10 @@ async function loadTokenUsage() {
       const cx = 90, cy = 90, r = 75, lw = 12;
       ctx.clearRect(0, 0, 180, 180);
       ctx.beginPath(); ctx.arc(cx, cy, r, 0.75 * Math.PI, 2.25 * Math.PI); ctx.strokeStyle = '#f1f3f9'; ctx.lineWidth = lw; ctx.lineCap = 'round'; ctx.stroke();
-      ctx.beginPath(); ctx.arc(cx, cy, r, 0.75 * Math.PI, (0.75 + 1.5 * pct / 100) * Math.PI);
-      ctx.strokeStyle = pct > 90 ? '#ef4444' : pct > 75 ? '#f59e0b' : '#6366f1'; ctx.lineWidth = lw; ctx.lineCap = 'round'; ctx.stroke();
+      if (hasSub && pct > 0) {
+        ctx.beginPath(); ctx.arc(cx, cy, r, 0.75 * Math.PI, (0.75 + 1.5 * pct / 100) * Math.PI);
+        ctx.strokeStyle = pct > 90 ? '#ef4444' : pct > 75 ? '#f59e0b' : '#6366f1'; ctx.lineWidth = lw; ctx.lineCap = 'round'; ctx.stroke();
+      }
     }
   } catch(e) { console.error('Token usage:', e); }
 }

app/services/superadmin_service.py

@@ -132,6 +132,56 @@ class SuperAdminService:
         )
         logger.info("Author unsuspended", author_id=author_id)
 
+    async def delete_author(self, actor: User, author_id: str) -> None:
+        """Permanently delete an author account and all associated data.
+
+        Args:
+            actor: The SuperAdmin performing the action.
+            author_id: UUID of the author to delete.
+
+        Raises:
+            ValueError: If author not found, is SuperAdmin, or is the actor.
+        """
+        author = await self._user_repo.get_by_id(author_id)
+        if not author:
+            raise ValueError(f"Author {author_id} not found")
+        if author.role == "superadmin":
+            raise ValueError("Cannot delete SuperAdmin accounts")
+        if author.id == actor.id:
+            raise ValueError("Cannot delete your own account")
+
+        from sqlalchemy import select
+
+        result = await self._db.execute(
+            select(ClientAccess).where(ClientAccess.author_id == author_id)
+        )
+        for access in result.scalars().all():
+            if not access.is_revoked:
+                await revoke_token_in_redis(
+                    redis=self._redis,
+                    token_hash=access.token_hash,
+                    expires_at=access.expires_at,
+                )
+
+        await clear_token_usage_counters(self._redis, author_id)
+
+        email = author.email
+        name = author.full_name or email
+
+        await self._audit.log(
+            actor_id=actor.id,
+            actor_email=actor.email,
+            action="delete_author",
+            target_type="author",
+            target_id=author_id,
+            details={"email": email, "full_name": name},
+        )
+
+        await self._db.delete(author)
+        await self._db.flush()
+
+        logger.info("Author deleted", author_id=author_id, email=email)
+
     async def grant_access(
         self,
         actor: User,

app/services/token_budget.py

@@ -36,9 +36,32 @@ def usage_summary(access: ClientAccess) -> dict:
         "used": used,
         "remaining": max(0, budget - used),
         "percent_used": percent_used(access),
+        "has_active_subscription": True,
+        "subscription_status": "active",
+        "plan": access.plan,
+        "expires_at": access.expires_at.isoformat() if access.expires_at else None,
     }
 
 
+NO_SUBSCRIPTION_SUMMARY: dict = {
+    "budget": 0,
+    "used": 0,
+    "remaining": 0,
+    "percent_used": 0,
+    "has_active_subscription": False,
+    "subscription_status": "none",
+    "plan": None,
+    "expires_at": None,
+}
+
+
+def usage_summary_or_empty(access: ClientAccess | None) -> dict:
+    """Return usage stats for an active grant, or zeros when unsubscribed."""
+    if not access:
+        return dict(NO_SUBSCRIPTION_SUMMARY)
+    return usage_summary(access)
+
+
 async def record_token_usage(
     db,
     redis,

app/superadmin/router.py

@@ -214,6 +214,22 @@ async def unsuspend_author(
         return _err(e, "unsuspend_author")
 
 
+@router.delete("/authors/{author_id}", status_code=200)
+async def delete_author(
+    author_id: str,
+    superadmin=Depends(get_current_superadmin),
+    db: AsyncSession = Depends(get_db),
+    redis=Depends(get_redis),
+):
+    """Permanently delete an author account and all associated data."""
+    try:
+        service = SuperAdminService(db, redis)
+        await service.delete_author(actor=superadmin, author_id=author_id)
+        return {"message": "Author deleted"}
+    except Exception as e:
+        return _err(e, "delete_author")
+
+
 # ── Grant Access ──────────────────────────────────────────────────────────────
 
 @router.post("/authors/{author_id}/grant", status_code=201)

app/superadmin/templates/superadmin.html

@@ -249,7 +249,7 @@
 
     <!-- AUTHORS -->
     <div class="page" id="page-authors">
-      <div class="page-header"><h1 class="page-title">Author Management <span class="info-tip">ℹ<span class="tip-text">All registered authors on the platform. You can suspend/unsuspend accounts, view their book counts, and manage their subscriptions. Click an author row for details.</span></span></h1><p class="page-sub">Manage all registered author accounts</p></div>
+      <div class="page-header"><h1 class="page-title">Author Management <span class="info-tip">ℹ<span class="tip-text">All registered authors on the platform. Suspend, unsuspend, or permanently remove accounts. Deleting an author removes all books, chats, and subscription data.</span></span></h1><p class="page-sub">Manage all registered author accounts</p></div>
       <div class="toolbar">
         <div class="search-bar"><span>🔍</span><input type="text" placeholder="Search authors..." id="author-search" oninput="filterAuthors()"></div>
         <div class="toolbar-spacer"></div>
@@ -515,6 +515,11 @@ async function apiPost(path, body) {
   token = auth.getAccessToken();
   return data;
 }
+async function apiDelete(path) {
+  const data = await auth.delete(path);
+  token = auth.getAccessToken();
+  return data;
+}
 
 function animateNumber(id, target) {
   const el = document.getElementById(id); if (!el) return;
@@ -561,6 +566,7 @@ function renderAuthors(list) {
         ? `<button class="btn btn-success btn-sm" onclick="toggleSuspend('${a.id}', false)">Unsuspend</button>`
         : `<button class="btn btn-danger btn-sm" onclick="toggleSuspend('${a.id}', true)">Suspend</button>`}
       <button class="btn btn-secondary btn-sm" onclick="viewAuthorDetail('${a.id}')">Details</button>
+      <button class="btn btn-danger btn-sm" onclick="confirmDeleteAuthor('${a.id}','${esc(a.email)}')" title="Permanently delete this author">Remove</button>
     </td>
   </tr>`).join('');
 }
@@ -582,6 +588,28 @@ async function executeSuspend(id) {
   try { await apiPost(`/super/authors/${id}/suspend?reason=${encodeURIComponent(reason)}`, {}); closeModal(); toast('Author suspended', 'success'); loadAuthors(); } catch(e) { toast(e.message, 'error'); }
 }
 
+function confirmDeleteAuthor(id, email) {
+  showModal('Remove Author',
+    `<div class="modal-sub">Permanently delete <strong>${email}</strong>? This removes all books, chat history, embeddings, and subscriptions. <strong>This cannot be undone.</strong></div>
+     <div class="form-group"><label class="form-label">Type DELETE to confirm</label><input type="text" class="form-input" id="delete-author-confirm" placeholder="DELETE"></div>`,
+    `<button class="btn btn-secondary" onclick="closeModal()">Cancel</button><button class="btn btn-danger" onclick="executeDeleteAuthor('${id}')">Remove Author</button>`);
+}
+
+async function executeDeleteAuthor(id) {
+  const input = document.getElementById('delete-author-confirm');
+  if (!input || input.value.trim().toUpperCase() !== 'DELETE') {
+    toast('Type DELETE to confirm removal', 'error');
+    return;
+  }
+  try {
+    await apiDelete(`/super/authors/${id}`);
+    closeModal();
+    toast('Author removed', 'success');
+    loadAuthors();
+    if (typeof loadOverview === 'function') loadOverview();
+  } catch(e) { toast(e.message, 'error'); }
+}
+
 function viewAuthorDetail(id) {
   const a = allAuthors.find(x => x.id === id);
   if (!a) return;

tests/unit/test_suite_a_token_consistency.py

@@ -76,3 +76,16 @@ def test_superadmin_and_admin_budget_formula_match(client_access):
     super_total = total_budget(client_access)
     admin_budget = usage_summary(client_access)["budget"]
     assert admin_budget == super_total
+
+
+@pytest.mark.p0
+def test_no_active_subscription_returns_zeros():
+    """Authors without an active grant must see zero budget, not stale grants."""
+    from app.services.token_budget import usage_summary_or_empty
+
+    result = usage_summary_or_empty(None)
+    assert result["budget"] == 0
+    assert result["used"] == 0
+    assert result["remaining"] == 0
+    assert result["has_active_subscription"] is False
+    assert result["subscription_status"] == "none"