SUBSCRIPTION Introduce (#34)

* New Feature added

* Update README.md

* Update README.md

* Update README.md

* Update README.md

* 2.1.0 - SUBSCRIPTION added

* Update start.sh

---------

Co-authored-by: Karan Adhikari <doc.adhikari@gmail.com>

Backend/__init__.py

@@ -11,4 +11,4 @@ StartTime = time()
 USE_DEFAULT_ID: str = None
 db = Database()  
 
-__version__ = "2.0.0"
+__version__ = "2.1.0"

Backend/__main__.py

@@ -49,6 +49,13 @@ async def start_services():
         link_checker_task = DeadLinkChecker(db, app, check_interval_hours=24)
         loop.create_task(link_checker_task.start())
         
+        # Start Subscription Background Task
+        from Backend.config import Telegram
+        if Telegram.SUBSCRIPTION:
+            from Backend.helper.subscription_checker import subscription_checker_loop
+            loop.create_task(subscription_checker_loop(StreamBot))
+            LOGGER.info("Subscription Checker Task Started.")
+        
         LOGGER.info("Telegram-Stremio Started Successfully!")
         await idle()
     except Exception:

Backend/config.py

@@ -31,4 +31,8 @@ class Telegram:
 
     ADMIN_USERNAME = getenv("ADMIN_USERNAME", "fyvio")
     ADMIN_PASSWORD = getenv("ADMIN_PASSWORD", "fyvio")
-    
+    
+    SUBSCRIPTION = getenv("SUBSCRIPTION", "false").lower() == "true"
+    SUBSCRIPTION_GROUP_ID = int(getenv("SUBSCRIPTION_GROUP_ID", "0"))
+    SUBSCRIPTION_URL = getenv("SUBSCRIPTION_URL", "https://t.me/")
+    APPROVER_IDS = [int(x.strip()) for x in (getenv("APPROVER_IDS") or "").split(",") if x.strip().isdigit()]

Backend/fastapi/main.py

@@ -10,7 +10,7 @@ from Backend.fastapi.routes.stremio_routes import router as stremio_router
 from Backend.fastapi.routes.template_routes import (
     login_page, login_post, logout, set_theme, dashboard_page,
     media_management_page, edit_media_page, public_status_page, stremio_guide_page,
-    admin_dashboard_page
+    admin_dashboard_page, admin_subscriptions_page, admin_access_page
 )
 from Backend.fastapi.routes.api_routes import (
     list_media_api, delete_media_api, update_media_api,
@@ -19,7 +19,11 @@ from Backend.fastapi.routes.api_routes import (
     create_token_api, revoke_token_api, update_token_limits_api,
     speed_test_api, speed_test_stream_api,
     get_admin_stats_api, clear_cache_api, get_dead_links_api,
-    get_stream_analytics_api
+    get_stream_analytics_api,
+    get_subscription_plans_api, add_subscription_plan_api,
+    update_subscription_plan_api, delete_subscription_plan_api,
+    get_all_subscribers_api, manage_subscriber_api,
+    get_all_tokens_api, assign_plan_api, link_token_user_api
 )
 
 app = FastAPI(
@@ -176,6 +180,61 @@ async def get_dead_links(_: bool = Depends(require_auth)):
 async def get_stream_analytics(_: bool = Depends(require_auth)):
     return await get_stream_analytics_api()
 
+@app.get("/admin/subscriptions", response_class=HTMLResponse)
+async def admin_subscriptions(request: Request, _: bool = Depends(require_auth)):
+    return await admin_subscriptions_page(request, _)
+
+@app.get("/api/admin/subscriptions/plans")
+async def get_subscription_plans(_: bool = Depends(require_auth)):
+    return await get_subscription_plans_api()
+
+@app.post("/api/admin/subscriptions/plans")
+async def add_subscription_plan(payload: dict, _: bool = Depends(require_auth)):
+    return await add_subscription_plan_api(payload)
+
+@app.put("/api/admin/subscriptions/plans/{plan_id}")
+async def update_subscription_plan(plan_id: str, payload: dict, _: bool = Depends(require_auth)):
+    return await update_subscription_plan_api(plan_id, payload)
+
+@app.delete("/api/admin/subscriptions/plans/{plan_id}")
+async def delete_subscription_plan(plan_id: str, _: bool = Depends(require_auth)):
+    return await delete_subscription_plan_api(plan_id)
+
+@app.get("/api/admin/subscriptions/users")
+async def get_subscribers(_: bool = Depends(require_auth)):
+    return await get_all_subscribers_api()
+
+@app.post("/api/admin/subscriptions/users/{user_id}/manage")
+async def manage_subscriber(user_id: int, payload: dict, _: bool = Depends(require_auth)):
+    return await manage_subscriber_api(user_id, payload)
+
+# --- Access Management ---
+@app.get("/admin/access", response_class=HTMLResponse)
+async def admin_access(request: Request, _: bool = Depends(require_auth)):
+    return await admin_access_page(request, _)
+
+@app.get("/api/admin/access/tokens")
+async def get_access_tokens(_: bool = Depends(require_auth)):
+    return await get_all_tokens_api()
+
+@app.delete("/api/admin/access/tokens/{token}")
+async def delete_access_token(token: str, _: bool = Depends(require_auth)):
+    from Backend.fastapi.routes.api_routes import revoke_token_api as _revoke_token_api
+    return await _revoke_token_api(token)
+
+@app.post("/api/admin/access/users/{user_id}/assign-plan")
+async def assign_access_plan(user_id: int, payload: dict, _: bool = Depends(require_auth)):
+    days = int(payload.get("days", 0))
+    return await assign_plan_api(user_id, days)
+
+@app.patch("/api/admin/access/tokens/{token}/link-user")
+async def link_token_to_user(token: str, payload: dict, _: bool = Depends(require_auth)):
+    user_id = int(payload.get("user_id", 0))
+    if not user_id:
+        from fastapi import HTTPException
+        raise HTTPException(status_code=400, detail="user_id is required.")
+    return await link_token_user_api(token, user_id)
+
 @app.get("/api/system/speedtest")
 async def speed_test(
     quality_id: str = Query(...),

Backend/fastapi/routes/api_routes.py

@@ -468,4 +468,248 @@ async def get_stream_analytics_api() -> dict:
     except Exception as e:
         from Backend.logger import LOGGER
         LOGGER.error(f"Stream analytics API error: {e}")
-        return {"status": "error", "message": str(e)}
+        return {"status": "error", "message": str(e)}
+
+# ---------------------------------------------------------------------------
+# Admin Subscription Management API Routes
+# ---------------------------------------------------------------------------
+
+async def get_subscription_plans_api() -> dict:
+    from Backend import db
+    try:
+        plans = await db.get_subscription_plans()
+        return {"status": "success", "data": plans}
+    except Exception as e:
+        return {"status": "error", "message": str(e)}
+
+async def add_subscription_plan_api(payload: dict) -> dict:
+    from Backend import db
+    try:
+        days = int(payload.get("days", 0))
+        price = float(payload.get("price", 0.0))
+        if days <= 0 or price < 0:
+            raise HTTPException(status_code=400, detail="Invalid plan parameters")
+            
+        plan_id = await db.add_subscription_plan(days, price)
+        if plan_id:
+            return {"status": "success", "message": "Plan added successfully", "plan_id": plan_id}
+        else:
+            raise HTTPException(status_code=500, detail="Failed to add plan")
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+async def update_subscription_plan_api(plan_id: str, payload: dict) -> dict:
+    from Backend import db
+    try:
+        days = int(payload.get("days", 0))
+        price = float(payload.get("price", 0.0))
+        if days <= 0 or price < 0:
+             raise HTTPException(status_code=400, detail="Invalid plan parameters")
+             
+        success = await db.update_subscription_plan(plan_id, days, price)
+        if success:
+             return {"status": "success", "message": "Plan updated successfully"}
+        else:
+             raise HTTPException(status_code=404, detail="Plan not found or update failed")
+    except HTTPException:
+         raise
+    except Exception as e:
+         raise HTTPException(status_code=500, detail=str(e))
+
+async def delete_subscription_plan_api(plan_id: str) -> dict:
+    from Backend import db
+    try:
+        success = await db.delete_subscription_plan(plan_id)
+        if success:
+            return {"status": "success", "message": "Plan deleted successfully"}
+        else:
+            raise HTTPException(status_code=404, detail="Plan not found")
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+async def get_all_subscribers_api() -> dict:
+    from Backend import db
+    try:
+        users = await db.get_all_subscribers()
+        return {"status": "success", "data": users}
+    except Exception as e:
+        return {"status": "error", "message": str(e)}
+
+async def manage_subscriber_api(user_id: int, payload: dict) -> dict:
+    from Backend import db
+    try:
+        action = payload.get("action")
+        days = int(payload.get("days", 0))
+        
+        if action not in ["extend", "reduce", "delete"]:
+            raise HTTPException(status_code=400, detail="Invalid action")
+            
+        success = await db.manage_subscriber(user_id, action, days)
+        if success:
+            return {"status": "success", "message": "User subscription updated successfully"}
+        else:
+            raise HTTPException(status_code=404, detail="User not found or update failed")
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+# --- Access Management API ---
+
+async def get_all_tokens_api() -> dict:
+    from Backend import db
+    from Backend.config import Telegram
+    from datetime import datetime
+    try:
+        tokens = await db.get_all_api_tokens()
+        now = datetime.utcnow()
+        result = []
+
+        # Pre-load all subscribers into a dict keyed by user_id for O(1) lookup
+        subscriber_map = {}       # user_id (str) -> user doc
+        if Telegram.SUBSCRIPTION:
+            try:
+                for u in await db.get_all_subscribers():
+                    uid = str(u.get("_id"))
+                    subscriber_map[uid] = u
+            except Exception:
+                pass
+
+        def display_name(user, user_id, token_name=None):
+            """Return a non-empty display name for a user."""
+            if user:
+                n = user.get("first_name") or user.get("username")
+                if n:
+                    return n
+            # Fall back to the name stored on the token itself (set at creation time)
+            if token_name:
+                return token_name
+            return f"User {user_id}" if user_id else "Telegram User"
+
+        def build_entry(user_id, user, token_doc):
+            """Build a unified access entry from optional user + token records."""
+            expiry = None
+            sub_status = None
+            user_found = bool(user)
+
+            if user:
+                sub_status = user.get("subscription_status")
+                expiry = user.get("subscription_expiry")
+
+            # Token-level expiry as fallback
+            if token_doc:
+                t_expiry = token_doc.get("subscription_expiry") or token_doc.get("expires_at")
+                if t_expiry and not expiry:
+                    expiry = t_expiry
+
+            # Determine status
+            if Telegram.SUBSCRIPTION:
+                if not user_found:
+                    is_expired = True
+                elif sub_status != "active":
+                    is_expired = True
+                elif not expiry:
+                    is_expired = True
+                else:
+                    is_expired = expiry < now
+            else:
+                is_expired = bool(expiry and expiry < now)
+
+            token_str = token_doc.get("token") if token_doc else None
+            created = token_doc.get("created_at") if token_doc else (user.get("created_at") if user else None)
+
+            return {
+                "token": token_str,
+                "user_id": user_id,
+                "user_name": display_name(user, user_id, token_doc.get("name") if token_doc else None),
+                "user_found": user_found,
+                "has_token": bool(token_str),
+                "created_at": created.isoformat() if created else None,
+                "expires_at": expiry.isoformat() if expiry else None,
+                "is_expired": is_expired,
+                "sub_status": sub_status,
+                "addon_url": (
+                    f"{Telegram.BASE_URL}/stremio/{token_str}/manifest.json"
+                    if token_str else None
+                ),
+            }
+
+        # Track user_ids that are already represented via a token row
+        seen_user_ids = set()
+
+        # --- 1. Process all existing tokens ---
+        for t in tokens:
+            token_user_id = t.get("user_id")
+
+            # Try to resolve user from subscriber_map using token's user_id
+            user = None
+            if token_user_id:
+                uid_str = str(token_user_id)
+                user = subscriber_map.get(uid_str)
+                if not user:
+                    # Fallback: query DB if not in subscriber_map (e.g. non-active subscribers)
+                    try:
+                        user = await db.get_user(int(token_user_id))
+                    except Exception:
+                        pass
+                seen_user_ids.add(uid_str)
+
+            result.append(build_entry(token_user_id, user, t))
+
+        # --- 2. Add subscribers who have NO token ---
+        for uid_str, u in subscriber_map.items():
+            if uid_str in seen_user_ids:
+                continue  # already covered by a token row
+            result.append(build_entry(u.get("_id"), u, None))
+
+        # Sort: active-with-token first, then active-no-token, expired last
+        result.sort(key=lambda x: (x["is_expired"], not x["has_token"]))
+        return {"tokens": result}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+async def revoke_token_api(token: str) -> dict:
+    from Backend import db
+    try:
+        success = await db.revoke_api_token(token)
+        if success:
+            return {"status": "success", "message": "Token revoked."}
+        raise HTTPException(status_code=404, detail="Token not found.")
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+async def assign_plan_api(user_id: int, days: int) -> dict:
+    """Assign (or extend) a subscription for any user by user_id, even if not in DB."""
+    from Backend import db
+    try:
+        if days < 1:
+            raise HTTPException(status_code=400, detail="Days must be at least 1.")
+        result = await db.assign_subscription(user_id, days)
+        return {"status": "success", "data": result}
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+async def link_token_user_api(token: str, user_id: int) -> dict:
+    """Link an orphan token (no user_id) to a Telegram user_id."""
+    from Backend import db
+    try:
+        success = await db.link_token_user(token, user_id)
+        if success:
+            return {"status": "success", "message": f"Token linked to user {user_id}."}
+        raise HTTPException(status_code=404, detail="Token not found or already linked.")
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

Backend/fastapi/routes/stremio_routes.py

@@ -159,23 +159,222 @@ async def get_manifest(token: str, token_data: dict = Depends(verify_token)):
             }
         ]
 
+    # Build dynamic name/description/version with subscription info
+    addon_name = ADDON_NAME
+    addon_desc = "Streams movies and series from your Telegram."
+    addon_version = ADDON_VERSION
+    expiry_obj = None
+
+    if Telegram.SUBSCRIPTION:
+        user_id = token_data.get("user_id")
+        if user_id:
+            from Backend import db as _db
+            try:
+                user = await _db.get_user(int(user_id))
+                if user and user.get("subscription_status") == "active":
+                    expiry_obj = user.get("subscription_expiry")
+                    if expiry_obj:
+                        expiry_str = expiry_obj.strftime("%d %b %Y").lstrip("0")
+                        addon_name = f"{ADDON_NAME} — Expires {expiry_str}"
+                        addon_desc = (
+                            f"📅 Subscription active until {expiry_str}.\n"
+                            f"Streams movies and series from your Telegram."
+                        )
+                        # Encode expiry epoch (low 16 bits, hex) into version so
+                        # Stremio detects a change when subscription is updated.
+                        epoch_tag = format(int(expiry_obj.timestamp()) & 0xFFFF, "x")
+                        addon_version = f"{ADDON_VERSION}-{epoch_tag}"
+                    else:
+                        addon_name = f"{ADDON_NAME} — Active"
+                        addon_desc = "✅ Subscription active.\nStreams movies and series from your Telegram."
+            except Exception:
+                pass  # Fallback to defaults on error
+
+    # Configure URL — opening this reinstalls the addon with latest manifest
+    configure_url = f"{Telegram.BASE_URL}/stremio/{token}/configure"
+
     return {
-        "id": "telegram.media",
-        "version": ADDON_VERSION,
-        "name": ADDON_NAME,
+        "id": f"telegram.media.{token[:8]}",   # per-user ID so each token is independent
+        "version": addon_version,
+        "name": addon_name,
         "logo": "https://i.postimg.cc/XqWnmDXr/Picsart-25-10-09-08-09-45-867.png",
-        "description": "Streams movies and series from your Telegram.",
+        "description": addon_desc,
         "types": ["movie", "series"],
         "resources": resources,
         "catalogs": catalogs,
         "idPrefixes": ["tt"],
         "behaviorHints": {
-            "configurable": False,
+            "configurable": True,
             "configurationRequired": False
-        }
+        },
+        "config": [
+            {
+                "key": "manifest_url",
+                "title": "Your Addon URL (copy to reinstall)",
+                "type": "text",
+                "default": f"{Telegram.BASE_URL}/stremio/{token}/manifest.json"
+            }
+        ]
     }
 
 
+@router.get("/{token}/configure")
+async def configure_addon(token: str):
+    """
+    Configure/update page for the Stremio addon.
+    Uses the correct stremio://addon_install?manifest= deep-link so Stremio
+    actually shows the Install/Update dialog when the button is clicked.
+    """
+    from urllib.parse import quote
+    from fastapi.responses import HTMLResponse
+    from Backend import db as _db
+
+    manifest_url = f"{Telegram.BASE_URL}/stremio/{token}/manifest.json"
+    # Universal Stremio web install — works on desktop and mobile
+    web_install_url = f"https://web.stremio.com/#/?addon_manifest={quote(manifest_url, safe='')}"
+
+    # Fetch user info for display
+    token_doc = await _db.get_api_token(token)
+    user_name = "Unknown"
+    expiry_str = "N/A"
+    status_color = "#ef4444"
+    status_text = "Unknown"
+
+    if token_doc:
+        uid = token_doc.get("user_id")
+        if uid:
+            try:
+                user = await _db.get_user(int(uid))
+                if user:
+                    user_name = user.get("first_name") or user.get("username") or f"User {uid}"
+                    sub_status = user.get("subscription_status", "")
+                    expiry = user.get("subscription_expiry")
+                    if expiry:
+                        expiry_str = expiry.strftime("%d %b %Y").lstrip("0")
+                    if sub_status == "active":
+                        status_color = "#22c55e"
+                        status_text = "✅ Active"
+                    else:
+                        status_color = "#ef4444"
+                        status_text = "🔴 Expired"
+            except Exception:
+                pass
+
+    html = f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Update Telegram Stremio Addon</title>
+  <style>
+    * {{ box-sizing: border-box; margin: 0; padding: 0; }}
+    body {{
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+      background: #0f0f1a; color: #e2e8f0;
+      min-height: 100vh; display: flex; align-items: center; justify-content: center;
+      padding: 24px;
+    }}
+    .card {{
+      background: #1e1e2e; border: 1px solid #2d2d44; border-radius: 16px;
+      padding: 40px 32px; max-width: 480px; width: 100%; text-align: center;
+    }}
+    .logo {{ font-size: 48px; margin-bottom: 12px; }}
+    h1 {{ font-size: 1.5rem; font-weight: 700; color: #f8fafc; margin-bottom: 6px; }}
+    .sub-title {{ color: #94a3b8; font-size: 0.9rem; margin-bottom: 28px; }}
+    .info-row {{
+      display: flex; justify-content: space-between; align-items: center;
+      background: #2a2a3e; border-radius: 10px; padding: 12px 16px;
+      margin-bottom: 12px; font-size: 0.9rem;
+    }}
+    .info-label {{ color: #94a3b8; }}
+    .info-val {{ font-weight: 600; color: #f1f5f9; }}
+    .status-badge {{
+      display: inline-block; padding: 2px 10px; border-radius: 999px;
+      font-size: 0.8rem; font-weight: 700;
+      background: {status_color}22; color: {status_color};
+    }}
+    .btn-update {{
+      display: block; width: 100%;
+      background: linear-gradient(135deg, #7c3aed, #4f46e5);
+      color: white; font-weight: 700; font-size: 1rem;
+      padding: 14px 24px; border-radius: 12px; border: none;
+      cursor: pointer; text-decoration: none; margin: 28px 0 12px;
+      transition: opacity 0.2s;
+    }}
+    .btn-update:hover {{ opacity: 0.85; }}
+    .btn-web {{
+      display: block; color: #6366f1; font-size: 0.85rem;
+      text-decoration: underline; margin-bottom: 20px;
+    }}
+    .steps {{
+      background: #2a2a3e; border-radius: 10px; padding: 14px 18px;
+      margin: 16px 0; text-align: left; font-size: 0.85rem; color: #cbd5e1;
+    }}
+    .steps b {{ color: #f1f5f9; }}
+    .steps ol {{ margin-top: 8px; margin-left: 18px; line-height: 1.8; }}
+    .url-box {{
+      background: #111827; border: 1px solid #374151; border-radius: 8px;
+      padding: 10px 14px; font-family: monospace; font-size: 0.75rem;
+      color: #94a3b8; word-break: break-all; text-align: left; margin-top: 16px;
+    }}
+    .btn-copy {{
+      margin-top: 10px; width: 100%; padding: 10px;
+      background: #1e293b; border: 1px solid #374151; color: #94a3b8;
+      border-radius: 8px; cursor: pointer; font-size: 0.85rem; transition: all 0.2s;
+    }}
+    .btn-copy:hover {{ background: #334155; color: #f1f5f9; }}
+    .hint {{ color: #64748b; font-size: 0.78rem; margin-top: 6px; }}
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="logo">🎬</div>
+    <h1>Telegram Stremio Addon</h1>
+    <p class="sub-title">Click the button below to install or update your addon in Stremio.</p>
+
+    <div class="info-row">
+      <span class="info-label">User</span>
+      <span class="info-val">{user_name}</span>
+    </div>
+    <div class="info-row">
+      <span class="info-label">Status</span>
+      <span class="status-badge">{status_text}</span>
+    </div>
+    <div class="info-row">
+      <span class="info-label">Expires</span>
+      <span class="info-val">{expiry_str}</span>
+    </div>
+
+    <a href="{web_install_url}" class="btn-update" target="_blank">
+      ⚡ Install / Update in Stremio
+    </a>
+
+    <div class="steps">
+      <b>Or install manually:</b>
+      <ol>
+        <li>Open Stremio → <b>Add-ons</b> tab</li>
+        <li>Click the <b>🔍 Search / URL</b> icon</li>
+        <li>Paste the URL below and press Enter</li>
+      </ol>
+    </div>
+
+    <div class="url-box" id="murl">{manifest_url}</div>
+    <button onclick="copyUrl()" class="btn-copy">📋 Copy URL</button>
+    <script>
+      function copyUrl() {{
+        navigator.clipboard.writeText('{manifest_url}').then(() => {{
+          const b = document.querySelector('.btn-copy');
+          b.textContent = '✅ Copied!';
+          setTimeout(() => b.textContent = '📋 Copy URL', 2000);
+        }});
+      }}
+    </script>
+  </div>
+</body>
+</html>"""
+    return HTMLResponse(html)
+
+
 
 
 @router.get("/{token}/catalog/{media_type}/{id}/{extra:path}.json")
@@ -303,6 +502,18 @@ async def get_streams(
     token_data: dict = Depends(verify_token)
 ):
 
+    if token_data.get("subscription_expired"):
+        from Backend.config import Telegram as _TG
+        return {
+            "streams": [
+                {
+                    "name": "🚫 Subscription Expired",
+                    "title": "Your subscription has expired.\nRenew via the bot to continue watching.",
+                    "url": _TG.SUBSCRIPTION_URL
+                }
+            ]
+        }
+
     if token_data.get("limit_exceeded"):
         limit_type = token_data["limit_exceeded"]
 

Backend/fastapi/routes/template_routes.py

@@ -239,3 +239,31 @@ async def stremio_guide_page(request: Request):
         "current_theme": theme_name,
         "is_authenticated": is_authenticated(request)
     })
+
+async def admin_subscriptions_page(request: Request, _: bool = Depends(require_auth)):
+    theme_name = request.session.get("theme", "purple_gradient")
+    theme = get_theme(theme_name)
+    current_user = get_current_user(request)
+    
+    return templates.TemplateResponse("subscriptions_manage.html", {
+        "request": request,
+        "theme": theme,
+        "themes": get_all_themes(),
+        "current_theme": theme_name,
+        "current_user": current_user
+    })
+
+
+async def admin_access_page(request: Request, _: bool = Depends(require_auth)):
+    theme_name = request.session.get("theme", "purple_gradient")
+    theme = get_theme(theme_name)
+    current_user = get_current_user(request)
+
+    return templates.TemplateResponse("access_manage.html", {
+        "request": request,
+        "theme": theme,
+        "themes": get_all_themes(),
+        "current_theme": theme_name,
+        "current_user": current_user,
+    })
+

Backend/fastapi/security/tokens.py

@@ -1,8 +1,11 @@
 from fastapi import HTTPException
+from datetime import datetime
 from Backend import db
+from Backend.config import Telegram
 
 DAILY_LIMIT_VIDEO = "https://bit.ly/3YZFKT5"
 MONTHLY_LIMIT_VIDEO = "https://bit.ly/4rfjtgd"
+SUBSCRIPTION_EXPIRED_VIDEO = "https://bit.ly/4rfjtgd"
 
 
 async def verify_token(token: str):
@@ -13,24 +16,54 @@ async def verify_token(token: str):
     limits = token_data.get("limits", {})
     usage = token_data.get("usage", {})
 
-    daily_limit = limits.get("daily_limit_gb")
-    monthly_limit = limits.get("monthly_limit_gb")
-
     token_data["limit_exceeded"] = None
     token_data["limit_video"] = None
+    token_data["subscription_expired"] = False
+
+    # --- Subscription expiry check (only when SUBSCRIPTION feature is enabled) ---
+    if Telegram.SUBSCRIPTION:
+        user_id = token_data.get("user_id")
+        if not user_id:
+            # Token has no linked user — treat as expired (unverified token)
+            token_data["subscription_expired"] = True
+            return token_data
 
-    if daily_limit and daily_limit > 0:
-        current_daily_gb = usage.get("daily", {}).get("bytes", 0) / (1024 ** 3)
-        if current_daily_gb >= daily_limit:
-            token_data["limit_exceeded"] = "daily"
-            token_data["limit_video"] = DAILY_LIMIT_VIDEO
+        user = await db.get_user(int(user_id))
+        if not user or user.get("subscription_status") != "active":
+            token_data["subscription_expired"] = True
             return token_data
 
-    if monthly_limit and monthly_limit > 0:
-        current_monthly_gb = usage.get("monthly", {}).get("bytes", 0) / (1024 ** 3)
-        if current_monthly_gb >= monthly_limit:
-            token_data["limit_exceeded"] = "monthly"
-            token_data["limit_video"] = MONTHLY_LIMIT_VIDEO
+        expiry = user.get("subscription_expiry")
+        if not expiry:
+            token_data["subscription_expired"] = True
             return token_data
 
+        # Compare correctly regardless of timezone awareness
+        now = datetime.utcnow()
+        try:
+            if expiry.tzinfo is not None:
+                from datetime import timezone
+                now = datetime.now(timezone.utc)
+        except AttributeError:
+            pass
+        if expiry < now:
+            token_data["subscription_expired"] = True
+            return token_data
+
+    if daily_limit := limits.get("daily_limit_gb"):
+        if daily_limit > 0:
+            current_daily_gb = usage.get("daily", {}).get("bytes", 0) / (1024 ** 3)
+            if current_daily_gb >= daily_limit:
+                token_data["limit_exceeded"] = "daily"
+                token_data["limit_video"] = DAILY_LIMIT_VIDEO
+                return token_data
+
+    if monthly_limit := limits.get("monthly_limit_gb"):
+        if monthly_limit > 0:
+            current_monthly_gb = usage.get("monthly", {}).get("bytes", 0) / (1024 ** 3)
+            if current_monthly_gb >= monthly_limit:
+                token_data["limit_exceeded"] = "monthly"
+                token_data["limit_video"] = MONTHLY_LIMIT_VIDEO
+                return token_data
+
     return token_data

Backend/fastapi/templates/access_manage.html

@@ -0,0 +1,439 @@
+{% extends "base.html" %}
+{% block title %}Access Management{% endblock %}
+{% block content %}
+<div class="container mx-auto px-4 py-8 max-w-7xl">
+
+    <!-- Header -->
+    <div class="flex items-center justify-between mb-6">
+        <div>
+            <h2 class="text-3xl font-bold text-primary">🔑 Access Management</h2>
+            <p class="text-sm text-text opacity-60 mt-1">Manage API tokens for Stremio addon access</p>
+        </div>
+        <button onclick="loadTokens()"
+            class="bg-primary text-white px-4 py-2 rounded-lg hover:opacity-80 transition text-sm font-medium">
+            🔄 Refresh
+        </button>
+    </div>
+
+    <!-- Stats -->
+    <div class="grid grid-cols-3 gap-4 mb-6">
+        <div class="theme-card rounded-xl p-4 text-center">
+            <div class="text-2xl font-bold text-primary" id="stat-total">–</div>
+            <div class="text-xs text-text opacity-60 mt-1">Total Tokens</div>
+        </div>
+        <div class="theme-card rounded-xl p-4 text-center">
+            <div class="text-2xl font-bold text-green-500" id="stat-active">–</div>
+            <div class="text-xs text-text opacity-60 mt-1">Active</div>
+        </div>
+        <div class="theme-card rounded-xl p-4 text-center">
+            <div class="text-2xl font-bold text-red-400" id="stat-expired">–</div>
+            <div class="text-xs text-text opacity-60 mt-1">Expired / No Sub</div>
+        </div>
+    </div>
+
+    <!-- Search & Filter bar -->
+    <div class="flex flex-wrap gap-3 mb-4 items-center">
+        <input id="search-input" type="text" placeholder="🔍 Search by name or user ID…"
+            class="flex-1 min-w-[200px] border border-gray-300 dark:border-gray-600 rounded-lg px-4 py-2 text-sm focus:outline-none focus:border-primary bg-white dark:bg-gray-800 text-text"
+            oninput="renderPage()">
+        <select id="filter-status"
+            class="border border-gray-300 dark:border-gray-600 rounded-lg px-3 py-2 text-sm focus:outline-none bg-white dark:bg-gray-800 text-text"
+            onchange="renderPage()">
+            <option value="all">All Status</option>
+            <option value="active">🟢 Active</option>
+            <option value="expired">🔴 Expired</option>
+        </select>
+        <select id="page-size"
+            class="border border-gray-300 dark:border-gray-600 rounded-lg px-3 py-2 text-sm focus:outline-none bg-white dark:bg-gray-800 text-text"
+            onchange="currentPage=1; renderPage()">
+            <option value="10">10 / page</option>
+            <option value="25">25 / page</option>
+            <option value="50">50 / page</option>
+        </select>
+    </div>
+
+    <!-- Token Table -->
+    <div class="theme-card rounded-2xl shadow overflow-hidden">
+        <div class="overflow-x-auto">
+            <table class="w-full text-sm">
+                <thead>
+                    <tr class="border-b border-gray-200 dark:border-gray-700">
+                        <th class="px-4 py-3 text-left text-text opacity-70 font-semibold">Status</th>
+                        <th class="px-4 py-3 text-left text-text opacity-70 font-semibold">User</th>
+                        <th class="px-4 py-3 text-left text-text opacity-70 font-semibold">Addon Link</th>
+                        <th class="px-4 py-3 text-left text-text opacity-70 font-semibold">Created</th>
+                        <th class="px-4 py-3 text-left text-text opacity-70 font-semibold">Expires</th>
+                        <th class="px-4 py-3 text-center text-text opacity-70 font-semibold">Actions</th>
+                    </tr>
+                </thead>
+                <tbody id="token-table-body">
+                    <tr>
+                        <td colspan="6" class="text-center py-10 text-text opacity-40">Loading tokens…</td>
+                    </tr>
+                </tbody>
+            </table>
+        </div>
+    </div>
+
+    <!-- Pagination -->
+    <div class="flex items-center justify-between mt-4 text-sm text-text opacity-70" id="pagination-bar">
+        <span id="page-info"></span>
+        <div class="flex gap-2">
+            <button id="btn-prev" onclick="changePage(-1)"
+                class="px-3 py-1 rounded border border-gray-300 hover:bg-gray-100 disabled:opacity-30 transition">‹
+                Prev</button>
+            <span id="page-num" class="px-3 py-1 font-semibold"></span>
+            <button id="btn-next" onclick="changePage(1)"
+                class="px-3 py-1 rounded border border-gray-300 hover:bg-gray-100 disabled:opacity-30 transition">Next
+                ›</button>
+        </div>
+    </div>
+</div>
+
+<!-- Assign Plan Modal -->
+<div id="assign-modal" class="fixed inset-0 bg-black bg-opacity-60 hidden items-center justify-center z-50"
+    style="display:none">
+    <div class="bg-white dark:bg-gray-800 rounded-2xl p-6 w-full max-w-md shadow-2xl mx-4">
+        <h3 class="text-lg font-bold mb-1 text-gray-800 dark:text-white">📋 Assign Subscription Plan</h3>
+        <p class="text-sm text-gray-500 mb-4" id="assign-user-label">User: –</p>
+        <input type="hidden" id="assign-user-id">
+
+        <div class="mb-4">
+            <label class="block text-sm font-semibold text-gray-700 dark:text-gray-300 mb-2">Select a Plan</label>
+            <select id="assign-plan-select"
+                class="w-full border border-gray-300 rounded-lg px-4 py-2 text-sm focus:outline-none focus:border-primary dark:bg-gray-700 dark:border-gray-600 dark:text-white">
+                <option value="">— Select plan —</option>
+            </select>
+        </div>
+
+        <div class="mb-4">
+            <label class="block text-sm font-semibold text-gray-700 dark:text-gray-300 mb-2">Or enter custom
+                days</label>
+            <input type="number" id="assign-custom-days" placeholder="e.g. 30" min="1"
+                class="w-full border border-gray-300 rounded-lg px-4 py-2 text-sm focus:outline-none focus:border-primary dark:bg-gray-700 dark:border-gray-600 dark:text-white">
+            <p class="text-xs text-gray-400 mt-1">Custom days override plan selection above.</p>
+        </div>
+
+        <div class="flex justify-end gap-3 mt-6">
+            <button onclick="closeAssignModal()"
+                class="px-4 py-2 text-gray-600 hover:bg-gray-100 dark:hover:bg-gray-700 rounded-lg transition text-sm">Cancel</button>
+            <button onclick="assignPlan()"
+                class="px-4 py-2 bg-primary text-white rounded-lg hover:opacity-80 transition text-sm font-semibold">✅
+                Assign & Activate</button>
+        </div>
+    </div>
+</div>
+
+<script>
+    let allTokens = [];
+    let currentPage = 1;
+
+    function getFiltered() {
+        const q = document.getElementById('search-input').value.toLowerCase();
+        const status = document.getElementById('filter-status').value;
+        return allTokens.filter(t => {
+            const matchQ = !q ||
+                (t.user_name && t.user_name.toLowerCase().includes(q)) ||
+                (t.user_id && String(t.user_id).includes(q));
+            const matchStatus = status === 'all' || (status === 'active' && !t.is_expired) || (status === 'expired' && t.is_expired);
+            return matchQ && matchStatus;
+        });
+    }
+
+    function renderPage() {
+        const filtered = getFiltered();
+        const pageSize = parseInt(document.getElementById('page-size').value);
+        const totalPages = Math.max(1, Math.ceil(filtered.length / pageSize));
+        if (currentPage > totalPages) currentPage = totalPages;
+
+        const start = (currentPage - 1) * pageSize;
+        const slice = filtered.slice(start, start + pageSize);
+
+        document.getElementById('page-info').textContent = `Showing ${start + 1}–${Math.min(start + pageSize, filtered.length)} of ${filtered.length}`;
+        document.getElementById('page-num').textContent = `Page ${currentPage} / ${totalPages}`;
+        document.getElementById('btn-prev').disabled = currentPage <= 1;
+        document.getElementById('btn-next').disabled = currentPage >= totalPages;
+
+        const tbody = document.getElementById('token-table-body');
+        if (!slice.length) {
+            tbody.innerHTML = '<tr><td colspan="6" class="text-center py-10 text-text opacity-40">No tokens match your search.</td></tr>';
+            return;
+        }
+        tbody.innerHTML = slice.map(renderRow).join('');
+    }
+
+    function renderRow(t) {
+        const statusBadge = t.is_expired
+            ? '<span class="px-2 py-1 rounded-full text-xs font-semibold bg-red-100 text-red-600">🔴 Expired</span>'
+            : '<span class="px-2 py-1 rounded-full text-xs font-semibold bg-green-100 text-green-700">🟢 Active</span>';
+
+        // User column — show name or fallback to Telegram User (ID: X)
+        const displayName = t.user_name || (t.user_id ? `Telegram User` : 'Unknown');
+        const nameHtml = `<div class="font-medium text-text">${escHtml(displayName)}</div>`;
+        const idHtml = t.user_id ? `<div class="text-xs text-text opacity-50">ID: ${t.user_id}</div>` : '';
+
+        const addonLink = !t.has_token
+            ? `<span class="px-2 py-1 rounded-full text-xs font-semibold bg-yellow-100 text-yellow-700">⚠️ No Token Yet</span>
+         <div class="text-xs text-text opacity-40 italic mt-1">User hasn't generated addon token via bot.</div>`
+            : t.is_expired
+                ? `<div>
+           <span class="px-2 py-1 rounded-full text-xs font-semibold bg-red-100 text-red-600">🔴 Subscription Expired</span>
+           <div class="text-xs text-text opacity-40 italic mt-1">${t.user_found ? 'Subscription inactive/expired' : 'No subscription record'}</div>
+           ${t.addon_url ? `<button onclick="copyLink('${escHtml(t.addon_url)}')" class="text-xs text-text opacity-30 hover:opacity-60 underline mt-0.5">Copy URL (admin)</button>` : ''}
+         </div>`
+                : (t.addon_url
+                    ? `<button onclick="copyLink('${escHtml(t.addon_url)}')" class="text-primary hover:underline text-xs">📋 Copy Install Link</button>`
+                    : '—');
+
+        const expires = t.expires_at
+            ? `<span class="${t.is_expired ? 'text-red-500 font-semibold' : ''}">${fmtDate(t.expires_at)}</span>`
+            : '<span class="text-red-400 text-xs italic">No expiry</span>';
+
+        const rowCls = t.is_expired ? 'bg-red-50 dark:bg-red-900/10' : '';
+        const safeName = escHtml(t.user_name || String(t.user_id || ''));
+
+        // --- Action buttons ---
+        let actionBtns = '';
+        if (t.user_id) {
+            // Full actions for linked tokens/subscribers
+            actionBtns = `
+            <button onclick="openAssignModal(${t.user_id}, '${safeName}')"
+              class="text-blue-500 hover:text-blue-700 text-xs px-2 py-1 rounded border border-blue-300 hover:bg-blue-50 transition mb-1 mr-1">
+              📅 Assign
+            </button>
+            <button onclick="openSubModal(${t.user_id}, '${safeName}', 'extend')"
+              class="text-green-600 hover:text-green-800 text-xs px-2 py-1 rounded border border-green-300 hover:bg-green-50 transition mb-1 mr-1">
+              ➕ Extend
+            </button>
+            <button onclick="openSubModal(${t.user_id}, '${safeName}', 'reduce')"
+              class="text-yellow-600 hover:text-yellow-800 text-xs px-2 py-1 rounded border border-yellow-300 hover:bg-yellow-50 transition mb-1 mr-1">
+              ➖ Reduce
+            </button>
+            <button onclick="openSubModal(${t.user_id}, '${safeName}', 'delete')"
+              class="text-red-500 hover:text-red-700 text-xs px-2 py-1 rounded border border-red-300 hover:bg-red-50 transition mb-1 mr-1">
+              🚫 Revoke
+            </button>`;
+        } else if (t.token) {
+            // Orphan token — show Link User button
+            actionBtns = `
+            <button onclick="linkUser('${escHtml(t.token)}')"
+              class="text-purple-600 hover:text-purple-800 text-xs px-3 py-1 rounded border border-purple-300 hover:bg-purple-50 transition mb-1 font-semibold">
+              🔗 Link User ID
+            </button>
+            <div class="text-xs text-text opacity-40 italic mt-0.5 w-full">Enter Telegram user_id to enable management</div>`;
+        }
+
+        const revokeTokenBtn = t.token ? `
+            <button onclick="revokeToken('${escHtml(t.token)}')"
+              class="text-gray-500 hover:text-red-700 text-xs px-2 py-1 rounded border border-gray-300 hover:bg-red-50 transition mb-1">
+              🗑 Del Token
+            </button>` : '';
+
+        return `<tr class="border-b border-gray-100 dark:border-gray-800 hover:bg-gray-50 dark:hover:bg-gray-800/30 transition ${rowCls}">
+      <td class="px-4 py-3">${statusBadge}</td>
+      <td class="px-4 py-3">${nameHtml}${idHtml}</td>
+      <td class="px-4 py-3">${addonLink}</td>
+      <td class="px-4 py-3 text-text opacity-70 text-xs">${t.created_at ? fmtDate(t.created_at) : '—'}</td>
+      <td class="px-4 py-3 text-xs">${expires}</td>
+      <td class="px-4 py-3">
+        <div class="flex flex-wrap gap-1">${actionBtns}${revokeTokenBtn}</div>
+      </td>
+    </tr>`;
+    }
+
+    function changePage(dir) {
+        currentPage += dir;
+        renderPage();
+    }
+
+    async function loadTokens() {
+        const tbody = document.getElementById('token-table-body');
+        tbody.innerHTML = '<tr><td colspan="6" class="text-center py-10 text-text opacity-40">Loading…</td></tr>';
+        try {
+            const resp = await fetch('/api/admin/access/tokens');
+            const data = await resp.json();
+            allTokens = data.tokens || [];
+
+            document.getElementById('stat-total').textContent = allTokens.length;
+            document.getElementById('stat-active').textContent = allTokens.filter(t => !t.is_expired).length;
+            document.getElementById('stat-expired').textContent = allTokens.filter(t => t.is_expired).length;
+
+            currentPage = 1;
+            renderPage();
+        } catch (err) {
+            tbody.innerHTML = `<tr><td colspan="6" class="text-center py-10 text-red-500">Error: ${err.message}</td></tr>`;
+        }
+    }
+
+    async function loadPlans() {
+        try {
+            const resp = await fetch('/api/admin/subscriptions/plans');
+            const data = await resp.json();
+            const plans = data.plans || data || [];
+            const sel = document.getElementById('assign-plan-select');
+            sel.innerHTML = '<option value="">— Select a plan —</option>' +
+                plans.map(p => `<option value="${p.days}">${p.days} days${p.price ? ' — ₹' + p.price : ''}</option>`).join('');
+        } catch (e) { console.warn('Could not load plans', e); }
+    }
+
+    function openAssignModal(userId, userName) {
+        document.getElementById('assign-user-id').value = userId;
+        document.getElementById('assign-user-label').textContent = `User: ${userName} (ID: ${userId})`;
+        document.getElementById('assign-custom-days').value = '';
+        document.getElementById('assign-plan-select').value = '';
+        const modal = document.getElementById('assign-modal');
+        modal.style.display = 'flex';
+    }
+
+    function closeAssignModal() {
+        document.getElementById('assign-modal').style.display = 'none';
+    }
+
+    async function assignPlan() {
+        const userId = parseInt(document.getElementById('assign-user-id').value);
+        const customDays = parseInt(document.getElementById('assign-custom-days').value) || 0;
+        const planDays = parseInt(document.getElementById('assign-plan-select').value) || 0;
+        const days = customDays || planDays;
+
+        if (!days || days < 1) { showToast('Please select a plan or enter custom days.', 'red'); return; }
+
+        try {
+            const resp = await fetch(`/api/admin/access/users/${userId}/assign-plan`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ days })
+            });
+            const data = await resp.json();
+            if (resp.ok) {
+                showToast(`✅ Assigned ${days} days to user ${userId}`, 'green');
+                closeAssignModal();
+                loadTokens();
+            } else {
+                showToast(data.detail || 'Failed to assign plan.', 'red');
+            }
+        } catch (err) { showToast('Error: ' + err.message, 'red'); }
+    }
+
+    async function revokeToken(token) {
+        if (!confirm('Delete this token? The user will lose addon access immediately.')) return;
+        try {
+            const resp = await fetch(`/api/admin/access/tokens/${encodeURIComponent(token)}`, { method: 'DELETE' });
+            const data = await resp.json();
+            if (resp.ok) { showToast('Token deleted.', 'green'); loadTokens(); }
+            else showToast(data.detail || 'Failed.', 'red');
+        } catch (err) { showToast('Error: ' + err.message, 'red'); }
+    }
+
+    async function linkUser(token) {
+        const userId = prompt('Enter the Telegram User ID to link this token to:');
+        if (!userId || isNaN(parseInt(userId))) { showToast('Invalid user ID.', 'red'); return; }
+        try {
+            const resp = await fetch(`/api/admin/access/tokens/${encodeURIComponent(token)}/link-user`, {
+                method: 'PATCH',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ user_id: parseInt(userId) })
+            });
+            const data = await resp.json();
+            if (resp.ok) {
+                showToast(`✅ Token linked to user ${userId}. Refreshing…`, 'green');
+                loadTokens();
+            } else { showToast(data.detail || 'Failed to link.', 'red'); }
+        } catch (err) { showToast('Error: ' + err.message, 'red'); }
+    }
+
+    // Sub action modal (Extend / Reduce / Revoke)
+    function openSubModal(userId, userName, action) {
+        document.getElementById('sub-action-user-id').value = userId;
+        document.getElementById('sub-action-action').value = action;
+        const titles = { extend: '➕ Extend Subscription', reduce: '➖ Reduce Subscription', delete: '🚫 Revoke Subscription' };
+        const descs = {
+            extend: `Add days to <b>${userName}</b>'s subscription.`,
+            reduce: `Remove days from <b>${userName}</b>'s subscription.`,
+            delete: `<b>Warning:</b> Revoke <b>${userName}</b>'s subscription entirely.`
+        };
+        document.getElementById('sub-action-title').textContent = titles[action];
+        document.getElementById('sub-action-desc').innerHTML = descs[action];
+        document.getElementById('sub-action-days-group').className = action === 'delete' ? 'hidden' : 'mb-4';
+        document.getElementById('sub-action-days').value = 30;
+        const btn = document.getElementById('sub-action-btn');
+        btn.className = `px-4 py-2 rounded-lg text-white text-sm font-semibold transition hover:opacity-80 ${action === 'delete' ? 'bg-red-500' : action === 'reduce' ? 'bg-yellow-500' : 'bg-green-600'}`;
+        document.getElementById('sub-action-modal').style.display = 'flex';
+    }
+
+    function closeSubModal() { document.getElementById('sub-action-modal').style.display = 'none'; }
+
+    async function submitSubAction() {
+        const userId = parseInt(document.getElementById('sub-action-user-id').value);
+        const action = document.getElementById('sub-action-action').value;
+        const days = parseInt(document.getElementById('sub-action-days').value) || 0;
+        try {
+            const resp = await fetch(`/api/admin/subscriptions/users/${userId}/manage`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ action, days })
+            });
+            const data = await resp.json();
+            if (resp.ok) {
+                showToast(`✅ ${action.charAt(0).toUpperCase() + action.slice(1)}d subscription for user ${userId}`, 'green');
+                closeSubModal();
+                loadTokens();
+            } else { showToast(data.detail || 'Failed.', 'red'); }
+        } catch (err) { showToast('Error: ' + err.message, 'red'); }
+    }
+
+    async function copyLink(url) {
+        try { await navigator.clipboard.writeText(url); showToast('Link copied!', 'green'); }
+        catch { prompt('Copy this link:', url); }
+    }
+
+    function fmtDate(iso) {
+        if (!iso) return '—';
+        const d = new Date(iso);
+        return d.toLocaleDateString('en-IN', { timeZone: 'Asia/Kolkata', day: '2-digit', month: 'short', year: 'numeric' })
+            + ' ' + d.toLocaleTimeString('en-IN', { timeZone: 'Asia/Kolkata', hour: '2-digit', minute: '2-digit' });
+    }
+
+    function escHtml(s) {
+        return String(s || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#039;');
+    }
+
+    function showToast(msg, color) {
+        const t = document.createElement('div');
+        t.textContent = msg;
+        t.className = `fixed bottom-6 right-6 px-4 py-3 rounded-xl shadow-lg text-white text-sm z-[200] bg-${color}-500 transition-all`;
+        document.body.appendChild(t);
+        setTimeout(() => t.remove(), 3000);
+    }
+
+    // Close modal on backdrop click
+    document.getElementById('assign-modal').addEventListener('click', function (e) {
+        if (e.target === this) closeAssignModal();
+    });
+
+    loadPlans();
+    loadTokens();
+</script>
+
+<!-- Sub Action Modal (Extend / Reduce / Revoke) -->
+<div id="sub-action-modal" class="fixed inset-0 bg-black bg-opacity-60 items-center justify-center z-50 mx-4"
+    style="display:none">
+    <div class="bg-white dark:bg-gray-800 rounded-2xl p-6 w-full max-w-md shadow-2xl mx-auto mt-24">
+        <h3 class="text-lg font-bold mb-1 text-gray-800 dark:text-white" id="sub-action-title">Manage Subscription</h3>
+        <p class="text-sm text-gray-500 mb-4" id="sub-action-desc"></p>
+        <input type="hidden" id="sub-action-user-id">
+        <input type="hidden" id="sub-action-action">
+        <div id="sub-action-days-group" class="mb-4">
+            <label class="block text-sm font-semibold text-gray-700 dark:text-gray-300 mb-2">Number of Days</label>
+            <input type="number" id="sub-action-days" value="30" min="1"
+                class="w-full border border-gray-300 rounded-lg px-4 py-2 text-sm focus:outline-none focus:border-primary dark:bg-gray-700 dark:border-gray-600 dark:text-white">
+        </div>
+        <div class="flex justify-end gap-3 mt-4">
+            <button onclick="closeSubModal()"
+                class="px-4 py-2 text-gray-600 hover:bg-gray-100 dark:hover:bg-gray-700 rounded-lg transition text-sm">Cancel</button>
+            <button id="sub-action-btn" onclick="submitSubAction()"
+                class="px-4 py-2 bg-green-600 text-white rounded-lg hover:opacity-80 transition text-sm font-semibold">Confirm</button>
+        </div>
+    </div>
+</div>
+
+{% endblock %}

Backend/fastapi/templates/base.html

@@ -65,40 +65,44 @@
                     <h1 class="text-2xl font-bold text-primary">Telegram Stremio</h1>
                     {% if current_user %}
                     <div class="hidden md:flex space-x-4">
-                        <a href="/" class="text-text hover:text-primary px-3 py-2 rounded-md transition-colors">Dashboard</a>
-                        <a href="/media/manage" class="text-text hover:text-primary px-3 py-2 rounded-md transition-colors">Media</a>
-                        <a href="/admin/dashboard" class="text-text hover:text-primary px-3 py-2 rounded-md transition-colors">Admin</a>
+                        <a href="/"
+                            class="text-text hover:text-primary px-3 py-2 rounded-md transition-colors">Dashboard</a>
+                        <a href="/media/manage"
+                            class="text-text hover:text-primary px-3 py-2 rounded-md transition-colors">Media</a>
+                        <a href="/admin/dashboard"
+                            class="text-text hover:text-primary px-3 py-2 rounded-md transition-colors">Admin</a>
+                        <a href="/admin/subscriptions"
+                            class="text-text hover:text-primary px-3 py-2 rounded-md transition-colors">Sub Manage</a>
+                        <a href="/admin/access"
+                            class="text-text hover:text-primary px-3 py-2 rounded-md transition-colors">Access</a>
                     </div>
                     {% endif %}
                 </div>
 
                 <div class="flex items-center space-x-4">
                     <!-- Theme Selector -->
-                    <form method="post" action="/set-theme" id="theme-form">
-                        <select name="theme"
-                                onchange="document.getElementById('theme-form').submit()"
-                                class="theme-card border border-gray-300 dark:border-gray-700 rounded-md px-3 py-2 text-sm text-text focus:outline-none focus:ring-2 focus:ring-primary">
-                            {% for theme_key, theme_data in themes.items() %}
-                            <option value="{{ theme_key }}" {% if current_theme==theme_key %}selected{% endif %}>
-                                {{ theme_data.name }}
-                            </option>
-                            {% endfor %}
-                        </select>
-                    </form>
+                    <div class="relative">
+                        <form method="post" action="/set-theme" id="theme-form">
+                            <select name="theme" onchange="document.getElementById('theme-form').submit()"
+                                class="theme-card border border-gray-300 rounded-md px-3 py-2 text-sm">
+                                {% for theme_key, theme_data in themes.items() %}
+                                <option value="{{ theme_key }}" {% if current_theme==theme_key %}selected{% endif %}>
+                                    {{ theme_data.name }}
+                                </option>
+                                {% endfor %}
+                            </select>
+                        </form>
+                    </div>
 
                     {% if current_user %}
                     <div class="flex items-center space-x-4">
                         <span class="text-sm theme-text-secondary">{{ current_user }}</span>
                         <a href="/logout"
-                           class="bg-red-600 text-white px-4 py-2 rounded-md hover:bg-red-700 transition-colors">
-                            Logout
-                        </a>
+                            class="bg-red-600 text-white px-4 py-2 rounded-md hover:bg-red-700 transition-colors">Logout</a>
                     </div>
                     {% else %}
                     <a href="/login"
-                       class="bg-blue-600 hover:bg-blue-700 text-white px-4 py-2 rounded-md transition-colors">
-                        Login
-                    </a>
+                        class="bg-blue-600 hover:bg-blue-700 text-white px-4 py-2 rounded-md transition-colors">Login</a>
                     {% endif %}
                 </div>
             </div>
@@ -116,13 +120,14 @@
             <div class="flex justify-between items-center">
                 <p class="theme-text-secondary text-sm">© 2025 Telegram Stremio. All rights reserved.</p>
                 <div class="flex space-x-4">
-                    <a href="/status" class="theme-text-secondary hover:text-primary text-sm transition-colors">Status</a>
-                    <a href="/stremio" class="theme-text-secondary hover:text-primary text-sm transition-colors">
-                        Stremio Guide
-                    </a>
+                    <a href="/status"
+                        class="theme-text-secondary hover:text-primary text-sm transition-colors">Status</a>
+                    <a href="/stremio" class="theme-text-secondary hover:text-primary text-sm transition-colors">Stremio
+                        Guide</a>
                 </div>
             </div>
         </div>
     </footer>
 </body>
-</html>
+
+</html>

Backend/fastapi/templates/dashboard.html

@@ -669,50 +669,51 @@
             const response = await fetch('/stream/stats');
             if (response.ok) {
                 const data = await response.json();
-                const activeStreams = data.active_streams || [];
+                const allStreams = data.active_streams || [];
                 const container = document.getElementById('active-streams-container');
+                // Only show streams that are actively sending data
+                const liveStreams = allStreams.filter(s => s.status === 'active' && (s.total_bytes || 0) > 0);
 
-                if (container) {
-                    if (activeStreams.length === 0) {
-                        container.innerHTML = `<div class="p-8 text-center bg-gray-50 border border-dashed rounded-lg">
+                if (liveStreams.length === 0) {
+                    container.innerHTML = `<div class="p-8 text-center bg-gray-50 border border-dashed rounded-lg">
                             <i class="fas fa-video-slash text-gray-300 text-3xl mb-3"></i>
                             <p class="text-gray-500 font-medium">No active streams at the moment</p>
                             <p class="text-xs text-gray-400 mt-1">Users are not currently watching any media.</p>
                         </div>`;
-                    } else {
-                        const escapeHtml = (unsafe) => {
-                            if (!unsafe) return '';
-                            return unsafe
-                                .toString()
-                                .replace(/&/g, "&amp;")
-                                .replace(/</g, "&lt;")
-                                .replace(/>/g, "&gt;")
-                                .replace(/"/g, "&quot;")
-                                .replace(/'/g, "&#039;");
-                        };
-
-                        const formatBytesStr = (bytes) => {
-                            if (bytes === 0) return '0 B';
-                            const k = 1024;
-                            const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
-                            const i = Math.floor(Math.log(bytes) / Math.log(k));
-                            return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
-                        };
-
-                        container.innerHTML = activeStreams.map(stream => {
-                            let statusColor = 'bg-red-100 text-red-800';
-                            let statusPulse = 'hidden';
-                            if (stream.status === 'active') {
-                                statusColor = 'bg-green-100 text-green-800';
-                                statusPulse = '';
-                            } else if (stream.status === 'cancelled') {
-                                statusColor = 'bg-yellow-100 text-yellow-800';
-                            }
+                } else {
+                    const escapeHtml = (unsafe) => {
+                        if (!unsafe) return '';
+                        return unsafe
+                            .toString()
+                            .replace(/&/g, "&amp;")
+                            .replace(/</g, "&lt;")
+                            .replace(/>/g, "&gt;")
+                            .replace(/"/g, "&quot;")
+                            .replace(/'/g, "&#039;");
+                    };
+
+                    const formatBytesStr = (bytes) => {
+                        if (bytes === 0) return '0 B';
+                        const k = 1024;
+                        const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+                        const i = Math.floor(Math.log(bytes) / Math.log(k));
+                        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+                    };
+
+                    container.innerHTML = liveStreams.map(stream => {
+                        let statusColor = 'bg-red-100 text-red-800';
+                        let statusPulse = 'hidden';
+                        if (stream.status === 'active') {
+                            statusColor = 'bg-green-100 text-green-800';
+                            statusPulse = '';
+                        } else if (stream.status === 'cancelled') {
+                            statusColor = 'bg-yellow-100 text-yellow-800';
+                        }
 
-                            const streamIdStr = stream.stream_id ? stream.stream_id.substring(0, 8) + '...' : 'Unknown';
-                            const titleStr = (stream.meta && stream.meta.title) ? stream.meta.title : (stream.title || 'Unknown Stream');
+                        const streamIdStr = stream.stream_id ? stream.stream_id.substring(0, 8) + '...' : 'Unknown';
+                        const titleStr = (stream.meta && stream.meta.title) ? stream.meta.title : (stream.title || 'Unknown Stream');
 
-                            return `
+                        return `
                             <div class="p-4 bg-gray-50 rounded-lg border-l-4 border-green-500">
                                 <div class="flex justify-between items-start mb-3">
                                     <div class="flex items-center gap-2 max-w-[70%]">
@@ -797,13 +798,13 @@
                                 ` : ''}
                             </div>
                             `;
-                        }).join('');
-                    }
+                    }).join('');
                 }
             }
-        } catch (error) {
-            console.error("Failed to update active streams:", error);
         }
+        } catch (error) {
+        console.error("Failed to update active streams:", error);
+    }
     }
 
     // Auto-refresh every 2 minutes

Backend/fastapi/templates/subscriptions_manage.html

@@ -0,0 +1,343 @@
+{% extends "base.html" %}
+
+{% block title %}Subscription Management - Telegram Stremio{% endblock %}
+
+{% block content %}
+<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+    <div class="mb-8 flex justify-between items-center">
+        <div>
+            <h1 class="text-3xl font-bold text-gray-900 dark:text-white">Subscription Management</h1>
+            <p class="mt-2 text-sm text-gray-600 dark:text-gray-400">Manage subscription plans and view or edit active
+                users.</p>
+        </div>
+    </div>
+
+    <!-- Subscription Plans Section -->
+    <div class="mb-10">
+        <div class="flex items-center justify-between mb-4">
+            <h2 class="text-xl font-semibold text-gray-800 dark:text-gray-200">Subscription Plans</h2>
+            <button onclick="openPlanModal()"
+                class="bg-blue-600 hover:bg-blue-700 text-white px-4 py-2 rounded-md text-sm font-medium transition-colors shadow-sm flex items-center">
+                <i class="fas fa-plus mr-2"></i> Add Plan
+            </button>
+        </div>
+        <div class="grid grid-cols-1 md:grid-cols-3 gap-6" id="plans-container">
+            <div class="col-span-3 text-center text-gray-500 py-8">
+                <i class="fas fa-spinner fa-spin mr-2"></i> Loading plans...
+            </div>
+        </div>
+    </div>
+
+    <!-- User Subscriptions Section -->
+    <div class="mb-10">
+        <div class="flex items-center justify-between mb-3">
+            <h2 class="text-xl font-semibold text-gray-800 dark:text-gray-200">User Subscriptions</h2>
+            <button onclick="fetchSubscribers()"
+                class="bg-gray-200 hover:bg-gray-300 dark:bg-gray-700 dark:hover:bg-gray-600 text-gray-800 dark:text-gray-200 px-4 py-2 rounded-md text-sm font-medium transition-colors shadow-sm flex items-center">
+                <i class="fas fa-sync-alt mr-2"></i> Refresh
+            </button>
+        </div>
+
+        <!-- Search & Filter bar -->
+        <div class="flex flex-wrap gap-3 mb-3 items-center">
+            <input id="sub-search" type="text" placeholder="🔍 Search by name, username or ID…"
+                class="flex-1 min-w-[200px] border border-gray-300 dark:border-gray-600 rounded-lg px-4 py-2 text-sm focus:outline-none focus:border-primary bg-white dark:bg-gray-800 text-text"
+                oninput="renderSubPage()">
+            <select id="sub-filter"
+                class="border border-gray-300 dark:border-gray-600 rounded-lg px-3 py-2 text-sm focus:outline-none bg-white dark:bg-gray-800 text-text"
+                onchange="renderSubPage()">
+                <option value="all">All Status</option>
+                <option value="active">🟢 Active</option>
+                <option value="expired">🔴 Expired</option>
+            </select>
+            <select id="sub-page-size"
+                class="border border-gray-300 dark:border-gray-600 rounded-lg px-3 py-2 text-sm focus:outline-none bg-white dark:bg-gray-800 text-text"
+                onchange="subPage=1; renderSubPage()">
+                <option value="10">10 / page</option>
+                <option value="25">25 / page</option>
+                <option value="50">50 / page</option>
+            </select>
+        </div>
+
+        <div class="theme-card border rounded-xl overflow-hidden shadow-sm">
+            <div class="overflow-x-auto">
+                <table class="w-full text-sm text-left">
+                    <thead class="text-xs uppercase bg-gray-50 dark:bg-gray-800 dark:text-gray-300 border-b">
+                        <tr>
+                            <th class="px-6 py-4 font-semibold">User Details</th>
+                            <th class="px-6 py-4 font-semibold text-center">Status</th>
+                            <th class="px-6 py-4 font-semibold text-center">Expiry Date</th>
+                            <th class="px-6 py-4 font-semibold text-right">Actions</th>
+                        </tr>
+                    </thead>
+                    <tbody id="subscribers-tbody" class="divide-y divide-gray-100 dark:divide-gray-800">
+                        <tr>
+                            <td colspan="4" class="px-6 py-8 text-center text-gray-500"><i
+                                    class="fas fa-spinner fa-spin mr-2"></i> Loading...</td>
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+        </div>
+
+        <!-- Pagination -->
+        <div class="flex items-center justify-between mt-3 text-sm text-text opacity-70" id="sub-pagination">
+            <span id="sub-page-info"></span>
+            <div class="flex gap-2">
+                <button id="sub-btn-prev" onclick="subChangePage(-1)"
+                    class="px-3 py-1 rounded border border-gray-300 hover:bg-gray-100 transition">‹ Prev</button>
+                <span id="sub-page-num" class="px-3 py-1 font-semibold"></span>
+                <button id="sub-btn-next" onclick="subChangePage(1)"
+                    class="px-3 py-1 rounded border border-gray-300 hover:bg-gray-100 transition">Next ›</button>
+            </div>
+        </div>
+    </div>
+</div>
+
+<!-- Plan Modal -->
+<div id="plan-modal" class="fixed inset-0 bg-gray-600 bg-opacity-50 overflow-y-auto h-full w-full hidden z-50">
+    <div class="relative top-20 mx-auto p-5 border shadow-lg rounded-md theme-card sm:w-11/12 md:max-w-md">
+        <div class="mt-3 text-center">
+            <h3 class="text-lg leading-6 font-medium text-gray-900 dark:text-white mb-2" id="plan-modal-title">Add New
+                Plan</h3>
+            <div class="mt-2 text-left">
+                <form id="plan-form" onsubmit="submitPlanForm(event)">
+                    <input type="hidden" id="plan-id">
+                    <div class="mb-4">
+                        <label class="block text-gray-700 dark:text-gray-300 text-sm font-bold mb-2">Duration
+                            (Days)</label>
+                        <input type="number" id="plan-days"
+                            class="shadow appearance-none border rounded w-full py-2 px-3 text-gray-700 leading-tight focus:outline-none dark:bg-gray-700 dark:text-white dark:border-gray-600"
+                            required min="1">
+                    </div>
+                    <div class="mb-4">
+                        <label class="block text-gray-700 dark:text-gray-300 text-sm font-bold mb-2">Price (₹)</label>
+                        <input type="number" id="plan-price"
+                            class="shadow appearance-none border rounded w-full py-2 px-3 text-gray-700 leading-tight focus:outline-none dark:bg-gray-700 dark:text-white dark:border-gray-600"
+                            required min="0" step="0.01">
+                    </div>
+                    <div class="flex justify-end gap-2 mt-6">
+                        <button type="button" onclick="closePlanModal()"
+                            class="bg-gray-300 hover:bg-gray-400 text-gray-800 px-4 py-2 rounded shadow">Cancel</button>
+                        <button type="submit"
+                            class="bg-blue-600 hover:bg-blue-700 text-white px-4 py-2 rounded shadow">Save Plan</button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </div>
+</div>
+
+<!-- User Action Modal -->
+<div id="user-modal" class="fixed inset-0 bg-gray-600 bg-opacity-50 overflow-y-auto h-full w-full hidden z-50">
+    <div class="relative top-20 mx-auto p-5 border shadow-lg rounded-md theme-card sm:w-11/12 md:max-w-md">
+        <div class="mt-3 text-center">
+            <h3 class="text-lg leading-6 font-medium text-gray-900 dark:text-white mb-2" id="user-modal-title">Manage
+                User</h3>
+            <div class="text-sm text-gray-500 dark:text-gray-400 mb-4" id="user-modal-desc"></div>
+            <div class="mt-2 text-left">
+                <form id="user-form" onsubmit="submitUserForm(event)">
+                    <input type="hidden" id="manage-user-id">
+                    <input type="hidden" id="manage-action">
+                    <div class="mb-4" id="days-input-group">
+                        <label class="block text-gray-700 dark:text-gray-300 text-sm font-bold mb-2">Days to <span
+                                id="days-action-label"></span></label>
+                        <input type="number" id="manage-days"
+                            class="shadow appearance-none border rounded w-full py-2 px-3 text-gray-700 focus:outline-none dark:bg-gray-700 dark:text-white dark:border-gray-600"
+                            min="1" value="30">
+                    </div>
+                    <div class="flex justify-end gap-2 mt-6">
+                        <button type="button" onclick="closeUserModal()"
+                            class="bg-gray-300 hover:bg-gray-400 text-gray-800 px-4 py-2 rounded shadow">Cancel</button>
+                        <button type="submit" class="bg-blue-600 hover:bg-blue-700 text-white px-4 py-2 rounded shadow"
+                            id="btn-user-save">Confirm</button>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </div>
+</div>
+
+<script>
+    // ---- Plans ----
+    async function fetchPlans() {
+        try {
+            const res = await fetch('/api/admin/subscriptions/plans');
+            const container = document.getElementById('plans-container');
+            if (res.ok) {
+                const data = await res.json();
+                const plans = data.data || data.plans || [];
+                if (!plans.length) {
+                    container.innerHTML = '<div class="col-span-3 text-center text-gray-500 py-8">No plans found. Create one.</div>';
+                    return;
+                }
+                container.innerHTML = plans.map(p => `
+          <div class="theme-card rounded-xl border p-6 shadow-sm relative group">
+            <div class="absolute right-4 top-4 hidden group-hover:flex gap-2">
+              <button onclick="openPlanModal('${p._id}', ${p.days}, ${p.price})" class="text-blue-500 hover:text-blue-700"><i class="fas fa-edit"></i></button>
+              <button onclick="deletePlan('${p._id}')" class="text-red-500 hover:text-red-700"><i class="fas fa-trash"></i></button>
+            </div>
+            <div class="flex items-center">
+              <div class="flex-shrink-0 bg-yellow-100 dark:bg-yellow-900/30 p-3 rounded-lg">
+                <i class="fas fa-calendar-alt text-xl text-yellow-600 dark:text-yellow-400"></i>
+              </div>
+              <div class="ml-4">
+                <h3 class="text-sm font-medium text-gray-500 dark:text-gray-400">${p.days} Days Plan</h3>
+                <p class="text-2xl font-bold text-gray-900 dark:text-white">₹${p.price}</p>
+              </div>
+            </div>
+          </div>`).join('');
+            }
+        } catch (err) { console.error(err); }
+    }
+
+    function openPlanModal(id = '', days = '', price = '') {
+        document.getElementById('plan-id').value = id;
+        document.getElementById('plan-days').value = days;
+        document.getElementById('plan-price').value = price;
+        document.getElementById('plan-modal-title').innerText = id ? 'Edit Plan' : 'Add New Plan';
+        document.getElementById('plan-modal').classList.remove('hidden');
+    }
+    function closePlanModal() { document.getElementById('plan-modal').classList.add('hidden'); }
+
+    async function submitPlanForm(e) {
+        e.preventDefault();
+        const id = document.getElementById('plan-id').value;
+        const payload = { days: parseInt(document.getElementById('plan-days').value), price: parseFloat(document.getElementById('plan-price').value) };
+        const res = await fetch(id ? `/api/admin/subscriptions/plans/${id}` : '/api/admin/subscriptions/plans', {
+            method: id ? 'PUT' : 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload)
+        });
+        if (res.ok) { closePlanModal(); fetchPlans(); } else alert('Failed to save plan.');
+    }
+
+    async function deletePlan(id) {
+        if (!confirm('Delete this plan?')) return;
+        const res = await fetch(`/api/admin/subscriptions/plans/${id}`, { method: 'DELETE' });
+        if (res.ok) fetchPlans(); else alert('Failed to delete.');
+    }
+
+    // ---- Subscribers with Search + Pagination ----
+    let allUsers = [];
+    let subPage = 1;
+
+    function getSubFiltered() {
+        const q = document.getElementById('sub-search').value.toLowerCase();
+        const status = document.getElementById('sub-filter').value;
+        return allUsers.filter(u => {
+            const name = ((u.first_name || '') + ' ' + (u.username || '') + ' ' + (u._id || '')).toLowerCase();
+            const matchQ = !q || name.includes(q);
+            const matchStatus = status === 'all' || u.subscription_status === status;
+            return matchQ && matchStatus;
+        });
+    }
+
+    function renderSubPage() {
+        const filtered = getSubFiltered();
+        const pageSize = parseInt(document.getElementById('sub-page-size').value);
+        const totalPages = Math.max(1, Math.ceil(filtered.length / pageSize));
+        if (subPage > totalPages) subPage = totalPages;
+        const start = (subPage - 1) * pageSize;
+        const slice = filtered.slice(start, start + pageSize);
+
+        document.getElementById('sub-page-info').textContent = `Showing ${start + 1}–${Math.min(start + pageSize, filtered.length)} of ${filtered.length}`;
+        document.getElementById('sub-page-num').textContent = `Page ${subPage} / ${totalPages}`;
+        document.getElementById('sub-btn-prev').disabled = subPage <= 1;
+        document.getElementById('sub-btn-next').disabled = subPage >= totalPages;
+
+        const tbody = document.getElementById('subscribers-tbody');
+        if (!slice.length) {
+            tbody.innerHTML = '<tr><td colspan="4" class="px-6 py-8 text-center text-gray-500">No users match your search.</td></tr>';
+            return;
+        }
+
+        tbody.innerHTML = slice.map(u => {
+            const statusColor = u.subscription_status === 'active' ? 'bg-green-100 text-green-800' : 'bg-red-100 text-red-800';
+            let expiry = 'N/A';
+            if (u.subscription_expiry) {
+                const d = new Date(u.subscription_expiry);
+                expiry = d.toLocaleDateString('en-IN', { timeZone: 'Asia/Kolkata', day: '2-digit', month: 'short', year: 'numeric' }) +
+                    ' ' + d.toLocaleTimeString('en-IN', { timeZone: 'Asia/Kolkata', hour: '2-digit', minute: '2-digit' });
+            }
+            let name = u.first_name || '';
+            if (u.username) name += (name ? ' ' : '') + `(@${u.username})`;
+            if (!name) name = `User ${u._id}`;
+            const safeName = name.replace(/'/g, "\\'");
+            return `<tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50 transition-colors">
+        <td class="px-6 py-4">
+          <div class="font-medium text-gray-900 dark:text-gray-100">${name}</div>
+          <div class="text-xs text-gray-500">ID: ${u._id}</div>
+        </td>
+        <td class="px-6 py-4 text-center">
+          <span class="px-2 py-1 rounded ${statusColor} text-xs font-bold uppercase tracking-wider">${u.subscription_status}</span>
+        </td>
+        <td class="px-6 py-4 text-center text-sm">${expiry}</td>
+        <td class="px-6 py-4 text-right">
+          <div class="flex justify-end gap-2 flex-wrap">
+            <button onclick="openUserModal(${u._id}, '${safeName}', 'extend')"
+              class="bg-green-50 text-green-600 hover:bg-green-100 px-2 py-1 rounded text-xs font-medium border border-green-200">Extend</button>
+            <button onclick="openUserModal(${u._id}, '${safeName}', 'reduce')"
+              class="bg-yellow-50 text-yellow-600 hover:bg-yellow-100 px-2 py-1 rounded text-xs font-medium border border-yellow-200">Reduce</button>
+            <button onclick="openUserModal(${u._id}, '${safeName}', 'delete')"
+              class="bg-red-50 text-red-600 hover:bg-red-100 px-2 py-1 rounded text-xs font-medium border border-red-200">Revoke</button>
+          </div>
+        </td>
+      </tr>`;
+        }).join('');
+    }
+
+    function subChangePage(dir) { subPage += dir; renderSubPage(); }
+
+    async function fetchSubscribers() {
+        document.getElementById('subscribers-tbody').innerHTML =
+            '<tr><td colspan="4" class="px-6 py-8 text-center text-gray-500"><i class="fas fa-spinner fa-spin mr-2"></i> Loading...</td></tr>';
+        try {
+            const res = await fetch('/api/admin/subscriptions/users');
+            if (res.ok) {
+                const data = await res.json();
+                allUsers = data.data || [];
+                subPage = 1;
+                renderSubPage();
+            }
+        } catch (err) { console.error(err); }
+    }
+
+    function openUserModal(userId, userName, action) {
+        document.getElementById('manage-user-id').value = userId;
+        document.getElementById('manage-action').value = action;
+        let title = '', desc = '', btnColor = 'bg-blue-600 hover:bg-blue-700', showDays = true;
+        if (action === 'extend') {
+            title = 'Extend Subscription'; desc = `Add days to <b>${userName}</b>'s subscription.`;
+            document.getElementById('days-action-label').innerText = 'Add';
+        } else if (action === 'reduce') {
+            title = 'Reduce Subscription'; desc = `Remove days from <b>${userName}</b>'s subscription.`;
+            document.getElementById('days-action-label').innerText = 'Subtract'; btnColor = 'bg-yellow-600 hover:bg-yellow-700';
+        } else {
+            title = 'Revoke Subscription'; desc = `<b>Warning:</b> This will revoke <b>${userName}</b>'s subscription entirely.`;
+            showDays = false; btnColor = 'bg-red-600 hover:bg-red-700';
+        }
+        document.getElementById('user-modal-title').innerText = title;
+        document.getElementById('user-modal-desc').innerHTML = desc;
+        document.getElementById('days-input-group').className = showDays ? 'mb-4' : 'hidden';
+        document.getElementById('btn-user-save').className = `${btnColor} text-white px-4 py-2 rounded shadow`;
+        if (!showDays) { document.getElementById('manage-days').value = 0; document.getElementById('manage-days').removeAttribute('required'); }
+        else document.getElementById('manage-days').setAttribute('required', 'required');
+        document.getElementById('user-modal').classList.remove('hidden');
+    }
+
+    function closeUserModal() { document.getElementById('user-modal').classList.add('hidden'); }
+
+    async function submitUserForm(e) {
+        e.preventDefault();
+        const userId = document.getElementById('manage-user-id').value;
+        const action = document.getElementById('manage-action').value;
+        const days = document.getElementById('manage-days').value;
+        const res = await fetch(`/api/admin/subscriptions/users/${userId}/manage`, {
+            method: 'POST', headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ action, days: parseInt(days) || 0 })
+        });
+        if (res.ok) { closeUserModal(); fetchSubscribers(); } else alert('Failed to update user.');
+    }
+
+    document.addEventListener('DOMContentLoaded', () => { fetchPlans(); fetchSubscribers(); });
+</script>
+{% endblock %}

Backend/helper/database.py

@@ -78,6 +78,217 @@ class Database:
             upsert=True
         )
 
+    # -------------------------------
+    # User Subscription Management
+    # -------------------------------
+    async def get_user(self, user_id: int) -> Optional[dict]:
+        return await self.dbs["tracking"]["users"].find_one({"_id": user_id})
+
+    async def update_user_interaction(self, user_id: int, first_name: str, username: str):
+        await self.dbs["tracking"]["users"].update_one(
+            {"_id": user_id},
+            {"$set": {"first_name": first_name, "username": username, "last_interaction": datetime.utcnow()}},
+            upsert=True
+        )
+
+    async def set_pending_payment(self, user_id: int, plan_duration: int, msg_id: int, price=0, admin_messages: list = None):
+        update_data = {
+            "pending_payment": {
+                "duration": plan_duration,
+                "price": price,
+                "msg_id": msg_id,
+                "date": datetime.utcnow(),
+            }
+        }
+        if admin_messages is not None:
+            update_data["pending_payment"]["admin_messages"] = admin_messages
+        await self.dbs["tracking"]["users"].update_one(
+            {"_id": user_id},
+            {"$set": update_data},
+            upsert=True
+        )
+
+    async def approve_payment(self, user_id: int) -> Optional[dict]:
+        user = await self.get_user(user_id)
+        if not user or "pending_payment" not in user:
+            return None
+
+        duration = user["pending_payment"]["duration"]
+        
+        # Calculate new expiry
+        current_expiry = user.get("subscription_expiry")
+        now = datetime.utcnow()
+        if current_expiry and current_expiry > now:
+            from datetime import timedelta
+            new_expiry = current_expiry + timedelta(days=duration)
+        else:
+            from datetime import timedelta
+            new_expiry = now + timedelta(days=duration)
+
+        await self.dbs["tracking"]["users"].update_one(
+            {"_id": user_id},
+            {
+                "$set": {"subscription_expiry": new_expiry, "subscription_status": "active"},
+                "$unset": {"pending_payment": ""}
+            }
+        )
+        return await self.get_user(user_id)
+
+    async def reject_payment(self, user_id: int) -> bool:
+        result = await self.dbs["tracking"]["users"].update_one(
+            {"_id": user_id},
+            {"$unset": {"pending_payment": ""}}
+        )
+        return result.modified_count > 0
+
+    async def get_expired_users(self) -> List[dict]:
+        cursor = self.dbs["tracking"]["users"].find({
+            "subscription_expiry": {"$lt": datetime.utcnow()},
+            "subscription_status": "active"
+        })
+        return await cursor.to_list(None)
+
+    async def mark_user_expired(self, user_id: int):
+        await self.dbs["tracking"]["users"].update_one(
+            {"_id": user_id},
+            {"$set": {"subscription_status": "expired"}}
+        )
+
+    async def get_expiring_users(self, hours: int = 24) -> List[dict]:
+        from datetime import timedelta
+        now = datetime.utcnow()
+        target_time = now + timedelta(hours=hours)
+        cursor = self.dbs["tracking"]["users"].find({
+            "subscription_expiry": {"$gt": now, "$lte": target_time},
+            "reminder_sent": {"$ne": True},
+            "subscription_status": "active"
+        })
+        return await cursor.to_list(None)
+        
+    async def mark_reminder_sent(self, user_id: int):
+         await self.dbs["tracking"]["users"].update_one(
+            {"_id": user_id},
+            {"$set": {"reminder_sent": True}}
+        )
+
+    # -------------------------------
+    # Admin Subscription Management
+    # -------------------------------
+    async def get_subscription_plans(self) -> List[dict]:
+        cursor = self.dbs["tracking"]["sub_plans"].find().sort("days", ASCENDING)
+        plans = await cursor.to_list(None)
+        return [convert_objectid_to_str(plan) for plan in plans]
+
+    async def add_subscription_plan(self, days: int, price: float) -> Optional[str]:
+        result = await self.dbs["tracking"]["sub_plans"].insert_one({
+            "days": days,
+            "price": price,
+            "created_at": datetime.utcnow()
+        })
+        return str(result.inserted_id)
+
+    async def update_subscription_plan(self, plan_id: str, days: int, price: float) -> bool:
+        try:
+            result = await self.dbs["tracking"]["sub_plans"].update_one(
+                {"_id": ObjectId(plan_id)},
+                {"$set": {"days": days, "price": price, "updated_at": datetime.utcnow()}}
+            )
+            return result.modified_count > 0
+        except Exception:
+            return False
+
+    async def delete_subscription_plan(self, plan_id: str) -> bool:
+        try:
+            result = await self.dbs["tracking"]["sub_plans"].delete_one({"_id": ObjectId(plan_id)})
+            return result.deleted_count > 0
+        except Exception:
+            return False
+
+    async def get_all_subscribers(self) -> List[dict]:
+        cursor = self.dbs["tracking"]["users"].find({
+            "subscription_status": {"$in": ["active", "expired"]}
+        }).sort("subscription_expiry", DESCENDING)
+        users = await cursor.to_list(None)
+        return [convert_objectid_to_str(u) for u in users]
+
+    async def manage_subscriber(self, user_id: int, action: str, days: int = 0) -> bool:
+        user = await self.get_user(user_id)
+        if not user:
+            return False
+            
+        now = datetime.utcnow()
+        if action == "extend" or action == "reduce":
+            from datetime import timedelta
+            current_expiry = user.get("subscription_expiry")
+            
+            if action == "extend":
+                if current_expiry and current_expiry > now:
+                    new_expiry = current_expiry + timedelta(days=days)
+                else:
+                    new_expiry = now + timedelta(days=days)
+            else: # reduce
+                if current_expiry:
+                    new_expiry = current_expiry - timedelta(days=days)
+                    if new_expiry < now:
+                        new_expiry = now # Just expire them
+                else:
+                    new_expiry = now # Already expired or none
+            
+            status = "active" if new_expiry > now else "expired"
+            
+            result = await self.dbs["tracking"]["users"].update_one(
+                {"_id": user_id},
+                {"$set": {"subscription_expiry": new_expiry, "subscription_status": status}}
+            )
+            return result.modified_count > 0
+            
+        elif action == "delete":
+            result = await self.dbs["tracking"]["users"].update_one(
+                {"_id": user_id},
+                {"$unset": {"subscription_expiry": "", "subscription_status": ""}}
+            )
+            return result.modified_count > 0
+            
+        return False
+
+    async def assign_subscription(self, user_id: int, days: int) -> dict:
+        """Upsert a subscription for any user_id, creating a record if it doesn't exist."""
+        from datetime import timedelta
+        now = datetime.utcnow()
+
+        user = await self.get_user(user_id)
+        if user:
+            current_expiry = user.get("subscription_expiry")
+            if current_expiry and current_expiry > now:
+                new_expiry = current_expiry + timedelta(days=days)
+            else:
+                new_expiry = now + timedelta(days=days)
+        else:
+            new_expiry = now + timedelta(days=days)
+
+        await self.dbs["tracking"]["users"].update_one(
+            {"_id": user_id},
+            {
+                "$set": {
+                    "subscription_expiry": new_expiry,
+                    "subscription_status": "active",
+                },
+                "$setOnInsert": {
+                    "_id": user_id,
+                    "first_name": f"User {user_id}",
+                    "username": None,
+                    "created_at": now,
+                }
+            },
+            upsert=True
+        )
+        return {
+            "user_id": user_id,
+            "subscription_expiry": new_expiry.isoformat(),
+            "subscription_status": "active",
+            "days_assigned": days,
+        }
+
 
     # -------------------------------
     # Helper Methods for Repeated Logic
@@ -938,13 +1149,20 @@ class Database:
     # API Token Methods
     # -------------------------------
 
-    async def add_api_token(self, name: str, daily_limit_gb: float = None, monthly_limit_gb: float = None) -> dict:
+    async def add_api_token(self, name: str, daily_limit_gb: float = None, monthly_limit_gb: float = None, user_id: int = None) -> dict:
+        # If a user_id is provided, return existing token if already created
+        if user_id:
+            existing = await self.dbs["tracking"]["api_tokens"].find_one({"user_id": user_id})
+            if existing:
+                return convert_objectid_to_str(existing)
+
         alphabet = string.ascii_letters + string.digits
         token = ''.join(secrets.choice(alphabet) for _ in range(32))
         
         token_doc = {
             "name": name,
             "token": token,
+            "user_id": user_id,
             "created_at": datetime.utcnow(),
             "limits": {
                 "daily_limit_gb": daily_limit_gb if daily_limit_gb else 0,
@@ -973,6 +1191,14 @@ class Database:
         result = await self.dbs["tracking"]["api_tokens"].delete_one({"token": token})
         return result.deleted_count > 0
 
+    async def link_token_user(self, token: str, user_id: int) -> bool:
+        """Link an existing token to a Telegram user_id."""
+        result = await self.dbs["tracking"]["api_tokens"].update_one(
+            {"token": token},
+            {"$set": {"user_id": user_id}}
+        )
+        return result.modified_count > 0
+
     async def update_token_usage(self, token: str, bytes_delta: int):
         today_str = datetime.now(timezone.utc).strftime("%Y-%m-%d")
         month_str = datetime.now(timezone.utc).strftime("%Y-%m")

Backend/helper/subscription_checker.py

@@ -0,0 +1,61 @@
+import asyncio
+from pyrogram import Client
+from Backend.config import Telegram
+from Backend import db
+from datetime import datetime
+from Backend.logger import LOGGER
+
+async def subscription_checker_loop(bot: Client):
+    while True:
+        try:
+            if not Telegram.SUBSCRIPTION:
+                await asyncio.sleep(3600)
+                continue
+
+            LOGGER.info("Running subscription checker...")
+
+            # 1. Fetch expired users & kick them
+            expired_users = await db.get_expired_users()
+            for user in expired_users:
+                user_id = user["_id"]
+                try:
+                    # Ban then unban to kick the user without permanently banning them
+                    await bot.ban_chat_member(Telegram.SUBSCRIPTION_GROUP_ID, user_id)
+                    await bot.unban_chat_member(Telegram.SUBSCRIPTION_GROUP_ID, user_id)
+                    
+                    await db.mark_user_expired(user_id)
+                    
+                    # Notify user
+                    await bot.send_message(
+                        user_id,
+                        "❌ <b>Subscription Expired</b>\n\n"
+                        "Your subscription has expired, and you have been removed from the private group.\n"
+                        "Send /start to renew your subscription and regain access."
+                    )
+                    LOGGER.info(f"Kicked expired user {user_id}")
+                except Exception as e:
+                    LOGGER.error(f"Failed to kick/notify expired user {user_id}: {e}")
+
+            # 2. Remind users expiring in 24 hours
+            expiring_users = await db.get_expiring_users(hours=24)
+            for user in expiring_users:
+                user_id = user["_id"]
+                expiry = user["subscription_expiry"]
+                try:
+                    await bot.send_message(
+                        user_id,
+                        f"⚠️ <b>Subscription Expiring Soon</b>\n\n"
+                        f"Your subscription will expire on <b>{expiry.strftime('%Y-%m-%d %H:%M UTC')}</b>.\n"
+                        "Send /start to renew your plan before you lose access to the group!"
+                    )
+                    await db.mark_reminder_sent(user_id)
+                    LOGGER.info(f"Sent expiry reminder to user {user_id}")
+                except Exception as e:
+                    LOGGER.error(f"Failed to send reminder to user {user_id}: {e}")
+
+            # Check every hour
+            await asyncio.sleep(3600)
+
+        except Exception as e:
+            LOGGER.error(f"Error in subscription checker loop: {e}")
+            await asyncio.sleep(300) # Wait 5 minutes before retrying on error

Backend/pyrofork/plugins/group_security.py

@@ -0,0 +1,47 @@
+from pyrogram import Client, filters
+from pyrogram.types import ChatMemberUpdated
+from Backend.config import Telegram
+from Backend import db
+from datetime import datetime
+from Backend.logger import LOGGER
+from pyrogram.enums import ChatMemberStatus
+
+@Client.on_chat_member_updated()
+async def on_user_join(client: Client, chat_member_updated: ChatMemberUpdated):
+    if not Telegram.SUBSCRIPTION:
+        return
+
+    # Check if this update is for the subscription group
+    if chat_member_updated.chat.id != Telegram.SUBSCRIPTION_GROUP_ID:
+        return
+
+    # Check if it's a join event (user was not a member, now is a member)
+    old_status = chat_member_updated.old_chat_member.status if chat_member_updated.old_chat_member else None
+    new_status = chat_member_updated.new_chat_member.status if chat_member_updated.new_chat_member else None
+    
+    if new_status == ChatMemberStatus.MEMBER:
+        user = chat_member_updated.new_chat_member.user
+        
+        # Verify subscription
+        db_user = await db.get_user(user.id)
+        is_active = False
+        if db_user and db_user.get("subscription_status") == "active":
+            if db_user.get("subscription_expiry") and db_user.get("subscription_expiry") > datetime.utcnow():
+                is_active = True
+                
+        if not is_active:
+            try:
+                # Kick the user
+                await client.ban_chat_member(chat_member_updated.chat.id, user.id)
+                await client.unban_chat_member(chat_member_updated.chat.id, user.id)
+                LOGGER.info(f"Kicked unauthorized user {user.id} from group {chat_member_updated.chat.id}")
+                
+                # Notify them
+                await client.send_message(
+                    user.id,
+                    "❌ <b>Access Denied</b>\n\n"
+                    "You were removed from the private group because you do not have an active subscription.\n"
+                    "Please press /start in this bot to purchase or renew your subscription."
+                )
+            except Exception as e:
+                LOGGER.error(f"Failed to kick/notify unauthorized user {user.id}: {e}")

Backend/pyrofork/plugins/help.py

@@ -0,0 +1,22 @@
+from pyrogram import Client, filters
+from pyrogram.types import Message
+from Backend.config import Telegram
+from Backend.helper.custom_filter import CustomFilters
+
+@Client.on_message(filters.command("help"))
+async def help_command(client: Client, message: Message):
+    if Telegram.SUBSCRIPTION:
+        text = (
+            "<b>Bot Commands:</b>\n\n"
+            "/start - Main menu / Purchase membership\n"
+            "/status - Check your subscription expiry date\n"
+            "/help - Show this message"
+        )
+    else:
+        text = (
+            "<b>Bot Commands:</b>\n\n"
+            "/start - Get the Stremio Addon URL\n"
+            "/help - Show this message"
+        )
+        
+    await message.reply_text(text, quote=True)

Backend/pyrofork/plugins/start.py

@@ -1,18 +1,78 @@
 from pyrogram import filters, Client, enums
+from pyrogram.types import Message, InlineKeyboardMarkup, InlineKeyboardButton
 from Backend.helper.custom_filter import CustomFilters
-from pyrogram.types import Message
 from Backend.config import Telegram
+from Backend import db
+from datetime import datetime
 
-@Client.on_message(filters.command('start') & filters.private & CustomFilters.owner, group=10)
+print("DEBUG: start.py PLUGIN LOADED SUCCESSFULLY!")
+
+@Client.on_message(filters.command('start'), group=10)
 async def send_start_message(client: Client, message: Message):
     try:
+        user_id = (message.from_user.id if message.from_user else None) or (message.sender_chat.id if message.sender_chat else None) or message.chat.id
+        print(f"DEBUG: Received /start command from {user_id}")
+        # await message.reply_text("DEBUG: Bot received the start command.")
+        
         base_url = Telegram.BASE_URL
         addon_url = f"{base_url}/stremio/manifest.json"
 
+        # If subscriptions are NOT enabled, only the OWNER should use the bot
+        if not Telegram.SUBSCRIPTION and user_id != Telegram.OWNER_ID:
+            return
+
+        # Subscription logic
+        if Telegram.SUBSCRIPTION:
+            user = await db.get_user(user_id)
+            now = datetime.utcnow()
+            
+            # Check if user has an active subscription
+            is_active = False
+            if user and user.get("subscription_status") == "active":
+                if user.get("subscription_expiry") and user.get("subscription_expiry") > now:
+                    is_active = True
+                else:
+                    await db.mark_user_expired(user_id)
+
+            if not is_active:
+                plans = await db.get_subscription_plans()
+                if not plans:
+                    return await message.reply_text(
+                        '<b>Welcome to the Telegram Stremio Private Group!</b>\n\n'
+                        'Currently, no subscription plans are set up. Please contact the administrator.',
+                        quote=True,
+                        parse_mode=enums.ParseMode.HTML
+                    )
+                
+                keyboard_buttons = []
+                for plan in plans:
+                    keyboard_buttons.append([InlineKeyboardButton(f"{plan['days']} Days - ₹{plan['price']}", callback_data=f"plan_{plan['_id']}")])
+                
+                keyboard = InlineKeyboardMarkup(keyboard_buttons)
+                
+                return await message.reply_text(
+                    '<b>Welcome to the Telegram Stremio Private Group!</b>\n\n'
+                    'Access to this bot and the Stremio Addon requires an active subscription.\n'
+                    'Please select a subscription plan below to continue:',
+                    reply_markup=keyboard,
+                    quote=True,
+                    parse_mode=enums.ParseMode.HTML
+                )
+            
+            # User is active, fetch their token
+            all_tokens = await db.get_all_api_tokens()
+            token_doc = next((t for t in all_tokens if t.get("user_id") == user_id), None)
+            
+            if token_doc and "token" in token_doc:
+                token_str = token_doc["token"]
+                addon_url = f"{base_url}/stremio/{token_str}/manifest.json"
+
         await message.reply_text(
-            '<b>Welcome to the main Telegram Stremio bot!</b>\n\n'
-            'To install the Stremio addon, copy the URL below and add it in the Stremio addons:\n\n'
-            f'<b>Your Addon URL:</b>\n<code>{addon_url}</code>',
+            '🎉 <b>Welcome to the Telegram Stremio Media Server!</b>\n\n'
+            'Your subscription is active. Here is your personal addon link:\n\n'
+            '🎬 <b>Stremio Addon — Install Link:</b>\n'
+            f'<code>{addon_url}</code>\n\n'
+            'Tap the link above → <b>Install</b> in Stremio to start watching!',
             quote=True,
             parse_mode=enums.ParseMode.HTML
         )

Backend/pyrofork/plugins/subscription.py

@@ -0,0 +1,308 @@
+from pyrogram import Client, filters
+from pyrogram.types import Message, CallbackQuery, InlineKeyboardMarkup, InlineKeyboardButton
+from Backend.config import Telegram
+from Backend import db
+from datetime import datetime, timedelta
+import asyncio
+
+from bson.objectid import ObjectId
+
+@Client.on_callback_query(filters.regex(r"^plan_([a-fA-F0-9]{24})$"))
+async def plan_selection(client: Client, callback_query: CallbackQuery):
+    if not Telegram.SUBSCRIPTION:
+        return await callback_query.answer("Subscriptions are not enabled.", show_alert=True)
+        
+    plan_id = callback_query.matches[0].group(1)
+    
+    plans = await db.get_subscription_plans()
+    plan = next((p for p in plans if p["_id"] == plan_id), None)
+    
+    if not plan:
+        return await callback_query.answer("Invalid plan.", show_alert=True)
+        
+    duration = plan["days"]
+    await callback_query.answer()
+    
+    user_id = callback_query.from_user.id if callback_query.from_user else callback_query.message.chat.id
+    first_name = callback_query.from_user.first_name if callback_query.from_user else callback_query.message.chat.title
+    username = callback_query.from_user.username if callback_query.from_user else callback_query.message.chat.username
+
+    # Store initial user interaction if needed
+    await db.update_user_interaction(user_id, first_name, username)
+
+    # Calculate expiry
+    user = await db.get_user(user_id)
+    now = datetime.utcnow()
+    current_expiry = user.get("subscription_expiry") if user else None
+
+    if current_expiry and current_expiry > now:
+        new_expiry = current_expiry + timedelta(days=int(duration))
+    else:
+        new_expiry = now + timedelta(days=int(duration))
+
+    expiry_str = new_expiry.strftime("%Y-%m-%d %H:%M UTC")
+
+    text = (
+        f"<b>✅ Plan Selected: {plan['days']} Days</b>\n\n"
+        f"<b>💰 Price:</b> ₹{plan['price']}\n"
+        f"<b>📅 Expiry (if approved now):</b> {expiry_str}\n\n"
+        f"<b>📋 Payment Instructions:</b>\n"
+        f"1. Pay ₹{plan['price']} to the admin.\n"
+        f"2. <b>Send your payment screenshot directly here (in this chat)</b>.\n"
+        f"   The admin will review and activate your subscription."
+    )
+
+    # Set pending payment state (price stored for admin display)
+    await db.set_pending_payment(user_id, int(duration), 0, price=plan.get("price", 0))
+
+    # Always try to DM the user directly so the screenshot handler (filters.private) picks it up
+    dm_sent = False
+    from pyrogram.types import ForceReply
+
+    # Always try to DM the user directly so the screenshot handler (filters.private) picks it up
+    dm_sent = False
+    try:
+        await client.send_message(
+            chat_id=user_id,
+            text=text,
+            reply_markup=ForceReply(selective=True),
+        )
+        dm_sent = True
+    except Exception as e:
+        print(f"Could not DM user {user_id}: {e}")
+
+    if dm_sent:
+        await callback_query.answer("✅ Check your DM for payment instructions!", show_alert=True)
+    else:
+        # Fallback: reply in current chat if DM fails (user hasn't started bot)
+        await callback_query.message.reply_text(
+            text + "\n\n⚠️ <i>Please start a DM with the bot first by clicking its username, then send your screenshot there.</i>",
+            reply_markup=ForceReply(selective=True),
+            quote=True,
+        )
+        await callback_query.answer()
+
+
+@Client.on_message(filters.photo & filters.private)
+async def handle_payment_screenshot(client: Client, message: Message):
+    if not Telegram.SUBSCRIPTION:
+        return
+    
+    # Safely resolve sender ID
+    sender_id = (message.from_user.id if message.from_user else None) \
+             or (message.sender_chat.id if message.sender_chat else None) \
+             or message.chat.id
+
+    try:
+        print(f"DEBUG: handle_payment_screenshot triggered by {sender_id}")
+        # Check if user has a pending payment request
+        user = await db.get_user(sender_id)
+        print(f"DEBUG: user from DB = {user}")
+        if not user or "pending_payment" not in user:
+            # No active payment flow - tell the user what to do
+            print(f"DEBUG: No pending_payment found for {sender_id}")
+            await message.reply_text(
+                "ℹ️ We received your photo, but you don't have an active payment request.\n\n"
+                "Please use /start to select a subscription plan first, then send your payment screenshot.",
+                quote=True
+            )
+            return
+
+        pending = user["pending_payment"]
+        duration = pending.get("duration", "?")
+        price    = pending.get("price", "?")
+
+        # --- Admin notification ---
+        keyboard = InlineKeyboardMarkup([
+            [
+                InlineKeyboardButton("✅ Approve", callback_data=f"approve_{sender_id}"),
+                InlineKeyboardButton("❌ Reject",  callback_data=f"reject_{sender_id}")
+            ]
+        ])
+
+        user_mention = message.from_user.mention if message.from_user else f"User {sender_id}"
+        username_str = f"@{message.from_user.username}" if (message.from_user and message.from_user.username) else "N/A"
+
+        admin_text = (
+            f"<b>💰 New Payment Screenshot Received</b>\n\n"
+            f"<b>👤 User:</b> {user_mention}\n"
+            f"<b>🆔 User ID:</b> <code>{sender_id}</code>\n"
+            f"<b>🔗 Username:</b> {username_str}\n\n"
+            f"<b>📦 Plan Details:</b>\n"
+            f"  • Duration: <b>{duration} days</b>\n"
+            f"  • Price: <b>₹{price}</b>\n\n"
+            f"Please review the screenshot above and approve or reject."
+        )
+
+        approver_ids = Telegram.APPROVER_IDS if Telegram.APPROVER_IDS else [Telegram.OWNER_ID]
+        admin_messages = []
+        for approver_id in approver_ids:
+            try:
+                sent = await message.copy(approver_id, caption=admin_text, reply_markup=keyboard)
+                admin_messages.append({"chat_id": approver_id, "message_id": sent.id})
+            except Exception as e:
+                print(f"Failed to forward screenshot to approver {approver_id}: {e}")
+
+        # Update pending state with screenshot message ID + all admin message IDs
+        await db.set_pending_payment(sender_id, duration, message.id, price=price,
+                                     admin_messages=admin_messages)
+
+        if admin_messages:
+            await message.reply_text(
+                "✅ <b>Screenshot Received!</b>\n\n"
+                "Your payment screenshot has been forwarded to the admin for review.\n"
+                "You will be notified once it's approved. Thank you! 🙏",
+                quote=True
+            )
+        else:
+            await message.reply_text(
+                "⚠️ Your screenshot was received but we could not reach the admin. "
+                "Please contact the admin directly.",
+                quote=True
+            )
+
+    except Exception as e:
+        print(f"Error in handle_payment_screenshot: {e}")
+        await message.reply_text(
+            f"⚠️ Something went wrong while processing your screenshot. Please try again or contact the admin.\n\nError: {e}",
+            quote=True
+        )
+
+
+@Client.on_callback_query(filters.regex(r"^(approve|reject)_(\d+)$"))
+async def admin_review(client: Client, callback_query: CallbackQuery):
+    approver_ids = Telegram.APPROVER_IDS if Telegram.APPROVER_IDS else [Telegram.OWNER_ID]
+    if callback_query.from_user.id not in approver_ids:
+        return await callback_query.answer("You are not authorized to perform this action.", show_alert=True)
+
+    action = callback_query.matches[0].group(1)
+    target_user_id = int(callback_query.matches[0].group(2))
+    acting_admin = callback_query.from_user
+    admin_name = acting_admin.first_name or acting_admin.username or f"Admin {acting_admin.id}"
+
+    # Fetch admin_messages BEFORE any DB write (approve/reject unsets pending_payment)
+    user_pre = await db.get_user(target_user_id)
+    if not user_pre or "pending_payment" not in user_pre:
+        return await callback_query.answer("This request has already been processed.", show_alert=True)
+
+    admin_messages = user_pre["pending_payment"].get("admin_messages", [])
+
+    if action == "approve":
+        user_data = await db.approve_payment(target_user_id)
+        if user_data:
+            # Generate or retrieve existing API token for this user
+            try:
+                user_obj = await db.get_user(target_user_id)
+                user_name = (user_obj.get("first_name") or user_obj.get("username") or str(target_user_id)) if user_obj else str(target_user_id)
+                token_doc = await db.add_api_token(name=user_name, user_id=target_user_id)
+                token_str = token_doc.get("token")
+                addon_url = f"{Telegram.BASE_URL}/stremio/{token_str}/manifest.json"
+            except Exception as te:
+                token_str = None
+                addon_url = None
+
+            # Generate invite link for the group
+            try:
+                invite_link = await client.create_chat_invite_link(
+                    chat_id=Telegram.SUBSCRIPTION_GROUP_ID,
+                    member_limit=1,
+                    expire_date=datetime.utcnow() + timedelta(days=1)
+                )
+                invite_text = f"\n\n🔗 <b>Group Invite:</b> {invite_link.invite_link}"
+            except Exception:
+                invite_text = ""
+
+            expiry_str = user_data["subscription_expiry"].strftime("%Y-%m-%d")
+
+            # Build confirmation message for user
+            success_text = (
+                f"🎉 <b>Payment Approved!</b>\n\n"
+                f"Your subscription is now active until <b>{expiry_str}</b>."
+                f"{invite_text}"
+            )
+            if addon_url:
+                success_text += (
+                    f"\n\n🎬 <b>Stremio Addon — Install Link:</b>\n"
+                    f"<code>{addon_url}</code>\n\n"
+                    f"Tap the link above → <b>Install</b> in Stremio to start watching!"
+                )
+
+            await client.send_message(target_user_id, success_text)
+
+            # Update acting admin's message
+            status_caption = f"✅ <b>Approved</b> by {admin_name}."
+            await callback_query.message.edit_caption(status_caption)
+
+            # Update all OTHER admins' copies
+            acting_msg_id = callback_query.message.id
+            for am in admin_messages:
+                if am["message_id"] == acting_msg_id:
+                    continue
+                try:
+                    await client.edit_message_caption(
+                        chat_id=am["chat_id"],
+                        message_id=am["message_id"],
+                        caption=f"✅ <b>Approved</b> by {admin_name}. No further action needed."
+                    )
+                except Exception:
+                    pass
+        else:
+            await callback_query.answer("Could not approve — no pending payment found.", show_alert=True)
+
+    elif action == "reject":
+        success = await db.reject_payment(target_user_id)
+        if success:
+            await client.send_message(
+                target_user_id,
+                "❌ <b>Payment Rejected</b>\n\nYour recent payment submission was rejected by the admin. Please contact the admin or try submitting again."
+            )
+
+            # Update acting admin's message
+            status_caption = f"❌ <b>Rejected</b> by {admin_name}."
+            await callback_query.message.edit_caption(status_caption)
+
+            # Update all OTHER admins' copies
+            acting_msg_id = callback_query.message.id
+            for am in admin_messages:
+                if am["message_id"] == acting_msg_id:
+                    continue
+                try:
+                    await client.edit_message_caption(
+                        chat_id=am["chat_id"],
+                        message_id=am["message_id"],
+                        caption=f"❌ <b>Rejected</b> by {admin_name}. No further action needed."
+                    )
+                except Exception:
+                    pass
+        else:
+            await callback_query.answer("Could not reject — no pending payment found.", show_alert=True)
+
+
+@Client.on_message(filters.command("status"))
+async def check_status(client: Client, message: Message):
+    if not Telegram.SUBSCRIPTION:
+        return
+        
+    user_id = (message.from_user.id if message.from_user else None) or (message.sender_chat.id if message.sender_chat else None) or message.chat.id
+        
+    user = await db.get_user(user_id)
+    if not user or user.get("subscription_status") != "active":
+        return await message.reply_text("You do not have an active subscription.")
+        
+    expiry = user.get("subscription_expiry")
+    if not expiry:
+        return await message.reply_text("Error retrieving expiry date.")
+        
+    now = datetime.utcnow()
+    if now > expiry:
+        return await message.reply_text("Your subscription has expired.")
+        
+    remaining = expiry - now
+    days = remaining.days
+    hours = remaining.seconds // 3600
+    
+    await message.reply_text(
+        f"<b>Subscription Status:</b> Active ✅\n"
+        f"<b>Expiry Date:</b> {expiry.strftime('%Y-%m-%d %H:%M UTC')}\n"
+        f"<b>Time Remaining:</b> {days} days and {hours} hours"
+    )

README.md

@@ -25,6 +25,12 @@
 - [🚀 Introduction](#-introduction)
   - [✨ Key Features](#-key-features)
   - [🆕 New Features](#-new-features)
+  - [� Subscription Management](#-subscription-management)
+  - [💳 Subscription Management](#-subscription-management-config)
+  - [📋 Plans](#-subscription-plans)
+  - [🤖 Bot Payment Flow](#-bot-payment-flow)
+  - [🗃️ Access Management](#️-access-management)
+  - [🎬 Stremio Addon Integration](#-stremio-addon-integration)
 - [⚙️ How It Works](#️-how-it-works)
   - [Overview](#overview)
   - [Upload Guidelines](#upload-guidelines)
@@ -41,8 +47,10 @@
   - [🌐 Server](#-server)
   - [🔄 Update Settings](#-update-settings)
   - [🔐 Admin Panel](#-admin-panel)
+
   - [🧰 Additional CDN Bots (Multi-Token System)](#-additional-cdn-bots-multi-token-system)
-- [🚀 Deployment Guide](#-deployment-guide)
+
+- [�🚀 Deployment Guide](#-deployment-guide)
   - [✅ Recommended Prerequisites](#-recommended-prerequisites)
   - [🐙 Heroku Guide](#-heroku-guide)
   - [🐳 VPS Guide (Recommended)](#-vps-guide)
@@ -66,6 +74,18 @@ This project is a **next-generation Telegram Stremio Media Server** that allows
 - 🎬 **IMDB and TMDB Metadata Integration** 
 - ♾️ **No File Expiration** 
 - 🧠 **Admin Panel Support** 
+- 💳 **Subscription Management** — Plans, payment approval, auto token generation, and expiry enforcement
+- 🔐 **Access Management** — View, extend, reduce, revoke, and reassign subscriptions from the admin UI
+
+
+## 🆕 New Features
+
+- ⚡ **Speed Test** – Speed testing added for all bots on each file to optimize streaming performance.
+- 🔄 **Improved Load Balancer** – Enhanced load balancing algorithm for better traffic distribution across multiple tokens.
+- 🚫 **Failed Bot Management** – Max failed bots will be marked as shadow or idle for buffer optimization. This is due to some data center bots having rate-limiting constraints.
+- 📊 **Bot-wise Analysis** – Detailed bot performance analytics available in the admin dashboard for monitoring and optimization.
+- 🧹 **Deleted File Detection** – Automatic detection of deleted files on every restart, with admin capability to manually remove them from the database.
+- 🛠️ **Additional Admin Features** – Various small enhancements and improvements for administrators.
 
 
 ## 🆕 New Features
@@ -270,6 +290,19 @@ All environment variables for this project are defined in the `config.env` file.
 | **`ADMIN_PASSWORD`** | Password for Admin Panel access.|
  **⚠️ Change from default values for security.** 
 
+### 💳 Subscription Management Config
+
+Enable the subscription feature to gate access to streams behind a paid plan. When `SUBSCRIPTION=True`, every user must have an active subscription to stream content.
+
+| Variable | Description |
+| :--- | :--- |
+| **`SUBSCRIPTION`** | Enable (`True`) or disable (`False`) the subscription gate. When enabled, users without an active subscription see an expired message in Stremio instead of streams. *Default: `False`*. |
+| **`SUBSCRIPTION_GROUP_ID`** | Telegram **group/channel ID** where approved subscribers are invited. Users receive an invite link upon payment approval. |
+| **`APPROVER_IDS`** | Comma-separated Telegram user IDs of admins who can **approve or reject** subscription payment requests. |
+| **`SUBSCRIPTION_URL`** | Telegram bot URL (e.g. `https://t.me/your_bot`) shown to expired users in Stremio so they can renew. |
+
+> 💡 `SUBSCRIPTION_GROUP_ID` and `APPROVER_IDS` must be set **without quotes** in `config.env`.
+
 ### 🧰 Additional CDN Bots (Multi-Token System)
 
 | Variable | Description |
@@ -287,6 +320,137 @@ To avoid this, you can use **MULTI_TOKEN** system:
 - The system will automatically distribute the load among all these bots!
 
 
+---
+
+# 💳 Subscription Management
+
+The Subscription Management system allows you to **monetise access** to your Telegram Stremio server. When enabled, users must have an active subscription to stream content.
+
+## 📋 Subscription Plans
+
+Admins can create and manage subscription plans from the **Admin Panel → Subscription Management** page.
+
+Each plan has:
+- **Name** (e.g. `Monthly`, `Quarterly`)
+- **Duration** in days
+- **Price** (for display)
+- **Description**
+
+Plans are stored in MongoDB and can be added, edited, or deleted at any time without restarting.
+
+---
+
+## 🤖 Bot Payment Flow
+
+Users interact with the bot to subscribe:
+
+```
+User → /start → selects plan → sends payment screenshot
+      → Approver gets notification → Approve / Reject
+      → On Approve:
+          ✅ Subscription saved to DB
+          🔑 Stremio addon token auto-generated
+          📨 User receives Stremio install link + group invite
+```
+
+**Approver actions** (available to `APPROVER_IDS`):
+
+| Button | Action |
+| :--- | :--- |
+| ✅ Approve | Activates subscription, generates addon token, invites user to group |
+| ❌ Reject | Notifies user with rejection message |
+
+---
+
+## 🗃️ Access Management
+
+The **Admin Panel → Access Management** page gives admins full control over all users and their addon tokens.
+
+### Columns Shown
+
+| Column | Description |
+| :--- | :--- |
+| Status | 🟢 Active / 🔴 Expired |
+| User | Display name or `User {id}` |
+| Addon Link | Stremio install URL + copy button |
+| Created | Token creation date |
+| Expires | Subscription expiry date |
+| Actions | Buttons for managing the user |
+
+### Action Buttons
+
+| Button | Description |
+| :--- | :--- |
+| 📅 **Assign** | Assign or extend a subscription plan (adds days) |
+| ➕ **Extend** | Add extra days to an active subscription |
+| ➖ **Reduce** | Subtract days from an active subscription |
+| 🚫 **Revoke** | Wipe subscription entirely (marks expired) |
+| 🗑️ **Del Token** | Delete the addon token only (user still subscribed) |
+| 🔗 **Link User ID** | Link an old/orphan token to a Telegram user ID to enable management |
+
+> 💡 Manually created (old) tokens that have no linked user ID show a **🔗 Link User ID** button. Once linked, all action buttons become available.
+
+### Search & Filtering
+
+- 🔍 Search by user name or ID
+- Filter by status: All / Active / Expired
+- Pagination with configurable page size
+
+---
+
+## 🎬 Stremio Addon Integration
+
+### Per-User Addon Token
+
+Each user gets a **unique addon token** automatically generated on payment approval. Their Stremio addon URL is:
+
+```
+https://your-domain.com/stremio/{token}/manifest.json
+```
+
+### Dynamic Manifest
+
+The addon manifest updates dynamically per user:
+
+| Scenario | Addon Name | Description |
+| :--- | :--- | :--- |
+| Active, has expiry | `Telegram — Expires 28 Mar 2026` | 📅 Subscription active until 28 Mar 2026 |
+| Active, no expiry | `Telegram — Active` | ✅ Subscription active |
+| Default (no subscription mode) | `Telegram` | Standard description |
+
+The manifest `version` encodes the expiry date — when an admin extends or revokes a subscription, the version changes and Stremio detects an update.
+
+### Expired Stream
+
+When a user's subscription expires, instead of streams they see:
+
+```json
+{
+  "name": "🚫 Subscription Expired",
+  "title": "Your subscription has expired.\nRenew via the bot to continue watching.",
+  "url": "https://t.me/your_bot"   ← SUBSCRIPTION_URL from config
+}
+```
+
+Clicking the stream name opens the bot directly for renewal.
+
+### Configure & Reinstall Page
+
+Every addon has a **Configure page** at:
+
+```
+https://your-domain.com/stremio/{token}/configure
+```
+
+This page shows:
+- User name, subscription status, expiry date
+- **⚡ Install / Update in Stremio** button (Stremio Web install flow)
+- Manual install steps + **📋 Copy URL** button
+
+The ⚙️ gear icon in Stremio opens this page so users can reinstall after an admin updates their subscription.
+
+---
+
 # 🚀 Deployment Guide
 
 This guide will help you deploy your **Telegram Stremio Media Server** using either Heroku or a VPS with Docker.
@@ -552,6 +716,6 @@ If you want to use **only** your **Telegram Stremio Media Server addon** for met
 
 |<img width="80" src="https://avatars.githubusercontent.com/u/113664541">|<img width="80" src="https://avatars.githubusercontent.com/u/13152917">|<img width="80" src="https://avatars.githubusercontent.com/u/14957082">|<img width="80" src="https://raw.githubusercontent.com/vflixa1prime/Readme/main/VFlixPRime.png">|
 |:---:|:---:|:---:|:---:|
-|[`Karan`](https://github.com/Weebzone)|[`Stremio`](https://github.com/Stremio)|[`ChatGPT`](https://github.com/OPENAI)|[`VFlix Prime`](https://t.me/vflixprime)|
+|[`Karan`](https://github.com/Weebzone)|[`Stremio`](https://github.com/Stremio)|[`ChatGPT`](https://github.com/OPENAI)|[`VFlix Prime`](https://t.me/vflixprime2)|
 |Author|Stremio SDK|Refactor|Community Support
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "Telegram-Stremio"
-version = "2.0.0"
+version = "2.1.0"
 description = "A powerful, self-hosted Telegram Stremio Media Server built with FastAPI, MongoDB, and PyroFork seamlessly integrated with Stremio for automated media streaming and discovery."
 readme = "README.md"
 requires-python = ">=3.11"

sample_config.env

@@ -1,34 +1,24 @@
 # Startup Config
-API_ID = ""
-API_HASH = ""
-BOT_TOKEN = ""
-HELPER_BOT_TOKEN = ""
-OWNER_ID = ""
-REPLACE_MODE = "true"
-HIDE_CATALOG = "false"
-PARALLEL = "1"
-PRE_FETCH = "1"
-
-# STORAGE
-AUTH_CHANNEL = ""
-DATABASE = ""
-
-# API
-TMDB_API = ""
-
-# SERVER 
-BASE_URL = ""
-PORT = "8000"
-
-# Update
-UPSTREAM_REPO = "https://github.com/weebzone/Telegram-Stremio"
-UPSTREAM_BRANCH = "master"
-
-# Admin Pannel
-ADMIN_USERNAME = "fyvio"
-ADMIN_PASSWORD = "fyvio"
-
-# Additional CDN Bots
-# MULTI_TOKEN1 = ""
-
-
+API_ID=""
+API_HASH=""
+BOT_TOKEN=""
+HELPER_BOT_TOKEN=""
+OWNER_ID=""
+REPLACE_MODE=""
+HIDE_CATALOG=""
+PARALLEL="4"
+PRE_FETCH="3"
+AUTH_CHANNEL=""
+DATABASE=""
+TMDB_API=""
+BASE_URL=""
+PORT="8001"
+UPSTREAM_REPO="https://github.com/weebzone/Telegram-Stremio"
+UPSTREAM_BRANCH="master"
+ADMIN_USERNAME=""
+ADMIN_PASSWORD=""
+SUBSCRIPTION=True #without ""
+SUBSCRIPTION_GROUP_ID= #without ""
+APPROVER_IDS= #without ""
+SUBSCRIPTION_URL="" #telegram bot url like https://t.me/username
+MULTI_TOKEN1=""

start.sh

@@ -1 +1 @@
-uv run update.py && uv run -m Backend
+uv run update.py && uv run -m Backend

subscription_bot/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "subscription_bot",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "type": "commonjs"
+}