Update app.py

app.py

@@ -1,6 +1,6 @@
 """
 Campus Recovery Network - Main Application
-Complete working version for Hugging Face Spaces
+Complete working version for Hugging Face Spaces with database sessions
 """
 
 import os
@@ -12,15 +12,16 @@ import time
 import re
 import csv
 import io
+import secrets
 from datetime import datetime, timedelta
 from functools import wraps
-from flask import Flask, render_template, request, redirect, url_for, jsonify, flash, g, send_file, make_response, session
+from flask import Flask, render_template, request, redirect, url_for, jsonify, flash, g, send_file, make_response
 from flask_bcrypt import Bcrypt
 from flask_cors import CORS
 from werkzeug.utils import secure_filename
 
 # ── Configuration ─────────────────────────────────────────────────────────────
-SECRET_KEY = os.environ.get('SECRET_KEY', 'campus_recovery_secret_key_2024_must_be_long_and_secure')
+SECRET_KEY = os.environ.get('SECRET_KEY', 'campus_recovery_secret_key_2024')
 UPLOAD_FOLDER = 'static/uploads'
 MAX_CONTENT_LENGTH = 16 * 1024 * 1024
 
@@ -31,73 +32,41 @@ ADMIN_EMAIL = os.environ.get('ADMIN_EMAIL', 'admin@campusrecovery.com')
 os.makedirs(UPLOAD_FOLDER, exist_ok=True)
 DATABASE = 'campus_recovery.db'
 
-# ── Optional AI libs (graceful fallback) ─────────────────────────────────────
+# ── Optional AI libs ─────────────────────────────────────────────────────────
 try:
     import numpy as np
-    NUMPY_OK = True
 except ImportError:
-    NUMPY_OK = False
+    np = None
 
 try:
     import cv2
-    OPENCV_OK = True
 except ImportError:
-    OPENCV_OK = False
+    cv2 = None
 
 try:
     from PIL import Image
-    PIL_OK = True
 except ImportError:
-    PIL_OK = False
+    Image = None
 
 try:
     from ultralytics import YOLO
-    YOLO_OK = True
     yolo_model = YOLO('yolov8n.pt')
-    print("✓ YOLOv8 loaded")
-except Exception as e:
-    YOLO_OK = False
+    YOLO_OK = True
+except Exception:
     yolo_model = None
-    print(f"⚠ YOLOv8 not available: {e}")
+    YOLO_OK = False
 
 # ── App setup ───────────────────────────────────────────────────────────────
 app = Flask(__name__)
 app.secret_key = SECRET_KEY
 app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
 app.config['MAX_CONTENT_LENGTH'] = MAX_CONTENT_LENGTH
-app.config['SESSION_PERMANENT'] = True
-app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=30)
-app.config['SESSION_COOKIE_SECURE'] = False  # Set to True if using HTTPS
-app.config['SESSION_COOKIE_HTTPONLY'] = True
-app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
 
 bcrypt = Bcrypt(app)
 CORS(app, supports_credentials=True)
 
 ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'webp'}
 
-# ── Login Required Decorator ─────────────────────────────────────────────────
-def login_required(f):
-    @wraps(f)
-    def decorated_function(*args, **kwargs):
-        if 'user_id' not in session:
-            flash('Please log in to continue.', 'warning')
-            return redirect(url_for('login'))
-        
-        # Verify user still exists and is not banned
-        user = query_db("SELECT id, is_banned FROM users WHERE id=?", [session['user_id']], one=True)
-        if not user:
-            session.clear()
-            flash('Session expired. Please log in again.', 'warning')
-            return redirect(url_for('login'))
-        if user['is_banned']:
-            session.clear()
-            flash('Your account has been suspended.', 'danger')
-            return redirect(url_for('login'))
-        
-        return f(*args, **kwargs)
-    return decorated_function
-
 # ── Database helpers ─────────────────────────────────────────────────────────
 def get_db():
     db = getattr(g, '_database', None)
@@ -128,7 +97,70 @@ def query_db(query, args=(), one=False, commit=False):
             db.rollback()
         raise e
 
-# ── Database Schema ───────────────────────────────────────────────────────────
+# ── Session Management (Database-based) ──────────────────────────────────────
+def create_session_token(user_id):
+    """Create a new session token and store in database"""
+    token = secrets.token_urlsafe(32)
+    expires_at = datetime.now() + timedelta(days=30)
+    query_db(
+        "INSERT INTO user_sessions (session_token, user_id, expires_at) VALUES (?, ?, ?)",
+        [token, user_id, expires_at.isoformat()],
+        commit=True
+    )
+    return token
+
+def validate_session_token(token):
+    """Validate session token and return user_id if valid"""
+    if not token:
+        return None
+    session = query_db(
+        "SELECT user_id, expires_at FROM user_sessions WHERE session_token = ?",
+        [token],
+        one=True
+    )
+    if not session:
+        return None
+    expires_at = datetime.fromisoformat(session['expires_at'])
+    if expires_at < datetime.now():
+        query_db("DELETE FROM user_sessions WHERE session_token = ?", [token], commit=True)
+        return None
+    return session['user_id']
+
+def delete_session_token(token):
+    """Delete a session token (logout)"""
+    if token:
+        query_db("DELETE FROM user_sessions WHERE session_token = ?", [token], commit=True)
+
+# ── Login Required Decorator ─────────────────────────────────────────────────
+def login_required(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        # First try to get token from cookie
+        token = request.cookies.get('session_token')
+        user_id = validate_session_token(token) if token else None
+        
+        # If not found, try URL parameter (fallback for HF Spaces)
+        if not user_id:
+            token = request.args.get('token')
+            user_id = validate_session_token(token) if token else None
+        
+        if not user_id:
+            flash('Please log in to continue.', 'warning')
+            return redirect(url_for('login'))
+        
+        # Get user info
+        user = query_db("SELECT * FROM users WHERE id=? AND is_banned=0", [user_id], one=True)
+        if not user:
+            flash('Please log in again.', 'warning')
+            return redirect(url_for('login'))
+        
+        g.user_id = user_id
+        g.username = user['username']
+        g.user = user
+        return f(*args, **kwargs)
+    return decorated_function
+
+# ── Database Schema (with sessions table) ─────────────────────────────────────
 def init_db():
     with app.app_context():
         db = get_db()
@@ -141,7 +173,6 @@ def init_db():
             role TEXT DEFAULT 'user',
             is_banned INTEGER DEFAULT 0,
             ban_reason TEXT,
-            avatar TEXT,
             email_notifications INTEGER DEFAULT 1,
             match_alerts INTEGER DEFAULT 1,
             claim_updates INTEGER DEFAULT 1,
@@ -150,6 +181,15 @@ def init_db():
             last_login TEXT
         );
 
+        CREATE TABLE IF NOT EXISTS user_sessions (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            session_token TEXT UNIQUE NOT NULL,
+            user_id INTEGER NOT NULL,
+            created_at TEXT DEFAULT (datetime('now')),
+            expires_at TEXT NOT NULL,
+            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+        );
+
         CREATE TABLE IF NOT EXISTS items (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             user_id INTEGER NOT NULL,
@@ -163,8 +203,6 @@ def init_db():
             brand TEXT,
             image_path TEXT,
             status TEXT DEFAULT 'active' CHECK(status IN ('active','resolved','claimed')),
-            image_features TEXT,
-            ai_embedding TEXT,
             source TEXT DEFAULT 'web',
             ai_item_name TEXT,
             ai_brand_model TEXT,
@@ -180,7 +218,7 @@ def init_db():
             lost_item_id INTEGER NOT NULL,
             found_item_id INTEGER NOT NULL,
             score REAL DEFAULT 0,
-            status TEXT DEFAULT 'pending' CHECK(status IN ('pending','accepted','rejected')),
+            status TEXT DEFAULT 'pending',
             created_at TEXT DEFAULT (datetime('now')),
             FOREIGN KEY (lost_item_id) REFERENCES items(id) ON DELETE CASCADE,
             FOREIGN KEY (found_item_id) REFERENCES items(id) ON DELETE CASCADE
@@ -192,7 +230,7 @@ def init_db():
             claimant_id INTEGER NOT NULL,
             proof_text TEXT NOT NULL,
             proof_image TEXT,
-            status TEXT DEFAULT 'pending' CHECK(status IN ('pending','approved','rejected')),
+            status TEXT DEFAULT 'pending',
             admin_note TEXT,
             created_at TEXT DEFAULT (datetime('now')),
             resolved_at TEXT,
@@ -223,25 +261,6 @@ def init_db():
             FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
         );
 
-        CREATE TABLE IF NOT EXISTS chat_history (
-            id INTEGER PRIMARY KEY AUTOINCREMENT,
-            user_id INTEGER NOT NULL,
-            role TEXT NOT NULL,
-            content TEXT NOT NULL,
-            created_at TEXT DEFAULT (datetime('now')),
-            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
-        );
-
-        CREATE TABLE IF NOT EXISTS admin_actions (
-            id INTEGER PRIMARY KEY AUTOINCREMENT,
-            admin_id INTEGER,
-            action TEXT NOT NULL,
-            target_type TEXT,
-            target_id INTEGER,
-            details TEXT,
-            created_at TEXT DEFAULT (datetime('now'))
-        );
-
         CREATE TABLE IF NOT EXISTS ratings (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             user_id INTEGER NOT NULL,
@@ -250,32 +269,28 @@ def init_db():
             created_at TEXT DEFAULT (datetime('now')),
             FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
         );
-
-        CREATE TABLE IF NOT EXISTS system_settings (
-            key TEXT PRIMARY KEY,
-            value TEXT,
-            updated_at TEXT DEFAULT (datetime('now'))
-        );
         """)
         db.commit()
 
-        # Add missing columns for existing databases
-        columns_to_add = [
-            ('items', 'ai_item_name', 'TEXT'),
-            ('items', 'ai_brand_model', 'TEXT'),
-            ('items', 'ai_dominant_color', 'TEXT'),
-            ('items', 'ai_confidence_scores', 'TEXT'),
-            ('notifications', 'metadata', 'TEXT'),
-        ]
-        
-        for table, column, col_type in columns_to_add:
-            try:
-                db.execute(f"ALTER TABLE {table} ADD COLUMN {column} {col_type}")
-                print(f"✓ Added column {column} to {table}")
-            except sqlite3.OperationalError:
-                pass
+        # Add missing columns if needed
+        try:
+            db.execute("ALTER TABLE items ADD COLUMN ai_item_name TEXT")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            db.execute("ALTER TABLE items ADD COLUMN ai_brand_model TEXT")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            db.execute("ALTER TABLE items ADD COLUMN ai_dominant_color TEXT")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            db.execute("ALTER TABLE items ADD COLUMN ai_confidence_scores TEXT")
+        except sqlite3.OperationalError:
+            pass
 
-        # Create admin user if not exists
+        # Create admin user
         existing_admin = db.execute("SELECT id FROM users WHERE username=?", (ADMIN_USERNAME,)).fetchone()
         if not existing_admin:
             pw_hash = bcrypt.generate_password_hash(ADMIN_PASSWORD_RAW).decode('utf-8')
@@ -299,127 +314,31 @@ def save_upload(file):
         return filename
     return None
 
-def add_notification(user_id, title, message, notif_type='info', link=None, metadata=None):
+def add_notification(user_id, title, message, notif_type='info', link=None):
     try:
         query_db(
-            "INSERT INTO notifications (user_id, title, message, type, link, metadata) VALUES (?,?,?,?,?,?)",
-            [user_id, title, message, notif_type, link, json.dumps(metadata) if metadata else None], 
+            "INSERT INTO notifications (user_id, title, message, type, link) VALUES (?,?,?,?,?)",
+            [user_id, title, message, notif_type, link], 
             commit=True
         )
     except Exception as e:
         print(f"Error adding notification: {e}")
 
-# ── Color Detection ──────────────────────────────────────────────────────────
-COLOR_NAMES = {
-    'Red': ([0, 100, 100], [10, 255, 255]),
-    'Orange': ([10, 100, 100], [25, 255, 255]),
-    'Yellow': ([25, 100, 100], [35, 255, 255]),
-    'Green': ([35, 100, 100], [85, 255, 255]),
-    'Blue': ([85, 100, 100], [130, 255, 255]),
-    'Purple': ([130, 100, 100], [160, 255, 255]),
-    'Pink': ([160, 100, 100], [180, 255, 255]),
-    'Black': ([0, 0, 0], [180, 255, 50]),
-    'White': ([0, 0, 200], [180, 30, 255]),
-    'Gray': ([0, 0, 50], [180, 30, 200]),
-    'Brown': ([0, 50, 50], [30, 255, 150]),
-}
-
-def detect_color_with_opencv(image_path):
-    if not OPENCV_OK or not NUMPY_OK:
-        return None
-    try:
-        img = cv2.imread(image_path)
-        if img is None:
-            return None
-        hsv = cv2.cvtColor(img, cv2.COLOR_BGR2HSV)
-        hsv = cv2.resize(hsv, (200, 200))
-        pixels = hsv.reshape(-1, 3)
-        
-        from sklearn.cluster import KMeans
-        kmeans = KMeans(n_clusters=3, random_state=42, n_init=10)
-        kmeans.fit(pixels)
-        centers = kmeans.cluster_centers_
-        
-        for color_hsv in centers:
-            h, s, v = color_hsv
-            for color_name, (lower, upper) in COLOR_NAMES.items():
-                lower_h, lower_s, lower_v = lower
-                upper_h, upper_s, upper_v = upper
-                if color_name == 'Red':
-                    if (lower_h <= h <= upper_h) or (h >= 150 and h <= 180):
-                        if lower_s <= s <= upper_s and lower_v <= v <= upper_v:
-                            return color_name.lower()
-                else:
-                    if (lower_h <= h <= upper_h and 
-                        lower_s <= s <= upper_s and 
-                        lower_v <= v <= upper_v):
-                        return color_name.lower()
-        return None
-    except Exception as e:
-        print(f"Color detection error: {e}")
-        return None
-
-def detect_item_with_yolo(image_path):
-    if not YOLO_OK or yolo_model is None:
-        return None
-    try:
-        results = yolo_model(image_path)
-        for result in results:
-            boxes = result.boxes
-            if boxes and len(boxes) > 0:
-                cls = int(boxes.cls[0])
-                conf = float(boxes.conf[0])
-                label = yolo_model.names[cls]
-                if conf > 0.25:
-                    friendly_names = {
-                        'cell phone': 'Smartphone', 'laptop': 'Laptop',
-                        'backpack': 'Backpack', 'handbag': 'Handbag',
-                        'book': 'Book', 'bottle': 'Water Bottle',
-                        'watch': 'Watch',
-                    }
-                    item_name = friendly_names.get(label, label.replace('_', ' ').title())
-                    return {'item': item_name, 'confidence': conf}
-        return None
-    except Exception as e:
-        print(f"YOLO detection error: {e}")
-        return None
-
 def auto_detect_category(title):
     title_lower = title.lower().strip()
-    category_map = {
-        'Electronics & Gadgets': ['laptop', 'computer', 'tablet', 'phone', 'iphone', 'samsung', 'charger', 'headphone', 'camera', 'watch'],
-        'Personal Items & Accessories': ['wallet', 'purse', 'bag', 'backpack', 'keys', 'glasses', 'sunglasses', 'umbrella'],
-        'Clothing & Wearables': ['shirt', 'jacket', 'hoodie', 'sweater', 'pants', 'jeans', 'shoe', 'hat'],
-        'Academic Materials': ['book', 'textbook', 'notebook', 'pen', 'pencil', 'calculator'],
-        'Documents & IDs': ['id', 'identification', 'passport', 'license', 'student id', 'card'],
-        'Food & Kitchen': ['bottle', 'lunchbox', 'cup', 'mug', 'water bottle'],
+    categories = {
+        'Electronics': ['laptop', 'computer', 'phone', 'iphone', 'samsung', 'charger', 'headphone', 'camera', 'watch'],
+        'Accessories': ['wallet', 'purse', 'bag', 'backpack', 'keys', 'glasses', 'sunglasses', 'umbrella'],
+        'Clothing': ['shirt', 'jacket', 'hoodie', 'sweater', 'pants', 'jeans', 'shoe', 'hat'],
+        'Academic': ['book', 'textbook', 'notebook', 'pen', 'pencil', 'calculator'],
+        'Documents': ['id', 'identification', 'passport', 'license', 'card'],
+        'Food & Drink': ['bottle', 'lunchbox', 'cup', 'mug', 'water bottle'],
     }
-    for category, keywords in category_map.items():
+    for category, keywords in categories.items():
         for keyword in keywords:
             if keyword in title_lower:
                 return category
-    return 'Miscellaneous'
-
-def analyze_image_for_autofill(image_path):
-    suggestions = {'item_name': None, 'category': None, 'color': None, 'brand': None, 'confidence_scores': {}}
-    print(f"🔍 Analyzing image: {image_path}")
-    
-    yolo_result = detect_item_with_yolo(image_path)
-    if yolo_result:
-        suggestions['item_name'] = yolo_result['item']
-        suggestions['confidence_scores']['yolo'] = yolo_result['confidence']
-        print(f"✅ YOLO detected: {yolo_result['item']}")
-    
-    color_result = detect_color_with_opencv(image_path)
-    if color_result:
-        suggestions['color'] = color_result.title()
-        suggestions['confidence_scores']['color'] = 0.85
-        print(f"✅ OpenCV detected color: {color_result}")
-    
-    if suggestions['item_name']:
-        suggestions['category'] = auto_detect_category(suggestions['item_name'])
-    
-    return suggestions
+    return 'Other'
 
 def compute_match_score(item_a, item_b):
     score = 0
@@ -453,8 +372,8 @@ def run_matching_engine():
                         if score >= 40:
                             db.execute("INSERT INTO matches (lost_item_id, found_item_id, score) VALUES (?,?,?)", (lost['id'], found['id'], score))
                             db.commit()
-                            add_notification(lost['user_id'], f"Potential match found! ({score}%)", f"We found a possible match for your '{lost['title']}'.", 'match', f"/item/{found['id']}")
-                            add_notification(found['user_id'], f"Potential match found! ({score}%)", f"Your found item '{found['title']}' matches a lost report!", 'match', f"/item/{lost['id']}")
+                            add_notification(lost['user_id'], f"Potential match! ({score}%)", f"We found a match for '{lost['title']}'", 'match', f"/item/{found['id']}")
+                            add_notification(found['user_id'], f"Potential match! ({score}%)", f"Your found item matches '{lost['title']}'", 'match', f"/item/{lost['id']}")
                 db.close()
             except Exception as e:
                 print(f"Matching engine error: {e}")
@@ -471,34 +390,32 @@ def index():
 
 @app.route('/login', methods=['GET', 'POST'])
 def login():
-    if 'user_id' in session:
+    # Check if already logged in via cookie
+    token = request.cookies.get('session_token')
+    if token and validate_session_token(token):
         return redirect(url_for('dashboard'))
     
     if request.method == 'POST':
         identifier = request.form.get('identifier', '').strip()
         password = request.form.get('password', '')
         
-        if not identifier or not password:
-            flash('Please enter both username/email and password.', 'danger')
-            return render_template('login.html')
-        
         user = query_db("SELECT * FROM users WHERE username=? OR email=?", [identifier, identifier], one=True)
         
         if user and bcrypt.check_password_hash(user['password_hash'], password):
             if user['is_banned']:
-                flash('Your account has been suspended.', 'danger')
+                flash('Account suspended.', 'danger')
                 return render_template('login.html')
             
-            session.clear()
-            session['user_id'] = user['id']
-            session['username'] = user['username']
-            session['role'] = user['role']
-            session.permanent = True
-            
+            # Create session token
+            token = create_session_token(user['id'])
             query_db("UPDATE users SET last_login=datetime('now') WHERE id=?", [user['id']], commit=True)
             
             flash(f'Welcome back, {user["username"]}!', 'success')
-            return redirect(url_for('dashboard'))
+            
+            # Create response with cookie
+            resp = make_response(redirect(url_for('dashboard')))
+            resp.set_cookie('session_token', token, max_age=30*24*60*60, httponly=True, samesite='Lax', path='/')
+            return resp
         else:
             flash('Invalid credentials.', 'danger')
     
@@ -506,9 +423,6 @@ def login():
 
 @app.route('/register', methods=['GET', 'POST'])
 def register():
-    if 'user_id' in session:
-        return redirect(url_for('dashboard'))
-    
     if request.method == 'POST':
         username = request.form.get('username', '').strip()
         email = request.form.get('email', '').strip()
@@ -516,7 +430,7 @@ def register():
         confirm = request.form.get('confirm_password', '')
         
         if not username or not email or not password:
-            flash('All fields are required.', 'danger')
+            flash('All fields required.', 'danger')
             return render_template('register.html')
         
         if password != confirm:
@@ -535,32 +449,46 @@ def register():
         pw_hash = bcrypt.generate_password_hash(password).decode('utf-8')
         user_id = query_db("INSERT INTO users (username, email, password_hash) VALUES (?,?,?)", [username, email, pw_hash], commit=True)
         
-        session.clear()
-        session['user_id'] = user_id
-        session['username'] = username
-        session['role'] = 'user'
-        session.permanent = True
+        # Create session token
+        token = create_session_token(user_id)
         
-        add_notification(user_id, 'Welcome to Campus Recovery Network!', 'Your account has been created. Start by reporting a lost or found item.', 'success')
-        flash('Registration successful! Welcome!', 'success')
-        return redirect(url_for('dashboard'))
+        add_notification(user_id, 'Welcome!', 'Your account has been created.', 'success')
+        flash('Registration successful!', 'success')
+        
+        resp = make_response(redirect(url_for('dashboard')))
+        resp.set_cookie('session_token', token, max_age=30*24*60*60, httponly=True, samesite='Lax', path='/')
+        return resp
     
     return render_template('register.html')
 
 @app.route('/logout')
 def logout():
-    session.clear()
-    flash('You have been logged out.', 'info')
-    return redirect(url_for('index'))
+    token = request.cookies.get('session_token')
+    if token:
+        delete_session_token(token)
+    resp = make_response(redirect(url_for('index')))
+    resp.set_cookie('session_token', '', expires=0, path='/')
+    flash('Logged out.', 'info')
+    return resp
 
 @app.route('/dashboard')
-@login_required
 def dashboard():
-    uid = session['user_id']
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    
+    if not user_id:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
+    user = query_db("SELECT * FROM users WHERE id=? AND is_banned=0", [user_id], one=True)
+    if not user:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
+    uid = user['id']
     my_items = query_db("SELECT * FROM items WHERE user_id=? ORDER BY created_at DESC LIMIT 10", [uid])
     my_matches = query_db("""
-        SELECT m.*, li.title as lost_title, fi.title as found_title,
-               li.id as lid, fi.id as fid
+        SELECT m.*, li.title as lost_title, fi.title as found_title, li.id as lid, fi.id as fid
         FROM matches m
         JOIN items li ON m.lost_item_id = li.id
         JOIN items fi ON m.found_item_id = fi.id
@@ -574,13 +502,23 @@ def dashboard():
         'found': query_db("SELECT COUNT(*) as c FROM items WHERE user_id=? AND item_type='found'", [uid], one=True)['c'] or 0,
         'resolved': query_db("SELECT COUNT(*) as c FROM items WHERE user_id=? AND status='resolved'", [uid], one=True)['c'] or 0,
     }
-    return render_template('dashboard.html', my_items=my_items, my_matches=my_matches, recent_found=recent_found, stats=stats, username=session.get('username'))
+    return render_template('dashboard.html', my_items=my_items, my_matches=my_matches, recent_found=recent_found, stats=stats, username=user['username'])
 
 @app.route('/report', methods=['GET', 'POST'])
-@login_required
 def report_item():
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    
+    if not user_id:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
+    user = query_db("SELECT * FROM users WHERE id=? AND is_banned=0", [user_id], one=True)
+    if not user:
+        return redirect(url_for('login'))
+    
     if request.method == 'POST':
-        uid = session['user_id']
+        uid = user['id']
         item_type = request.form.get('item_type', 'lost')
         title = request.form.get('title', '').strip()
         description = request.form.get('description', '').strip()
@@ -591,87 +529,76 @@ def report_item():
         brand = request.form.get('brand', '').strip()
 
         if not title or not location:
-            flash('Title and location are required.', 'danger')
+            flash('Title and location required.', 'danger')
             return redirect(url_for('report_item'))
 
         image_path = None
-        ai_item_name = None
-        ai_brand_model = None
-        ai_dominant_color = None
-        ai_confidence_scores = {}
-
         if 'image' in request.files and request.files['image'].filename:
             file = request.files['image']
             if allowed_file(file.filename):
                 image_path = save_upload(file)
-                if image_path:
-                    full_path = os.path.join(app.config['UPLOAD_FOLDER'], image_path)
-                    suggestions = analyze_image_for_autofill(full_path)
-                    if suggestions:
-                        ai_item_name = suggestions.get('item_name')
-                        ai_brand_model = suggestions.get('brand')
-                        ai_dominant_color = suggestions.get('color')
-                        ai_confidence_scores = suggestions.get('confidence_scores', {})
-                        if not category and suggestions.get('category'):
-                            category = suggestions.get('category')
-                        if not color and suggestions.get('color'):
-                            color = suggestions.get('color')
 
         if not category:
             category = auto_detect_category(title)
 
         item_id = query_db(
             """INSERT INTO items (user_id, item_type, title, description, category, location,
-               date_occurred, color, brand, image_path, ai_item_name, ai_brand_model, 
-               ai_dominant_color, ai_confidence_scores, source) 
-               VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)""",
+               date_occurred, color, brand, image_path, source) 
+               VALUES (?,?,?,?,?,?,?,?,?,?,?)""",
             [uid, item_type, title, description, category, location,
-             date_occurred, color, brand, image_path, ai_item_name, 
-             ai_brand_model, ai_dominant_color, json.dumps(ai_confidence_scores), 'web'], commit=True
+             date_occurred, color, brand, image_path, 'web'], commit=True
         )
         
-        add_notification(uid, f"Item Reported: {title}", f"Your {item_type} item report has been submitted!", 'success', f'/item/{item_id}')
-        flash(f'Your {item_type} item has been reported successfully!', 'success')
+        add_notification(uid, f"Item Reported: {title}", f"Your {item_type} item has been reported.", 'success', f'/item/{item_id}')
+        flash(f'Item reported successfully!', 'success')
         return redirect(url_for('item_detail', item_id=item_id))
     
     return render_template('report.html')
 
 @app.route('/item/<int:item_id>')
-@login_required
 def item_detail(item_id):
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    
+    if not user_id:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
     item = query_db("SELECT i.*, u.username FROM items i JOIN users u ON i.user_id=u.id WHERE i.id=?", [item_id], one=True)
     if not item:
         flash('Item not found.', 'danger')
         return redirect(url_for('search'))
     
-    uid = session['user_id']
-    is_owner = (item['user_id'] == uid)
+    is_owner = (item['user_id'] == user_id)
     
     if item['item_type'] == 'lost':
         matches = query_db("""
-            SELECT m.*, fi.title, fi.image_path, fi.location, fi.color, fi.brand, fi.id as matched_id, u.username as finder_username
-            FROM matches m JOIN items fi ON m.found_item_id=fi.id JOIN users u ON fi.user_id=u.id
+            SELECT m.*, fi.title, fi.image_path, fi.location, fi.color, fi.brand, fi.id as matched_id
+            FROM matches m JOIN items fi ON m.found_item_id=fi.id
             WHERE m.lost_item_id=? ORDER BY m.score DESC
         """, [item_id])
     else:
         matches = query_db("""
-            SELECT m.*, li.title, li.image_path, li.location, li.color, li.brand, li.id as matched_id, u.username as owner_username
-            FROM matches m JOIN items li ON m.lost_item_id=li.id JOIN users u ON li.user_id=u.id
+            SELECT m.*, li.title, li.image_path, li.location, li.color, li.brand, li.id as matched_id
+            FROM matches m JOIN items li ON m.lost_item_id=li.id
             WHERE m.found_item_id=? ORDER BY m.score DESC
         """, [item_id])
     
     claims = query_db("SELECT c.*, u.username FROM claims c JOIN users u ON c.claimant_id=u.id WHERE c.item_id=? ORDER BY c.created_at DESC", [item_id])
-    user_claim = query_db("SELECT * FROM claims WHERE item_id=? AND claimant_id=?", [item_id, uid], one=True)
+    user_claim = query_db("SELECT * FROM claims WHERE item_id=? AND claimant_id=?", [item_id, user_id], one=True)
     return render_template('item_detail.html', item=item, is_owner=is_owner, matches=matches, claims=claims, user_claim=user_claim)
 
 @app.route('/search')
-@login_required
 def search():
+    token = request.cookies.get('session_token')
+    if not token or not validate_session_token(token):
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
     q = request.args.get('q', '').strip()
     item_type = request.args.get('type', '')
     category = request.args.get('category', '')
     location_filter = request.args.get('location', '')
-    sort = request.args.get('sort', 'newest')
     
     conditions = ["i.status='active'"]
     params = []
@@ -685,247 +612,201 @@ def search():
     if location_filter:
         conditions.append("i.location LIKE ?"); params.append(f'%{location_filter}%')
     
-    order = {'newest': 'i.created_at DESC', 'oldest': 'i.created_at ASC', 'title': 'i.title ASC'}.get(sort, 'i.created_at DESC')
     where = ' AND '.join(conditions)
-    items = query_db(f"SELECT i.*, u.username FROM items i JOIN users u ON i.user_id=u.id WHERE {where} ORDER BY {order}", params)
+    items = query_db(f"SELECT i.*, u.username FROM items i JOIN users u ON i.user_id=u.id WHERE {where} ORDER BY i.created_at DESC", params)
     categories = query_db("SELECT DISTINCT category FROM items WHERE category IS NOT NULL AND category != ''")
-    return render_template('search.html', items=items, query=q, item_type=item_type, category=category, location_filter=location_filter, sort=sort, categories=[r['category'] for r in categories])
+    return render_template('search.html', items=items, query=q, item_type=item_type, category=category, location_filter=location_filter, categories=[r['category'] for r in categories])
 
 @app.route('/claim/<int:item_id>', methods=['POST'])
-@login_required
 def submit_claim(item_id):
-    uid = session['user_id']
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    
+    if not user_id:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
     item = query_db("SELECT * FROM items WHERE id=? AND item_type='found' AND status='active'", [item_id], one=True)
     if not item:
-        flash('Item not found or not claimable.', 'danger')
+        flash('Item not claimable.', 'danger')
         return redirect(url_for('item_detail', item_id=item_id))
-    if item['user_id'] == uid:
-        flash("You cannot claim your own item.", 'danger')
+    
+    if item['user_id'] == user_id:
+        flash("Cannot claim your own item.", 'danger')
         return redirect(url_for('item_detail', item_id=item_id))
     
-    existing = query_db("SELECT id FROM claims WHERE item_id=? AND claimant_id=?", [item_id, uid], one=True)
+    existing = query_db("SELECT id FROM claims WHERE item_id=? AND claimant_id=?", [item_id, user_id], one=True)
     if existing:
-        flash('You already submitted a claim for this item.', 'warning')
+        flash('You already submitted a claim.', 'warning')
         return redirect(url_for('item_detail', item_id=item_id))
     
     proof_text = request.form.get('proof_text', '').strip()
     proof_image = save_upload(request.files['proof_image']) if 'proof_image' in request.files else None
+    
     if not proof_text:
-        flash('Please provide proof of ownership.', 'danger')
+        flash('Proof required.', 'danger')
         return redirect(url_for('item_detail', item_id=item_id))
     
-    claim_id = query_db("INSERT INTO claims (item_id, claimant_id, proof_text, proof_image) VALUES (?,?,?,?)", [item_id, uid, proof_text, proof_image], commit=True)
-    add_notification(item['user_id'], 'Someone claimed your item!', f"A user submitted a claim for '{item['title']}'.", 'warning', f'/item/{item_id}')
-    add_notification(uid, 'Claim Submitted', f"Your claim for '{item['title']}' is under review.", 'info')
-    flash('Your claim has been submitted!', 'success')
+    claim_id = query_db("INSERT INTO claims (item_id, claimant_id, proof_text, proof_image) VALUES (?,?,?,?)", [item_id, user_id, proof_text, proof_image], commit=True)
+    add_notification(item['user_id'], 'Claim Received', f"Someone claimed '{item['title']}'", 'warning', f'/item/{item_id}')
+    add_notification(user_id, 'Claim Submitted', f"Your claim for '{item['title']}' is under review.", 'info')
+    flash('Claim submitted!', 'success')
     return redirect(url_for('claim_chat', claim_id=claim_id))
 
 @app.route('/claim/<int:claim_id>/chat', methods=['GET', 'POST'])
-@login_required
 def claim_chat(claim_id):
-    uid = session['user_id']
-    claim = query_db("""SELECT c.*, i.title as item_title, i.user_id as finder_id, u.username as claimant_name, u2.username as finder_name
-        FROM claims c JOIN items i ON c.item_id=i.id JOIN users u ON c.claimant_id=u.id JOIN users u2 ON i.user_id=u2.id WHERE c.id=?""", [claim_id], one=True)
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    
+    if not user_id:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
+    claim = query_db("""SELECT c.*, i.title as item_title, i.user_id as finder_id, 
+                        u.username as claimant_name, u2.username as finder_name
+        FROM claims c 
+        JOIN items i ON c.item_id=i.id 
+        JOIN users u ON c.claimant_id=u.id 
+        JOIN users u2 ON i.user_id=u2.id 
+        WHERE c.id=?""", [claim_id], one=True)
+    
     if not claim:
         flash('Claim not found.', 'danger')
         return redirect(url_for('dashboard'))
     
-    if uid != claim['claimant_id'] and uid != claim['finder_id']:
+    if user_id != claim['claimant_id'] and user_id != claim['finder_id']:
         flash('Unauthorized.', 'danger')
         return redirect(url_for('dashboard'))
     
     if request.method == 'POST':
         msg = request.form.get('message', '').strip()
         if msg:
-            query_db("INSERT INTO claim_messages (claim_id, sender_id, message) VALUES (?,?,?)", [claim_id, uid, msg], commit=True)
+            query_db("INSERT INTO claim_messages (claim_id, sender_id, message) VALUES (?,?,?)", [claim_id, user_id, msg], commit=True)
     
     messages = query_db("SELECT cm.*, u.username FROM claim_messages cm JOIN users u ON cm.sender_id=u.id WHERE cm.claim_id=? ORDER BY cm.created_at ASC", [claim_id])
     return render_template('claim_chat.html', claim=claim, messages=messages)
 
 @app.route('/notifications')
-@login_required
 def notifications():
-    uid = session['user_id']
-    notifs = query_db("SELECT * FROM notifications WHERE user_id=? ORDER BY created_at DESC", [uid])
-    query_db("UPDATE notifications SET is_read=1 WHERE user_id=?", [uid], commit=True)
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    
+    if not user_id:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
+    notifs = query_db("SELECT * FROM notifications WHERE user_id=? ORDER BY created_at DESC", [user_id])
+    query_db("UPDATE notifications SET is_read=1 WHERE user_id=?", [user_id], commit=True)
     return render_template('notifications.html', notifications=notifs)
 
 @app.route('/profile', methods=['GET', 'POST'])
-@login_required
 def profile():
-    uid = session['user_id']
-    user = query_db("SELECT * FROM users WHERE id=?", [uid], one=True)
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    
+    if not user_id:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
+    user = query_db("SELECT * FROM users WHERE id=?", [user_id], one=True)
+    
     if request.method == 'POST':
         action = request.form.get('action')
         if action == 'update_prefs':
             query_db("UPDATE users SET email_notifications=?, match_alerts=?, claim_updates=? WHERE id=?",
-                     [1 if request.form.get('email_notifications') else 0, 1 if request.form.get('match_alerts') else 0, 1 if request.form.get('claim_updates') else 0, uid], commit=True)
+                     [1 if request.form.get('email_notifications') else 0,
+                      1 if request.form.get('match_alerts') else 0,
+                      1 if request.form.get('claim_updates') else 0, user_id], commit=True)
             flash('Preferences updated!', 'success')
         elif action == 'change_password':
             current = request.form.get('current_password')
             new_pw = request.form.get('new_password')
             confirm = request.form.get('confirm_password')
             if not bcrypt.check_password_hash(user['password_hash'], current):
-                flash('Current password is incorrect.', 'danger')
+                flash('Current password incorrect.', 'danger')
             elif new_pw != confirm:
                 flash('Passwords do not match.', 'danger')
             elif len(new_pw) < 6:
-                flash('Password must be at least 6 characters.', 'danger')
+                flash('Password must be 6+ characters.', 'danger')
             else:
-                query_db("UPDATE users SET password_hash=? WHERE id=?", [bcrypt.generate_password_hash(new_pw).decode('utf-8'), uid], commit=True)
-                flash('Password changed successfully!', 'success')
+                query_db("UPDATE users SET password_hash=? WHERE id=?", [bcrypt.generate_password_hash(new_pw).decode('utf-8'), user_id], commit=True)
+                flash('Password changed!', 'success')
         return redirect(url_for('profile'))
     
-    my_items = query_db("SELECT * FROM items WHERE user_id=? ORDER BY created_at DESC", [uid])
-    my_claims = query_db("SELECT c.*, i.title as item_title FROM claims c JOIN items i ON c.item_id=i.id WHERE c.claimant_id=? ORDER BY c.created_at DESC", [uid])
+    my_items = query_db("SELECT * FROM items WHERE user_id=? ORDER BY created_at DESC", [user_id])
+    my_claims = query_db("SELECT c.*, i.title as item_title FROM claims c JOIN items i ON c.item_id=i.id WHERE c.claimant_id=? ORDER BY c.created_at DESC", [user_id])
     return render_template('profile.html', user=user, my_items=my_items, my_claims=my_claims)
 
-# ── API Routes ────────────────────────────────────────────────────────────────
-@app.route('/api/analyze-image', methods=['POST'])
-@login_required
-def analyze_image_api():
-    if 'image' not in request.files:
-        return jsonify({'error': 'No image'}), 400
-    f = request.files['image']
-    if not allowed_file(f.filename):
-        return jsonify({'error': 'Invalid file type'}), 400
-    
-    ext = f.filename.rsplit('.', 1)[1].lower()
-    temp_filename = f"temp_{uuid.uuid4().hex}.{ext}"
-    temp_path = os.path.join(app.config['UPLOAD_FOLDER'], temp_filename)
-    f.save(temp_path)
-    
-    try:
-        suggestions = analyze_image_for_autofill(temp_path)
-        os.remove(temp_path)
-        
-        if suggestions.get('item_name') or suggestions.get('color'):
-            return jsonify({'success': True, 'suggestions': suggestions})
-        else:
-            return jsonify({'success': False, 'message': 'Could not detect specific details.'})
-    except Exception as e:
-        try:
-            os.remove(temp_path)
-        except:
-            pass
-        return jsonify({'error': str(e)}), 500
-
-@app.route('/api/generate-description', methods=['POST'])
-@login_required
-def generate_description_api():
-    data = request.get_json() or {}
-    title = data.get('title', '')
-    color = data.get('color', '')
-    brand = data.get('brand', '')
-    location = data.get('location', '')
-    date_str = data.get('date', '')
-    item_type = data.get('item_type', 'lost')
-    
-    if not title:
-        return jsonify({'success': False, 'error': 'Title is required'}), 400
-    
-    action = "lost" if item_type == "lost" else "found"
-    formatted_date = ''
-    if date_str:
-        try:
-            date_obj = datetime.strptime(date_str, '%Y-%m-%d')
-            formatted_date = date_obj.strftime('%B %d, %Y')
-        except:
-            formatted_date = date_str
-    
-    description_parts = []
-    if brand and color:
-        description_parts.append(f"This {color} {brand} {title}")
-    elif brand:
-        description_parts.append(f"This {brand} {title}")
-    elif color:
-        description_parts.append(f"This {color} {title}")
-    else:
-        description_parts.append(f"This {title}")
-    
-    if location and formatted_date:
-        description_parts.append(f"was {action} at {location} on {formatted_date}.")
-    elif location:
-        description_parts.append(f"was {action} at {location}.")
-    else:
-        description_parts.append(f"was {action}.")
-    
-    description_parts.append(" Please contact if you have any information about this item.")
-    full_description = " ".join(description_parts)
-    
-    return jsonify({'success': True, 'description': full_description})
-
-@app.route('/api/auto-category', methods=['POST'])
-@login_required
-def auto_category():
-    data = request.get_json() or {}
-    title = data.get('title', '')
-    if title:
-        return jsonify({'category': auto_detect_category(title)})
-    return jsonify({'category': 'Miscellaneous'})
-
 @app.route('/api/notifications/count')
-@login_required
 def notif_count():
-    count = query_db("SELECT COUNT(*) as c FROM notifications WHERE user_id=? AND is_read=0", [session['user_id']], one=True)['c'] or 0
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
+        return jsonify({'count': 0})
+    count = query_db("SELECT COUNT(*) as c FROM notifications WHERE user_id=? AND is_read=0", [user_id], one=True)['c'] or 0
     return jsonify({'count': count})
 
 @app.route('/rate', methods=['POST'])
-@login_required
 def submit_rating():
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
+        flash('Please log in.', 'warning')
+        return redirect(url_for('login'))
+    
     score = int(request.form.get('score', 0))
     feedback = request.form.get('feedback', '').strip()
     if 1 <= score <= 5:
-        query_db("INSERT INTO ratings (user_id, score, feedback) VALUES (?,?,?)", [session['user_id'], score, feedback], commit=True)
+        query_db("INSERT INTO ratings (user_id, score, feedback) VALUES (?,?,?)", [user_id, score, feedback], commit=True)
         flash('Thank you for your feedback!', 'success')
     return redirect(url_for('dashboard'))
 
 # ── Admin Routes ──────────────────────────────────────────────────────────────
 @app.route('/nimda')
 def admin_dashboard():
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
         return redirect(url_for('login'))
-    
-    user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
+    user = query_db("SELECT role FROM users WHERE id=?", [user_id], one=True)
     if not user or user['role'] != 'admin':
         flash('Admin access required.', 'danger')
         return redirect(url_for('dashboard'))
-    
     return render_template('admin.html')
 
 @app.route('/nimda/api/users')
 def admin_api_users():
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
     users = query_db("SELECT id, username, email, role, is_banned, created_at FROM users ORDER BY created_at DESC")
     return jsonify([dict(u) for u in users])
 
 @app.route('/nimda/api/items')
 def admin_api_items():
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
     items = query_db("SELECT i.*, u.username FROM items i JOIN users u ON i.user_id=u.id ORDER BY i.created_at DESC")
     return jsonify([dict(it) for it in items])
 
 @app.route('/nimda/api/claims')
 def admin_api_claims():
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
     claims = query_db("""
         SELECT c.*, i.title as item_title, u.username as claimant_name, u2.username as finder_name
         FROM claims c 
@@ -938,13 +819,13 @@ def admin_api_claims():
 
 @app.route('/nimda/api/stats')
 def admin_api_stats():
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
     stats = {
         'total_users': query_db("SELECT COUNT(*) as c FROM users WHERE role='user'", one=True)['c'] or 0,
         'total_items': query_db("SELECT COUNT(*) as c FROM items", one=True)['c'] or 0,
@@ -953,105 +834,98 @@ def admin_api_stats():
         'resolved': query_db("SELECT COUNT(*) as c FROM items WHERE status='resolved'", one=True)['c'] or 0,
         'pending_claims': query_db("SELECT COUNT(*) as c FROM claims WHERE status='pending'", one=True)['c'] or 0,
         'total_matches': query_db("SELECT COUNT(*) as c FROM matches", one=True)['c'] or 0,
-        'banned_users': query_db("SELECT COUNT(*) as c FROM users WHERE is_banned=1", one=True)['c'] or 0,
     }
-    total = stats['total_items']
-    stats['recovery_rate'] = round((stats['resolved'] / total * 100) if total > 0 else 0, 1)
-    
     return jsonify({'stats': stats})
 
 @app.route('/nimda/api/users/<int:user_id>/ban', methods=['POST'])
 def admin_api_ban_user(user_id):
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id_admin = validate_session_token(token) if token else None
+    if not user_id_admin:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id_admin], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    reason = (request.get_json() or {}).get('reason', 'Violation of terms')
-    query_db("UPDATE users SET is_banned=1, ban_reason=? WHERE id=?", [reason, user_id], commit=True)
+    query_db("UPDATE users SET is_banned=1 WHERE id=?", [user_id], commit=True)
     return jsonify({'success': True})
 
 @app.route('/nimda/api/users/<int:user_id>/unban', methods=['POST'])
 def admin_api_unban_user(user_id):
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id_admin = validate_session_token(token) if token else None
+    if not user_id_admin:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id_admin], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    query_db("UPDATE users SET is_banned=0, ban_reason=NULL WHERE id=?", [user_id], commit=True)
+    query_db("UPDATE users SET is_banned=0 WHERE id=?", [user_id], commit=True)
     return jsonify({'success': True})
 
 @app.route('/nimda/api/users/<int:user_id>/delete', methods=['POST'])
 def admin_api_delete_user(user_id):
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id_admin = validate_session_token(token) if token else None
+    if not user_id_admin:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id_admin], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
     query_db("DELETE FROM users WHERE id=?", [user_id], commit=True)
     return jsonify({'success': True})
 
 @app.route('/nimda/api/items/<int:item_id>/delete', methods=['POST'])
 def admin_api_delete_item(item_id):
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
     query_db("DELETE FROM items WHERE id=?", [item_id], commit=True)
     return jsonify({'success': True})
 
 @app.route('/nimda/api/claims/<int:claim_id>/approve', methods=['POST'])
 def admin_api_approve_claim(claim_id):
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
     query_db("UPDATE claims SET status='approved', resolved_at=datetime('now') WHERE id=?", [claim_id], commit=True)
     claim = query_db("SELECT * FROM claims WHERE id=?", [claim_id], one=True)
     if claim:
         query_db("UPDATE items SET status='resolved' WHERE id=?", [claim['item_id']], commit=True)
-        add_notification(claim['claimant_id'], 'Claim Approved!', 'Your claim has been approved!', 'success')
     return jsonify({'success': True})
 
 @app.route('/nimda/api/claims/<int:claim_id>/reject', methods=['POST'])
 def admin_api_reject_claim(claim_id):
-    if 'user_id' not in session:
+    token = request.cookies.get('session_token')
+    user_id = validate_session_token(token) if token else None
+    if not user_id:
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    admin_user = query_db("SELECT role FROM users WHERE id=?", [session['user_id']], one=True)
-    if not admin_user or admin_user['role'] != 'admin':
+    admin = query_db("SELECT role FROM users WHERE id=?", [user_id], one=True)
+    if not admin or admin['role'] != 'admin':
         return jsonify({'error': 'Unauthorized'}), 401
-    
-    note = (request.get_json() or {}).get('note', '')
-    query_db("UPDATE claims SET status='rejected', admin_note=?, resolved_at=datetime('now') WHERE id=?", [note, claim_id], commit=True)
-    claim = query_db("SELECT * FROM claims WHERE id=?", [claim_id], one=True)
-    if claim:
-        add_notification(claim['claimant_id'], 'Claim Rejected', f'Your claim was rejected.', 'danger')
+    query_db("UPDATE claims SET status='rejected', resolved_at=datetime('now') WHERE id=?", [claim_id], commit=True)
     return jsonify({'success': True})
 
 # ── Context processor ────────────────────────────────────────────────────────
 @app.context_processor
 def inject_globals():
     unread = 0
-    if 'user_id' in session:
-        try:
-            row = query_db("SELECT COUNT(*) as c FROM notifications WHERE user_id=? AND is_read=0", [session['user_id']], one=True)
-            unread = row['c'] if row else 0
-        except:
-            pass
-    return {'unread_count': unread, 'current_year': datetime.now().year, 'session': session}
+    token = request.cookies.get('session_token')
+    if token:
+        user_id = validate_session_token(token)
+        if user_id:
+            try:
+                row = query_db("SELECT COUNT(*) as c FROM notifications WHERE user_id=? AND is_read=0", [user_id], one=True)
+                unread = row['c'] if row else 0
+            except:
+                pass
+    return {'unread_count': unread, 'current_year': datetime.now().year}
 
 # ── Boot ─────────────────────────────────────────────────────────────────────
 if __name__ == '__main__':