nodebb-plugin-pdf-secure2 1.3.7 → 1.3.9

package/lib/controllers.js

@@ -10,12 +10,37 @@ const db = require.main.require('./src/database');
 
 const Controllers = module.exports;
 
-// Rate limiting configuration (DB-backed sliding window)
+// Rate limiting configuration (DB-backed sliding window — spam protection, not shown in UI)
 const RATE_LIMITS = {
 	vip: { max: 50, window: 60 * 1000 },
 	premium: { max: 25, window: 60 * 1000 },
 };
 
+// 4-hour rolling window token quota (shown in UI quota bar as percentage)
+// Tracks output tokens (candidatesTokenCount) only — fair regardless of PDF size
+// Defaults — overridden by admin settings via initQuotaSettings()
+const QUOTAS = {
+	vip: { max: 750000, window: 4 * 60 * 60 * 1000 }, // 750K output tokens / 4h
+	premium: { max: 200000, window: 4 * 60 * 60 * 1000 }, // 200K output tokens / 4h
+};
+
+// Apply admin-configured quota settings (called from library.js on init)
+Controllers.initQuotaSettings = function (settings) {
+	if (!settings) return;
+	const premiumTokens = parseInt(settings.quotaPremiumTokens, 10);
+	const vipTokens = parseInt(settings.quotaVipTokens, 10);
+	const windowHours = parseInt(settings.quotaWindowHours, 10);
+
+	if (premiumTokens >= 10000 && premiumTokens <= 10000000) QUOTAS.premium.max = premiumTokens;
+	if (vipTokens >= 10000 && vipTokens <= 10000000) QUOTAS.vip.max = vipTokens;
+	if (windowHours >= 1 && windowHours <= 24) {
+		const windowMs = windowHours * 60 * 60 * 1000;
+		QUOTAS.premium.window = windowMs;
+		QUOTAS.vip.window = windowMs;
+	}
+	console.log('[PDF-Secure] Quota settings: Premium', QUOTAS.premium.max, 'tokens/', QUOTAS.premium.window / 3600000, 'h, VIP', QUOTAS.vip.max, 'tokens/', QUOTAS.vip.window / 3600000, 'h');
+};
+
 // DB-backed sliding window rate limiter
 // Returns { allowed, used, max } for quota visibility
 async function checkRateLimit(uid, tier) {
@@ -41,6 +66,104 @@ async function checkRateLimit(uid, tier) {
 	}
 }
 
+// Helper: parse token count from sorted set members and calculate totals
+// Member format: "${timestamp}:${random}:${tokensUsed}"
+function sumTokensFromMembers(members) {
+	let total = 0;
+	for (const m of members) {
+		const parts = (typeof m === 'string' ? m : m.value || '').split(':');
+		total += parseInt(parts[2], 10) || 0;
+	}
+	return total;
+}
+
+// Token-based 4-hour sliding window quota (DB-backed sorted set)
+// Read-only check — does NOT add entries (call recordQuotaUsage after AI response)
+// Returns { allowed, used, max, resetsIn }
+async function checkQuota(uid, tier) {
+	const cfg = QUOTAS[tier] || QUOTAS.premium;
+	const key = `pdf-secure:quota:${uid}`;
+	const now = Date.now();
+	const windowStart = now - cfg.window;
+
+	try {
+		// Remove expired entries outside the 4-hour window
+		await db.sortedSetRemoveRangeByScore(key, '-inf', windowStart);
+		// Get all members to sum their token values
+		const members = await db.getSortedSetRange(key, 0, -1);
+		const totalTokens = sumTokensFromMembers(members);
+
+		// Calculate resetsIn from oldest entry
+		let resetsIn = 0;
+		if (members.length > 0) {
+			const oldest = await db.getSortedSetRangeWithScores(key, 0, 0);
+			if (oldest && oldest.length > 0) {
+				resetsIn = Math.max(0, (oldest[0].score + cfg.window) - now);
+			}
+		}
+
+		if (totalTokens >= cfg.max) {
+			return { allowed: false, used: totalTokens, max: cfg.max, resetsIn };
+		}
+		return { allowed: true, used: totalTokens, max: cfg.max, resetsIn };
+	} catch (err) {
+		return { allowed: true, used: 0, max: cfg.max, resetsIn: 0 };
+	}
+}
+
+// Record token usage after a successful AI response
+// Returns updated { used, max, resetsIn }
+async function recordQuotaUsage(uid, tier, tokensUsed) {
+	const cfg = QUOTAS[tier] || QUOTAS.premium;
+	const key = `pdf-secure:quota:${uid}`;
+	const now = Date.now();
+
+	try {
+		// Add entry with token count encoded in member string
+		await db.sortedSetAdd(key, now, `${now}:${crypto.randomBytes(4).toString('hex')}:${tokensUsed}`);
+
+		// Re-read total for accurate response
+		const members = await db.getSortedSetRange(key, 0, -1);
+		const totalTokens = sumTokensFromMembers(members);
+
+		let resetsIn = 0;
+		if (members.length > 0) {
+			const oldest = await db.getSortedSetRangeWithScores(key, 0, 0);
+			if (oldest && oldest.length > 0) {
+				resetsIn = Math.max(0, (oldest[0].score + cfg.window) - now);
+			}
+		}
+
+		return { used: totalTokens, max: cfg.max, resetsIn };
+	} catch (err) {
+		return { used: 0, max: cfg.max, resetsIn: 0 };
+	}
+}
+
+// Read-only quota usage (for initial UI display, does not increment)
+async function getQuotaUsage(uid, tier) {
+	const cfg = QUOTAS[tier] || QUOTAS.premium;
+	const key = `pdf-secure:quota:${uid}`;
+	const now = Date.now();
+	const windowStart = now - cfg.window;
+
+	try {
+		await db.sortedSetRemoveRangeByScore(key, '-inf', windowStart);
+		const members = await db.getSortedSetRange(key, 0, -1);
+		const totalTokens = sumTokensFromMembers(members);
+		let resetsIn = 0;
+		if (members.length > 0) {
+			const oldest = await db.getSortedSetRangeWithScores(key, 0, 0);
+			if (oldest && oldest.length > 0) {
+				resetsIn = Math.max(0, (oldest[0].score + cfg.window) - now);
+			}
+		}
+		return { used: totalTokens, max: cfg.max, resetsIn };
+	} catch (err) {
+		return { used: 0, max: cfg.max, resetsIn: 0 };
+	}
+}
+
 // AES-256-GCM encryption - replaces weak XOR obfuscation
 function aesGcmEncrypt(buffer, key, iv) {
 	const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
@@ -132,10 +255,21 @@ Controllers.handleChat = async function (req, res) {
 	const isVip = isVipMember || isAdmin;
 	const tier = isVip ? 'vip' : 'premium';
 
-	// Rate limiting (DB-backed sliding window, survives restarts and works across cluster)
+	// 4-hour rolling window quota check (visible to user in quota bar)
+	const quotaResult = await checkQuota(req.uid, tier);
+	if (!quotaResult.allowed) {
+		return res.status(429).json({
+			error: 'Mesaj kotanız doldu.',
+			quotaExhausted: true,
+			quota: { used: quotaResult.used, max: quotaResult.max, resetsIn: quotaResult.resetsIn },
+			tier,
+		});
+	}
+
+	// Spam rate limiting (DB-backed 60s sliding window, not shown in UI)
 	const rateResult = await checkRateLimit(req.uid, tier);
 	if (!rateResult.allowed) {
-		return res.status(429).json({ error: 'Çok hızlı mesaj gönderiyorsunuz. Lütfen biraz bekleyin.', quota: { used: rateResult.used, max: rateResult.max } });
+		return res.status(429).json({ error: 'Çok hızlı mesaj gönderiyorsunuz. Lütfen biraz bekleyin.', quota: { used: quotaResult.used, max: quotaResult.max, resetsIn: quotaResult.resetsIn } });
 	}
 
 	// Body validation
@@ -158,6 +292,7 @@ Controllers.handleChat = async function (req, res) {
 		return res.status(400).json({ error: 'Invalid history (max 50 entries)' });
 	}
 	if (history) {
+		let totalHistorySize = 0;
 		for (const entry of history) {
 			if (!entry || typeof entry !== 'object') {
 				return res.status(400).json({ error: 'Invalid history entry' });
@@ -168,6 +303,10 @@ Controllers.handleChat = async function (req, res) {
 			if (typeof entry.text !== 'string' || entry.text.length > 4000) {
 				return res.status(400).json({ error: 'Invalid history text' });
 			}
+			totalHistorySize += entry.text.length;
+			if (totalHistorySize > 50000) {
+				return res.status(400).json({ error: 'History too large' });
+			}
 			// Sanitize: strip null bytes and control characters
 			entry.text = entry.text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
 			// Collapse excessive whitespace (padding attack prevention)
@@ -178,14 +317,19 @@ Controllers.handleChat = async function (req, res) {
 
 	try {
 		const result = await geminiChat.chat(safeName, trimmedQuestion, history || [], tier);
+		// Record actual token usage after successful AI response
+		// Sanitize: clamp to [0, 1000000] to prevent NaN/negative/absurd values
+		const tokensUsed = Math.max(0, Math.min(parseInt(result.tokensUsed, 10) || 0, 1000000));
+		const updatedQuota = await recordQuotaUsage(req.uid, tier, tokensUsed);
 		return res.json({
 			answer: result.text,
 			injectionWarning: result.suspicious || false,
-			quota: { used: rateResult.used, max: rateResult.max },
+			quota: updatedQuota,
 		});
 	} catch (err) {
 		console.error('[PDF-Secure] Chat error:', err.message, err.status || '', err.code || '');
-		const quota = { used: rateResult.used, max: rateResult.max };
+		// On error, no tokens were used — return pre-call quota
+		const quota = { used: quotaResult.used, max: quotaResult.max, resetsIn: quotaResult.resetsIn };
 
 		if (err.message === 'File not found') {
 			return res.status(404).json({ error: 'PDF bulunamadı.', quota });
@@ -224,6 +368,9 @@ Controllers.getSuggestions = async function (req, res) {
 		return res.status(403).json({ error: 'Premium/VIP only' });
 	}
 
+	const isVip = isVipMember || isAdmin;
+	const tier = isVip ? 'vip' : 'premium';
+
 	// Simple rate limit: 1 request per 12 seconds per user
 	const now = Date.now();
 	const lastReq = suggestionsRateLimit.get(req.uid) || 0;
@@ -243,7 +390,8 @@ Controllers.getSuggestions = async function (req, res) {
 
 	try {
 		const suggestions = await geminiChat.generateSuggestions(safeName);
-		return res.json({ suggestions });
+		const quotaUsage = await getQuotaUsage(req.uid, tier);
+		return res.json({ suggestions, quota: quotaUsage });
 	} catch (err) {
 		console.error('[PDF-Secure] Suggestions error:', err.message);
 		return res.json({ suggestions: [] });

package/lib/gemini-chat.js

@@ -140,25 +140,82 @@ async function getOrUploadPdf(filename) {
 		throw new Error('PDF too large for AI chat');
 	}
 
+	// Upload to Gemini File API — file is stored server-side, only URI is sent per request
+	console.log('[PDF-Secure] === FILE API UPLOAD START ===');
+	console.log('[PDF-Secure] Filename:', filename);
+	console.log('[PDF-Secure] FilePath:', filePath);
+	console.log('[PDF-Secure] FileSize:', stats.size, 'bytes');
+	console.log('[PDF-Secure] ai.files exists:', !!ai.files);
+	console.log('[PDF-Secure] ai.files.upload exists:', typeof (ai.files && ai.files.upload));
+
+	const fileBuffer = await fs.promises.readFile(filePath);
+	console.log('[PDF-Secure] File read OK, buffer size:', fileBuffer.length);
+
+	// Try upload with multiple approaches
+	let uploadResult;
+	const uploadErrors = [];
+
+	// Approach 1: file path string
+	console.log('[PDF-Secure] Trying approach 1: file path string...');
 	try {
-		// Upload to Gemini File API — file is stored server-side, only URI is sent per request
-		const uploadResult = await ai.files.upload({
+		uploadResult = await ai.files.upload({
 			file: filePath,
-			config: { mimeType: 'application/pdf' },
+			config: { mimeType: 'application/pdf', displayName: filename },
 		});
+		console.log('[PDF-Secure] Approach 1 SUCCESS! Result:', JSON.stringify(uploadResult).slice(0, 500));
+	} catch (err1) {
+		console.error('[PDF-Secure] Approach 1 FAILED:', err1.message);
+		console.error('[PDF-Secure] Approach 1 error detail:', err1.status || '', err1.code || '', err1.stack?.split('\n').slice(0, 3).join(' | '));
+		uploadErrors.push('path: ' + err1.message);
+	}
 
+	// Approach 2: Blob (Node 18+)
+	if (!uploadResult) {
+		console.log('[PDF-Secure] Trying approach 2: Blob...');
+		console.log('[PDF-Secure] Blob available:', typeof Blob !== 'undefined');
+		try {
+			const blob = new Blob([fileBuffer], { type: 'application/pdf' });
+			uploadResult = await ai.files.upload({
+				file: blob,
+				config: { mimeType: 'application/pdf', displayName: filename },
+			});
+			console.log('[PDF-Secure] Approach 2 SUCCESS! Result:', JSON.stringify(uploadResult).slice(0, 500));
+		} catch (err2) {
+			console.error('[PDF-Secure] Approach 2 FAILED:', err2.message);
+			uploadErrors.push('blob: ' + err2.message);
+		}
+	}
+
+	// Approach 3: Buffer directly
+	if (!uploadResult) {
+		console.log('[PDF-Secure] Trying approach 3: Buffer...');
+		try {
+			uploadResult = await ai.files.upload({
+				file: fileBuffer,
+				config: { mimeType: 'application/pdf', displayName: filename },
+			});
+			console.log('[PDF-Secure] Approach 3 SUCCESS! Result:', JSON.stringify(uploadResult).slice(0, 500));
+		} catch (err3) {
+			console.error('[PDF-Secure] Approach 3 FAILED:', err3.message);
+			uploadErrors.push('buffer: ' + err3.message);
+		}
+	}
+
+	if (uploadResult && uploadResult.uri) {
 		const fileUri = uploadResult.uri;
 		const mimeType = uploadResult.mimeType || 'application/pdf';
-		console.log('[PDF-Secure] File API upload OK:', filename, '→', fileUri);
+		console.log('[PDF-Secure] === UPLOAD FINAL: SUCCESS ===', fileUri);
 
 		fileUploadCache.set(filename, { fileUri, mimeType, cachedAt: Date.now() });
 		return { type: 'fileData', fileUri, mimeType };
-	} catch (uploadErr) {
-		// Fallback: use inline base64 (works but uses many tokens)
-		console.warn('[PDF-Secure] File API upload failed, falling back to inline:', uploadErr.message);
-		const base64 = await getPdfBase64(filename);
-		return { type: 'inlineData', mimeType: 'application/pdf', data: base64 };
 	}
+
+	// All upload methods failed
+	console.error('[PDF-Secure] === UPLOAD FINAL: ALL FAILED ===');
+	console.error('[PDF-Secure] Errors:', uploadErrors.join(' | '));
+	console.error('[PDF-Secure] Falling back to inline base64 (will use many tokens!)');
+	const base64 = fileBuffer.toString('base64');
+	return { type: 'inlineData', mimeType: 'application/pdf', data: base64 };
 }
 
 // Read PDF and cache base64 in memory (fallback for File API failure)
@@ -253,7 +310,10 @@ GeminiChat.chat = async function (filename, question, history, tier) {
 		throw new Error('Empty response from AI');
 	}
 
-	return sanitizeAiOutput(text);
+	const tokensUsed = response?.usageMetadata?.candidatesTokenCount || 0;
+	const result = sanitizeAiOutput(text);
+	result.tokensUsed = tokensUsed;
+	return result;
 };
 
 // Generate AI-powered question suggestions for a PDF

package/library.js

@@ -73,6 +73,9 @@ plugin.init = async (params) => {
 		geminiChat.init(pluginSettings.geminiApiKey);
 	}
 
+	// Apply admin-configured quota settings
+	controllers.initQuotaSettings(pluginSettings);
+
 	const watermarkEnabled = pluginSettings.watermarkEnabled === 'on';
 
 	// Admin page route
@@ -158,6 +161,7 @@ plugin.init = async (params) => {
 			isPremium,
 			isVip,
 			isLite,
+			tier: isVip ? 'vip' : (isPremium ? 'premium' : 'free'),
 			uid: req.uid,
 			totalPages,
 			chatEnabled: geminiChat.isAvailable(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-pdf-secure2",
-  "version": "1.3.7",
+  "version": "1.3.9",
   "description": "Secure PDF viewer plugin for NodeBB - prevents downloading, enables canvas-only rendering with Premium group support",
   "main": "library.js",
   "repository": {

package/static/templates/admin/plugins/pdf-secure.tpl

@@ -41,7 +41,7 @@
 										Grup Adi
 									</label>
 									<input type="text" id="vipGroup" name="vipGroup" data-key="vipGroup" title="VIP Group Name" class="form-control" placeholder="VIP" value="VIP">
-									<div class="form-text">Premium ozellikleri + VIP rozeti, yuksek token/rate limitleri.</div>
+									<div class="form-text">Premium ozellikleri + VIP rozeti, yuksek token limitleri.</div>
 								</div>
 
 								<div class="mb-0">
@@ -96,12 +96,47 @@
 									</div>
 								</div>
 
-								<div class="alert alert-light border d-flex gap-2 mb-0" role="alert" style="font-size:13px;">
-									<svg viewBox="0 0 24 24" style="width:18px;height:18px;fill:#0d6efd;flex-shrink:0;margin-top:1px;"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-6h2v6zm0-8h-2V7h2v2z"/></svg>
+								<hr class="my-3">
+								<h6 class="fw-semibold mb-3" style="font-size:13px;">Token Kota Ayarlari</h6>
+
+								<div class="row g-3 mb-3">
+									<div class="col-6">
+										<label class="form-label fw-medium" for="quotaPremiumTokens" style="font-size:13px;">
+											<span class="badge text-bg-primary me-1" style="font-size:9px;">PREMIUM</span>
+											Token Limiti
+										</label>
+										<div class="input-group input-group-sm">
+											<input type="number" id="quotaPremiumTokens" name="quotaPremiumTokens" data-key="quotaPremiumTokens" class="form-control" placeholder="200000" min="10000" step="10000">
+											<span class="input-group-text" style="font-size:12px;">token</span>
+										</div>
+										<div class="form-text" style="font-size:11px;">Varsayilan: 200.000 (~100 mesaj)</div>
+									</div>
+									<div class="col-6">
+										<label class="form-label fw-medium" for="quotaVipTokens" style="font-size:13px;">
+											<span class="badge me-1" style="font-size:9px;background:linear-gradient(135deg,#f59e0b,#d97706);color:#fff;">VIP</span>
+											Token Limiti
+										</label>
+										<div class="input-group input-group-sm">
+											<input type="number" id="quotaVipTokens" name="quotaVipTokens" data-key="quotaVipTokens" class="form-control" placeholder="750000" min="10000" step="10000">
+											<span class="input-group-text" style="font-size:12px;">token</span>
+										</div>
+										<div class="form-text" style="font-size:11px;">Varsayilan: 750.000 (~375 mesaj)</div>
+									</div>
+								</div>
+								<div class="mb-3">
+									<label class="form-label fw-medium" for="quotaWindowHours" style="font-size:13px;">Pencere Suresi</label>
+									<div class="input-group input-group-sm" style="max-width:180px;">
+										<input type="number" id="quotaWindowHours" name="quotaWindowHours" data-key="quotaWindowHours" class="form-control" placeholder="4" min="1" max="24" step="1">
+										<span class="input-group-text" style="font-size:12px;">saat</span>
+									</div>
+									<div class="form-text" style="font-size:11px;">Varsayilan: 4 saat. Kota bu sure icerisinde sifirlanir.</div>
+								</div>
+
+								<div class="alert alert-light border d-flex gap-2 mb-0" role="alert" style="font-size:12px;">
+									<svg viewBox="0 0 24 24" style="width:16px;height:16px;fill:#0d6efd;flex-shrink:0;margin-top:1px;"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-6h2v6zm0-8h-2V7h2v2z"/></svg>
 									<div>
-										<strong>Tier farklari:</strong><br>
-										<strong>Premium</strong> — 25 mesaj/dk, 2048 token, 20 gecmis<br>
-										<strong>VIP</strong> — 50 mesaj/dk, 4096 token, 30 gecmis
+										Sadece output (yanit) tokenleri sayilir. PDF ve soru tokenleri dahil degildir.<br>
+										Ortalama mesaj ~1000-2000 token, uzun ozet ~3000-4000 token tuketir.
 									</div>
 								</div>
 							</div>

package/static/viewer.html

@@ -1048,6 +1048,8 @@
             background: linear-gradient(135deg, #ffd700 0%, #ffaa00 100%);
             color: #1a1a1a;
             text-decoration: none;
+            border: none;
+            cursor: pointer;
             border-radius: 10px;
             font-size: 14px;
             font-weight: 700;
@@ -1092,6 +1094,7 @@
             color: #ccc;
             font-size: 13px;
             font-weight: 600;
+            cursor: pointer;
             border-radius: 10px;
             border: 1.5px solid rgba(255, 255, 255, 0.15);
             text-decoration: none;
@@ -1105,6 +1108,59 @@
             background: rgba(255, 255, 255, 0.05);
         }
 
+        /* Quota exhausted upsell (in-chat) */
+        .chatQuotaExhausted {
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            text-align: center;
+            padding: 24px 16px;
+            margin: 8px;
+            background: rgba(255, 215, 0, 0.06);
+            border: 1px solid rgba(255, 215, 0, 0.15);
+            border-radius: 12px;
+        }
+        .quotaExhaustedIcon { margin-bottom: 10px; opacity: 0.9; }
+        .quotaExhaustedTitle {
+            font-size: 16px;
+            font-weight: 700;
+            color: #ffd700;
+            margin-bottom: 6px;
+        }
+        .quotaExhaustedText {
+            font-size: 13px;
+            color: #a0a0a0;
+            line-height: 1.5;
+            margin-bottom: 14px;
+            max-width: 240px;
+        }
+        .quotaExhaustedText strong { color: #ffd700; }
+        .quotaExhaustedBtn {
+            display: inline-flex;
+            align-items: center;
+            gap: 6px;
+            padding: 10px 24px;
+            background: linear-gradient(135deg, #ffd700, #ffaa00);
+            color: #1a1a1a;
+            text-decoration: none;
+            border: none;
+            cursor: pointer;
+            border-radius: 10px;
+            font-size: 14px;
+            font-weight: 700;
+            transition: transform 0.2s, box-shadow 0.2s;
+            box-shadow: 0 4px 15px rgba(255, 215, 0, 0.3);
+        }
+        .quotaExhaustedBtn:hover {
+            transform: translateY(-2px);
+            box-shadow: 0 6px 20px rgba(255, 215, 0, 0.4);
+        }
+        .quotaExhaustedNote {
+            font-size: 11px;
+            color: #666;
+            margin-top: 10px;
+        }
+
         /* PRO badge on chat button for non-premium */
         #chatBtn {
             position: relative;
@@ -2800,7 +2856,7 @@
             <span id="chatQuotaText"></span>
         </div>
         <div id="chatInputArea">
-            <textarea id="chatInput" placeholder="Bu PDF hakkında bir soru sorun..." rows="1"></textarea>
+            <textarea id="chatInput" placeholder="Bu PDF hakkında bir soru sorun..." rows="1" maxlength="2000"></textarea>
             <button id="chatSendBtn">
                 <svg viewBox="0 0 24 24">
                     <path d="M2.01 21L23 12 2.01 3 2 10l15 2-15 2z" />
@@ -4035,13 +4091,28 @@
             var quotaFillEl = document.getElementById('chatQuotaFill');
             var quotaTextEl = document.getElementById('chatQuotaText');
 
-            function updateQuotaBar(used, max) {
+            // Format milliseconds to human-readable time string
+            function formatResetsIn(ms) {
+                if (!ms || ms <= 0) return '';
+                var totalMin = Math.ceil(ms / 60000);
+                if (totalMin < 60) return totalMin + 'dk';
+                var h = Math.floor(totalMin / 60);
+                var m = totalMin % 60;
+                return m > 0 ? (h + 's ' + m + 'dk') : (h + 's');
+            }
+
+            function updateQuotaBar(used, max, resetsIn) {
                 if (!quotaBarEl || !max) return;
-                var remaining = Math.max(0, max - used);
-                var pct = Math.min(100, (used / max) * 100);
+                var pct = Math.min(100, Math.round((used / max) * 100));
 
                 quotaFillEl.style.width = pct + '%';
-                quotaTextEl.textContent = remaining + '/' + max;
+
+                // Show percentage only (no raw token numbers — users don't need to know)
+                var text = '%' + pct + ' kullan\u0131ld\u0131';
+                if (used > 0 && resetsIn > 0) {
+                    text += ' \u2022 ' + formatResetsIn(resetsIn) + ' sonra yenilenir';
+                }
+                quotaTextEl.textContent = text;
 
                 // Color states
                 quotaFillEl.classList.remove('warning', 'critical');
@@ -4098,6 +4169,14 @@
                         } else {
                             existingChips.forEach(function (c) { c.classList.remove('loading'); });
                         }
+                        // Show initial quota bar from suggestions response
+                        if (data.quota) {
+                            updateQuotaBar(data.quota.used, data.quota.max, data.quota.resetsIn);
+                            // Proactive lock: if quota already exhausted on page load, lock input immediately
+                            if (data.quota.max > 0 && data.quota.used >= data.quota.max) {
+                                showQuotaExhaustedUpsell(_cfg.tier || 'premium', data.quota.resetsIn);
+                            }
+                        }
                     })
                     .catch(function () {
                         existingChips.forEach(function (c) { c.classList.remove('loading'); });
@@ -4126,26 +4205,158 @@
             function showChatUpsell() {
                 var uid = (_cfg && _cfg.uid) || 0;
                 var checkoutUrl = 'https://forum.ieu.app/pay/checkout?uid=' + uid;
-                const upsell = document.createElement('div');
+                var materialUrl = 'https://forum.ieu.app/material-info';
+
+                // Build using DOM methods — MutationObserver strips <a> tags
+                var upsell = document.createElement('div');
                 upsell.className = 'chatUpsell';
-                upsell.innerHTML = '<div class="chatUpsellIcon">' +
-                    '<svg viewBox="0 0 24 24" width="48" height="48" fill="#ffd700">' +
-                    '<path d="M18 8h-1V6c0-2.76-2.24-5-5-5S7 3.24 7 6v2H6c-1.1 0-2 .9-2 2v10c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V10c0-1.1-.9-2-2-2zm-6 9c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2zm3.1-9H8.9V6c0-1.71 1.39-3.1 3.1-3.1 1.71 0 3.1 1.39 3.1 3.1v2z"/>' +
-                    '</svg></div>' +
-                    '<div class="chatUpsellTitle">PDF Chat</div>' +
-                    '<div class="chatUpsellText">PDF\'ler hakkında <strong>yapay zeka</strong> ile sohbet edebilir, sorular sorabilirsiniz. Bu özellik <strong>Premium</strong> ve <strong>VIP</strong> üyelere özeldir.</div>' +
-                    '<div class="chatUpsellActions">' +
-                    '<a href="' + checkoutUrl + '" target="_blank" class="chatUpsellBtn">' +
-                    '<svg viewBox="0 0 24 24" width="18" height="18" fill="#1a1a1a"><path d="M16 18v2H8v-2h8zM11 7.99V16h2V7.99h3L12 4l-4 3.99h3z"/></svg>' +
-                    'Hesabını Yükselt</a>' +
-                    '<div class="chatUpsellDivider">ya da</div>' +
-                    '<a href="https://forum.ieu.app/material-info" target="_blank" class="chatUpsellBtnSecondary">' +
-                    '<svg viewBox="0 0 24 24" width="16" height="16" fill="#ccc"><path d="M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm4 18H6V4h7v5h5v11zM8 15.01l1.41 1.41L11 14.84V19h2v-4.16l1.59 1.59L16 15.01 12.01 11 8 15.01z"/></svg>' +
-                    'Materyal Yükle</a>' +
-                    '</div>';
+
+                // Icon
+                var iconDiv = document.createElement('div');
+                iconDiv.className = 'chatUpsellIcon';
+                var iconSvg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+                iconSvg.setAttribute('viewBox', '0 0 24 24');
+                iconSvg.setAttribute('width', '48');
+                iconSvg.setAttribute('height', '48');
+                iconSvg.setAttribute('fill', '#ffd700');
+                var iconPath = document.createElementNS('http://www.w3.org/2000/svg', 'path');
+                iconPath.setAttribute('d', 'M18 8h-1V6c0-2.76-2.24-5-5-5S7 3.24 7 6v2H6c-1.1 0-2 .9-2 2v10c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V10c0-1.1-.9-2-2-2zm-6 9c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2zm3.1-9H8.9V6c0-1.71 1.39-3.1 3.1-3.1 1.71 0 3.1 1.39 3.1 3.1v2z');
+                iconSvg.appendChild(iconPath);
+                iconDiv.appendChild(iconSvg);
+                upsell.appendChild(iconDiv);
+
+                // Title
+                var title = document.createElement('div');
+                title.className = 'chatUpsellTitle';
+                title.textContent = 'PDF Chat';
+                upsell.appendChild(title);
+
+                // Text
+                var text = document.createElement('div');
+                text.className = 'chatUpsellText';
+                text.innerHTML = 'PDF\'ler hakk\u0131nda <strong>yapay zeka</strong> ile sohbet edebilir, sorular sorabilirsiniz. Bu \u00f6zellik <strong>Premium</strong> ve <strong>VIP</strong> \u00fcyelere \u00f6zeldir.';
+                upsell.appendChild(text);
+
+                // Actions
+                var actions = document.createElement('div');
+                actions.className = 'chatUpsellActions';
+
+                // Primary button (upgrade)
+                var btn1 = document.createElement('button');
+                btn1.className = 'chatUpsellBtn';
+                var btn1Svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+                btn1Svg.setAttribute('viewBox', '0 0 24 24');
+                btn1Svg.setAttribute('width', '18');
+                btn1Svg.setAttribute('height', '18');
+                btn1Svg.setAttribute('fill', '#1a1a1a');
+                var btn1Path = document.createElementNS('http://www.w3.org/2000/svg', 'path');
+                btn1Path.setAttribute('d', 'M16 18v2H8v-2h8zM11 7.99V16h2V7.99h3L12 4l-4 3.99h3z');
+                btn1Svg.appendChild(btn1Path);
+                btn1.appendChild(btn1Svg);
+                btn1.appendChild(document.createTextNode(' Hesab\u0131n\u0131 Y\u00fckselt'));
+                btn1.addEventListener('click', function () { window.open(checkoutUrl, '_blank'); });
+                actions.appendChild(btn1);
+
+                // Divider
+                var divider = document.createElement('div');
+                divider.className = 'chatUpsellDivider';
+                divider.textContent = 'ya da';
+                actions.appendChild(divider);
+
+                // Secondary button (upload material)
+                var btn2 = document.createElement('button');
+                btn2.className = 'chatUpsellBtnSecondary';
+                var btn2Svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+                btn2Svg.setAttribute('viewBox', '0 0 24 24');
+                btn2Svg.setAttribute('width', '16');
+                btn2Svg.setAttribute('height', '16');
+                btn2Svg.setAttribute('fill', '#ccc');
+                var btn2Path = document.createElementNS('http://www.w3.org/2000/svg', 'path');
+                btn2Path.setAttribute('d', 'M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm4 18H6V4h7v5h5v11zM8 15.01l1.41 1.41L11 14.84V19h2v-4.16l1.59 1.59L16 15.01 12.01 11 8 15.01z');
+                btn2Svg.appendChild(btn2Path);
+                btn2.appendChild(btn2Svg);
+                btn2.appendChild(document.createTextNode(' Materyal Y\u00fckle'));
+                btn2.addEventListener('click', function () { window.open(materialUrl, '_blank'); });
+                actions.appendChild(btn2);
+
+                upsell.appendChild(actions);
                 chatMessagesEl.appendChild(upsell);
             }
 
+            function showQuotaExhaustedUpsell(tier, resetsIn) {
+                var uid = (_cfg && _cfg.uid) || 0;
+                var checkoutUrl = 'https://forum.ieu.app/pay/checkout?uid=' + uid;
+                var resetText = resetsIn ? formatResetsIn(resetsIn) : '~4 saat';
+                var msg = document.createElement('div');
+                msg.className = 'chatMsg chatQuotaExhausted';
+
+                // Build using DOM methods to avoid MutationObserver stripping <a> tags
+                var icon = document.createElement('div');
+                icon.className = 'quotaExhaustedIcon';
+                var iconSvg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+                iconSvg.setAttribute('viewBox', '0 0 24 24');
+                iconSvg.setAttribute('width', '36');
+                iconSvg.setAttribute('height', '36');
+                var iconPath = document.createElementNS('http://www.w3.org/2000/svg', 'path');
+
+                if (tier === 'vip') {
+                    iconSvg.setAttribute('fill', '#f59e0b');
+                    iconPath.setAttribute('d', 'M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z');
+                } else {
+                    iconSvg.setAttribute('fill', '#ffd700');
+                    iconPath.setAttribute('d', 'M12 2L9.19 8.63 2 9.24l5.46 4.73L5.82 21 12 17.27 18.18 21l-1.64-7.03L22 9.24l-7.19-.61z');
+                }
+                iconSvg.appendChild(iconPath);
+                icon.appendChild(iconSvg);
+                msg.appendChild(icon);
+
+                var title = document.createElement('div');
+                title.className = 'quotaExhaustedTitle';
+                title.textContent = 'Mesaj kotas\u0131 doldu';
+                msg.appendChild(title);
+
+                var text = document.createElement('div');
+                text.className = 'quotaExhaustedText';
+                if (tier === 'vip') {
+                    text.textContent = 'Mesaj hakk\u0131n\u0131z\u0131 kulland\u0131n\u0131z. ' + resetText + ' sonra s\u0131f\u0131rlan\u0131r.';
+                } else {
+                    text.innerHTML = 'Kullan\u0131m hakk\u0131n\u0131z doldu. <strong>VIP</strong>\u2019e y\u00fckselterek \u00e7ok daha fazla kullan\u0131m hakk\u0131 kazan\u0131n!';
+                }
+                msg.appendChild(text);
+
+                if (tier !== 'vip') {
+                    // Use <button> + addEventListener instead of <a> to avoid
+                    // MutationObserver stripping (it removes <a> tags as dangerous)
+                    var btn = document.createElement('button');
+                    btn.className = 'quotaExhaustedBtn';
+                    var btnSvg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+                    btnSvg.setAttribute('viewBox', '0 0 24 24');
+                    btnSvg.setAttribute('width', '18');
+                    btnSvg.setAttribute('height', '18');
+                    btnSvg.setAttribute('fill', '#1a1a1a');
+                    var btnPath = document.createElementNS('http://www.w3.org/2000/svg', 'path');
+                    btnPath.setAttribute('d', 'M16 18v2H8v-2h8zM11 7.99V16h2V7.99h3L12 4l-4 3.99h3z');
+                    btnSvg.appendChild(btnPath);
+                    btn.appendChild(btnSvg);
+                    btn.appendChild(document.createTextNode(' Hesab\u0131n\u0131 Y\u00fckselt'));
+                    btn.addEventListener('click', function () { window.open(checkoutUrl, '_blank'); });
+                    msg.appendChild(btn);
+                }
+
+                var note = document.createElement('div');
+                note.className = 'quotaExhaustedNote';
+                note.textContent = resetText + ' sonra s\u0131f\u0131rlan\u0131r';
+                msg.appendChild(note);
+
+                chatMessagesEl.appendChild(msg);
+                chatMessagesEl.scrollTop = chatMessagesEl.scrollHeight;
+
+                // Disable input area
+                chatInputEl.disabled = true;
+                chatSendBtnEl.disabled = true;
+                chatInputEl.placeholder = 'Mesaj kotas\u0131 doldu';
+            }
+
             async function sendChatMessage() {
                 if (!chatIsPremium) return;
                 if (chatSending) return;
@@ -4180,7 +4391,12 @@
                     const data = await resp.json();
                     // Update quota bar from response
                     if (data.quota) {
-                        updateQuotaBar(data.quota.used, data.quota.max);
+                        updateQuotaBar(data.quota.used, data.quota.max, data.quota.resetsIn);
+                    }
+                    // Daily quota exhausted — show upsell
+                    if (resp.status === 429 && data.quotaExhausted) {
+                        showQuotaExhaustedUpsell(data.tier, data.quota && data.quota.resetsIn);
+                        return;
                     }
                     if (resp.ok && data.answer) {
                         addChatMessage('ai', data.answer, data.injectionWarning);
@@ -4198,9 +4414,12 @@
                     addChatMessage('error', 'Bağlantı hatası. Tekrar deneyin.');
                 } finally {
                     chatSending = false;
-                    chatSendBtnEl.disabled = false;
-                    updateSendBtnState();
-                    chatInputEl.focus();
+                    // Don't re-enable if quota exhausted (input was permanently disabled)
+                    if (!chatInputEl.disabled) {
+                        chatSendBtnEl.disabled = false;
+                        updateSendBtnState();
+                        chatInputEl.focus();
+                    }
                 }
             }