Add ad-based access verification with 24h session and verification persistence

[SasukeXDev]

Motivation

• Provide an alternative access flow that lets visitors unlock the site by completing an external verification (ad) and then access the site for 24 hours without username/password login.
• Persist verification state server-side to allow session revalidation and to avoid repeated manual logins for the verification window.
• Apply verification gating to existing page routes so only verified sessions can access protected pages and admin actions.

Description

• Added a verifications collection and save_verification method in Database to persist visitor verification records via db.save_verification.
• Implemented verification session helpers and constants in stream_routes.py, including VERIFICATION_WINDOW_SECONDS, is_verified_session, get_client_ip, and get_verified_user, plus routes POST /verify/start and POST /verify-access to manage the timed verification flow and visitor identity (visitor_id).
• Updated authentication flow so GET /login now generates verify_nonce and verify_wait values, POST /login sets verified_at/verified_user_id on successful admin login, POST /logout clears verification state, and many page routes now call get_verified_user to enforce verification.
• Updated render_page to accept verify_nonce and verify_wait placeholders and replaced the old login.html template with a new verification-focused page that includes client-side logic to start the verification timer (/verify/start) and submit POST /verify-access once the wait finishes.

Testing

• No automated tests were run for these changes.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hub360	Ready	Preview, Comment	Mar 24, 2026 6:32pm