geenforce: judge silence on both clocks, not just the server's

The fleet table has two time columns and staleness only looked at one. A PC can
go quiet in either direction: silent to the server, or still posting while its
own cycle has stopped advancing. Only the first was caught, so a machine whose
Last check-in had not moved since the previous morning still showed 'ok'.

The two are tested independently rather than by taking the newer of them.
receivedat is the server's own record and cannot be argued with; lastcheckin is
asserted by the client, so a wrong clock there must not be able to vouch for a
PC the server has not actually heard from. Checking them separately means a
future-dated lastcheckin cannot mask real silence.

The tooltip now names both times, since which one stopped says what kind of
failure it is.

plugins/geenforce/api/routes.py

@@ -1116,9 +1116,20 @@ def list_reports():
             latest_cache[key] = _current_published_version(*key)
         latest = latest_cache[key]
         known = facts.get((report.hostname or '').lower(), {})
-        isstale = (stalecutoff is not None
-                   and (report.receivedat is None
-                        or report.receivedat < stalecutoff))
+        # Two separate ways to have gone quiet, and the table has a column for
+        # each. receivedat is the SERVER's record of the last report it got;
+        # lastcheckin is the client's own claim about when it last ran. A PC can
+        # fail either way round - silent to the server, or still posting while
+        # its own cycle has stopped advancing - so both count.
+        #
+        # They are checked independently rather than by taking the newer of the
+        # two: lastcheckin is client-asserted, so a wrong or future value there
+        # must not be able to mask real silence on receivedat.
+        isstale = stalecutoff is not None and (
+            report.receivedat is None
+            or report.receivedat < stalecutoff
+            or (report.lastcheckin is not None
+                and report.lastcheckin < stalecutoff))
         data.append({
             'reportid': report.reportid,
             'hostname': report.hostname,

plugins/geenforce/frontend/views/EnforcementReports.vue

@@ -192,9 +192,11 @@ function statusClass(status) {
 }
 
 function staleTitle(report) {
-  const last = report.receivedat ? formatDate(report.receivedat) : 'never'
-  return `No report for over ${report.staleafterminutes} minutes.`
-    + ` Last heard ${last}, reporting "${report.status}".`
+  const received = report.receivedat ? formatDate(report.receivedat) : 'never'
+  const checkin = report.lastcheckin ? formatDate(report.lastcheckin) : 'not reported'
+  return `Nothing heard for over ${report.staleafterminutes} minutes.`
+    + ` Last report received ${received}, PC last checked in ${checkin},`
+    + ` reporting "${report.status}".`
 }
 function actionClass(action) {
   return { installed: 'badge-info', skipped: 'badge-success', failed: 'badge-danger',