Fix reports 500 on MySQL; enforcement report asset context

plugins/geenforce/api/routes.py

@@ -11,6 +11,7 @@ Two audiences:
 import ipaddress
 import os
 import time
+from datetime import datetime
 from functools import wraps
 
 from flask import Blueprint, request, Response, send_file, current_app, g
@@ -24,6 +25,9 @@ from shopdb.api import (
 
 SHAREROOT_SETTING = 'geenforce_share_root'
 
+# Sort floor for revisions with no lastseenat (they sort last regardless).
+_EPOCH = datetime.min
+
 from ..models import (
     ManifestScope, ManifestEntry, ManifestPublishedVersion,
     ManifestEnforcementReport, ManifestEnforcementResult, ManifestPayload,
@@ -1037,12 +1041,19 @@ def _attach_backup_state(facts, hostnames):
         return
     rows = (BackupRevision.query
             .filter(BackupRevision.sourcehostname.in_(hostnames))
-            .order_by(BackupRevision.lastseenat.desc().nullslast())
             .all())
+    # Newest confirmed first, ordered HERE rather than in SQL: putting nulls
+    # last needs ORDER BY ... NULLS LAST, which SQLite accepts and MySQL
+    # rejects outright - so the query passed every test and 500'd on the real
+    # database. Row counts here are one per host per kind, so sorting in Python
+    # costs nothing.
+    rows.sort(key=lambda revision: (revision.lastseenat is not None,
+                                    revision.lastseenat or _EPOCH),
+              reverse=True)
     for revision in rows:
         key = (revision.sourcehostname or '').lower()
         entry = facts.get(key)
-        # First row per host wins: ordered newest-confirmed first.
+        # First row per host wins.
         if entry and entry['backuplastseen'] is None:
             entry['backupkind'] = revision.backupkind
             entry['backuplastseen'] = (