From 9c8b2c9c9e33f79befc5be0b1a7c09eb835b8a8d Mon Sep 17 00:00:00 2001
From: cproudlock <cproudlock@localhost>
Date: Mon, 13 Jul 2026 09:09:29 -0400
Subject: [PATCH] DB review safe-fix: naive-UTC timestamp defaults (drop
 db.func.now)

DB review found four DateTime columns defaulting to db.func.now() (MySQL
session-timezone wall clock) while the rest of the schema stores naive UTC, so
one schema mixed two clocks and to_dict() labelled the local values UTC with a
'Z' suffix. Switch application.dateadded, computers.installeddate,
knowledgebase.lastupdated (default + onupdate), and slides.uploadeddate to the
module-level naive-UTC _utcnow callable already used elsewhere (apitoken.py).
ORM-side default only - no column-type change, no data migration; affects
new/updated rows.

Targeted tests pass (154); naming + pyflakes green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 plugins/computers/models/computer.py          | 9 ++++++++-
 plugins/knowledgebase/models/knowledgebase.py | 9 ++++++++-
 plugins/slides/models/tvslide.py              | 9 ++++++++-
 shopdb/core/models/application.py             | 9 ++++++++-
 4 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/plugins/computers/models/computer.py b/plugins/computers/models/computer.py
index 81abcd7..c435bd0 100644
--- a/plugins/computers/models/computer.py
+++ b/plugins/computers/models/computer.py
@@ -1,8 +1,15 @@
 """Computer plugin models."""
 
+from datetime import datetime, timezone
+
 from shopdb.api import db, BaseModel
 
 
+def _utcnow():
+    # naive UTC to match the other DB DateTime columns (stored without tzinfo)
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
 class ComputerType(BaseModel):
     """
     Computer type classification.
@@ -170,7 +177,7 @@ class ComputerInstalledApp(db.Model):
     # Raw version string from automated collection (when no curated AppVersion)
     installedversion = db.Column(db.String(100), nullable=True)
     isactive = db.Column(db.Boolean, default=True, nullable=False)
-    installeddate = db.Column(db.DateTime, default=db.func.now())
+    installeddate = db.Column(db.DateTime, default=_utcnow)
 
     # Relationships
     computer = db.relationship('Computer', back_populates='installedapps')
diff --git a/plugins/knowledgebase/models/knowledgebase.py b/plugins/knowledgebase/models/knowledgebase.py
index 909d289..b37b95e 100644
--- a/plugins/knowledgebase/models/knowledgebase.py
+++ b/plugins/knowledgebase/models/knowledgebase.py
@@ -7,9 +7,16 @@ references the core applications table by name, which resolves at mapper config
 time without importing the core model.
 """
 
+from datetime import datetime, timezone
+
 from shopdb.api import db, BaseModel
 
 
+def _utcnow():
+    # naive UTC to match the other DB DateTime columns (stored without tzinfo)
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
 class KnowledgeBase(BaseModel):
     """Knowledge Base article linking to external resources."""
     __tablename__ = 'knowledgebase'
@@ -20,7 +27,7 @@ class KnowledgeBase(BaseModel):
     linkurl = db.Column(db.String(2000))
     keywords = db.Column(db.String(500))
     clicks = db.Column(db.Integer, default=0)
-    lastupdated = db.Column(db.DateTime, default=db.func.now(), onupdate=db.func.now())
+    lastupdated = db.Column(db.DateTime, default=_utcnow, onupdate=_utcnow)
 
     # Relationship to the core Application model (resolved by class name).
     application = db.relationship('Application', backref=db.backref('knowledgebase_articles', lazy='dynamic'))
diff --git a/plugins/slides/models/tvslide.py b/plugins/slides/models/tvslide.py
index 78fdd49..a5b5ac1 100644
--- a/plugins/slides/models/tvslide.py
+++ b/plugins/slides/models/tvslide.py
@@ -1,8 +1,15 @@
 """Slide model for the TV dashboard / screensaver slideshows."""
 
+from datetime import datetime, timezone
+
 from shopdb.api import db
 
 
+def _utcnow():
+    # naive UTC to match the other DB DateTime columns (stored without tzinfo)
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
 class TvSlide(db.Model):
     """One slide image in a surface's playlist.
 
@@ -17,7 +24,7 @@ class TvSlide(db.Model):
     filename = db.Column(db.String(255), nullable=False)
     sortorder = db.Column(db.Integer, default=0, nullable=False)
     seconds = db.Column(db.Integer, default=0, nullable=False)  # 0 = use default interval
-    uploadeddate = db.Column(db.DateTime, default=db.func.now())
+    uploadeddate = db.Column(db.DateTime, default=_utcnow)
 
     # No DB-level unique on (surface, filename): utf8mb4 pushes that index past
     # MySQL 5.6's 767-byte limit. Upload unique-renames, so dupes can't occur.
diff --git a/shopdb/core/models/application.py b/shopdb/core/models/application.py
index 5aebb31..1ddf72d 100644
--- a/shopdb/core/models/application.py
+++ b/shopdb/core/models/application.py
@@ -1,7 +1,14 @@
 """Application tracking models."""
 
+from datetime import datetime, timezone
+
 from shopdb.extensions import db
 from .base import BaseModel
+
+
+def _utcnow():
+    # naive UTC to match the other DB DateTime columns (stored without tzinfo)
+    return datetime.now(timezone.utc).replace(tzinfo=None)
 # SupportTeam / SupportTeamContact live in supportteam.py; imported by the
 # models package so the Application.supportteam relationship resolves.
 
@@ -61,7 +68,7 @@ class AppVersion(db.Model):
     version = db.Column(db.String(50), nullable=False)
     releasedate = db.Column(db.Date)
     notes = db.Column(db.String(255))
-    dateadded = db.Column(db.DateTime, default=db.func.now())
+    dateadded = db.Column(db.DateTime, default=_utcnow)
     isactive = db.Column(db.Boolean, default=True)
 
     # Relationships