kryten-webqueue 0.22.0__tar.gz → 0.23.1__tar.gz

kryten_webqueue-0.23.1/.github/workflows/python-publish.yml

@@ -0,0 +1,93 @@
+name: Publish Python Package to PyPI
+
+# Builds and publishes to PyPI. This workflow MUST run top-level (never invoked
+# via a reusable `uses:` call). PyPI Trusted Publishing matches the OIDC
+# `job_workflow_ref` claim — the filename of the workflow that contains the
+# running job — against the configured publisher (python-publish.yml). Running
+# this as a reusable workflow would change that filename and break publishing
+# (and is explicitly unsupported by PyPI).
+on:
+  # Primary automated path: fire after "Release Automation" (release.yml)
+  # finishes creating the tag + GitHub Release. workflow_run keeps this workflow
+  # top-level, unlike a reusable `uses:` invocation.
+  workflow_run:
+    workflows: ["Release Automation"]
+    types: [completed]
+  # Manual fallbacks: publishing a GitHub Release by hand, or pushing a tag.
+  release:
+    types: [published]
+  push:
+    tags:
+      - 'kryten-webqueue-v*'
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  release-build:
+    name: Build distribution packages
+    runs-on: ubuntu-latest
+    # When triggered by release.yml's completion, only proceed on success.
+    # release/tag triggers aren't workflow_run events, so they always build.
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          # For a workflow_run trigger, build the exact commit release.yml
+          # processed; otherwise build the tag/release commit.
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.2.0
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Build release distributions
+        run: |
+          uv build
+          echo "📦 Built packages:"
+          ls -lh dist/
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-dists
+          path: dist/
+
+  pypi-publish:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs:
+      - release-build
+    environment:
+      name: pypi
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v8
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+          skip-existing: true
+          attestations: false
+
+      - name: Success notification
+        if: success()
+        run: |
+          echo "✅ Successfully published to PyPI!"
+          echo "🔗 Package URL: https://pypi.org/project/kryten-webqueue/"

{kryten_webqueue-0.22.0 → kryten_webqueue-0.23.1}/.github/workflows/release.yml

@@ -1,6 +1,10 @@
 name: Release Automation
 
-# Automatically create GitHub releases when version in pyproject.toml changes
+# Automatically create GitHub releases when version in pyproject.toml changes.
+# Publishing to PyPI is handled separately by python-publish.yml, which triggers
+# on this workflow's completion (see its workflow_run trigger). Publishing is
+# intentionally NOT inlined here: PyPI Trusted Publishing matches the OIDC
+# job_workflow_ref filename, which is configured as python-publish.yml.
 on:
   push:
     branches:
@@ -11,8 +15,6 @@ on:
 
 permissions:
   contents: write
-  pull-requests: read
-  id-token: write
 
 jobs:
   create-release:
@@ -20,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Full history for changelog
       
@@ -93,11 +95,3 @@ jobs:
         if: steps.check_tag.outputs.exists == 'true'
         run: |
           echo "ℹ️ Release ${{ steps.version.outputs.tag }} already exists - skipping"
-
-  publish-to-pypi:
-    name: Publish to PyPI
-    needs: [create-release]
-    uses: ./.github/workflows/python-publish.yml
-    permissions:
-      id-token: write
-      contents: read

{kryten_webqueue-0.22.0 → kryten_webqueue-0.23.1}/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## [0.23.1] — 2026-06-21
+
+### Changed
+
+- **Release CI hardening (no runtime changes).** PyPI publishing was moved out of a reusable workflow into a top-level one. PyPI Trusted Publishing matches the OIDC `job_workflow_ref` claim — the filename of the workflow containing the running job — against the configured publisher (`python-publish.yml`); invoking that workflow via a reusable `uses:` call is unsupported by PyPI and raised a "workflow misconfiguration" warning. `python-publish.yml` now triggers via `workflow_run` after `release.yml` completes (keeping it top-level so the publisher filename stays `python-publish.yml`), and `release.yml` no longer calls it reusably. All GitHub Actions were bumped off the deprecated Node 20 runtime: `actions/checkout@v7`, `actions/setup-python@v6`, `actions/upload-artifact@v7`, `actions/download-artifact@v8`, and `astral-sh/setup-uv@v8.2.0`.
+
+[0.23.1]: https://github.com/grobertson/kryten-webqueue/releases/tag/v0.23.1
+
+## [0.23.0] — 2026-06-21
+
+### Fixed
+
+- **Scheduled-event pre-fire lock lingered until midnight.** The pay-to-play pre-fire lock lives in `playlist_schedules` and was gated on `fire_at > datetime('now')`. `fire_at` is stored as a raw ISO string with a `T` separator (e.g. `2026-06-21T15:00:00+00:00`, or `…Z` from the admin UI) while SQLite's `datetime('now')` is space-separated, so the two were compared as **strings** — `'T'` sorts after `' '`, keeping the condition true from fire time until the calendar date rolled over. A 15-minute pre-fire lock effectively lasted until midnight, the queue stayed locked with no active-schedule row to show for it, and "Clear Active" couldn't lift it. The lock queries now wrap `fire_at` in `datetime(…)` so the comparison is over normalized timestamps and the lock releases exactly at `fire_at`. `get_next_schedule` shared the same flaw (already-fired events showed as "next" until midnight) and is fixed too.
+
+### Added
+
+- **Clear admin lockout indicator + one-click "End lockout now".** The admin Schedules page now shows a prominent banner whenever pay-to-play is closed — covering the pre-fire window (which has no active-schedule row and was previously invisible until a queue attempt failed) as well as an in-progress immutable event. A new `GET /admin/schedules/lock-status` reports the authoritative state, and `POST /admin/schedules/unlock` now lifts an in-progress event lock **and** every active pre-fire lock in a single action (it previously lifted only one), so one click reliably reopens the queue. Schedules stay armed — a recurring event re-locks on its next firing.
+
+[0.23.0]: https://github.com/grobertson/kryten-webqueue/releases/tag/v0.23.0
+
 ## [0.22.0] - 2026-06-19
 
 ### Added

{kryten_webqueue-0.22.0 → kryten_webqueue-0.23.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kryten-webqueue
-Version: 0.22.0
+Version: 0.23.1
 Summary: Netflix/Tubi-style catalog browser and pay-to-play queue management for CyTube
 Author: grobertson
 License-Expression: MIT

{kryten_webqueue-0.22.0 → kryten_webqueue-0.23.1}/kryten_webqueue/catalog/db.py

@@ -1166,12 +1166,19 @@ class Database:
     # --- Pre-fire lock check ---
 
     async def is_pre_fire_lock_active(self) -> bool:
+        # NOTE: fire_at must be wrapped in datetime() on BOTH sides. fire_at is
+        # stored as a raw ISO string ('2026-06-21T15:00:00+00:00' or '...Z'),
+        # whose 'T' separator sorts lexically AFTER the space-separated string
+        # returned by datetime('now'). A bare `fire_at > datetime('now')` is a
+        # string comparison that stays true from fire time until the calendar
+        # day rolls over, so the lock lingered until midnight instead of
+        # releasing at fire_at.
         row = await self._fetch_one("""
             SELECT 1 FROM playlist_schedules
             WHERE is_active = 1
               AND lock_disabled = 0
               AND datetime(fire_at, '-' || pre_fire_lock_minutes || ' minutes') <= datetime('now')
-              AND fire_at > datetime('now')
+              AND datetime(fire_at) > datetime('now')
             LIMIT 1
         """)
         return row is not None
@@ -1187,12 +1194,32 @@ class Database:
             WHERE is_active = 1
               AND lock_disabled = 0
               AND datetime(fire_at, '-' || pre_fire_lock_minutes || ' minutes') <= datetime('now')
-              AND fire_at > datetime('now')
-            ORDER BY fire_at
+              AND datetime(fire_at) > datetime('now')
+            ORDER BY datetime(fire_at)
             LIMIT 1
         """)
 
+    async def disable_active_pre_fire_locks(self) -> int:
+        """Lift ALL currently-active pre-fire locks in a single operation.
+
+        Sets ``lock_disabled = 1`` for every schedule whose pre-fire window is
+        open right now, so one admin action ends the lockout even when more than
+        one schedule's window overlaps. Recurring schedules reset
+        ``lock_disabled`` to 0 when they re-arm, so future firings still lock.
+        Returns the number of schedules affected.
+        """
+        cursor = await self._db.execute("""
+            UPDATE playlist_schedules
+            SET lock_disabled = 1
+            WHERE is_active = 1
+              AND lock_disabled = 0
+              AND datetime(fire_at, '-' || pre_fire_lock_minutes || ' minutes') <= datetime('now')
+              AND datetime(fire_at) > datetime('now')
+        """)
+        await self._db.commit()
+        return cursor.rowcount
+
     async def get_next_schedule(self) -> dict | None:
         return await self._fetch_one(
-            "SELECT * FROM playlist_schedules WHERE is_active=1 AND fire_at > datetime('now') ORDER BY fire_at LIMIT 1"
+            "SELECT * FROM playlist_schedules WHERE is_active=1 AND datetime(fire_at) > datetime('now') ORDER BY datetime(fire_at) LIMIT 1"
         )

{kryten_webqueue-0.22.0 → kryten_webqueue-0.23.1}/kryten_webqueue/routes/admin_schedules.py

@@ -134,24 +134,62 @@ async def clear_active(request: Request, user: dict = Depends(require_admin)):
     return {"success": True}
 
 
+@router.get("/lock-status")
+async def lock_status(request: Request, user: dict = Depends(require_admin)):
+    """Authoritative pay-to-play lock state for the admin lock banner.
+
+    Reports *both* lock types so an admin always sees why the queue is closed
+    and can end it — whether a schedule is in its pre-fire window (no active
+    schedule row) or an immutable event is mid-play.
+    """
+    db = request.app.state.db
+
+    # Pre-fire window lives entirely in playlist_schedules (no active_schedule
+    # row), which is why "Clear Active" can't see or clear it.
+    if await db.is_pre_fire_lock_active():
+        lock = await db.get_active_pre_fire_lock() or {}
+        return {
+            "locked": True,
+            "type": "pre_fire",
+            "label": lock.get("label"),
+            "fire_at": lock.get("fire_at"),
+        }
+
+    # In-progress immutable scheduled event.
+    if await db.is_event_lock_active():
+        active = await db.get_active_schedule() or {}
+        label = None
+        if active.get("playlist_id"):
+            playlist = await db.get_saved_playlist(active["playlist_id"])
+            if playlist:
+                label = playlist.get("name")
+        return {
+            "locked": True,
+            "type": "event",
+            "label": label,
+            "estimated_end_at": active.get("estimated_end_at"),
+        }
+
+    return {"locked": False, "type": None}
+
+
 @router.post("/unlock")
 async def unlock(request: Request, user: dict = Depends(require_admin)):
-    """Lift the currently-active pay-to-play lock without deleting the schedule.
+    """End the active pay-to-play lockout, whatever its source.
 
-    Targets the in-progress scheduled-event lock first (keeps the event banner
-    and any recurring schedule armed); otherwise lifts an active pre-fire lock
-    for its current occurrence only (a recurring schedule re-locks on its next
-    firing).
+    Lifts an in-progress event lock *and* every currently-active pre-fire lock
+    in a single action, so one click reliably reopens pay-to-play. The schedules
+    themselves stay armed: a recurring schedule re-locks on its next firing.
     """
     db = request.app.state.db
+    lifted: list[str] = []
 
     if await db.is_event_lock_active():
         await db.disable_active_lock()
-        return {"success": True, "lifted": "event"}
+        lifted.append("event")
 
-    prefire = await db.get_active_pre_fire_lock()
-    if prefire:
-        await db.update_schedule(prefire["id"], lock_disabled=1)
-        return {"success": True, "lifted": "pre_fire"}
+    pre_fire_count = await db.disable_active_pre_fire_locks()
+    if pre_fire_count:
+        lifted.append("pre_fire")
 
-    return {"success": True, "lifted": None}
+    return {"success": True, "lifted": lifted, "pre_fire_count": pre_fire_count}

{kryten_webqueue-0.22.0 → kryten_webqueue-0.23.1}/kryten_webqueue/static/css/main.css

@@ -1210,6 +1210,33 @@ a.np-chip {
     border-left: 3px solid var(--warning);
 }
 
+/* Pay-to-play lock banner (admin schedules) — deliberately prominent so a
+   lockout is never a surprise discovered only when a queue attempt fails. */
+.lock-banner {
+    background: rgba(225, 112, 85, 0.12);
+    border: 1px solid var(--danger);
+    border-left: 4px solid var(--danger);
+    border-radius: var(--radius);
+    padding: 0.9rem 1.1rem;
+    margin-bottom: 1.5rem;
+}
+.lock-banner-row {
+    display: flex;
+    align-items: center;
+    gap: 0.9rem;
+    flex-wrap: wrap;
+}
+.lock-banner-icon {
+    font-size: 1.4rem;
+    line-height: 1;
+}
+.lock-banner-text {
+    flex: 1 1 240px;
+}
+.lock-banner-text > strong {
+    color: var(--danger);
+}
+
 /* Modal */
 .modal-overlay {
     position: fixed;

{kryten_webqueue-0.22.0 → kryten_webqueue-0.23.1}/kryten_webqueue/templates/admin/schedules.html

@@ -7,6 +7,7 @@
     <h1>Schedules</h1>
     <p><a href="/admin">&larr; Back to Admin</a></p>
 
+    <div id="lock-banner" class="lock-banner hidden"></div>
     <div id="active-banner" class="schedule-info hidden" style="margin-bottom:1.5rem;"></div>
 
     <div class="admin-section">
@@ -36,6 +37,58 @@ async function loadPlaylistsForSelect() {
     return rows;
 }
 
+async function loadLockStatus() {
+    // Authoritative, server-side lock indicator. Unlike the active-schedule
+    // banner, this also surfaces a pre-fire lockout (which has no active_schedule
+    // row) — the case where the queue is locked with nothing obviously "running".
+    const banner = document.getElementById('lock-banner');
+    let st;
+    try {
+        const resp = await fetch('/admin/schedules/lock-status');
+        if (!resp.ok) { banner.classList.add('hidden'); return; }
+        st = await resp.json();
+    } catch { banner.classList.add('hidden'); return; }
+
+    if (!st || !st.locked) {
+        banner.classList.add('hidden');
+        banner.innerHTML = '';
+        return;
+    }
+
+    const label = st.label ? escapeHtml(st.label) : 'a scheduled event';
+    let detail;
+    if (st.type === 'pre_fire') {
+        const when = st.fire_at ? formatLocalDateTime(st.fire_at) : null;
+        detail = `Pre-event lockout for <strong>${label}</strong>${when ? ` — fires ${when}` : ''}. Pay-to-play reopens when the event starts.`;
+    } else {
+        const when = st.estimated_end_at ? formatLocalDateTime(st.estimated_end_at) : null;
+        detail = `Event <strong>${label}</strong> is playing${when ? ` — ends ~${when}` : ''}. Pay-to-play reopens when the last scheduled item begins.`;
+    }
+
+    banner.classList.remove('hidden');
+    banner.innerHTML = `
+        <div class="lock-banner-row">
+            <span class="lock-banner-icon" aria-hidden="true">&#128274;</span>
+            <div class="lock-banner-text">
+                <strong>Queue locked &mdash; pay-to-play is closed.</strong>
+                <div class="muted">${detail}</div>
+            </div>
+            <button class="btn btn-danger btn-sm" onclick="endLockout()">End lockout now</button>
+        </div>`;
+}
+
+async function endLockout() {
+    if (!confirm('End the pay-to-play lockout now? Users can queue items immediately. Schedules stay armed — a recurring event re-locks on its next firing.')) return;
+    let ok = false;
+    try {
+        const resp = await fetch('/admin/schedules/unlock', {method: 'POST'});
+        ok = resp.ok;
+    } catch { ok = false; }
+    showToast(ok ? 'Lockout ended' : 'Failed to end lockout', ok ? 'success' : 'error');
+    await loadLockStatus();
+    loadSchedules();
+}
+
 async function loadActive() {
     const banner = document.getElementById('active-banner');
     const resp = await fetch('/admin/schedules/active');
@@ -69,6 +122,7 @@ async function unlockNow() {
     if (!confirm('Lift the pay-to-play lock now? Users will be able to queue items again. The schedule stays armed for future firings.')) return;
     const resp = await fetch('/admin/schedules/unlock', {method: 'POST'});
     showToast(resp.ok ? 'Lock lifted' : 'Failed', resp.ok ? 'success' : 'error');
+    await loadLockStatus();
     loadSchedules();
 }
 
@@ -76,11 +130,13 @@ async function clearActive() {
     if (!confirm('Clear the active schedule and return to free mode?')) return;
     const resp = await fetch('/admin/schedules/clear-active', {method: 'POST'});
     showToast(resp.ok ? 'Cleared' : 'Failed', resp.ok ? 'success' : 'error');
+    await loadLockStatus();
     loadActive();
 }
 
 async function loadSchedules() {
     await loadPlaylistsForSelect();
+    await loadLockStatus();
     await loadActive();
     const resp = await fetch('/admin/schedules/');
     const el = document.getElementById('schedules-list');
@@ -213,10 +269,14 @@ function closeModal() { const m = document.getElementById('admin-modal'); if (m)
 
 loadSchedules();
 
-// Keep the active-event banner fresh without a reload: re-check every 15s while
-// the tab is visible (the backend clears the row once the event plays out).
+// Keep the lock indicator and active-event banner fresh without a reload:
+// re-check every 15s while the tab is visible (the backend lifts the lock at
+// fire time and clears the active row once the event plays out).
 setInterval(() => {
-    if (document.visibilityState === 'visible') loadActive();
+    if (document.visibilityState === 'visible') {
+        loadLockStatus();
+        loadActive();
+    }
 }, 15000);
 </script>
 {% endblock %}

{kryten_webqueue-0.22.0 → kryten_webqueue-0.23.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kryten-webqueue"
-version = "0.22.0"
+version = "0.23.1"
 description = "Netflix/Tubi-style catalog browser and pay-to-play queue management for CyTube"
 readme = "README.md"
 license = "MIT"

kryten_webqueue-0.23.1/tests/test_schedule_lock.py

@@ -0,0 +1,130 @@
+"""Regression tests for the scheduled-event pre-fire pay-to-play lock.
+
+These cover a bug where the pre-fire lock lingered far past ``fire_at`` (until
+the calendar day rolled over at midnight). ``fire_at`` is stored as a raw ISO
+string with a ``T`` separator (e.g. ``2026-06-21T15:00:00+00:00`` from the
+scheduler, or ``...Z`` from the admin UI's ``toISOString``). The lock predicate
+compared it against ``datetime('now')`` (space-separated) without normalizing,
+so SQLite did a *string* comparison in which ``'T'`` (84) sorts after ``' '``
+(32). That kept ``fire_at > datetime('now')`` true from fire time until the date
+prefix changed, so a 15-minute lock effectively lasted until midnight.
+
+The fix wraps ``fire_at`` in ``datetime(...)`` on both sides so the comparison
+is over normalized timestamps.
+"""
+
+from datetime import datetime, timedelta, UTC
+
+import pytest
+
+from kryten_webqueue.catalog.db import Database
+
+
+@pytest.fixture
+async def db(tmp_path):
+    database = Database(str(tmp_path / "test.db"))
+    await database.connect()
+    await database.run_migrations()
+    yield database
+    await database.close()
+
+
+def _iso_offset(dt: datetime) -> str:
+    """Scheduler storage format, e.g. '2026-06-21T15:00:00+00:00'."""
+    return dt.astimezone(UTC).isoformat()
+
+
+def _iso_zulu(dt: datetime) -> str:
+    """Admin-UI storage format (JS Date.toISOString), e.g. '...T15:00:00.000Z'."""
+    return dt.astimezone(UTC).strftime("%Y-%m-%dT%H:%M:%S.000Z")
+
+
+async def _make_schedule(db: Database, *, fire_at: str, lock_minutes: int = 15) -> int:
+    return await db.create_schedule(
+        playlist_id=None,
+        label="Test Event",
+        fire_at=fire_at,
+        pre_fire_lock_minutes=lock_minutes,
+        is_active=True,
+        created_by="tester",
+    )
+
+
+@pytest.mark.parametrize("fmt", [_iso_offset, _iso_zulu])
+async def test_pre_fire_lock_releases_at_fire_time(db, fmt):
+    """A schedule whose fire_at has passed must NOT keep the queue locked.
+
+    Before the fix this returned True for the rest of the calendar day.
+    """
+    past = datetime.now(UTC) - timedelta(hours=2)
+    await _make_schedule(db, fire_at=fmt(past))
+    assert await db.is_pre_fire_lock_active() is False
+    assert await db.get_active_pre_fire_lock() is None
+
+
+async def test_pre_fire_lock_active_inside_window(db):
+    """Inside the pre-fire window (future fire_at), the lock is active."""
+    soon = datetime.now(UTC) + timedelta(minutes=5)
+    await _make_schedule(db, fire_at=_iso_offset(soon), lock_minutes=15)
+    assert await db.is_pre_fire_lock_active() is True
+    lock = await db.get_active_pre_fire_lock()
+    assert lock is not None and lock["label"] == "Test Event"
+
+
+async def test_pre_fire_lock_inactive_before_window(db):
+    """Before the pre-fire window opens, the lock is not active."""
+    later = datetime.now(UTC) + timedelta(hours=2)
+    await _make_schedule(db, fire_at=_iso_offset(later), lock_minutes=15)
+    assert await db.is_pre_fire_lock_active() is False
+
+
+async def test_get_next_schedule_ignores_past_fire(db):
+    """The 'next schedule' must skip events whose fire_at has already passed.
+
+    Before the fix a same-day past schedule was returned (and could even sort
+    ahead of a genuine upcoming one).
+    """
+    past = datetime.now(UTC) - timedelta(hours=2)
+    future = datetime.now(UTC) + timedelta(hours=3)
+    await _make_schedule(db, fire_at=_iso_offset(past))
+    future_id = await _make_schedule(db, fire_at=_iso_offset(future))
+
+    nxt = await db.get_next_schedule()
+    assert nxt is not None
+    assert nxt["id"] == future_id
+
+
+async def test_disable_active_pre_fire_locks_ends_lockout(db):
+    """One call lifts EVERY active pre-fire lock, across both stored formats."""
+    soon = datetime.now(UTC) + timedelta(minutes=5)
+    later = datetime.now(UTC) + timedelta(minutes=10)
+    await _make_schedule(db, fire_at=_iso_offset(soon), lock_minutes=15)
+    await _make_schedule(db, fire_at=_iso_zulu(later), lock_minutes=15)
+
+    assert await db.is_pre_fire_lock_active() is True
+    count = await db.disable_active_pre_fire_locks()
+    assert count == 2
+    assert await db.is_pre_fire_lock_active() is False
+
+
+async def test_disable_active_pre_fire_locks_noop_when_unlocked(db):
+    """No active window → nothing lifted, returns 0 (idempotent end-lockout)."""
+    later = datetime.now(UTC) + timedelta(hours=2)  # before its pre-fire window
+    await _make_schedule(db, fire_at=_iso_offset(later), lock_minutes=15)
+
+    assert await db.is_pre_fire_lock_active() is False
+    assert await db.disable_active_pre_fire_locks() == 0
+
+
+async def test_disable_active_pre_fire_locks_leaves_future_windows(db):
+    """Lifting the current lockout must not pre-emptively unlock a later event
+    whose pre-fire window has not opened yet."""
+    soon = datetime.now(UTC) + timedelta(minutes=5)    # in-window now
+    later = datetime.now(UTC) + timedelta(hours=4)     # window opens much later
+    await _make_schedule(db, fire_at=_iso_offset(soon), lock_minutes=15)
+    later_id = await _make_schedule(db, fire_at=_iso_offset(later), lock_minutes=15)
+
+    assert await db.disable_active_pre_fire_locks() == 1
+    later_sched = await db.get_schedule(later_id)
+    assert later_sched["lock_disabled"] == 0
+

kryten_webqueue-0.22.0/.github/workflows/python-publish.yml

@@ -1,75 +0,0 @@
-name: Publish Python Package to PyPI
-
-on:
-  workflow_call:
-  release:
-    types: [published]
-  push:
-    tags:
-      - 'kryten-webqueue-v*'
-      - 'v*'
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  release-build:
-    name: Build distribution packages
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-        with:
-          version: "latest"
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Build release distributions
-        run: |
-          uv build
-          echo "📦 Built packages:"
-          ls -lh dist/
-
-      - name: Upload distributions
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-dists
-          path: dist/
-
-  pypi-publish:
-    name: Publish to PyPI
-    runs-on: ubuntu-latest
-    needs:
-      - release-build
-    environment:
-      name: pypi
-    permissions:
-      id-token: write
-
-    steps:
-      - name: Retrieve release distributions
-        uses: actions/download-artifact@v4
-        with:
-          name: release-dists
-          path: dist/
-
-      - name: Publish release distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          packages-dir: dist/
-          skip-existing: true
-          attestations: false
-
-      - name: Success notification
-        if: success()
-        run: |
-          echo "✅ Successfully published to PyPI!"
-          echo "🔗 Package URL: https://pypi.org/project/kryten-webqueue/"