fix: standardize UTC timestamp handling

app/__init__.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import logging
-from datetime import datetime
 
 from flask import Flask, abort, jsonify, request
 
@@ -10,7 +9,7 @@ from .extensions import db, login_manager
 from .models import AppSetting, User
 from .prediction import FEATURES, load_model
 from .security import csrf_token, validate_csrf_token
-from .time_utils import format_datetime_for_timezone
+from .time_utils import current_year_for_timezone, format_datetime_for_timezone
 
 
 def create_app(config_object: type[Config] = Config, *, load_model_on_start: bool = True) -> Flask:
@@ -90,7 +89,7 @@ def register_app_hooks(app: Flask) -> None:
     @app.context_processor
     def inject_helpers():
         def now_year() -> int:
-            return datetime.now().year
+            return current_year_for_timezone(app.config["APP_TIMEZONE"])
 
         def format_datetime(value) -> str:
             return format_datetime_for_timezone(value, app.config["APP_TIMEZONE"])

app/models.py

@@ -1,11 +1,10 @@
 from __future__ import annotations
 
-from datetime import datetime
-
 from flask_login import UserMixin
 from werkzeug.security import check_password_hash, generate_password_hash
 
 from .extensions import db
+from .time_utils import utc_now
 
 
 class User(UserMixin, db.Model):
@@ -15,7 +14,7 @@ class User(UserMixin, db.Model):
     username = db.Column(db.String(100), unique=True, nullable=False)
     password_hash = db.Column(db.String(255), nullable=False)
     is_admin = db.Column(db.Boolean, default=False, nullable=False)
-    created_at = db.Column(db.DateTime, default=datetime.utcnow)
+    created_at = db.Column(db.DateTime, default=utc_now)
 
     def set_password(self, password: str) -> None:
         self.password_hash = generate_password_hash(password)
@@ -33,7 +32,7 @@ class PasswordResetToken(db.Model):
     token_hash = db.Column(db.String(64), unique=True, nullable=False, index=True)
     expires_at = db.Column(db.DateTime, nullable=False)
     used_at = db.Column(db.DateTime)
-    created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
+    created_at = db.Column(db.DateTime, default=utc_now, nullable=False)
 
     user = db.relationship(
         "User",
@@ -52,7 +51,7 @@ class UploadRecord(db.Model):
     saved_path = db.Column(db.String(500), nullable=False)
     prediction_path = db.Column(db.String(500), nullable=False)
     image_path = db.Column(db.String(500), nullable=False)
-    upload_time = db.Column(db.DateTime, default=datetime.utcnow)
+    upload_time = db.Column(db.DateTime, default=utc_now)
 
     user = db.relationship("User", backref=db.backref("uploads", lazy=True))
 
@@ -63,7 +62,7 @@ class AppSetting(db.Model):
     id = db.Column(db.Integer, primary_key=True)
     key = db.Column(db.String(100), unique=True, nullable=False)
     value = db.Column(db.String(255), nullable=False)
-    updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
+    updated_at = db.Column(db.DateTime, default=utc_now, onupdate=utc_now)
 
     @classmethod
     def get_bool(cls, key: str, default: bool = False) -> bool:

app/prediction.py

@@ -4,7 +4,6 @@ import logging
 import os
 import uuid
 from dataclasses import dataclass
-from datetime import datetime
 from pathlib import Path
 from typing import Any
 
@@ -20,6 +19,7 @@ from werkzeug.datastructures import FileStorage
 from werkzeug.utils import secure_filename
 
 from .config import IMAGE_DIR, UPLOAD_DIR
+from .time_utils import utc_now
 
 CHINESE_FONT_CANDIDATES = [
     "Noto Sans CJK SC",
@@ -386,7 +386,7 @@ def run_prediction(uploaded: FileStorage, user_id: int, model) -> PredictionArti
     if not original_filename:
         raise PredictionError("未选择文件")
 
-    timestamp = datetime.now().strftime("%Y%m%d%H%M%S")
+    timestamp = utc_now().strftime("%Y%m%d%H%M%S")
     run_id = f"{timestamp}_{uuid.uuid4().hex[:8]}"
     saved_filename, suffix = secure_upload_name(original_filename, run_id)
 

app/routes.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import os
 import hashlib
 import secrets
-from datetime import datetime, timedelta
+from datetime import timedelta
 
 from flask import (
     Blueprint,
@@ -26,7 +26,7 @@ from .extensions import db
 from .models import AppSetting, PasswordResetToken, UploadRecord, User
 from .prediction import PredictionError, run_prediction
 from .security import new_captcha
-from .time_utils import format_datetime_for_timezone
+from .time_utils import format_datetime_for_timezone, utc_now
 
 bp = Blueprint("main", __name__)
 REFERENCE_PDF_NAME = "20260630标准文本——供水管道健康状态与剩余寿命评估技术导则.pdf"
@@ -60,7 +60,7 @@ def password_reset_token_hash(token: str) -> str:
 
 def password_reset_expiry() -> datetime:
     minutes = max(int(current_app.config["PASSWORD_RESET_TOKEN_MINUTES"]), 1)
-    return datetime.utcnow() + timedelta(minutes=minutes)
+    return utc_now() + timedelta(minutes=minutes)
 
 
 def format_app_datetime(value: datetime | None) -> str:
@@ -74,7 +74,7 @@ def active_password_reset_token(token: str) -> PasswordResetToken | None:
     if (
         reset_token is None
         or reset_token.used_at is not None
-        or reset_token.expires_at <= datetime.utcnow()
+        or reset_token.expires_at <= utc_now()
     ):
         return None
     return reset_token
@@ -137,7 +137,7 @@ def prediction_result_payload(artifacts, record: UploadRecord) -> dict:
     )
     return {
         "original_filename": artifacts.original_filename,
-        "generated_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+        "generated_at": format_app_datetime(record.upload_time),
         "image_url": image_url,
         "importance_url": importance_url,
         "excel_url": url_for("main.download_file", record_id=record.id, file_type="prediction"),
@@ -238,7 +238,7 @@ def password_reset(token: str):
         ), 400
 
     reset_token.user.set_password(password)
-    reset_token.used_at = datetime.utcnow()
+    reset_token.used_at = utc_now()
     db.session.commit()
     flash("密码已重置，请使用新密码登录", "info")
     return render_auth_template("login", captcha=refresh_captcha())
@@ -326,7 +326,7 @@ def create_password_reset_link(user_id: int):
     if user.is_admin:
         return jsonify({"error": "管理员账号不支持通过此入口重置密码"}), 403
 
-    now = datetime.utcnow()
+    now = utc_now()
     PasswordResetToken.query.filter_by(user_id=user.id, used_at=None).update(
         {"used_at": now}
     )

app/time_utils.py

@@ -5,6 +5,15 @@ from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
 
 DEFAULT_TIMEZONE = "Asia/Shanghai"
+DATETIME_DISPLAY_FORMAT = "%Y-%m-%d %H:%M:%S"
+
+
+def utc_now() -> datetime:
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
+def current_year_for_timezone(timezone_name: str | None) -> int:
+    return datetime.now(timezone.utc).astimezone(timezone_for_name(timezone_name)).year
 
 
 def timezone_for_name(name: str | None) -> ZoneInfo:
@@ -19,4 +28,4 @@ def format_datetime_for_timezone(value: datetime | None, timezone_name: str | No
         return "-"
     if value.tzinfo is None:
         value = value.replace(tzinfo=timezone.utc)
-    return value.astimezone(timezone_for_name(timezone_name)).strftime("%Y-%m-%d %H:%M:%S")
+    return value.astimezone(timezone_for_name(timezone_name)).strftime(DATETIME_DISPLAY_FORMAT)