From 8fad2b859e5998b188e63463a0cacf678a43cd02 Mon Sep 17 00:00:00 2001
From: TallblokeUK <markanthonyharris@pm.me>
Date: Thu, 27 Aug 2026 09:01:32 +0100
Subject: [PATCH] fix: send snippet modification dates with a UTC offset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Modified column showed recently saved snippets in the future — six
hours ahead on a UTC-6 site, and by whatever the offset happens to be
elsewhere.

`Snippet::update_modified()` writes `gmdate( 'Y-m-d H:i:s' )`, so the
stored value is UTC but carries no offset. Both paths that hand snippets
to the browser passed it through verbatim: the REST response, whose
schema already declares `'format' => 'date-time'`, and the inline
`snippetsList` payload on the manage screen. The table then calls
`humanTimeDiff( snippet.modified )`, and an offset-less string is read as
local time, putting every recent snippet ahead of now.

`Snippet::get_modified_iso()` returns the same instant as ISO 8601 with
an explicit offset, reusing the existing UTC-aware
`get_modified_timestamp()`. Both output paths now send that, which also
makes the `<time datetime="...">` attribute valid where it previously
was not. The stored format is untouched, so nothing about how dates are
written or compared changes.

Verified against a reproduction of the reported environment — WordPress
7.0.4, PHP 8.2.33, 3.10.0, 190 snippets, site at UTC-6. The Modified
cell went from "6 hours from now" to "21 minutes ago", with the
datetime attribute changing from "2026-08-27 07:35:20" to
"2026-08-27T07:35:20+00:00".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../Admin/Menus/Manage/Manage_Menu_Assets.php |  3 ++
 src/php/Model/Snippet.php                     | 18 ++++++++++
 .../Snippets/Snippets_REST_Controller.php     |  4 +++
 tests/unit/Model/Snippet_Test.php             | 36 +++++++++++++++++++
 4 files changed, 61 insertions(+)

diff --git a/src/php/Admin/Menus/Manage/Manage_Menu_Assets.php b/src/php/Admin/Menus/Manage/Manage_Menu_Assets.php
index be1ebac7f..3d4f2eec2 100644
--- a/src/php/Admin/Menus/Manage/Manage_Menu_Assets.php
+++ b/src/php/Admin/Menus/Manage/Manage_Menu_Assets.php
@@ -111,6 +111,9 @@ public function enqueue( array $script_dependencies, array $style_dependencies )
 				function ( Snippet $snippet ) {
 					$fields = $snippet->get_fields();
 					$fields['code'] = '';
+					// Match the REST response: a UTC value with no offset is read
+					// as local time by the browser.
+					$fields['modified'] = $snippet->modified_iso;
 					return $fields;
 				},
 				get_snippets()
diff --git a/src/php/Model/Snippet.php b/src/php/Model/Snippet.php
index 95a166577..f74cd9ceb 100644
--- a/src/php/Model/Snippet.php
+++ b/src/php/Model/Snippet.php
@@ -463,6 +463,24 @@ protected function get_modified_timestamp(): int {
 		return $datetime ? $datetime->getTimestamp() : 0;
 	}
 
+	/**
+	 * Retrieve the modification date as an ISO 8601 string, including the UTC
+	 * offset.
+	 *
+	 * `$modified` is stored as 'Y-m-d H:i:s' in UTC, which carries no offset, so
+	 * anything parsing it — a browser, in particular — is free to read it as
+	 * local time and land the snippet hours away from when it was really saved.
+	 * This is the form to hand to clients.
+	 *
+	 * @return string|null ISO 8601 date, or null if no modification date is set.
+	 * @noinspection PhpUnused
+	 */
+	protected function get_modified_iso(): ?string {
+		$timestamp = $this->get_modified_timestamp();
+
+		return $timestamp ? gmdate( 'c', $timestamp ) : null;
+	}
+
 	/**
 	 * Retrieve the modification time in the local timezone.
 	 *
diff --git a/src/php/REST_API/Snippets/Snippets_REST_Controller.php b/src/php/REST_API/Snippets/Snippets_REST_Controller.php
index 1f925ce45..c1b8ff455 100644
--- a/src/php/REST_API/Snippets/Snippets_REST_Controller.php
+++ b/src/php/REST_API/Snippets/Snippets_REST_Controller.php
@@ -826,6 +826,10 @@ public function prepare_item_for_response( $item, $request ) {
 			$response[ $property ] = $item->$property;
 		}
 
+		// The schema declares this as a date-time, so send one: the stored value
+		// is UTC without an offset, which clients read as local time.
+		$response['modified'] = $item->modified_iso;
+
 		return rest_ensure_response( $response );
 	}
 
diff --git a/tests/unit/Model/Snippet_Test.php b/tests/unit/Model/Snippet_Test.php
index b611f675b..326b35182 100644
--- a/tests/unit/Model/Snippet_Test.php
+++ b/tests/unit/Model/Snippet_Test.php
@@ -30,4 +30,40 @@ public function test_description_round_trips_without_sanitization(): void {
 
 		$this->assertSame( $description, $snippet->desc );
 	}
+
+	/**
+	 * The modification date is exposed to clients with an explicit UTC offset.
+	 *
+	 * Stored as 'Y-m-d H:i:s' in UTC, the raw value carries no offset, so a
+	 * browser reads it as local time and shows a snippet saved moments ago as
+	 * hours into the future on any site behind UTC.
+	 *
+	 * @return void
+	 */
+	public function test_modified_is_exposed_as_iso_8601_utc(): void {
+		$snippet = new Snippet(
+            [
+				'name' => 'Timezone',
+				'modified' => '2026-08-27 07:35:20',
+			]
+        );
+
+		$this->assertSame( '2026-08-27T07:35:20+00:00', $snippet->modified_iso );
+		$this->assertNotSame(
+			$snippet->modified,
+			$snippet->modified_iso,
+			'the stored value has no offset, so it must not be handed to clients as-is'
+		);
+	}
+
+	/**
+	 * A snippet with no modification date exposes null rather than an epoch date.
+	 *
+	 * @return void
+	 */
+	public function test_modified_iso_is_null_when_unset(): void {
+		$snippet = new Snippet( [ 'name' => 'Never modified' ] );
+
+		$this->assertNull( $snippet->modified_iso );
+	}
 }