fix: docker build and auto-fix timing issues (clamp last scanned to

prevent future times)

Author: brambora69123

packages/api/Dockerfile

@@ -8,16 +8,18 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends pkg-config libssl-dev && \
     rm -rf /var/lib/apt/lists/*
 
-# Copy workspace files
+# Copy workspace files (all members for workspace resolution)
 COPY Cargo.toml ./
 COPY packages/shared/Cargo.toml packages/shared/
 COPY packages/api/Cargo.toml packages/api/
+COPY packages/scanner/Cargo.toml packages/scanner/
 COPY migration/Cargo.toml migration/
 
 # Create stub files for dependency resolution
-RUN mkdir -p packages/shared/src packages/api/src migration/src && \
+RUN mkdir -p packages/shared/src packages/api/src packages/scanner/src migration/src && \
     echo "pub fn main() {}" > packages/shared/src/lib.rs && \
     echo "fn main() {}" > packages/api/src/main.rs && \
+    echo "fn main() {}" > packages/scanner/src/main.rs && \
     echo "pub fn main() {}" > migration/src/lib.rs
 
 # Build dependencies (cached layer)
@@ -26,6 +28,7 @@ RUN cargo fetch
 # Copy actual source code
 COPY packages/shared/src packages/shared/src
 COPY packages/api/src packages/api/src
+COPY packages/scanner/src packages/scanner/src
 COPY migration/src migration/src
 
 # Build API service

packages/scanner/Dockerfile

@@ -8,15 +8,17 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends pkg-config libssl-dev && \
     rm -rf /var/lib/apt/lists/*
 
-# Copy workspace files
+# Copy workspace files (all members for workspace resolution)
 COPY Cargo.toml ./
 COPY packages/shared/Cargo.toml packages/shared/
+COPY packages/api/Cargo.toml packages/api/
 COPY packages/scanner/Cargo.toml packages/scanner/
 COPY migration/Cargo.toml migration/
 
 # Create stub files for dependency resolution
-RUN mkdir -p packages/shared/src packages/scanner/src migration/src && \
+RUN mkdir -p packages/shared/src packages/api/src packages/scanner/src migration/src && \
     echo "pub fn main() {}" > packages/shared/src/lib.rs && \
+    echo "fn main() {}" > packages/api/src/main.rs && \
     echo "fn main() {}" > packages/scanner/src/main.rs && \
     echo "pub fn main() {}" > migration/src/lib.rs
 
@@ -25,6 +27,7 @@ RUN cargo fetch
 
 # Copy actual source code
 COPY packages/shared/src packages/shared/src
+COPY packages/api/src packages/api/src
 COPY packages/scanner/src packages/scanner/src
 COPY migration/src migration/src
 

packages/shared/src/repositories/asns.rs

@@ -194,7 +194,8 @@ impl AsnRepository {
                 FROM asn_ranges r
                 JOIN asns a ON r.asn = a.asn
                 WHERE a.category = '{}'
-                  AND (r.last_scanned_at IS NULL 
+                  AND (r.last_scanned_at IS NULL
+                       OR r.last_scanned_at > NOW()  -- future timestamps: treat as eligible
                        OR r.last_scanned_at < NOW() - INTERVAL '{} HOURS')
                 ORDER BY
                     r.last_scanned_at ASC NULLS FIRST,

packages/shared/src/services/scheduler.rs

@@ -432,10 +432,16 @@ impl Scheduler {
             // If the range is exhausted, check if enough time has passed before resetting.
             // This prevents the same IPs from being rescanned immediately after epoch reset.
             if current_offset >= total_ips {
-                // Check cooldown: only reset if enough time has passed since last scan
+                // SAFETY: Clamp future timestamps to "now" to prevent permanent cooldown stalls
+                // (e.g. from clock drift, manual DB edits, or timezone bugs).
+                // If last_scanned_at is in the future, treat it as None (never scanned = always eligible).
                 let can_reset = range.last_scanned_at.map_or(true, |last_scan| {
-                    let hours_since = (now - last_scan.and_utc()).num_hours();
-                    hours_since >= min_epoch_hours as i64
+                    if last_scan.and_utc() > now {
+                        true  // future timestamp: treat as never scanned, always eligible
+                    } else {
+                        let hours_since = (now - last_scan.and_utc()).num_hours();
+                        hours_since >= min_epoch_hours as i64
+                    }
                 });
 
                 if can_reset {
@@ -450,13 +456,14 @@ impl Scheduler {
                     );
                 } else {
                     ranges_skipped_cooldown += 1;
+                    let hours_since = range.last_scanned_at.map_or(0, |t| {
+                        if t.and_utc() > now { 0 } else { (now - t.and_utc()).num_hours() }
+                    });
                     tracing::debug!(
                         "Range {} skipped (epoch {}), only {}h since last scan (need {}h)",
                         range.cidr,
                         range.scan_epoch,
-                        range
-                            .last_scanned_at
-                            .map_or(0, |t| (now - t.and_utc()).num_hours()),
+                        hours_since,
                         min_epoch_hours
                     );
                 }