fix: two runtime bugs flagged by flake8 (NameError in auth, UnboundLocalError in timer)

[MacJediWizard]

Summary

Two genuine runtime bugs in v5.5.2. flake8 already flags them (F821, F823) — they're not stylistic.

Bug 1 — app/routes/auth.py:620 — NameError: datetime

current_user.two_factor_confirmed_at = datetime.utcnow() references datetime without importing it. The 2FA confirmation route raises NameError: name 'datetime' is not defined whenever a user finalises 2FA setup.

# Top of file (existing imports — none of them brings in datetime)
from flask import (...)
from flask_babel import gettext as _
from flask_login import current_user, login_required, login_user, logout_user
from app import db, limiter, log_event, oauth, track_event

flake8: app/routes/auth.py:620:52: F821 undefined name 'datetime'

Fix: add from datetime import datetime to the import block.

Bug 2 — app/routes/timer.py — UnboundLocalError on _

Module level:

from flask_babel import gettext as _

Four functions then unpack:

can_start, _ = TimeTrackingService().can_start_timer(current_user.id)

at lines 175, 339, 453, 2022. Python's scoping promotes _ to a function-local for the entire enclosing scope, shadowing the imported translation function. Three flash(_("...")) calls in those functions sit BEFORE the local assignment (lines 171, 449, 2019) and now reference an uninitialised local — UnboundLocalError at runtime.

flake8:

app/routes/timer.py:171:15: F823 local variable '_' defined in enclosing scope on line 5 referenced before assignment
app/routes/timer.py:449:15: F823 local variable '_' defined in enclosing scope on line 5 referenced before assignment
app/routes/timer.py:2019:15: F823 local variable '_' defined in enclosing scope on line 5 referenced before assignment

Fix: rename the throwaway slot from _ to _unused in all four can_start_timer unpackings. The three previously-broken flash(_("...")) calls now resolve the translation alias as intended.

Reproduction

• Bug 1: enable 2FA on a user, complete the verification step → 500 with NameError.
• Bug 2: trigger any of the three timer paths under the conditions where the access check fires (start timer with no project access; start timer GET path with no access; resume another user's timer) → 500 with UnboundLocalError.

Diff size

app/routes/auth.py  | 2 ++
app/routes/timer.py | 8 ++++----
2 files changed, 6 insertions(+), 4 deletions(-)

No behavioural change beyond bug elimination. Tested against v5.5.2.

[evilguy4000]

@MacJediWizard Can you change the branch to develop?