fix(extensions): preserve config mtime on keep-config restore (mirror copy2)

Per review: the restore comment claimed it mirrors shutil.copy2 (mode +
mtime) but only restored permission bits. Capture and re-apply the
original atime/mtime via os.utime alongside the mode, so the keep-config
leftover restore truly matches copy2's timestamp preservation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jawwad-ali

src/specify_cli/extensions/__init__.py

@@ -1404,11 +1404,12 @@ def install_from_directory(
         # preserved configs and the backup-restore path never runs. Capture
         # them here and write them back after the fresh copytree, mirroring
         # the *-config filter the --force restore path uses.
-        # Capture (bytes, mode) so we can restore permissions too — config
-        # files may hold secrets (API keys), and recreating them with default
-        # perms could widen access. Mirrors the --force restore's shutil.copy2
-        # (which preserves mode/mtime).
-        preserved_configs: dict[str, tuple[bytes, int]] = {}
+        # Capture (bytes, mode, atime, mtime) so restore preserves both
+        # permissions and timestamps — truly mirroring the --force restore's
+        # shutil.copy2 (which preserves mode/mtime). Config files may hold
+        # secrets (API keys); recreating them with default perms could widen
+        # access.
+        preserved_configs: dict[str, tuple[bytes, int, float, float]] = {}
         if dest_dir.exists():
             for cfg_file in dest_dir.iterdir():
                 if (
@@ -1419,9 +1420,12 @@ def install_from_directory(
                         or cfg_file.name.endswith("-config.local.yml")
                     )
                 ):
+                    st = cfg_file.stat()
                     preserved_configs[cfg_file.name] = (
                         cfg_file.read_bytes(),
-                        cfg_file.stat().st_mode,
+                        st.st_mode,
+                        st.st_atime,
+                        st.st_mtime,
                     )
 
         # Install extension (dest_dir computed above during self-install guard)
@@ -1432,14 +1436,15 @@ def install_from_directory(
         shutil.copytree(source_dir, dest_dir, ignore=ignore_fn)
 
         # Restore configs preserved from a keep-config leftover (see above),
-        # preserving the original file mode. The --force backup-restore below
-        # (did_remove) still takes precedence for that path, which uses
-        # .backup/ rather than an in-place leftover.
-        for name, (data, mode) in preserved_configs.items():
+        # preserving the original file mode and timestamps. The --force
+        # backup-restore below (did_remove) still takes precedence for that
+        # path, which uses .backup/ rather than an in-place leftover.
+        for name, (data, mode, atime, mtime) in preserved_configs.items():
             dest_cfg = dest_dir / name
             dest_cfg.write_bytes(data)
             try:
                 os.chmod(dest_cfg, mode & 0o7777)  # permission bits only
+                os.utime(dest_cfg, (atime, mtime))  # and timestamps
             except OSError:
                 pass
 

tests/test_extensions.py

@@ -1571,6 +1571,9 @@ def test_reinstall_preserves_keep_config_leftover(self, extension_dir, project_d
         # Restrictive perms — a config may hold secrets; the restore must not
         # widen them (POSIX only; Windows chmod ignores group/other bits).
         config_file.chmod(0o600)
+        # Distinctive mtime to prove timestamps survive too (mirrors copy2).
+        old_mtime = 1_600_000_000
+        os.utime(config_file, (old_mtime, old_mtime))
 
         # keep-config removal: registry entry dropped, config left in place.
         assert manager.remove("test-ext", keep_config=True) is True
@@ -1582,7 +1585,9 @@ def test_reinstall_preserves_keep_config_leftover(self, extension_dir, project_d
         # The user's config must survive the reinstall (was silently wiped).
         assert config_file.exists()
         assert "MY-CUSTOMIZED-VALUE" in config_file.read_text()
-        # ...and keep its original (restrictive) mode, not default perms.
+        # ...and keep its original mtime (copy2-style timestamp preservation).
+        assert config_file.stat().st_mtime == old_mtime
+        # ...and its original (restrictive) mode, not default perms.
         if platform.system() != "Windows":
             assert config_file.stat().st_mode & 0o777 == 0o600