fix: distinguish repository publication and settings dates

src/server/routes/repository-private.ts

@@ -173,8 +173,10 @@ router.post(
       const reactivating = repo.status === RepositoryStatus.EXPIRED;
       const updates: Record<string, Date> = {
         "options.expirationDate": newExpiration,
+        settingsSavedAt: new Date(),
       };
       repo.model.options.expirationDate = newExpiration;
+      repo.model.settingsSavedAt = updates.settingsSavedAt;
       if (reactivating) {
         repo.model.anonymizeDate = new Date();
         updates.anonymizeDate = repo.model.anonymizeDate;
@@ -572,6 +574,7 @@ router.post(
         { _id: repo.model._id, "githubAccess.revision": previousAccessRevision || { $exists: false } },
         {
           $set: {
+            settingsSavedAt: new Date(),
             options: repo.model.options,
             source: repo.model.source,
             githubAccess: repo.model.githubAccess,
@@ -647,6 +650,7 @@ router.post("/", async (req, res) => {
     const repo = new AnonymizedRepositoryModel();
     repo.repoId = repoUpdate.repoId;
     repo.anonymizeDate = new Date();
+    repo.settingsSavedAt = repo.anonymizeDate;
     repo.owner = user.id;
     repo.githubAccess = selectedAccess.binding;
 

src/server/routes/repository-public.ts

@@ -385,9 +385,15 @@ router.get(
       res.json({
         url: redirectURL,
         download: download || user?.isAdmin === true,
-        lastUpdateDate: repo.model.source.commitDate
-          ? repo.model.source.commitDate
-          : repo.model.anonymizeDate,
+        // Source commits can predate publication by months and do not record
+        // changes to anonymization settings or expiration.
+        lastUpdateDate: new Date(Math.max(...[
+          repo.model.anonymizeDate, repo.model.settingsSavedAt, repo.model.publishedAt,
+        ].filter((date): date is Date => !!date).map(date => new Date(date).getTime()))),
+        anonymizedAt: repo.model.anonymizeDate,
+        sourceCommitDate: repo.model.source.commitDate,
+        settingsSavedAt: repo.model.settingsSavedAt,
+        publishedAt: repo.model.publishedAt,
         isAdmin: user?.isAdmin === true,
         isOwner: user?.id == repo.model.owner,
         hasWebsite: !!repo.options.page && !!repo.options.pageSource,