fix: reject naive datetime params; require timezone-aware

_format_datetime_iso8601 silently stamped naive datetimes with +00:00
(UTC). That hides real bugs in callers that used datetime.now() or
utcnow() in a local-time context — the value goes into the database as
a different instant than intended.

Raise EncodeError on naive datetime and hint at the fix
(datetime.now(datetime.UTC) / dt.replace(tzinfo=datetime.UTC)). Update
the tests that exercised the previous UTC-assumption behaviour to pass
aware datetimes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: antoineleclair

src/dqlitewire/types.py

@@ -213,21 +213,26 @@ def _format_datetime_iso8601(value: datetime.datetime) -> str:
       ``.1`` which was ambiguous between ``0.1 s`` and ``100000 µs`` to
       lenient parsers and broke direct string equality with
       ``datetime.isoformat(" ")``.
+    - Naive datetimes (tzinfo is None) are rejected: silently assuming UTC
+      hides real bugs in callers that used ``datetime.now()``/``utcnow()``
+      in a local-time context.
     """
+    if value.tzinfo is None:
+        raise EncodeError(
+            "Naive datetime has no timezone; pass an aware datetime "
+            "(e.g. datetime.now(datetime.UTC) or "
+            "dt.replace(tzinfo=datetime.UTC))."
+        )
     formatted = f"{value.year:04d}" + value.strftime("-%m-%d %H:%M:%S")
     if value.microsecond:
         formatted += f".{value.microsecond:06d}"
     utcoffset = value.utcoffset()
-    if utcoffset is not None:
-        total_seconds = int(utcoffset.total_seconds())
-        sign = "+" if total_seconds >= 0 else "-"
-        hours, remainder = divmod(abs(total_seconds), 3600)
-        minutes = remainder // 60
-        formatted += f"{sign}{hours:02d}:{minutes:02d}"
-    else:
-        # Naive datetime: assume UTC to match Go's always-offset format.
-        # (See #137 for a separate branch that rejects naive instead.)
-        formatted += "+00:00"
+    assert utcoffset is not None  # noqa: S101 - guarded above
+    total_seconds = int(utcoffset.total_seconds())
+    sign = "+" if total_seconds >= 0 else "-"
+    hours, remainder = divmod(abs(total_seconds), 3600)
+    minutes = remainder // 60
+    formatted += f"{sign}{hours:02d}:{minutes:02d}"
     return formatted
 
 

tests/test_types.py

@@ -682,11 +682,11 @@ def test_datetime_auto_detection(self) -> None:
         assert decoded.hour == 10
         assert decoded.second == 45
 
-    def test_naive_datetime_includes_utc_offset(self) -> None:
-        """Naive datetime should include +00:00 offset to match Go's format."""
-        from datetime import datetime
+    def test_aware_utc_datetime_includes_offset(self) -> None:
+        """Aware UTC datetime should include +00:00 offset to match Go's format."""
+        from datetime import UTC, datetime
 
-        dt = datetime(2024, 1, 15, 10, 30, 45)  # naive, no tzinfo
+        dt = datetime(2024, 1, 15, 10, 30, 45, tzinfo=UTC)
         encoded, vtype = encode_value(dt)
         assert vtype == ValueType.ISO8601
         # Check the raw encoded text contains +00:00
@@ -885,35 +885,28 @@ def test_encode_value_false_as_explicit_integer(self) -> None:
 class TestNaiveDatetimeISO8601:
     """166: naive datetime 'assume UTC' fallback path is untested."""
 
-    def test_naive_datetime_assumes_utc(self) -> None:
-        """Naive datetime is encoded as UTC (+00:00)."""
+    def test_naive_datetime_raises(self) -> None:
+        """Naive datetime params are rejected (no silent UTC assumption)."""
         import datetime
 
         naive = datetime.datetime(2024, 6, 15, 12, 30, 45)  # noqa: DTZ001
-        encoded, vtype = encode_value(naive, ValueType.ISO8601)
-        assert vtype == ValueType.ISO8601
-        decoded, _ = decode_value(encoded, ValueType.ISO8601)
-        assert decoded.utcoffset() == datetime.timedelta(0)
-        assert decoded.year == 2024
-        assert decoded.month == 6
-        assert decoded.hour == 12
+        with pytest.raises(EncodeError, match="[Nn]aive"):
+            encode_value(naive, ValueType.ISO8601)
 
-    def test_naive_datetime_with_microseconds(self) -> None:
-        """Naive datetime with fractional seconds encodes correctly."""
+    def test_aware_utc_datetime_with_microseconds(self) -> None:
+        """Aware UTC datetime with fractional seconds encodes correctly."""
         import datetime
 
-        naive = datetime.datetime(2024, 1, 1, 0, 0, 0, 123456)  # noqa: DTZ001
-        encoded, _ = encode_value(naive, ValueType.ISO8601)
+        dt = datetime.datetime(2024, 1, 1, 0, 0, 0, 123456, tzinfo=datetime.UTC)
+        encoded, _ = encode_value(dt, ValueType.ISO8601)
         decoded, _ = decode_value(encoded, ValueType.ISO8601)
         assert decoded.microsecond == 123456
 
-    def test_naive_datetime_roundtrip_becomes_aware(self) -> None:
-        """Naive datetime round-trips as timezone-aware UTC."""
+    def test_utc_datetime_roundtrips(self) -> None:
+        """Aware UTC datetime round-trips as timezone-aware UTC."""
         import datetime
 
-        naive = datetime.datetime(2024, 6, 15, 12, 30, 45)  # noqa: DTZ001
-        assert naive.tzinfo is None
-        encoded, _ = encode_value(naive, ValueType.ISO8601)
+        dt = datetime.datetime(2024, 6, 15, 12, 30, 45, tzinfo=datetime.UTC)
+        encoded, _ = encode_value(dt, ValueType.ISO8601)
         decoded, _ = decode_value(encoded, ValueType.ISO8601)
-        assert decoded.tzinfo is not None
-        assert decoded.replace(tzinfo=None) == naive
+        assert decoded == dt