fix(update): treat a timed paidAccess gate with no recorded end as active

CivitAI only returns a non-null paidAccess for an *active* gate: a lapsed gate
stays in the database as a tombstone and is filtered out server-side, so
{"permanent": false, "endsAt": null} — a timed gate whose window end has not
been recorded yet — is still enforced. Verified live: on model 1802980 that
version reports canDownload: false while its lapsed siblings report true.

Both the update service and the download gate dropped that shape, so such
versions read as free and "Hide Early Access Updates" missed them — the class
of bug reported in #1060.

The interpretation now lives in py/utils/paid_access.py and is shared, so the
badge, the update filter and the download warning cannot disagree.

py/services/download_manager.py

@@ -33,6 +33,13 @@ from ..utils.constants import (
     VALID_OTHER_CIVITAI_TYPES,
 )
 from ..utils.civitai_utils import normalize_civitai_download_url, rewrite_preview_url
+from ..utils.paid_access import (
+    is_early_access_deadline_active,
+    is_gate_active,
+    is_permanent_paid,
+    normalize_paid_access,
+    parse_civitai_timestamp,
+)
 from ..utils.file_utils import calculate_sha256, calculate_autov3
 from ..utils.preview_selection import resolve_mature_threshold, select_preview_media
 from ..utils.utils import calculate_filename_for_model, sanitize_folder_name
@@ -1985,40 +1992,32 @@ class DownloadManager:
                 os.makedirs(save_dir, exist_ok=True)
 
             # Check if this is a paid or early access model
-            paid_access = version_info.get("paidAccess")
-            if isinstance(paid_access, str):
-                # Some providers (e.g. CivArchive fallback) carry the DTO as JSON text
-                try:
-                    parsed = json.loads(paid_access)
-                    paid_access = parsed if isinstance(parsed, dict) else None
-                except (TypeError, ValueError):
-                    paid_access = None
-            if not isinstance(paid_access, dict):
-                paid_access = None
-            # An empty DTO ({"permanent": false, "endsAt": null}) is not a gate
-            if paid_access and not paid_access.get("permanent") and not paid_access.get("endsAt"):
-                paid_access = None
-            if version_info.get("earlyAccessEndsAt") or paid_access:
-                permanent_paid = bool(paid_access.get("permanent")) if paid_access else False
+            # CivitAI reports a non-null paidAccess only for an ACTIVE gate, so
+            # {"permanent": false, "endsAt": null} (a timed gate whose end is not
+            # recorded yet) still counts as gated here.
+            paid_access = normalize_paid_access(version_info.get("paidAccess"))
+            legacy_ea_ends_at = version_info.get("earlyAccessEndsAt")
+            gate_active = is_gate_active(paid_access) or is_early_access_deadline_active(
+                legacy_ea_ends_at
+            )
+            if gate_active:
+                permanent_paid = is_permanent_paid(paid_access)
                 if permanent_paid:
                     early_access_msg = (
                         "This model requires payment. Please ensure you have "
                         "purchased access and are logged in to Civitai."
                     )
                 else:
-                    early_access_date = version_info.get("earlyAccessEndsAt")
+                    early_access_date = legacy_ea_ends_at
                     if not early_access_date and paid_access:
                         early_access_date = paid_access.get("endsAt")
                     if not early_access_date:
                         early_access_date = ""
                     # Convert to a readable date if possible
                     try:
-                        from datetime import datetime
-
-                        date_obj = datetime.fromisoformat(
-                            early_access_date.replace("Z", "+00:00")
-                        )
-                        formatted_date = date_obj.strftime("%Y-%m-%d")
+                        formatted_date = parse_civitai_timestamp(
+                            early_access_date
+                        ).strftime("%Y-%m-%d")
                         early_access_msg = (
                             f"This model requires payment (until {formatted_date}). "
                         )

py/services/model_update_service.py

@@ -20,6 +20,10 @@ from .settings_manager import get_settings_manager
 from ..utils.cache_paths import CacheType, resolve_cache_path_with_migration
 from ..utils.constants import MODEL_WEIGHT_FILE_TYPES
 from ..utils.civitai_utils import rewrite_preview_url
+from ..utils.paid_access import (
+    is_early_access_deadline_active,
+    normalize_paid_access as _normalize_paid_access_payload,
+)
 from ..utils.preview_selection import resolve_mature_threshold, select_preview_media
 
 logger = logging.getLogger(__name__)
@@ -172,16 +176,10 @@ class ModelUpdateRecord:
         if version.is_paid and not version.early_access_ends_at:
             return False
 
-        # Phase 2: Precise check with exact end time
+        # Phase 2: Precise check with exact end time (None when the gate is timed
+        # but its window end has not been recorded yet -> treated as active below)
         if version.early_access_ends_at:
-            try:
-                ea_date = datetime.fromisoformat(
-                    version.early_access_ends_at.replace("Z", "+00:00")
-                )
-                return ea_date > datetime.now(timezone.utc)
-            except (ValueError, AttributeError):
-                # If date parsing fails, treat as active EA (conservative)
-                return True
+            return is_early_access_deadline_active(version.early_access_ends_at)
 
         # Phase 1: Basic EA flag from bulk API
         return version.is_early_access
@@ -1762,6 +1760,9 @@ class ModelUpdateService:
 
         # CivitAI's paidAccess DTO ({"permanent": bool, "endsAt": ISO|null})
         # gates versions behind a paid tier while availability stays "Public".
+        # A non-null DTO from the public API is always an ACTIVE gate: lapsed
+        # (tombstone) gates come back as null. That includes the timed gate whose
+        # end is not recorded yet, {"permanent": false, "endsAt": null}.
         paid_access = self._normalize_paid_access(entry.get("paidAccess"))
         paid_access_json = json.dumps(paid_access) if paid_access else None
         is_paid = bool(paid_access.get("permanent")) if paid_access else False
@@ -1769,7 +1770,7 @@ class ModelUpdateService:
             early_access_ends_at = _normalize_string(paid_access.get("endsAt"))
         # Only timed gates are early access; permanent paid versions are not
         # (consumers filter them via is_paid), so the stored flag stays accurate.
-        if not is_early_access and paid_access and paid_access.get("endsAt"):
+        if not is_early_access and paid_access and not paid_access.get("permanent"):
             is_early_access = True
 
         return ModelVersionRecord(
@@ -1797,24 +1798,12 @@ class ModelUpdateService:
         Accepts a dict, None, or a JSON string (as carried by the by-hash
         enrichment path) and returns ``{"permanent": bool, "endsAt": str|None}``
         or None when the input carries no paid-access signal.
+
+        Delegates to :mod:`py.utils.paid_access` so the update service and the
+        download gate cannot disagree about what counts as a gate.
         """
-        if value is None:
-            return None
-        if isinstance(value, str):
-            try:
-                parsed = json.loads(value)
-            except (TypeError, ValueError):
-                return None
-            if not isinstance(parsed, dict):
-                return None
-            value = parsed
-        if not isinstance(value, Mapping):
-            return None
-        permanent = bool(value.get("permanent"))
-        ends_at = _normalize_string(value.get("endsAt"))
-        if not permanent and ends_at is None:
-            return None
-        return {"permanent": permanent, "endsAt": ends_at}
+
+        return _normalize_paid_access_payload(value)
 
     @staticmethod
     def _extract_file_count(files) -> Optional[int]: