feat(datetime): resolve datetime TODOs

Introduce shim functions and constants, replacing the ad-hoc chrono
format strings and parse helpers used as phase-b placeholders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

3 files changed, 11 insertions, 25 deletions

diff --git a/crates/shirabe/src/advisory/auditor.rs b/crates/shirabe/src/advisory/auditor.rs
index 179278a..2b71237 100644
--- a/crates/shirabe/src/advisory/auditor.rs
+++ b/crates/shirabe/src/advisory/auditor.rs
@@ -6,8 +6,8 @@ use indexmap::IndexMap;
 use shirabe_external_packages::composer::pcre::Preg;
 use shirabe_external_packages::symfony::console::formatter::OutputFormatter;
 use shirabe_php_shim::{
-    InvalidArgumentException, PhpMixed, array_all, array_any, array_key_exists, array_keys,
-    array_reduce, get_class, sprintf, str_starts_with,
+    DATE_ATOM, InvalidArgumentException, PhpMixed, array_all, array_any, array_key_exists,
+    array_keys, array_reduce, get_class, sprintf, str_starts_with,
 };
 
 use crate::advisory::AnySecurityAdvisory;
@@ -464,11 +464,7 @@ impl Auditor {
                     sa.title.clone(),
                     self.get_url(sa),
                     sa.affected_versions().get_pretty_string(),
-                    // TODO(phase-b): PHP uses `$advisory->reportedAt->format(DATE_ATOM)`, but
-                    // shim DATE_ATOM ("Y-m-d\TH:i:sP") is a PHP format string incompatible with
-                    // chrono. Using the chrono equivalent directly; revisit once a PHP-style date
-                    // formatter exists (see also locker.rs DATE_RFC3339).
-                    sa.reported_at.format("%Y-%m-%dT%H:%M:%S%:z").to_string(),
+                    sa.reported_at.format(DATE_ATOM).to_string(),
                 ];
                 if let Some(ignored) = advisory.as_ignored() {
                     headers.push("Ignore reason".to_string());
@@ -523,14 +519,7 @@ impl Auditor {
                     "Affected versions: {}",
                     OutputFormatter::escape(&sa.affected_versions().get_pretty_string())
                 ));
-                error.push(format!(
-                    "Reported at: {}",
-                    // TODO(phase-b): PHP uses `$advisory->reportedAt->format(DATE_ATOM)`, but
-                    // shim DATE_ATOM ("Y-m-d\TH:i:sP") is a PHP format string incompatible with
-                    // chrono. Using the chrono equivalent directly; revisit once a PHP-style date
-                    // formatter exists (see also locker.rs DATE_RFC3339).
-                    sa.reported_at.format("%Y-%m-%dT%H:%M:%S%:z")
-                ));
+                error.push(format!("Reported at: {}", sa.reported_at.format(DATE_ATOM)));
                 if let Some(ignored) = advisory.as_ignored() {
                     error.push(format!(
                         "Ignore reason: {}",
diff --git a/crates/shirabe/src/advisory/partial_security_advisory.rs b/crates/shirabe/src/advisory/partial_security_advisory.rs
index 2062570..f72ecaa 100644
--- a/crates/shirabe/src/advisory/partial_security_advisory.rs
+++ b/crates/shirabe/src/advisory/partial_security_advisory.rs
@@ -4,10 +4,10 @@ use crate::advisory::AnySecurityAdvisory;
 use crate::advisory::SecurityAdvisory;
 use crate::package::version::VersionParser;
 use anyhow::Result;
-use chrono::{DateTime, TimeZone, Utc};
+use chrono::{DateTime, Utc};
 use indexmap::IndexMap;
 use shirabe_external_packages::composer::pcre::Preg;
-use shirabe_php_shim::{PhpMixed, UnexpectedValueException};
+use shirabe_php_shim::{DATE_RFC3339, PhpMixed, UnexpectedValueException};
 use shirabe_semver::constraint::AnyConstraint;
 use shirabe_semver::constraint::SimpleConstraint;
 
@@ -57,12 +57,9 @@ impl PartialSecurityAdvisory {
             && data.contains_key("reportedAt");
 
         if has_full_data {
-            let reported_at: DateTime<Utc> = Utc
-                .datetime_from_str(
-                    data["reportedAt"].as_string().unwrap_or(""),
-                    "%Y-%m-%dT%H:%M:%S+00:00",
-                )
-                .unwrap_or_default();
+            let reported_at: DateTime<Utc> =
+                shirabe_php_shim::date_create(data["reportedAt"].as_string().unwrap_or(""))
+                    .unwrap_or_default();
             let sources: Vec<IndexMap<String, String>> = data["sources"]
                 .as_list()
                 .map(|list| {
diff --git a/crates/shirabe/src/advisory/security_advisory.rs b/crates/shirabe/src/advisory/security_advisory.rs
index 2c5a309..7c258ee 100644
--- a/crates/shirabe/src/advisory/security_advisory.rs
+++ b/crates/shirabe/src/advisory/security_advisory.rs
@@ -2,17 +2,17 @@
 
 use chrono::{DateTime, Utc};
 use indexmap::IndexMap;
+use shirabe_php_shim::DATE_RFC3339;
 use shirabe_semver::constraint::AnyConstraint;
 
 use crate::advisory::IgnoredSecurityAdvisory;
 use crate::advisory::PartialSecurityAdvisory;
 
-/// Matches PHP's `format(DATE_RFC3339)`, e.g. "2020-01-01T00:00:00+00:00".
 fn serialize_date_rfc3339<S: serde::Serializer>(
     dt: &DateTime<Utc>,
     serializer: S,
 ) -> Result<S::Ok, S::Error> {
-    serializer.serialize_str(&dt.format("%Y-%m-%dT%H:%M:%S%:z").to_string())
+    serializer.serialize_str(&dt.format(DATE_RFC3339).to_string())
 }
 
 #[derive(Debug, Clone, serde::Serialize)]