Fixes #20524: Enhance API script scheduling validation

[pheus]

Fixes: #20524

Tightens script scheduling validation:

• Rejects schedule_at values in the past.
• When only interval is provided, starts now and repeats.
• Uses local_now() for accurate, timezone‑aware comparisons.

Small, backward‑compatible fix to make scheduling behave as expected.

[jnovinger]

Thanks @pheus. This fix looks good, although I did note one other edge case (w/ a suggestion) that the original bug report did not mention. Can you please address that, since we're already making changes there?

Could you please also add the following tests for this? Probably in ScriptTest around line 910 in netbox/extras/tests/test_api.py:

def test_schedule_script_past_time_rejected(self):
    """Scheduling with past schedule_at should 
fail"""
    # POST with schedule_at = timezone.now() - timedelta(hours=1)
    # Expect 400 with "must be in the future" error

def test_schedule_script_interval_only(self):
    """Interval without schedule_at should auto-set 
schedule_at to now"""
    # POST with interval=60, no schedule_at
    # Verify job created with schedule_at set

def test_schedule_script_when_disabled(self):
    """Scheduling should fail when 
script.scheduling_enabled=False"""
    # POST with schedule_at or interval

Let me know if you have any questions.

[jnovinger]

Suggested change

	if 'interval' in data and 'schedule_at' not in data:
	if 'interval' in data and not data.get('schedule_at'):

It seems there's a case not noticed in the original issue, where the API caller might pass something like {"scheduled": null, "interval": 60} and they'd end up with a recurring job that has no set start time. All other edge-case-y values that I could think of that might satisfy this conditional fail because they aren't a valid datetime format.

[pheus]

Great point, and I agree. I’ll use .get() for both schedule_at and interval. Using .get() treats an explicit null the same as a missing key, so the “interval‑only” behavior still applies when schedule_at is null.

I’ll normalize & validate accordingly:

• If both are None → no scheduling (run now).
• If interval is set and schedule_at is falsy → schedule_at = local_now().
• If schedule_at is set → must be in the future.
• If either is set and scheduling_enabled is False → reject.

[pheus]

Make this a property to mirror the model’s cached_property. This returns the class object (not a bound function), which fixes the test setup and matches production behavior.

[pheus]

Thanks for the thoughtful review!

I’ve pushed updates to address your suggestion and added tests:

• Use .get() so {"schedule_at": null, "interval": 60} starts now (no start‑less recurring job).
• Tests added: past schedule_at → 400; interval‑only → auto‑sets schedule_at; scheduling disabled → reject.
• Fixed the test setup to return the class from python_class, matching production behavior.

Happy to tweak anything.