59 lines
2.4 KiB
Python
59 lines
2.4 KiB
Python
|
"""Approximate-location fallback, frontend side.
|
||
|
|
|
||
|
|
Two things are worth locking down here, and both are about honesty rather than
|
||
|
|
mechanics: the server-rendered HTML must not vary by visitor (so no shared
|
||
|
|
cache can leak one person's city to another), and the privacy page's factual
|
||
|
|
claim about IP lookups must track the flag that decides whether they happen.
|
||
|
|
"""
|
||
|
|
import content
|
||
|
|
|
||
|
|
B = "/thermograph"
|
||
|
|
|
||
|
|
|
||
|
|
def test_home_ships_an_empty_hidden_container(client):
|
||
|
|
"""The suggestion is fetched client-side. If it were ever server-rendered
|
||
|
|
into the homepage, that page's HTML — and its ETag — would vary per
|
||
|
|
visitor, which is exactly the cache-poisoning shape this design avoids."""
|
||
|
|
r = client.get(f"{B}/")
|
||
|
|
assert r.status_code == 200
|
||
|
|
assert 'id="geo-approx"' in r.text
|
||
|
|
assert "hidden" in r.text.split('id="geo-approx"')[1].split(">")[0]
|
||
|
|
|
||
|
|
|
||
|
|
def test_home_html_is_identical_regardless_of_client_address(client):
|
||
|
|
"""Same bytes, same ETag, whatever the request claims about where it came
|
||
|
|
from — the property that lets the homepage stay cacheable."""
|
||
|
|
a = client.get(f"{B}/", headers={"X-Forwarded-For": "8.8.8.8"})
|
||
|
|
b = client.get(f"{B}/", headers={"X-Forwarded-For": "1.1.1.1"})
|
||
|
|
assert a.text == b.text
|
||
|
|
assert a.headers["etag"] == b.headers["etag"]
|
||
|
|
|
||
|
|
|
||
|
|
def test_privacy_says_no_ip_lookup_while_the_flag_is_off(client, monkeypatch):
|
||
|
|
monkeypatch.delenv("THERMOGRAPH_GEOIP", raising=False)
|
||
|
|
r = client.get(f"{B}/privacy")
|
||
|
|
assert r.status_code == 200
|
||
|
|
assert "never looks up your location from your IP address" in r.text
|
||
|
|
|
||
|
|
|
||
|
|
def test_privacy_describes_the_fallback_when_the_flag_is_on(client, monkeypatch):
|
||
|
|
"""Turning the feature on must not leave a published claim behind that is
|
||
|
|
no longer true."""
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_GEOIP", "1")
|
||
|
|
r = client.get(f"{B}/privacy")
|
||
|
|
assert r.status_code == 200
|
||
|
|
assert "never looks up your location from your IP address" not in r.text
|
||
|
|
assert "rough guess" in r.text
|
||
|
|
assert "not stored" in r.text
|
||
|
|
|
||
|
|
|
||
|
|
def test_geoip_enabled_reads_the_shared_flag(monkeypatch):
|
||
|
|
monkeypatch.delenv("THERMOGRAPH_GEOIP", raising=False)
|
||
|
|
assert content.geoip_enabled() is False
|
||
|
|
for on in ("1", "true", "YES", "on"):
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_GEOIP", on)
|
||
|
|
assert content.geoip_enabled() is True, on
|
||
|
|
for off in ("0", "", "no", "maybe"):
|
||
|
|
monkeypatch.setenv("THERMOGRAPH_GEOIP", off)
|
||
|
|
assert content.geoip_enabled() is False, off
|