"""Approximate-location fallback, frontend side. Two things are worth locking down here, and both are about honesty rather than mechanics: the server-rendered HTML must not vary by visitor (so no shared cache can leak one person's city to another), and the privacy page's factual claim about IP lookups must track the flag that decides whether they happen. """ import content B = "/thermograph" def test_home_ships_an_empty_hidden_container(client): """The suggestion is fetched client-side. If it were ever server-rendered into the homepage, that page's HTML — and its ETag — would vary per visitor, which is exactly the cache-poisoning shape this design avoids.""" r = client.get(f"{B}/") assert r.status_code == 200 assert 'id="geo-approx"' in r.text assert "hidden" in r.text.split('id="geo-approx"')[1].split(">")[0] def test_home_html_is_identical_regardless_of_client_address(client): """Same bytes, same ETag, whatever the request claims about where it came from — the property that lets the homepage stay cacheable.""" a = client.get(f"{B}/", headers={"X-Forwarded-For": "8.8.8.8"}) b = client.get(f"{B}/", headers={"X-Forwarded-For": "1.1.1.1"}) assert a.text == b.text assert a.headers["etag"] == b.headers["etag"] def test_privacy_says_no_ip_lookup_while_the_flag_is_off(client, monkeypatch): monkeypatch.delenv("THERMOGRAPH_GEOIP", raising=False) r = client.get(f"{B}/privacy") assert r.status_code == 200 assert "never looks up your location from your IP address" in r.text def test_privacy_describes_the_fallback_when_the_flag_is_on(client, monkeypatch): """Turning the feature on must not leave a published claim behind that is no longer true.""" monkeypatch.setenv("THERMOGRAPH_GEOIP", "1") r = client.get(f"{B}/privacy") assert r.status_code == 200 assert "never looks up your location from your IP address" not in r.text assert "rough guess" in r.text assert "not stored" in r.text def test_geoip_enabled_reads_the_shared_flag(monkeypatch): monkeypatch.delenv("THERMOGRAPH_GEOIP", raising=False) assert content.geoip_enabled() is False for on in ("1", "true", "YES", "on"): monkeypatch.setenv("THERMOGRAPH_GEOIP", on) assert content.geoip_enabled() is True, on for off in ("0", "", "no", "maybe"): monkeypatch.setenv("THERMOGRAPH_GEOIP", off) assert content.geoip_enabled() is False, off