# Test report — 2026-10-29 (Phase 1)

All results below were observed on Windows 11, Python 3.12.10. Nothing here was measured on a live server:
the site is not deployed.

## 1. Automated tests — `python -m unittest discover -s tests -v`

**36 tests, 36 passed** (about 17 s) both in the development folder and in a clean extraction of the final ZIP
inside a new virtual environment (Flask 3.1.3, Werkzeug 3.1.9, Jinja2 3.1.6, Pillow 13.0.0, waitress 3.0.2).

| Area | Tests |
|---|---|
| Public pages | 13 page types × 9 languages return 200 with the right `lang`; root redirects by browser language; unknown language/page → localized 404; navigation translated (de, zh, ru); untranslated bodies show a notice |
| Design (Phase 1) | homepage constellation: four star links (tours, activities, celebrations, camp) and four "Choose your star" arches in en/fr/zh; headline accent rendered as `<em>`; no 01–04 section numbers on any page type |
| Activities | all 18 confirmed activities listed and reachable; trip finder filters by destination, type and duration and never lists unpublished items |
| Publication status | weddings published after owner confirmation (page in en/fr/zh/uk; wording "customizable and subject to confirmation", accommodation "subject to availability", transfers "on request"; enquiry with guest count, sitemap, Service schema without offers); the other 8 proposed services are `pending_verification` and absent from pages, menus, search, sitemap, API (404 on direct URL); held starting points hidden; full workflow Draft → Pending → Confirmed → Published → Unpublished → Archived; publish refused unless Confirmed; a confirmed event can be published explicitly; draft preview requires login and is `noindex` |
| No prices | no currency or price wording on any public page (en/fr/es/de), the API or the sitemap; no `offers/price/priceRange/aggregateRating/review` in JSON-LD; internal price notes never rendered |
| Inquiries | valid request stored with language, date, group size, trip length, places, interests; references to unpublished items dropped; IP stored only as a keyed hash; duplicate not stored twice; server-side validation messages in French; CSRF and honeypot; activity and celebration forms; records visible only to signed-in staff; CSV export admin-only |
| WhatsApp | every link uses `https://wa.me/212620777564?text=…` with the page's item in the visitor's language |
| Admin | all admin screens require login; wrong password rejected; login rate limit after 5 failures; CSRF enforced on admin POSTs; editors cannot reach backups; all 18 admin screens render with `Cache-Control: no-store`; tour edits persist (route, legs, gallery); interface translation override and reset; image upload creates WebP sizes, invalid files rejected |
| SEO | canonical + hreflang (9 + x-default); sitemap with alternates; robots.txt; legacy `.html` URLs → 301 |
| Backup | backup zip with manifest; restore brings back damaged data and keeps a safety copy; foreign/malicious zip rejected |
| Security | CSP and `nosniff` headers; media path traversal and unknown files → 404 |

## 2. Clean-extraction check

Following README section 1 in a new folder: extract ZIP → `python -m venv .venv` → `pip install -r requirements.txt`
→ copy `.env.example` → `manage.py init-db` (content loaded) → `manage.py create-admin` → `init-db` again
(reported "nothing overwritten") → tests (33/33) → `manage.py serve --port 8099` (waitress) and HTTP checks:
`/` 302 · `/en/` 200 · `/zh/desert-activities/` 200 · `/en/desert-activities/camel-trek/` 200 ·
`/en/celebrations/wedding-merzouga/` 404 · `/sitemap.xml` 200 · `/robots.txt` 200 ·
`/tours/rose-dunes-circuit.html` 301 · `/admin/` 302 to login · static CSS and WebP 200.

Note: inside the very long folder path of the build machine, `pip` failed with a Windows 260-character path error;
the same steps succeeded in a short folder. Keep the project in a reasonably short path on Windows.

## 3. Manual visual checks (in a browser)

- Desktop 1440 px, full-page captures: home, Moroccan Tours, a tour, Desert Activities, a legacy activity (Camel
  Trekking), a new activity (Fossils & Erfoud), Events & Celebrations, Desert Camp, Plan Your Trip, journal, French
  home. Issues found and fixed during the audit: repeated "01 / Chapter 01" labels, unbalanced tour category
  columns, duplicated summary on new activity pages, double dune motif on the events page, featured-routes grid gap.
- Mobile 375 × 812 (device emulation): home (fr), menu drawer (fr), activities (fr), plan (es), activity (zh),
  events (ru), tour (de). `scrollWidth` equals the viewport width (no horizontal overflow).
- Admin: sign-in, dashboard, events list with pending statuses.
- Keyboard: skip link, visible focus ring, mega-menus open with Arrow Down / Space, close with Escape; the drawer
  closes with Escape. Reduced-motion preference disables animations.

## 4. Not tested

- Real deployment, HTTPS, real e-mail delivery (no mail integration exists), load/performance scores (no Lighthouse
  run was performed), Safari and Firefox (checked in Chromium-based browsers only), screen readers.