# TF-06 — IP Address Capture (ipify)

| | |
|---|---|
| **Feature** | Public IP address captured via ipify API and stored in `CONS_IP_adadress` hidden field |
| **Test Page** | [`test-pages/02-sfae-source.html`](../test-pages/02-sfae-source.html) |
| **Live URL** | https://sfae-forms.jjlo.app/test-pages/02-sfae-source.html |
| **Status** | ✅ Ready |
| **Last Verified** | 2026-05-24 |
| **Code Location** | `02-sfae-source.html` L3333–L3345 |
| **External API** | `https://api.ipify.org?format=json` |

---

## What We're Testing

On page load, the form makes a `fetch()` call to `api.ipify.org` to get the prospect's public IP address and stores it in the hidden `CONS_IP_adadress` field.
This is used for:
- Fraud detection / lead quality scoring
- Geo-IP fallback when no country param is passed
- Compliance audit trail

> **Note:** Field name contains a typo (`adadress` not `address`). This matches the SFAE custom field name exactly — do not "fix" the JS without updating the field in SFAE first.

---

## Code Reference

```javascript
// L3333–L3345 in 02-sfae-source.html
fetch('https://api.ipify.org?format=json')
  .then(response => response.json())
  .then(data => {
    fillPardotField('CONS_IP_adadress', data.ip);
  })
  .catch(error => {
    console.error('Error fetching IP address:', error);
  });
```

---

## Test Steps

### 1. Network Request Verification
- [ ] Open `02-sfae-source.html`
- [ ] Open DevTools → Network tab → filter by "ipify"
- [ ] Page load triggers a GET to `https://api.ipify.org?format=json`
- [ ] Response status: **200 OK**
- [ ] Response body: `{"ip":"x.x.x.x"}` — a valid IPv4 or IPv6 address

### 2. Field Population
- [ ] Wait ~2 seconds after page load (async)
- [ ] DevTools console: `document.querySelector('.CONS_IP_adadress input').value`
- [ ] Expected: your public IP address (not `localhost`, not `127.0.0.1`)
- [ ] Verify by comparing to `https://api.ipify.org` in a separate tab

### 3. Error Handling
- [ ] Open DevTools → Network → throttle to "Offline"
- [ ] Reload page
- [ ] `CONS_IP_adadress` field remains empty (no crash)
- [ ] Console shows: `Error fetching IP address: TypeError: Failed to fetch` (graceful fail)
- [ ] Form is still usable and submittable without the IP field

### 4. Submission with IP
- [ ] Restore network, reload
- [ ] Wait for IP to populate
- [ ] Submit form with all required fields
- [ ] In SFAE prospect record: `CONS_IP_adadress` field shows correct IP

### 5. HTTPS Requirement
- [ ] When served from `sfae-forms.jjlo.app` (HTTPS), `fetch()` to `api.ipify.org` (HTTPS) succeeds
- [ ] No mixed-content warnings in console

---

## Pass Criteria

ipify GET returns 200 on page load. `CONS_IP_adadress` field is populated within 2 seconds. Form is still functional if ipify is unreachable.

## Privacy / Compliance Notes

- IP addresses are personal data under GDPR. Storing them requires a legitimate interest or consent basis.
- The privacy policy displayed on the form should mention IP address collection.
- IP data should have a defined retention period in SFAE.
- **Do not log the IP to `console.log`** in production code.