## Implementation Plan

### Objective
Merge the two-layer IP restriction fix from branch `typosaurus/ticket-70` into `master`, ensuring all project verification commands pass. The merge must handle the known conflict set and address the pre-existing test failure in `tests/unit/content.py`.

---

### Steps

#### 1. Prepare the working tree
```bash
git checkout master
git pull origin master                           # ensure up to date
git checkout -b fix/restrict-openai-ip-restriction   # new branch for the merge
```

#### 2. Merge the fix branch
```bash
git merge typosaurus/ticket-70
```
Resolve all conflicts **manually** (do not accept theirs or ours blindly). The conflicting files (from earlier attempts) are:
- `devplacepy/config.py`
- `devplacepy/docs_devrant.py`
- `devplacepy/models.py`
- `devplacepy/services/devii/actions/catalog/comments.py`
- `devplacepy/templates/_comment_form.html`

For each conflict:
- Inspect both sides (`git diff HEAD...MERGE_HEAD` for the file).
- **Key rule**: Keep the master version (code that existed in production) **unless** the ticket-70 branch introduces a change that is *directly required* for the OpenAI IP restriction feature. In practice, the ticket-70 branch should only modify:
  - `devplacepy/main.py` (add middleware)
  - `nginx/nginx.conf.template` (add location block)
  - `tests/unit/test_openai_ip_restriction.py` (new file)
  - Possibly `devplacepy/__init__.py` or similar if imports added.

  The five conflicting files above are *not* part of the IP restriction feature; they were modified in ticket-70 by mistake or as part of an earlier abandoned attempt. **Discard changes from ticket-70** in those files; keep the master version.

After resolving, stage and commit:
```bash
git add -A
git commit -m "Merge branch 'typosaurus/ticket-70' into fix/restrict-openai-ip-restriction"
```

#### 3. Verify the fix files exist
Confirm that the following files now exist and contain the expected content:
- `devplacepy/main.py` – middleware block (lines ~537-543)
- `nginx/nginx.conf.template` – location `/openai/` block (lines ~196-213)
- `tests/unit/test_openai_ip_restriction.py` – 4 test cases

If `devplacepy/main.py` does not have the middleware, manually add it (copy from the ticket branch).

#### 4. Fix the pre‑existing test failure in `tests/unit/content.py`
Investigate the failing assertion at line 194:
```python
assert True is False
```
Run the test in isolation to understand the expected behaviour:
```bash
pytest tests/unit/content.py::test_owns_instance_true_for_creator -v
```
Common root causes:
- A fixture or mock changed on master since the test was written.
- The test logic is inverted (the test asserts `True is False` which is impossible unless the code or mock is wrong).

Fix either:
- Correct the assertion (e.g., change `assert True is False` to `assert result is True`) if the code under test actually returns `True`.
- Or adjust the test data/mock to match the current master behaviour.

**Do not skip the test** – ensure it passes exactly as written in master (unless a genuine regression was introduced by the merge; in that case fix the regression).

#### 5. Run project verification
```bash
pip install -e '.[dev]' -q && make test-unit
pip install -q ruff && ruff check .
```
Address any lint errors (likely none from the fix branch).

If `test-unit` fails due to other pre‑existing failures, fix each one with minimal, correct changes (no scope creep). The goal is to have all checks pass.

#### 6. Final confirmation
- All unit tests pass (including the 4 new OpenAI restriction tests).
- `ruff check .` passes with zero errors.
- Merge the branch into `master` and push.

---

## Definition of Done

- [ ] The branch `master` contains a commit that merges the IP‑restriction fix from `typosaurus/ticket-70`.
- [ ] The following changes are present and correct:
  - `devplacepy/main.py` has a middleware function `restrict_openai_to_localhost` that returns 403 for non‑localhost requests to paths starting with `/openai`.
  - `nginx/nginx.conf.template` has a `location /openai/` block with `allow 127.0.0.1; allow ::1; deny all;`.
  - `tests/unit/test_openai_ip_restriction.py` exists and contains the 4 test cases described in the investigation.
- [ ] No merge conflicts remain – all five previously conflicting files match the master version (no unwanted changes from the outdated ticket branch).
- [ ] The pre‑existing test failure in `tests/unit/content.py:194` is resolved so that it passes.
- [ ] `make test-unit` passes with **0 failures** and **0 errors**.
- [ ] `ruff check .` passes with **0 errors** (warnings may exist but no errors).
- [ ] The commit history is clean (no duplicate commits, no WIP messages).