Development testing
After saving an embedded draft, review automatic artifact checks and then verify real customer operations in a test installation.
Review artifact checks
The platform asynchronously reads the public Manifest and assets to check format, URL restrictions, and SHA-256. It does not execute third-party scripts or prove that browser mounting, sign-in, or business features work.
| Status | Action |
|---|---|
| Queued / running | Wait for the page to update; avoid repeated saves |
| Passed | Complete the real PC browser checks below |
| Failed | Correct URLs, the Manifest, or asset digests; save or check again |
| Service unavailable | Keep the draft and check again when the service recovers |
| Stale | Read the current draft and check its current URL, mode, and artifacts |
Changes to the application URL, Manifest, or opening mode invalidate the previous result for the new draft. Failed or unavailable checks preserve the existing published version.
Complete a PC test installation
Use test accounts and installations for the selected environment. Do not copy Sandbox credentials, customer data, or approvals to Production. A trusted-mode Sandbox draft must not run directly in a customer's production workspace.
| Check | Expected result |
|---|---|
| Open and refresh | Console opens the business page; refresh and deep links work |
| Existing session | Enter the business interface without repeated marketing or sign-in pages |
| Initial authorization and expiry | A clear user action opens authorization; cancellation and expiry can recover |
| Themes and language | Initial state and context changes work without duplicate host navigation |
| Customer/environment changes | Clear previous data; reject wrong application, environment, and unauthorized access |
| Unmount and reopen | Clean up resources, reject old messages, and warn about unsaved content |
| Load failure | Show an error with retry and open-in-new-window recovery |
| Plans and business features | If commerce is enabled, separately test plan selection, purchase, and entitlement activation |
| Payment success/cancellation | Use the provider's test mode; embedded access returns to the original Console application subscription page, standalone access to its own page; read the original order/subscription instead of checking only the URL |
| Payment window failures | Verify blocked-window recovery for the same payment, manual closure, severed communication, and delayed activation; retain the original order without a new purchase |
| Return receipt security | Reject forged origins, Windows, correlation values, wrong applications/environments, and receipts after unmount; a receipt grants no access |
Verify iframe and trusted mounting separately. Record the test environment, artifact version, results, and traceable evidence references for the release.
Troubleshooting
| Symptom | Check |
|---|---|
| iframe blocked | Container CSP frame-ancestors, X-Frame-Options, and registered Console origin |
| Asset check failed | Anonymous access, matching origin, complete assets, and actual byte digests |
| API calls target Console | Request URLs must use host.applicationOrigin |
| Checks passed but opening fails | Browser lifecycle, handshake, container response, and real sign-in; static checks cannot verify these |
| Trusted mode cannot start | Production environment, independent review, explicit risk approval, and explicit publication |
| Return opens standalone or checkout is blank | Check whether the application iframe was navigated to checkout; follow checkout and return handling to preserve Console and pay in a separate window |
Next: review and publish.