Testing Extensions
Test mapping, delivery, isolation, recovery, installation, and removal before asking another workspace to trust your app.
Testing ladder
- Unit tests — mapping, signature verification, idempotency, and conflict rules.
- Contract tests — current public Throttle request, response, and event shapes.
- Local HTTPS tests — iframe handshake and signed webhook delivery through a tunnel.
- Private install — full setup in a Test-mode application with realistic fixtures.
- Failure injection — timeouts, rate limits, expired credentials, retries, and provider outages.
- Production smoke test — a small, non-destructive live test after launch approval.
Required scenarios
Delivery and recovery
- Valid, missing, stale, and invalid signatures
- Duplicate and out-of-order events
- Timeout, 429, and 5xx retry behavior
- Poison event and dead-letter recovery
- Uninstall while work is queued
Lifecycle and data
- Pagination and missing optional fields
- Version upgrade and new-scope consent
- Strict Test/Live separation
- Provider credential expiration
- Cancellation and return races for fulfillment apps
Marketplace preflight
- All public endpoints use HTTPS and expose a useful health check.
- Scopes and event subscriptions are limited to demonstrated functionality.
- A clean install, configuration update, upgrade, replay, and uninstall all succeed.
- Logs and screenshots contain no credentials or customer-sensitive data.
- Support, privacy, and terms URLs are public and accurate.
Test mode is the default
Use Test mode throughout development. Verify production behavior deliberately with live credentials only after the extension passes security and marketplace preflight.
Review the Security Model before following the publishing procedure.