test-a-deep-link

# test-a-deep-link ## When to use - Use for web routes, universal links, app links, custom schemes, invitations, or notifications. - Do not expose tokens or allow links to bypass authorization. ## Procedure 1. Record canonical link, destination, platforms, install state, user state, expiry, and expected fallback. 2. Test web, installed app, uninstalled app, cold, warm, signed-out, signed-in, and wrong-account states. 3. Verify domain association, routing, parameter decoding, Unicode, encoding, and fragment handling. 4. Check authorization, tenant, invite, one-time token, replay, and expiration. 5. Test unavailable content, old app, browser choice, back navigation, and recovery. 6. Record observable outcomes without leaking sensitive URLs. ## Failure plan - Route to a safe login or explanation when destination authority cannot be proven. ## Worked example An invite deep link opens the right app but wrong tenant, so post-login authorization is repaired. ## Done - A deep-link test report records link, platforms, states, routing, parameters, authorization, fallback, and outcomes - Cold, warm, install, auth, tenant, encoding, expiry, replay, unavailable, back, and privacy tests verify behavior