NanaadeNanaade Developers
Browse documentation
Testing and launch

Test your integration and go live

Test both the happy path and deliberate failures on stable HTTPS staging domains. The repository's tenant_system reference app includes controls for the core scenarios.

Test data

Prepare three identities:

| Identity | Nanaade state | Expected result | |---|---|---| | Active pilot user | Active membership, matching email | Successful 303 launch | | Inactive user | Inactive/revoked membership | SSO_MEMBERSHIP_REQUIRED | | Unknown user | No membership | SSO_MEMBERSHIP_REQUIRED |

Do not use real production credentials in local fixtures or automated test output.

Contract scenarios

| Scenario | How to produce it | Expected result | |---|---|---| | Valid | Fresh times, nonce, active member | Cookie + 303 to approved workspace | | Replay | Submit identical signed fields twice | Second returns 409 SSO_ASSERTION_REPLAYED | | Expired | Set iat 10 minutes ago and exp 5 minutes ago | 401 SSO_ASSERTION_EXPIRED | | Invalid signature | Sign with a different test secret | 401 SSO_SIGNATURE_INVALID | | Future clock | Set iat more than 60 seconds ahead | 401 SSO_ASSERTION_EXPIRED | | Bad origin | Submit from unregistered staging origin | 403 SSO_ORIGIN_NOT_ALLOWED | | Bad destination | Sign unregistered redirect origin | 403 SSO_REDIRECT_NOT_ALLOWED | | Subject mismatch | Change sub after first binding | 409 SSO_SUBJECT_MISMATCH |

Generate destructive cases only in staging. Never intentionally expose or corrupt a production secret.

Authorization scenarios after SSO

  1. Licensed sidebar entries and dashboard cards appear.
  2. Unlicensed entries are omitted.
  3. Direct unlicensed page navigation renders Feature Unavailable.
  4. Direct API requests return 403 FEATURE_NOT_LICENSED with the required code.
  5. Removing a parent module blocks dependent add-ons.
  6. Revoking membership blocks all subsequent tenant access.
  7. Tenant A cannot read Tenant B roster, analytics, uploads, notifications, or background-job output.

Rotation rehearsal

Rotate with a short overlap. Confirm the new secret works immediately, old secret works only during overlap, and old secret fails afterward. Then update the operational runbook with the actual deployment time required.

Production checklist

  • [ ] Production portal, workspace, and API use HTTPS.
  • [ ] Exact origins and minimal return paths are registered.
  • [ ] Production credential differs from staging.
  • [ ] Secret is server-only and access-controlled.
  • [ ] Assertions derive identity from authenticated server state.
  • [ ] Servers use synchronized time.
  • [ ] Handoff responses are no-store with restrictive CSP.
  • [ ] Logs redact payloads, signatures, cookies, and personal data.
  • [ ] Pilot memberships are active and subjects are stable.
  • [ ] Replay, expiry, signature, origin, redirect, and membership failures pass.
  • [ ] Module, permission, and cross-tenant isolation tests pass.
  • [ ] Rotation and emergency revocation are rehearsed.
  • [ ] DNS, TLS, redirects, and cookies pass on final hostnames.
  • [ ] Technical and incident contacts are documented.

What success looks like

The user clicks once in the tenant portal, briefly sees the secure handoff page, lands in the correctly branded Nanaade workspace, and sees only licensed capabilities. No Nanaade password is requested, no tenant secret reaches the browser, and repeated or altered assertions fail with stable diagnostic codes.