Skip to content
TechTur POS

Sandbox and testing

The sandbox

  • Sandbox applications (environment: SANDBOX) and sandbox businesses are flagged in the database. A sandbox app can only connect to, and only receive tokens for, sandbox businesses; a live app only live ones.
  • Sandbox businesses never appear in the TechTur Control Centre's live figures.
  • Create one: Developer console → Create sandbox business (up to five each). It is VAT-registered with a test number (4000000000), has products with barcodes and 50 units of opening stock each, and two test customers.
  • Connect: your sandbox app → Test token (24-hour token, connection created for you), or run the full OAuth flow against the sandbox business.
  • Payments: POS does not process card payments itself. Order payments you submit are records of payments your platform collected. Never simulate successful real payments against a live business.

Things to test before going live

  1. Initial product sync of your whole catalogue; a second identical sync reports everything unchanged.
  2. A price change you own updates POS; a POS-owned field you change produces a conflict, not an overwrite.
  3. Submit a paid order; submit it again (same externalRef) — one sale, stock deducted once.
  4. Submit an unpaid order; see reserved; mark it paid; reservation released and stock deducted.
  5. Receive inventory.changed; verify the signature; send the same delivery twice — processed once.
  6. Disconnect the app from the business → your next call gets 401; you handle integration.disconnected.
  7. Kill your network mid-request; the SDK retry does not duplicate anything.
  8. Try a businessId you were not granted → 404.

Integration testing checklist

  • Manifest validates in the console
  • OAuth: state checked, PKCE verifier kept server-side, refresh rotation handled
  • Tokens stored encrypted, one pair per business
  • Webhook verification on raw body, replay window, de-duplication
  • Idempotency on every write
  • Retries only on 429/5xx/network
  • No secrets in logs
  • Disconnect handled
  • Tenant isolation test (foreign businessId → 404)

The repository's own suite runs these against a real database: apps/api/test/integrations.test.ts and platform.test.ts.