{
  "status": "Illustrative acceptance plan, not an executable test suite or observed production result",
  "topic": "Mobile deep links after login",
  "date": "2026-11-04",
  "sourceArticle": "https://aptixlabs.com/insights/mobile-deep-linking-authentication",
  "setup": [
    "Use synthetic accounts and records",
    "Record the environment and implementation version",
    "Agree the expected product contract before testing"
  ],
  "reviewSequence": [
    "Whitelist destination types and validate parameters",
    "Preserve intent across sign-in without trusting external redirects",
    "Reauthorize the target when it is opened"
  ],
  "cases": [
    {
      "id": "1",
      "condition": "User signs in as a different account",
      "expectedBehavior": "Access is checked for that account",
      "observedBehavior": null,
      "status": "not_run"
    },
    {
      "id": "2",
      "condition": "Linked record was removed",
      "expectedBehavior": "Show an accurate unavailable state",
      "observedBehavior": null,
      "status": "not_run"
    },
    {
      "id": "3",
      "condition": "Link contains an external return URL",
      "expectedBehavior": "It cannot become an unrestricted redirect",
      "observedBehavior": null,
      "status": "not_run"
    }
  ],
  "tradeoff": "Complex pending-link queues can be confusing when users open several links. A clearly defined latest-intent policy or explicit choice is often easier to reason about."
}