Zoom integration test plan

Bosla Coach is a practice-management platform for professional coaches. When a coaching session is booked, the app creates one Zoom meeting on the coach's own Zoom account and shows the join link to the coach and to their client. Rescheduling updates that meeting; cancelling deletes it. The app never reads meeting content — no recordings, transcripts, chat, participants or media.

The application interface is Arabic (right-to-left). Every step below gives the Arabic label with its English meaning, so the screens can be followed without reading Arabic.

Two roles: a coach (sign in at boslacoach.com/settings) and a client (sign in at boslacoach.com/portal). Both accounts are on production and authorize against the Production Client ID. Neither has two-factor authentication. The coach account is pre-loaded with six fictitious clients and seventeen sessions, and its subscription does not expire. All names, email addresses and phone numbers in it are invented; no real end-user data appears anywhere in the account. The client account belongs to one of those six fictitious clients, so the two-user flow can be tested end to end from the same data set. Test credentials for both roles are provided in the Marketplace review thread.

1. Open boslacoach.com/settings — a signed-out visitor is redirected to the sign-in page. Sign in with the coach credentials.
2. Scroll to the card titled «ربط زوم» (Connect Zoom).
3. Click «ربط حساب زوم» (Connect Zoom account). The app redirects to Zoom's authorization page with a signed, ten-minute state parameter.
4. Approve the requested permissions.
5. Zoom redirects to boslacoach.com/zoom/callback. The app exchanges the code, stores the tokens encrypted (AES-256-GCM), and returns to Settings.

Expected: the card shows «مرتبط» (Connected) with the Zoom account email. Refresh tokens are single-use and rotate on every refresh.

The three mandatory scopes are the full lifecycle of a single meeting: a booking creates it, a reschedule moves it, a cancellation removes it. Granting creation without deletion would leave an abandoned meeting in the coach's Zoom account every time a client cancels, so the three are requested together.

1. As the coach, book a future session for a client using Zoom as the meeting tool.
2. Sign out and sign in at boslacoach.com/portal with the client credentials. Expected: the session appears under «جلساتي» (My sessions) with a join button linking to the meeting created in step 1.
3. The same join link is included in the client's booking confirmation email and in the reminder emails sent 24 hours and 1 hour before the session.
4. As the coach, cancel the session. Expected: the link disappears from the client portal and the Zoom meeting is deleted.

The client never sees the coach's Zoom account details, and no client can reach any Zoom API — all Zoom calls are made server-side using the coach's own connection.

• Highest privilege (all six granted): every booked session receives its own Zoom meeting; rescheduling updates it and cancelling deletes it. The Connect Zoom card shows the authorized account's email. This is the experience we expect most customers to use.
• Least privilege (the three optional scopes declined): authorize while unticking user:read:user, meeting:read:meeting and meeting:read:participant, then repeat the scope tests above. Expected: identical behaviour — meetings are still created, updated and deleted normally, because the application never calls the two read endpoints. The only visible difference is the Connect Zoom card showing the account as connected but without an email address. Nothing in the product is blocked or degraded.
• Revocation while connected: book a session successfully, remove the app from the Zoom App Marketplace, then book another session. Expected: the first meeting is unaffected; the app receives the deauthorization event and deletes the stored tokens; the second booking still succeeds and falls back to the coach's own default meeting link, with the card prompting them to reconnect. No booking is ever lost because a Zoom connection is missing.

From the app: Settings → «ربط زوم» → «فصل الربط» (Disconnect). Expected: all stored tokens for that coach are deleted immediately and the card returns to its disconnected state.

From Zoom: Zoom App Marketplace → Manage → Added Apps → Remove. Expected: the app receives Zoom's deauthorization webhook and deletes the stored tokens and Zoom user ID immediately.

Meetings already created remain in the coach's Zoom account by design; the app does not delete past meetings on disconnect.

One meeting is created per booked session — never in bulk. Failed calls are logged with their Zoom error code; a 4711 (missing scopes) response sets the re-authorization notice, and a 401 marks the connection as needing reconnection rather than retrying in a loop.