Obuchat Assistant — Zoom Marketplace Test Plan

For Zoom Marketplace Security & Privacy review.

App type: User-managed OAuth (General app). Not a Zoom in-client / in-meeting app. Users interact via Telegram and our Mini App only.

Entry points

Production Authorization URL: https://zoom.us/oauth/authorize?response_type=code&client_id=25bg0QtHTVyrLWzx1WQwgQ&redirect_uri=https://assistant.obuchat.me/oauth/zoom/callback
Production OAuth redirect: https://assistant.obuchat.me/oauth/zoom/callback
Development OAuth redirect: https://stagassistant.obuchat.me/oauth/zoom/callback
Home URL: https://assistant.obuchat.me/zoom/home
Documentation: zoom.html
Privacy Policy: privacy-en.html
Deauthorization endpoint: https://assistant.obuchat.me/webhook/deauthorize

Test credentials

Single-user flow (one Telegram user ↔ one Zoom account). No multi-role app.

Full login credentials (Telegram phone + Zoom email/password) are provided in the Zoom Marketplace submission → Account Credentials field. The test Telegram account is pre-approved on our production allowlist (no access gate).

Service	Credentials (see Marketplace submission)
Telegram	Bot: https://t.me/PshAssistent_bot Dedicated test phone number (login via Telegram app; 2FA disabled). User ID pre-approved on production allowlist.
Zoom	Dedicated Zoom test account (email + password in submission). Connect via OAuth (`/zoom_auth`) after logging into Telegram. Dummy scheduled meeting may be pre-loaded on the test account.

Important: OAuth on production uses Production Client ID (25bg0QtHTVyrLWzx1WQwgQ) on assistant.obuchat.me — not the Development Client ID.

Reviewer steps (end-to-end)

Open Home URL → Open bot in Telegram.
Log into Telegram with the test phone number from Account Credentials.
Open the bot, send /start.
Send /zoom_auth or Mini App → Profile → Zoom → Connect.
Sign in to Zoom with the test Zoom credentials from Account Credentials. Confirm Zoom shows as connected in Profile.
Run scope tests below.

OAuth scopes and test steps

All scopes below are required (not optional) in our Marketplace submission.

Scope	How to test
`user:read:user`	Complete OAuth as above. Mini App → Profile — Zoom shows connected name/email from Zoom profile.
`user:read:token`	Used by Leo’s note-taking agent: after a meeting is created with auto-record, Leo joins via Zoom SDK using an OBF token (not ZAK). After the meeting, transcription/summary appear in Mini App → Profile → Zoom recordings.
`meeting:write:meeting`	Send `zoom` in the bot. Bot replies with a Zoom join URL (instant meeting). English also works: `delete zoom`, `reschedule zoom to 15:00 tomorrow`.
`meeting:read:list_meetings`	Used before delete/reschedule: `GET /users/me/meetings` (visible in Marketplace Call logs). Then `DELETE` or `PATCH /meetings/{id}` — also visible in Call logs.
`meeting:update:meeting`	Create a scheduled meeting: `meeting tomorrow at 3pm with zoom`. Send: `reschedule zoom to 4pm tomorrow`. Bot confirms the meeting was moved. Call logs show `PATCH /meetings/{id}` (not a new `POST`). Instant meetings (`zoom` only) cannot be rescheduled — create a scheduled meeting first.
`meeting:delete:meeting`	Send `zoom` — bot returns join URL. Send `delete zoom` — bot confirms deletion. Call logs show `DELETE /meetings/{id}`.

Meeting recordings: Mini App → Profile → Zoom shows meeting-bot recordings (not Zoom Cloud Recording API). Enable auto-record or send a Zoom link to the bot, then check the recordings list after the meeting ends.

Deauthorization (required)

Connect Zoom as above.
In Zoom: Manage → Added Apps → remove Obuchat Assistant.
Our endpoint /webhook/deauthorize receives app_deauthorized and deletes stored OAuth tokens within 24 hours.
In Telegram, /zoom_auth is required again before creating meetings.

Manual disconnect (in-app)

Mini App → Profile → Zoom → Disconnect.
Tokens are revoked at Zoom and deleted locally.

Event subscription

meeting.ended — optional post-meeting notification to the host in Telegram.

Not a Zoom in-client app (no Meeting surface)

Obuchat Assistant is a General OAuth app only. It does not run inside the Zoom desktop or mobile meeting client. There is no in-meeting UI, no Meeting product under Surface, no Zoom App (in-client) mode, and no Zoom Apps SDK embed. Reviewers should not expect any UI inside an active Zoom meeting — all interaction is through Telegram chat and the web Mini App at assistant.obuchat.me.