[pumfleet]

Summary

Scale and Enterprise customers can connect hosts' calendars through their own Google, Microsoft or Zoom app, so the consent screen shows their brand instead of coss.com's.

• scheduling_oauth_app: one per environment and provider, managed from Scheduling → OAuth apps and coss.scheduling.oauthApps. The secret is encrypted with WEBHOOK_SECRETS_KEY and covered by reencryptWebhookSecrets. Never returned.
• Pinning: a connection stays on the app that issued its tokens (oauth_app_id, null for coss.com's), so adding an app disturbs nobody already connected. A consent pins its app, redirect URI and Microsoft tenant when it starts.
• Forwarding page: Google requires redirect URI domains to be verified by the app's owner, and customers can't verify api.coss.com. So redirect_uri can be a page on their own domain that forwards code and state to the existing callback. completion_url says where the browser lands afterwards.
• A refused secret is one outage, not one per host: invalid_client and deleted_client are now transient, so the app goes failing with one webhook and one owner email, and no host is marked or emailed. This also applies to coss.com's own apps, where it logs to Sentry. Calendars go stale and calendarVerdict hides hosts as usual. New secrets are tried before they replace the old one.
• Zoom isolation: deauthorization events are per app (POST /scheduling/zoom/events/:appId, its own Secret Token) and scoped to that app's connections. The old handler reached every organization's, which a customer holding their own token must never be able to do.
• Plan gate: schedulingOauthApps on Scale and Enterprise, checked when creating an app, in sandbox too. Rotating and deleting always work. Self-serve downgrades are refused while apps exist; if a contract just ends, existing apps keep working.
• Whitelabel: the hosted page's copy before consent names the customer and links their privacy_url, and Zoom's agenda marker no longer says coss.com (existing meetings are still found, by hash).

Migration 0140 is additive: a new table, nullable columns, and no backfill.

Testing

• bun run verify is green on this commit.
• New suites: packages/scheduling/test/oauth-apps.test.ts and apps/api/test/scheduling-oauth-apps.test.ts. They cover pinning, per-environment isolation, outages and recovery, the races below, Zoom tenant isolation, the real plan gate, re-encryption and environment deletion.
• apps/site builds, so the new guide's Twoslash samples compile.
• Drove the dashboard page in a browser: adding, refusal, the failing state, the hosts page banner, and deleting.

Not tested against real provider apps

The fakes can't prove these, and only one live call was made: real Google rejected a made-up client as invalid_client.

• A full consent, refresh and push through real Google, Microsoft and Zoom apps.
• Which error Microsoft and Zoom give for a wrong secret, and whether Microsoft checks the app before the token. If it doesn't, a new secret with no connections to try it on is only proven at first use.
• ZOOM_APP_SCOPES (also in the docs) was written from memory, since the repo had no list.

Before telling customers

• apps/site/content/legal/privacy.mdx describes coss.com's Google Limited Use. It's unchanged here, and needs a legal read for customer-owned apps, along with whether the DPA needs a line.

Review

Four Codex rounds against origin/main, with main merged in between (migration regenerated each time).

• Round 1, 3 findings, all fixed:
  • Rotating a secret could overwrite a Zoom Secret Token saved during the provider check. It now re-reads under a row lock.
  • A successful refresh trusted a status read before the outage began. It now always compare-and-sets, fenced to the credentials that worked.
  • The expiry warning could starve apps behind the first batch. It now walks the window with a cursor.
• Round 2: clean.
• Round 3, 1 finding, fixed: a pending Microsoft consent didn't pin its tenant, so editing the app could exchange a code at the wrong authority.
• Round 4: clean.

No findings were rejected.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[linear-code]

ENG-8162