CRM
Google OAuth verification

Google OAuth Reviewer Test Plan

Reviewer steps for authorization, Free/Busy, event and Google Meet management, recurrence, revocation, and account isolation.

Last updated: 6 August 2026

1. Test environment

Application and login URL
https://crm.unitix.pro/
Production callback
https://crm.unitix.pro/api/google-calendar/callback
Reviewer account
Use the CRM and Google test credentials supplied privately in the Google verification submission.

This public page contains no password, Client Secret, authorization code, access token, or refresh token.

2. Authorize Google Calendar

  1. Sign in with the private reviewer CRM account.
  2. Open Bookings → Settings and select Google Calendar Connect.
  3. Confirm Google's consent screen requests only calendar.events.owned, calendar.freebusy, and userinfo.email.
  4. Select the reviewer Google account and approve access.
  5. Confirm the callback returns to UNITIX Soft CRM and the card shows Connected with the correct email and no missing permissions.
Expected result

OAuth state is validated, the exact granted scopes are stored for this CRM user, and no token or authorization code appears in the UI or callback error.

3. Free/Busy

  1. Create a private busy event in the reviewer Google Calendar with a recognizable confidential title.
  2. Open the reviewer's public Booking Page in a private window.
  3. Confirm overlapping times are unavailable.
  4. Confirm the private title, description, attendees, location, exact conflict time, and Google metadata are not displayed.

4. Create an event and Google Meet

  1. Configure a reviewer Booking Page with Google Meet.
  2. Create a booking using a reviewer-controlled guest inbox.
  3. Confirm one owned Google Calendar event is created with the expected time, guest, and Meet link.
  4. Confirm the guest receives the invitation.

5. Update and recurrence

  1. Reschedule the test meeting and confirm the same Google event is updated without duplication.
  2. Create a finite weekly recurring CRM event and confirm the series in Google.
  3. Edit one occurrence and delete another; confirm the series and exceptions remain correct.

6. Delete or cancel

  1. Cancel the test booking or delete the test CRM event.
  2. Confirm the corresponding Google event is removed and attendees receive the cancellation.
  3. Repeat the cancellation and confirm it is handled safely.

7. Disconnect and reconnect

  1. Select Google Calendar Disconnect.
  2. Confirm the card becomes disconnected and Google third-party access shows the grant removed.
  3. Confirm availability and event operations stop while disconnected.
  4. Select Connect again, approve the same three scopes, and confirm a fresh connection.

8. Security and expected results

  • A second CRM user cannot read or operate the reviewer's Google connection or events.
  • An administrator cannot trigger Google operations through another user's credentials.
  • Participant identifiers reveal no other user's availability details.
  • Expired access tokens refresh server-side without token exposure.
  • Disconnect revokes Google access and deletes local credentials.
  • Errors and logs redact tokens, secrets, bearer values, and authorization codes.

For troubleshooting, record only the step, timestamp, HTTP status, and safe visible error, then email support@unitixsoft.pro. Never include the callback query string or credentials.