fix(quickbooks): validate refreshed execution context

Author: Bill Leoutsakos

apps/sim/lib/oauth/oauth.test.ts

@@ -483,6 +483,26 @@ describe('OAuth Token Refresh', () => {
       }
     )
 
+    it.concurrent('should preserve numeric string token expiry values', async () => {
+      const mockFetch = vi.fn().mockResolvedValue(
+        Response.json({
+          access_token: 'new_access_token',
+          expires_in: '7200',
+        })
+      )
+
+      const result = await withMockFetch(mockFetch, () =>
+        refreshOAuthToken('google', 'old_refresh_token')
+      )
+
+      expect(result).toEqual({
+        ok: true,
+        accessToken: 'new_access_token',
+        expiresIn: 7200,
+        refreshToken: 'old_refresh_token',
+      })
+    })
+
     it.concurrent('should handle providers that return new refresh tokens', async () => {
       const refreshToken = 'old_refresh_token'
       const newRefreshToken = 'new_refresh_token'

apps/sim/lib/oauth/oauth.ts

@@ -1885,10 +1885,13 @@ export async function refreshOAuthToken(
     }
 
     const expiresInCandidate = data.expires_in ?? data.expiresIn
-    const expiresIn =
-      typeof expiresInCandidate === 'number' && Number.isFinite(expiresInCandidate)
+    const parsedExpiresIn =
+      typeof expiresInCandidate === 'number'
         ? expiresInCandidate
-        : 3600
+        : typeof expiresInCandidate === 'string' && expiresInCandidate.trim()
+          ? Number(expiresInCandidate)
+          : Number.NaN
+    const expiresIn = Number.isFinite(parsedExpiresIn) ? parsedExpiresIn : 3600
 
     if (!accessToken) {
       logger.warn('No access token found in refresh response', {

apps/sim/tools/quickbooks/get_company_info.ts

@@ -59,14 +59,20 @@ export const quickbooksGetCompanyInfoTool: ToolConfig<
     retry: { enabled: false },
     maxResponseBytes: QUICKBOOKS_MAX_RESPONSE_BYTES,
   },
-  transformResponse: async (response) => {
+  transformResponse: async (response, params) => {
+    const realmId = normalizeQuickBooksRealmId(params?.realmId ?? '')
     const data = await parseQuickBooksJson<CompanyInfoEnvelope>(
       response,
       'QuickBooks CompanyInfo response'
     )
     if (!data.CompanyInfo || typeof data.CompanyInfo !== 'object') {
       throw new Error('QuickBooks CompanyInfo response is missing CompanyInfo')
     }
+    if (String(data.CompanyInfo.Id ?? '').trim() !== realmId) {
+      throw new Error(
+        'QuickBooks CompanyInfo response returned a different company. Reconnect the QuickBooks credential.'
+      )
+    }
     return {
       success: true,
       output: {

apps/sim/tools/quickbooks/quickbooks.test.ts

@@ -340,7 +340,8 @@ describe('QuickBooks tool boundaries', () => {
           CompanyInfo: { Id: '123456789', CompanyName: 'Sanitized Company' },
           time: 'test-time',
         })
-      )
+      ),
+      authParams
     )
     expect(result.output).toEqual({
       company: { Id: '123456789', CompanyName: 'Sanitized Company' },
@@ -351,11 +352,25 @@ describe('QuickBooks tool boundaries', () => {
   it('rejects an empty CompanyInfo wrapper', async () => {
     await expect(
       quickbooksGetCompanyInfoTool.transformResponse!(
-        new Response(JSON.stringify({ time: 'test-time' }))
+        new Response(JSON.stringify({ time: 'test-time' })),
+        authParams
       )
     ).rejects.toThrow('missing CompanyInfo')
   })
 
+  it('rejects CompanyInfo for a different realm', async () => {
+    await expect(
+      quickbooksGetCompanyInfoTool.transformResponse!(
+        new Response(
+          JSON.stringify({
+            CompanyInfo: { Id: '999', CompanyName: 'Different Sanitized Company' },
+          })
+        ),
+        authParams
+      )
+    ).rejects.toThrow('different company')
+  })
+
   it('recognizes a QuickBooks Fault in an HTTP 200 CompanyInfo response', async () => {
     await expect(
       quickbooksGetCompanyInfoTool.transformResponse!(
@@ -372,7 +387,8 @@ describe('QuickBooks tool boundaries', () => {
             },
           }),
           { status: 200 }
-        )
+        ),
+        authParams
       )
     ).rejects.toThrow(
       'QuickBooks request failed with HTTP 200. 3200: Authentication failed: Sanitized fault detail'