fix(quickbooks): close remaining response gaps

Author: Bill Leoutsakos

apps/sim/app/api/tools/quickbooks/upload-attachment/route.test.ts

@@ -89,6 +89,19 @@ describe('POST /api/tools/quickbooks/upload-attachment', () => {
     expect(mockFetch).not.toHaveBeenCalled()
   })
 
+  it('rejects whitespace-only access tokens at the API boundary', async () => {
+    const response = await POST(
+      createMockRequest('POST', {
+        ...baseBody,
+        accessToken: '   ',
+      })
+    )
+
+    expect(response.status).toBe(400)
+    expect(mockProcessFilesToUserFiles).not.toHaveBeenCalled()
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
   it('uploads an authorized file using QuickBooks multipart field names', async () => {
     const response = await POST(createMockRequest('POST', baseBody))
     expect(response.status).toBe(200)

apps/sim/lib/api/contracts/tools/quickbooks.ts

@@ -8,7 +8,8 @@ export const quickBooksUploadAttachmentBodySchema = z.object({
     .string()
     .min(1, 'Access token is required')
     .max(4096, 'Access token must be 4096 characters or less')
-    .regex(/^[^\r\n]+$/, 'Access token contains invalid characters'),
+    .regex(/^[^\r\n]+$/, 'Access token contains invalid characters')
+    .refine((value) => value.trim().length > 0, 'Access token is required'),
   realmId: z
     .string()
     .min(1, 'QuickBooks company ID is required')

apps/sim/tools/quickbooks/generic_operations.test.ts

@@ -107,6 +107,14 @@ describe('QuickBooks generic operations', () => {
   })
 
   it('builds current locale and SKU-dependent entity endpoints', () => {
+    expect(
+      buildQuickBooksRecordUrl({
+        realmId: '123145',
+        entity: 'Budget',
+        operation: 'read',
+        recordId: '40',
+      }).url
+    ).toBe('https://quickbooks.api.intuit.com/v3/company/123145/budget/40?minorversion=75')
     expect(
       buildQuickBooksRecordUrl({
         realmId: '123145',
@@ -644,6 +652,19 @@ describe('QuickBooks generic operations', () => {
     })
   })
 
+  it('rejects successful report responses without report sections', async () => {
+    await expect(
+      quickBooksRunReportTool.transformResponse?.(
+        new Response(JSON.stringify({ time: '2026-01-20T10:00:00-08:00' }), { status: 200 }),
+        {
+          accessToken: 'token',
+          realmId: '123145',
+          report: 'AgedPayables',
+        }
+      )
+    ).rejects.toThrow('QuickBooks report response did not include Header, Columns, and Rows')
+  })
+
   it('transforms QuickBooks CDC entity groups and deleted records', async () => {
     const response = new Response(
       JSON.stringify({

apps/sim/tools/quickbooks/run_report.ts

@@ -64,14 +64,21 @@ export const quickBooksRunReportTool: ToolConfig<QuickBooksReportParams, QuickBo
       if (!params) throw new Error('QuickBooks report parameters are required')
       const { report } = buildQuickBooksReportUrl(params)
       const data = await parseQuickBooksJson(response)
+      if (
+        !isQuickBooksReportSection(data.Header) ||
+        !isQuickBooksReportSection(data.Columns) ||
+        !isQuickBooksReportSection(data.Rows)
+      ) {
+        throw new Error('QuickBooks report response did not include Header, Columns, and Rows')
+      }
 
       return {
         success: true,
         output: {
           report,
-          header: data.Header ?? {},
-          columns: data.Columns ?? {},
-          rows: data.Rows ?? {},
+          header: data.Header,
+          columns: data.Columns,
+          rows: data.Rows,
           time: typeof data.time === 'string' ? data.time : null,
         },
       }
@@ -98,3 +105,12 @@ export const quickBooksRunReportTool: ToolConfig<QuickBooksReportParams, QuickBo
       },
     },
   }
+
+function isQuickBooksReportSection(value: unknown): value is Record<string, unknown> {
+  return (
+    value != null &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    Object.keys(value).length > 0
+  )
+}

apps/sim/tools/quickbooks/types.ts

@@ -43,6 +43,7 @@ export const QUICKBOOKS_READABLE_ENTITIES = [
   'Attachable',
   'Bill',
   'BillPayment',
+  'Budget',
   'Class',
   'CompanyCurrency',
   'CompanyInfo',