fix(quickbooks): enforce auth and record invariants

Author: Bill Leoutsakos

apps/sim/app/api/tools/quickbooks/upload-attachment/route.test.ts

@@ -247,6 +247,28 @@ describe('POST /api/tools/quickbooks/upload-attachment', () => {
     })
   })
 
+  it('rejects QuickBooks upload responses with an empty attachment object', async () => {
+    mockFetch.mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          AttachableResponse: [{ Attachable: {} }],
+          time: '2026-07-29T23:00:00Z',
+        }),
+        {
+          headers: { 'content-type': 'application/json' },
+          status: 200,
+        }
+      )
+    )
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(500)
+    await expect(response.json()).resolves.toEqual({
+      success: false,
+      error: 'QuickBooks attachment upload returned no attachment',
+    })
+  })
+
   it('rejects files over the buffered 25 MB attachment limit', async () => {
     mockProcessFilesToUserFiles.mockReturnValueOnce([
       { ...baseBody.file, size: 25 * 1024 * 1024 + 1 },

apps/sim/lib/oauth/quickbooks-token.ts

@@ -0,0 +1,18 @@
+const QUICKBOOKS_MAX_ACCESS_TOKEN_LENGTH = 4096
+
+export function normalizeQuickBooksAccessToken(accessToken: string): string {
+  if (/[\r\n]/.test(accessToken)) {
+    throw new Error('QuickBooks access token contains invalid characters')
+  }
+  if (accessToken.length > QUICKBOOKS_MAX_ACCESS_TOKEN_LENGTH) {
+    throw new Error(
+      `QuickBooks access token must be ${QUICKBOOKS_MAX_ACCESS_TOKEN_LENGTH} characters or less`
+    )
+  }
+
+  const normalizedAccessToken = accessToken.trim()
+  if (!normalizedAccessToken) {
+    throw new Error('QuickBooks access token is required')
+  }
+  return normalizedAccessToken
+}

apps/sim/lib/oauth/quickbooks.test.ts

@@ -56,6 +56,35 @@ describe('fetchQuickBooksUserInfo', () => {
     )
   })
 
+  it('normalizes and validates access tokens before making a user-info request', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          sub: 'intuit-user-1',
+        })
+      )
+    )
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(fetchQuickBooksUserInfo('  access-token  ', true)).resolves.toMatchObject({
+      sub: 'intuit-user-1',
+    })
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://sandbox-accounts.platform.intuit.com/v1/openid_connect/userinfo',
+      expect.objectContaining({
+        headers: expect.objectContaining({ Authorization: 'Bearer access-token' }),
+      })
+    )
+
+    await expect(fetchQuickBooksUserInfo('token\r\nX-Injected: true', true)).rejects.toThrow(
+      'QuickBooks access token contains invalid characters'
+    )
+    await expect(fetchQuickBooksUserInfo('x'.repeat(4097), true)).rejects.toThrow(
+      'QuickBooks access token must be 4096 characters or less'
+    )
+    expect(fetchMock).toHaveBeenCalledOnce()
+  })
+
   it('falls back to production when the sandbox endpoint rejects the token', async () => {
     const fetchMock = vi
       .fn()

apps/sim/lib/oauth/quickbooks.ts

@@ -4,6 +4,7 @@ import {
   readResponseJsonWithLimit,
   readResponseTextWithLimit,
 } from '@/lib/core/utils/stream-limits'
+import { normalizeQuickBooksAccessToken } from '@/lib/oauth/quickbooks-token'
 
 const logger = createLogger('QuickBooksOAuth')
 
@@ -38,6 +39,7 @@ export async function fetchQuickBooksUserInfo(
   if (!accessToken) {
     throw new Error('QuickBooks OAuth token response did not include an access token')
   }
+  const normalizedAccessToken = normalizeQuickBooksAccessToken(accessToken)
 
   const failures: string[] = []
 
@@ -46,7 +48,7 @@ export async function fetchQuickBooksUserInfo(
       const response = await fetch(endpoint, {
         headers: {
           Accept: 'application/json',
-          Authorization: `Bearer ${accessToken}`,
+          Authorization: `Bearer ${normalizedAccessToken}`,
         },
       })
 

apps/sim/tools/quickbooks/generic_operations.test.ts

@@ -592,6 +592,32 @@ describe('QuickBooks generic operations', () => {
     ).rejects.toThrow('QuickBooks API response did not include ExchangeRate')
   })
 
+  it('rejects successful entity responses without a record ID', async () => {
+    await expect(
+      quickBooksCreateRecordTool.transformResponse?.(
+        new Response(JSON.stringify({ Vendor: {} }), { status: 200 }),
+        {
+          accessToken: 'token',
+          realmId: '123145',
+          entity: 'Vendor',
+          payload: { DisplayName: 'Acme Supplies' },
+        }
+      )
+    ).rejects.toThrow('QuickBooks API response did not include Vendor')
+
+    await expect(
+      quickBooksCreateRecordTool.transformResponse?.(
+        new Response(JSON.stringify({ Vendor: { DisplayName: 'Acme Supplies' } }), { status: 200 }),
+        {
+          accessToken: 'token',
+          realmId: '123145',
+          entity: 'Vendor',
+          payload: { DisplayName: 'Acme Supplies' },
+        }
+      )
+    ).rejects.toThrow('QuickBooks API response did not include Vendor')
+  })
+
   it('transforms QuickBooks report sections', async () => {
     const response = new Response(
       JSON.stringify({

apps/sim/tools/quickbooks/utils.ts

@@ -1,5 +1,6 @@
 import { truncate } from '@sim/utils/string'
 import { readResponseTextWithLimit } from '@/lib/core/utils/stream-limits'
+import { normalizeQuickBooksAccessToken } from '@/lib/oauth/quickbooks-token'
 import type {
   QuickBooksApiEnvelope,
   QuickBooksAttachmentEntityName,
@@ -80,20 +81,8 @@ const QUICKBOOKS_RESOURCE_NAMES: Record<QuickBooksEntityName, string> = {
 }
 
 export function buildQuickBooksHeaders(accessToken: string): Record<string, string> {
-  if (/[\r\n]/.test(accessToken)) {
-    throw new Error('QuickBooks access token contains invalid characters')
-  }
-  if (accessToken.length > 4096) {
-    throw new Error('QuickBooks access token must be 4096 characters or less')
-  }
-
-  const normalizedAccessToken = accessToken.trim()
-  if (!normalizedAccessToken) {
-    throw new Error('QuickBooks access token is required')
-  }
-
   return {
-    Authorization: `Bearer ${normalizedAccessToken}`,
+    Authorization: `Bearer ${normalizeQuickBooksAccessToken(accessToken)}`,
     Accept: 'application/json',
     'Content-Type': 'application/json',
   }
@@ -500,7 +489,7 @@ export async function parseQuickBooksJson(response: Response): Promise<QuickBook
 export function assertQuickBooksAttachmentUploadResponse(
   data: QuickBooksApiEnvelope
 ): QuickBooksApiEnvelope {
-  const uploaded = data.AttachableResponse?.some((item) => isQuickBooksRecord(item.Attachable))
+  const uploaded = data.AttachableResponse?.some((item) => hasQuickBooksRecordId(item.Attachable))
   if (!uploaded) {
     throw new Error('QuickBooks attachment upload returned no attachment')
   }
@@ -555,7 +544,8 @@ export function extractQuickBooksRecord(
   entity: string
 ): QuickBooksRecord {
   const record = data[entity]
-  if (!isQuickBooksRecord(record)) {
+  const requiresId = entity !== 'Preferences' && entity !== 'ExchangeRate'
+  if (!isNonEmptyQuickBooksRecord(record) || (requiresId && !hasQuickBooksRecordId(record))) {
     throw new Error(`QuickBooks API response did not include ${entity}`)
   }
   return record
@@ -763,6 +753,14 @@ function isQuickBooksRecord(value: unknown): value is QuickBooksRecord {
   return value != null && typeof value === 'object' && !Array.isArray(value)
 }
 
+function isNonEmptyQuickBooksRecord(value: unknown): value is QuickBooksRecord {
+  return isQuickBooksRecord(value) && Object.keys(value).length > 0
+}
+
+function hasQuickBooksRecordId(value: unknown): value is QuickBooksRecord {
+  return isQuickBooksRecord(value) && typeof value.Id === 'string' && value.Id.trim().length > 0
+}
+
 function extractQuickBooksError(data: QuickBooksApiEnvelope): string | null {
   const errors = [
     ...extractFaultErrors(data.Fault),