feat(quickbooks): add procurement integration

[BillLeoutsakosvl346]

Summary

• Add QuickBooks Online OAuth support and procurement-focused query tools
• Add QuickBooks block for vendors, purchase orders, bills, and custom queries
• Generate integration docs and registry metadata

Type of Change

• New feature

Testing

• bun run scripts/generate-docs.ts
• bun run lint
• bun run test tools/quickbooks/quickbooks.test.ts lib/oauth/oauth.test.ts
• bun run type-check
• bun run check:api-validation:strict
• bun run check:bare-icons
• ship audit suite passed

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 29, 2026 11:32pm

[cursor]

PR Summary

Medium Risk
New OAuth and broad write/delete access to live accounting data increase blast radius; mitigations include scoped tools, upload auth/file checks, and solid test coverage, but misconfigured workflows could still mutate production books.

Overview
Introduces QuickBooks Online as an OAuth integration so workflows can read and write company accounting data using a required realmId (company ID).

OAuth and configuration: Intuit OAuth is wired through auth, env (QUICKBOOKS_CLIENT_*), token refresh (Basic auth), scopes including com.intuit.quickbooks.accounting, and the integrations/block registries plus docs and QuickBooksIcon.

Tools and block: About 20 tools cover generic CRUD, SQL-like query, financial reports, CDC (get_changes), batch requests, vendor/PO/bill list helpers, PDF download/send, attachment URL/upload, and company preferences/exchange rates. Shared helpers enforce entity allowlists, pagination limits, sandbox vs production hosts, response size caps, and nested QuickBooks faults on HTTP 200. The QuickBooks block routes each operation to the matching tool with conditional UI (entities, sync tokens, payloads, file upload).

Attachment upload: Multipart uploads go through POST /api/tools/quickbooks/upload-attachment with internal auth, assertToolFileAccess, a 100MB limit, access-token header injection checks, and Intuit multipart field names—the tool delegates to this route instead of calling Intuit from the client.

Tests: Unit/route tests cover URL building, delete payload rules, upload auth and fault handling, and block param mapping.

^{Reviewed by Cursor Bugbot for commit 117f122. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Adds QuickBooks Online OAuth, procurement-focused tools/block, upload-attachment API route, docs, and registry metadata.

• OAuth provider wiring for Intuit (auth, token refresh, scopes, env vars)
• Block/tools covering list/CRUD, reports, CDC, batch, query, attachments, and PDFs
• Sandbox vs production API host via advanced apiEnvironment (defaults to production)
• Manual Company ID (realmId) retained as required block input for v1

Confidence Score: 5/5

This PR appears safe to merge; prior review threads are resolved or accepted as intentional v1 tradeoffs.

No blocking failure remains. Sandbox API host selection is implemented and tested; manual Company ID was accepted as a v1 constraint of the OAuth hook boundary.

Important Files Changed

Filename	Overview
apps/sim/tools/quickbooks/utils.ts	Shared URL/query builders with production/sandbox host selection and validation.
apps/sim/blocks/blocks/quickbooks.ts	Block UI/ops mapping including required Company ID and advanced Environment selector.
apps/sim/lib/auth/auth.ts	QuickBooks genericOAuth provider and userinfo fetch; realmId left as manual Company ID for v1.
apps/sim/tools/quickbooks/quickbooks.test.ts	Covers sandbox host selection and invalid environment rejection.

Sequence Diagram

sequenceDiagram
  participant User
  participant Block as QuickBooks Block
  participant OAuth as OAuth / Better Auth
  participant Tools as QuickBooks Tools
  participant QBO as Intuit QBO API

  User->>OAuth: Connect QuickBooks
  OAuth->>QBO: OAuth2 authorize + token
  OAuth-->>User: Stored credential
  User->>Block: Operation + Company ID + Environment
  Block->>Tools: Map params (realmId, apiEnvironment, ...)
  Tools->>QBO: Request to prod or sandbox host
  QBO-->>Tools: JSON / PDF / attachment
  Tools-->>Block: Normalized tool output

Loading

_{Reviews (5): Last reviewed commit: "fix(quickbooks): validate attachment upl..." | Re-trigger Greptile}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 75579c9. Configure here.}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 117f122. Configure here.}

[cursor]

Direct calls skip token sanitization

Medium Severity

The upload-attachment API rejects accessToken values containing CR/LF, but buildQuickBooksHeaders builds Authorization: Bearer … for every other QuickBooks tool without the same check, so header-breaking tokens blocked on upload can still reach direct Intuit requests.

Additional Locations (1)

• apps/sim/lib/api/contracts/tools/quickbooks.ts#L6-L11

 

^{Reviewed by Cursor Bugbot for commit 117f122. Configure here.}

[cursor]

CRUD marks success without record

Medium Severity

After parseQuickBooksJson succeeds, create, get, and update tools always return success: true even when extractQuickBooksRecord yields no entity payload, so workflows can treat failed or empty Intuit bodies as completed operations.

Additional Locations (2)

• apps/sim/tools/quickbooks/get_record.ts#L74-L81
• apps/sim/tools/quickbooks/update_record.ts#L97-L104

 

^{Reviewed by Cursor Bugbot for commit 117f122. Configure here.}