feat(quickbooks): add procurement integration - #6061
feat(quickbooks): add procurement integration#6061BillLeoutsakosvl346 wants to merge 19 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview Auth & platform wiring: Intuit OAuth provider (Basic auth token refresh, OpenID userinfo with sandbox/production fallback), Capabilities: A QuickBooks workflow block routes 20 operations to matching tools—generic CRUD/list/query, vendors/bills/PO shortcuts, financial reports, preferences and exchange rates, CDC ( Upload path: Attachments use a dedicated Tests: Broad coverage for utils, tools, block param mapping, OAuth userinfo, and the upload API route. Reviewed by Cursor Bugbot for commit cbebb5f. Bugbot is set up for automated code reviews on this repo. Configure here. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Greptile SummaryAdds QuickBooks Online OAuth, a procurement-focused block/tools surface, attachment upload API, docs, and registry metadata.
Confidence Score: 5/5This PR appears safe to merge; prior Greptile threads are resolved or explicitly accepted for v1. Sandbox host selection is implemented end-to-end with tests, and the realmId/Company ID limitation was accepted as a documented v1 tradeoff with no remaining incomplete fix on that path.
|
| Filename | Overview |
|---|---|
| apps/sim/tools/quickbooks/utils.ts | URL builders resolve production vs sandbox hosts from apiEnvironment; prior production-only host issue is addressed. |
| apps/sim/blocks/blocks/quickbooks.ts | Adds Environment dropdown and passes apiEnvironment through tool params; Company ID remains required manual input per v1 tradeoff. |
| apps/sim/lib/auth/auth.ts | Registers QuickBooks genericOAuth provider; realmId still not auto-persisted (accepted v1). |
| apps/sim/app/api/tools/quickbooks/upload-attachment/route.ts | Multipart upload route forwards apiEnvironment into QuickBooks upload URL construction. |
Sequence Diagram
sequenceDiagram
participant User
participant Block as QuickBooks Block
participant OAuth as Better Auth OAuth
participant Tool as QuickBooks Tools
participant QBO as QuickBooks Online API
User->>OAuth: Connect QuickBooks
OAuth->>QBO: OAuth2 + userinfo
OAuth-->>User: Stored credential
User->>Block: Operation + Company ID + Environment
Block->>Tool: credential, realmId, apiEnvironment, params
Tool->>QBO: REST call (prod or sandbox host)
QBO-->>Tool: JSON / PDF / attachment
Tool-->>Block: Normalized tool output
Reviews (13): Last reviewed commit: "fix(quickbooks): close remaining respons..." | Re-trigger Greptile
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 75579c9. Configure here.
|
@cursor review |
|
@cursor review |
|
@cursor review |
|
@cursor review |
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit db63eba. Configure here.
|
@cursor review |
|
@cursor review |
| throw new Error( | ||
| `QuickBooks does not support ${normalizedContentType} content for .${extension} attachments` | ||
| ) | ||
| } |
There was a problem hiding this comment.
Octet stream blocks PDF uploads
Medium Severity
validateQuickBooksAttachmentFile rejects uploads when the resolved MIME is application/octet-stream, because that type is not on the per-extension whitelist. Many PDFs (and other allowed types) arrive with that generic type from the browser or from downloadServableFileFromStorage, which keeps userFile.type when set and does not treat octet-stream as “unknown” and infer from the filename. Valid attachments can fail validation before Intuit is called.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit cbebb5f. Configure here.
|
@cursor review |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit cbebb5f. Configure here.
| function normalizeMinorVersion(value?: string): string { | ||
| const trimmed = value?.trim() | ||
| return trimmed || QUICKBOOKS_MINOR_VERSION | ||
| } |
There was a problem hiding this comment.
Invalid minor version accepted
Low Severity
normalizeMinorVersion forwards any non-empty trimmed string into minorversion query params for direct Accounting tools, while the upload route contract requires one to five digits. A typo like abc in advanced Minor Version is not rejected before the Intuit request.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit cbebb5f. Configure here.
1 participant
Summary
Type of Change
Testing
bun run scripts/generate-docs.tsbun run lintbun run test tools/quickbooks/quickbooks.test.ts lib/oauth/oauth.test.tsbun run type-checkbun run check:api-validation:strictbun run check:bare-iconsChecklist