feat(quickbooks): add read-only procurement integration

[BillLeoutsakosvl346]

Summary

Adds a clean, read-only QuickBooks Online procurement integration with one OAuth connection bound to one selected QuickBooks company.

• Adds four fixed actions: get company info, list vendors, list purchase orders, and list bills.
• Binds realmId to the validated OAuth credential, so workflows cannot choose or override a company.
• Pins Accounting API requests to minor version 75 and selects sandbox/production hosts only from server configuration.
• Adds bounded response parsing, fixed-entity queries, explicit pagination, sanitized QuickBooks Fault handling, and no internal retries or automatic pagination.
• Adds the QuickBooks block, cropped official circular icon, metadata/templates, registry entries, generated integration docs, and contract tests.

Review fixes included

• Keeps the QuickBooks Fault extractor explicit to QuickBooks tools so unrelated provider errors retain their existing behavior.
• Detects QuickBooks Fault envelopes even when Intuit returns HTTP 200, including during OAuth-time CompanyInfo validation.
• Removes raw non-JSON provider bodies from tool output and logs.
• Caps OAuth token refresh responses at 64 KiB and removes token fragments/raw token responses from logging.
• Preserves bounded 1 MiB UserInfo and 8 MiB Accounting API reads.
• Corrects registry ordering and generated CompanyInfo schema documentation.

Validation

• bunx vitest run tools/index.test.ts tools/quickbooks lib/oauth/quickbooks.test.ts lib/oauth/oauth.test.ts lib/oauth/utils.test.ts app/api/auth/oauth/token/route.test.ts blocks/blocks.test.ts — 8 files, 387 tests passed.
• bun run type-check — 23/23 monorepo tasks passed.
• bun run lint:check — passed; only two pre-existing Biome false-positive warnings on terminal fit() method calls.
• bun run generate-docs — passed.
• bun run check:bare-icons — passed.
• bun run check:icon-paths — passed.
• bun run check:api-validation — passed.
• git diff --check origin/staging...HEAD — passed.
• Independent GPT-5.6-sol re-review found no remaining code issues and returned READY FOR DRAFT PR.

Manual sandbox acceptance still required

This PR remains a draft until a live Intuit sandbox confirms UserInfo realmId delivery and the full acceptance flow: CompanyInfo identity matching, all four actions, explicit page continuation, empty pages, two-company isolation, reconnect behavior, refresh-token rotation, revoked-credential guidance, and sandbox-host isolation. No credentials or unsanitized accounting data are committed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 1, 2026 8:05pm

[cursor]

PR Summary

Medium Risk
Touches OAuth callback, credential identity, and token issuance for a new financial-data provider; scope is large but read-only with validation, bounded parsing, and extensive tests—live sandbox acceptance is still noted as pending.

Overview
Adds a read-only QuickBooks Online integration: OAuth binds one credential to one company (realmId), with four workflow actions—company info, vendors, purchase orders, and bills.

OAuth and auth wires Intuit OAuth (scopes, token exchange, refresh with rotation), validates realmId on callback before code exchange, and scopes callback realm via async context during Better Auth handling. Token API returns realmId only for QuickBooks credentials; malformed company identities fail with reconnect guidance.

Runtime adds the QuickBooks block (pagination, templates/skills), tool client with bounded reads, minor version 75, explicit pagination, and a dedicated QuickBooks Fault error extractor (not global fallback). Serializer fix keeps singleton OAuth credentials when other advanced fields are set.

Docs and config: icon, integration registry/docs, QUICKBOOKS_* env vars, and expanded OAuth refresh tests (size limits, no sensitive leakage).

^{Reviewed by Cursor Bugbot for commit 9a6a51c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Adds a read-only QuickBooks Online procurement integration.

• Registers four tools for company information, vendors, purchase orders, and bills.
• Binds QuickBooks company identity to OAuth credentials and propagates the validated realm into tool execution.
• Adds bounded response parsing, sanitized fault handling, explicit pagination, environment-selected API hosts, and token-refresh hardening.
• Adds the block configuration, registries, icons, generated documentation, templates, and contract tests.

Confidence Score: 5/5

The PR appears safe to merge based on the reviewed code, with no actionable defects identified.

The company identifier remains credential-bound through OAuth validation and tool execution, requests are constrained to fixed read-only entities and configured hosts, and response, pagination, refresh, and error-handling paths include explicit bounds and validation.

Important Files Changed

Filename	Overview
apps/sim/lib/oauth/quickbooks.ts	Defines and validates the company-bound QuickBooks account identity and OAuth connection profile.
apps/sim/lib/auth/auth.ts	Registers the QuickBooks generic OAuth flow and validates the selected company during connection.
apps/sim/app/api/auth/oauth/token/route.ts	Extracts the bound QuickBooks realm from authorized credentials and returns it to tool execution.
apps/sim/lib/quickbooks/client.ts	Centralizes environment-specific hosts, URL construction, response limits, headers, and CompanyInfo validation.
apps/sim/tools/quickbooks/utils.ts	Implements fixed-entity queries, bounded JSON parsing, fault detection, pagination validation, and response transformation.
apps/sim/tools/index.ts	Propagates provider context, supports per-tool response limits, and sanitizes QuickBooks errors before output or logging.
apps/sim/blocks/blocks/quickbooks.ts	Adds the QuickBooks block, four fixed operations, validated pagination mapping, templates, and skills.
apps/sim/lib/oauth/oauth.ts	Registers QuickBooks OAuth metadata and hardens shared refresh-response parsing and logging.

Sequence Diagram

sequenceDiagram
  participant User
  participant OAuth as QuickBooks OAuth
  participant Auth as Sim Auth
  participant Token as OAuth Token Route
  participant Tool as QuickBooks Tool
  participant QBO as QuickBooks Accounting API
  User->>OAuth: Authorize selected company
  OAuth-->>Auth: Authorization code
  Auth->>OAuth: Exchange code and fetch UserInfo
  Auth->>QBO: Validate CompanyInfo for realmId
  Auth-->>User: Store company-bound credential
  Tool->>Token: Request refreshed credential context
  Token-->>Tool: accessToken and bound realmId
  Tool->>QBO: Fixed read-only request for bound company
  QBO-->>Tool: CompanyInfo or paginated entities
  Tool-->>User: Sanitized bounded response

Loading

_{Reviews (1): Last reviewed commit: "feat(quickbooks): add read-only procurem..." | Re-trigger Greptile}

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 33d9afb. Configure here.}

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 29bfcc5. Configure here.}

[BillLeoutsakosvl346]

@cursor review

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 19e00eb. Configure here.}

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 00fc671. Configure here.}

[BillLeoutsakosvl346]

@cursor review

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 970d3b1. Configure here.}

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6df18b0. Configure here.}