fix(quickbooks): sanitize bill payment faults

Author: Bill Leoutsakos

apps/sim/tools/quickbooks/create_bill_payment.ts

@@ -1,6 +1,7 @@
 import { readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
 import { ErrorExtractorId, extractErrorMessage } from '@/tools/error-extractors'
 import { QUICKBOOKS_MAX_RESPONSE_BYTES } from '@/tools/quickbooks/client'
+import { sanitizeQuickBooksFaultData } from '@/tools/quickbooks/fault'
 import { buildQuickBooksCreateBillPaymentBody } from '@/tools/quickbooks/purchasing_utils'
 import type {
   QuickBooksAccount,
@@ -39,7 +40,7 @@ async function getQuickBooksDirectExecutionError(
   const errorInfo = {
     status: response.status,
     statusText: response.statusText,
-    data,
+    data: sanitizeQuickBooksFaultData(data),
     headers: response.headers,
   }
   return Object.assign(

apps/sim/tools/quickbooks/purchasing.test.ts

@@ -593,6 +593,54 @@ describe('QuickBooks BillPayment account compatibility', () => {
     )
   })
 
+  it('allowlists QuickBooks fault data from direct execution errors', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue(
+        Response.json(
+          {
+            Fault: {
+              Error: [
+                {
+                  code: '3200',
+                  Message: 'Authentication failed',
+                  Detail: 'Reconnect the credential',
+                  secret: 'must-not-leak',
+                },
+              ],
+              privateMetadata: 'must-not-leak',
+            },
+            undocumentedRootField: 'must-not-leak',
+          },
+          { status: 401 }
+        )
+      )
+    )
+
+    let caught: unknown
+    try {
+      await quickbooksCreateBillPaymentTool.directExecution!(params)
+    } catch (error) {
+      caught = error
+    }
+
+    expect(caught).toBeInstanceOf(Error)
+    expect((caught as Error & { data?: unknown }).data).toEqual({
+      Fault: {
+        Error: [
+          {
+            code: '3200',
+            Message: 'Authentication failed',
+            Detail: 'Reconnect the credential',
+          },
+        ],
+      },
+    })
+    expect(JSON.stringify((caught as Error & { data?: unknown }).data)).not.toContain(
+      'must-not-leak'
+    )
+  })
+
   it('propagates cancellation and does not create a payment', async () => {
     const controller = new AbortController()
     const fetchMock = vi.fn().mockImplementationOnce(() => {