fix(quickbooks): validate bill allocations before account lookup

Author: Bill Leoutsakos

apps/sim/tools/quickbooks/create_bill_payment.ts

@@ -158,6 +158,7 @@ export const quickbooksCreateBillPaymentTool: ToolConfig<
     maxResponseBytes: QUICKBOOKS_MAX_RESPONSE_BYTES,
   },
   directExecution: async (params, signal) => {
+    const body = buildQuickBooksCreateBillPaymentBody(params)
     const paymentAccountId = params.paymentAccountId.trim()
     if (!paymentAccountId) throw new Error('paymentAccountId is required')
 
@@ -188,7 +189,7 @@ export const quickbooksCreateBillPaymentTool: ToolConfig<
       {
         method: 'POST',
         headers: getQuickBooksToolHeaders(params.accessToken, 'application/json'),
-        body: JSON.stringify(buildQuickBooksCreateBillPaymentBody(params)),
+        body: JSON.stringify(body),
         signal,
       }
     )

apps/sim/tools/quickbooks/purchasing.test.ts

@@ -500,12 +500,41 @@ describe('QuickBooks BillPayment account compatibility', () => {
       const mutationUrl = new URL(fetchMock.mock.calls[1][0] as URL)
       expect(mutationUrl.pathname).toBe('/v3/company/123456789/billpayment')
       expect(mutationUrl.searchParams.get('requestid')).toBe('sanitized-request-id')
-      expect(JSON.parse(fetchMock.mock.calls[1][1].body as string)).toMatchObject({
-        PayType: payType,
-      })
+      expect(JSON.parse(fetchMock.mock.calls[1][1].body as string)).toEqual(
+        buildQuickBooksCreateBillPaymentBody({ ...params, paymentType })
+      )
     }
   )
 
+  it.each([
+    ['allocation-total mismatch', [{ billId: '12', amount: 24 }]],
+    ['empty allocations', []],
+    ['malformed allocation', [null]],
+    [
+      'duplicate Bill IDs',
+      [
+        { billId: '12', amount: 12.5 },
+        { billId: '12', amount: 12.5 },
+      ],
+    ],
+    ['non-finite allocation', [{ billId: '12', amount: Number.POSITIVE_INFINITY }]],
+    [
+      'more than 100 allocations',
+      Array.from({ length: 101 }, (_, index) => ({ billId: String(index), amount: 1 })),
+    ],
+  ])('rejects %s before fetching the payment account', async (_name, billAllocations) => {
+    const fetchMock = vi.fn()
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      quickbooksCreateBillPaymentTool.directExecution!({
+        ...params,
+        billAllocations: billAllocations as QuickBooksCreateBillPaymentParams['billAllocations'],
+      })
+    ).rejects.toThrow()
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
   it.each([
     ['check', 'Credit Card', 'Bank'],
     ['credit_card', 'Bank', 'Credit Card'],