fix(quickbooks): harden master data outputs

Bill Leoutsakos · Bill Leoutsakos · commit 75ed53ef4d3d · 2026-08-01T13:05:31.000-07:00
diff --git a/apps/sim/blocks/blocks/quickbooks.ts b/apps/sim/blocks/blocks/quickbooks.ts
@@ -24,6 +24,10 @@ const PAGINATED_OPERATIONS = [
   'quickbooks_list_purchase_orders',
   'quickbooks_list_bills',
 ] as const
+const TRANSACTION_LIST_OPERATIONS = [
+  'quickbooks_list_purchase_orders',
+  'quickbooks_list_bills',
+] as const
 const QUICKBOOKS_OPERATIONS = [
   'quickbooks_get_company_info',
   MASTER_DATA_OPERATION,
@@ -67,6 +71,13 @@ function optionalValue(value: unknown): unknown {
   return typeof value === 'string' && value.trim() === '' ? undefined : value
 }
 
+function paginationCondition(values?: Record<string, unknown>) {
+  if (values?.operation === MASTER_DATA_OPERATION) {
+    return { field: 'readMode', value: 'list' }
+  }
+  return { field: 'operation', value: [...TRANSACTION_LIST_OPERATIONS] }
+}
+
 export const QuickBooksBlock: BlockConfig<QuickBooksResponse> = {
   type: 'quickbooks',
   name: 'QuickBooks',
@@ -157,15 +168,7 @@ export const QuickBooksBlock: BlockConfig<QuickBooksResponse> = {
       type: 'short-input',
       placeholder: '1',
       mode: 'advanced',
-      condition: {
-        field: 'operation',
-        value: [...PAGINATED_OPERATIONS],
-        and: {
-          field: 'readMode',
-          value: 'by_id',
-          not: true,
-        },
-      },
+      condition: paginationCondition,
       value: () => '1',
     },
     {
@@ -174,15 +177,7 @@ export const QuickBooksBlock: BlockConfig<QuickBooksResponse> = {
       type: 'short-input',
       placeholder: '25',
       mode: 'advanced',
-      condition: {
-        field: 'operation',
-        value: [...PAGINATED_OPERATIONS],
-        and: {
-          field: 'readMode',
-          value: 'by_id',
-          not: true,
-        },
-      },
+      condition: paginationCondition,
       value: () => '25',
     },
     {
@@ -620,47 +615,27 @@ export const QuickBooksBlock: BlockConfig<QuickBooksResponse> = {
       type: 'array',
       description:
         'Account, Customer, Vendor, Item, Employee, PurchaseOrder, or Bill objects with native QuickBooks fields',
-      condition: {
-        field: 'operation',
-        value: [...PAGINATED_OPERATIONS],
-        and: { field: 'readMode', value: 'by_id', not: true },
-      },
+      condition: { field: 'operation', value: [...PAGINATED_OPERATIONS] },
     },
     startPosition: {
       type: 'number',
       description: 'One-based position of the first returned list item',
-      condition: {
-        field: 'operation',
-        value: [...PAGINATED_OPERATIONS],
-        and: { field: 'readMode', value: 'by_id', not: true },
-      },
+      condition: { field: 'operation', value: [...PAGINATED_OPERATIONS] },
     },
     maxResults: {
       type: 'number',
       description: 'Actual number of items reported for the list response',
-      condition: {
-        field: 'operation',
-        value: [...PAGINATED_OPERATIONS],
-        and: { field: 'readMode', value: 'by_id', not: true },
-      },
+      condition: { field: 'operation', value: [...PAGINATED_OPERATIONS] },
     },
     nextStartPosition: {
       type: 'number',
       description: 'Position to pass into an explicit next-page request',
-      condition: {
-        field: 'operation',
-        value: [...PAGINATED_OPERATIONS],
-        and: { field: 'readMode', value: 'by_id', not: true },
-      },
+      condition: { field: 'operation', value: [...PAGINATED_OPERATIONS] },
     },
     hasMore: {
       type: 'boolean',
       description: 'Conservative indication that another list page may exist',
-      condition: {
-        field: 'operation',
-        value: [...PAGINATED_OPERATIONS],
-        and: { field: 'readMode', value: 'by_id', not: true },
-      },
+      condition: { field: 'operation', value: [...PAGINATED_OPERATIONS] },
     },
     record: {
       type: 'json',
diff --git a/apps/sim/tools/quickbooks/quickbooks.test.ts b/apps/sim/tools/quickbooks/quickbooks.test.ts
@@ -7,6 +7,7 @@ import {
   getQuickBooksUserInfoUrl,
   QUICKBOOKS_MAX_RESPONSE_BYTES,
 } from '@/tools/quickbooks/client'
+import { evaluateSubBlockCondition } from '@/lib/workflows/subblocks/visibility'
 import { quickbooksCreateCustomerTool } from '@/tools/quickbooks/create_customer'
 import { quickbooksCreateItemTool } from '@/tools/quickbooks/create_item'
 import { quickbooksCreateVendorTool } from '@/tools/quickbooks/create_vendor'
@@ -299,6 +300,74 @@ describe('QuickBooks master-data reader', () => {
     })
   })
 
+  it('allowlists Employee output fields and removes sensitive provider properties', async () => {
+    const employee = {
+      Id: '5',
+      SyncToken: '2',
+      DisplayName: 'Sanitized Employee',
+      Active: true,
+      SSN: '000-00-0000',
+      BankAccountNumber: 'sensitive',
+      PrimaryEmailAddr: {
+        Address: 'employee@example.test',
+        VerificationToken: 'sensitive',
+      },
+      PrimaryAddr: {
+        Line1: '123 Main St',
+        PostalCode: '94105',
+        InternalGeoCode: 'sensitive',
+      },
+      MetaData: {
+        CreateTime: '2026-01-01T00:00:00Z',
+        InternalRevision: 'sensitive',
+      },
+    }
+    const listParamsForEmployee: QuickBooksReadMasterDataParams = {
+      ...listParams,
+      recordType: 'employee',
+    }
+
+    await expect(
+      quickbooksReadMasterDataTool.transformResponse!(
+        Response.json({ QueryResponse: { Employee: [employee] } }),
+        listParamsForEmployee
+      )
+    ).resolves.toMatchObject({
+      success: true,
+      output: {
+        recordType: 'employee',
+        items: [
+          {
+            Id: '5',
+            SyncToken: '2',
+            DisplayName: 'Sanitized Employee',
+            Active: true,
+            PrimaryEmailAddr: { Address: 'employee@example.test' },
+            PrimaryAddr: { Line1: '123 Main St', PostalCode: '94105' },
+            MetaData: { CreateTime: '2026-01-01T00:00:00Z' },
+          },
+        ],
+      },
+    })
+
+    const listResult = await quickbooksReadMasterDataTool.transformResponse!(
+      Response.json({ QueryResponse: { Employee: [employee] } }),
+      listParamsForEmployee
+    )
+    expect(listResult.output.items?.[0]).not.toHaveProperty('SSN')
+    expect(listResult.output.items?.[0]).not.toHaveProperty('BankAccountNumber')
+    expect(listResult.output.items?.[0]?.PrimaryEmailAddr).not.toHaveProperty('VerificationToken')
+    expect(listResult.output.items?.[0]?.PrimaryAddr).not.toHaveProperty('InternalGeoCode')
+    expect(listResult.output.items?.[0]?.MetaData).not.toHaveProperty('InternalRevision')
+
+    const byIdResult = await quickbooksReadMasterDataTool.transformResponse!(
+      Response.json({ Employee: employee }),
+      { ...listParamsForEmployee, readMode: 'by_id', recordId: '5' }
+    )
+    expect(byIdResult.output.item).not.toHaveProperty('SSN')
+    expect(byIdResult.output.item).not.toHaveProperty('BankAccountNumber')
+  })
+
   it('rejects missing IDs, unknown types and unknown modes before a request', () => {
     const requestUrl = quickbooksReadMasterDataTool.request.url as (
       params: QuickBooksReadMasterDataParams
@@ -672,9 +741,37 @@ describe('QuickBooks tool and block boundaries', () => {
       and: { field: 'readMode', value: 'by_id' },
     })
     expect(subBlocks.startPosition.mode).toBe('advanced')
-    expect(subBlocks.startPosition.condition).toMatchObject({
+    expect(
+      evaluateSubBlockCondition(subBlocks.startPosition.condition, {
+        operation: 'quickbooks_read_master_data',
+        readMode: 'list',
+      })
+    ).toBe(true)
+    expect(
+      evaluateSubBlockCondition(subBlocks.startPosition.condition, {
+        operation: 'quickbooks_read_master_data',
+        readMode: 'by_id',
+      })
+    ).toBe(false)
+    expect(
+      evaluateSubBlockCondition(subBlocks.startPosition.condition, {
+        operation: 'quickbooks_list_purchase_orders',
+        readMode: 'by_id',
+      })
+    ).toBe(true)
+    expect(
+      evaluateSubBlockCondition(subBlocks.maxResults.condition, {
+        operation: 'quickbooks_list_bills',
+        readMode: 'by_id',
+      })
+    ).toBe(true)
+    expect(QuickBooksBlock.outputs.items.condition).toEqual({
       field: 'operation',
-      and: { field: 'readMode', value: 'by_id', not: true },
+      value: [
+        'quickbooks_read_master_data',
+        'quickbooks_list_purchase_orders',
+        'quickbooks_list_bills',
+      ],
     })
     expect(subBlocks.syncToken.condition).toEqual({
       field: 'operation',
diff --git a/apps/sim/tools/quickbooks/read_master_data.ts b/apps/sim/tools/quickbooks/read_master_data.ts
@@ -1,6 +1,8 @@
 import { QUICKBOOKS_MAX_RESPONSE_BYTES } from '@/tools/quickbooks/client'
 import { ErrorExtractorId } from '@/tools/error-extractors'
 import type {
+  QuickBooksAddress,
+  QuickBooksEmployee,
   QuickBooksMasterDataRecord,
   QuickBooksReadMasterDataParams,
   QuickBooksReadMasterDataResponse,
@@ -19,6 +21,102 @@ import {
 } from '@/tools/quickbooks/utils'
 import type { ToolConfig } from '@/tools/types'
 
+function optionalString(value: unknown): string | undefined {
+  return typeof value === 'string' ? value : undefined
+}
+
+function optionalBoolean(value: unknown): boolean | undefined {
+  return typeof value === 'boolean' ? value : undefined
+}
+
+function sanitizeEmployeeAddress(value: unknown): QuickBooksAddress | undefined {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined
+  const source = value as Record<string, unknown>
+  const address: QuickBooksAddress = {}
+  for (const key of [
+    'Id',
+    'Line1',
+    'Line2',
+    'Line3',
+    'Line4',
+    'Line5',
+    'City',
+    'Country',
+    'CountrySubDivisionCode',
+    'PostalCode',
+    'Lat',
+    'Long',
+  ] as const) {
+    const field = optionalString(source[key])
+    if (field !== undefined) address[key] = field
+  }
+  return Object.keys(address).length > 0 ? address : undefined
+}
+
+function sanitizeEmployee(value: QuickBooksMasterDataRecord): QuickBooksEmployee {
+  const source = value as Record<string, unknown>
+  const id = optionalString(source.Id)?.trim()
+  if (!id) throw new Error('QuickBooks Employee response is missing Id')
+
+  const employee: QuickBooksEmployee = { Id: id }
+  for (const key of [
+    'SyncToken',
+    'DisplayName',
+    'GivenName',
+    'MiddleName',
+    'FamilyName',
+    'Suffix',
+    'Title',
+    'PrintOnCheckName',
+  ] as const) {
+    const field = optionalString(source[key])
+    if (field !== undefined) employee[key] = field
+  }
+  for (const key of ['Active', 'BillableTime', 'sparse'] as const) {
+    const field = optionalBoolean(source[key])
+    if (field !== undefined) employee[key] = field
+  }
+
+  const primaryPhone = source.PrimaryPhone
+  if (primaryPhone && typeof primaryPhone === 'object' && !Array.isArray(primaryPhone)) {
+    const freeFormNumber = optionalString((primaryPhone as Record<string, unknown>).FreeFormNumber)
+    if (freeFormNumber !== undefined) employee.PrimaryPhone = { FreeFormNumber: freeFormNumber }
+  }
+  const mobile = source.Mobile
+  if (mobile && typeof mobile === 'object' && !Array.isArray(mobile)) {
+    const freeFormNumber = optionalString((mobile as Record<string, unknown>).FreeFormNumber)
+    if (freeFormNumber !== undefined) employee.Mobile = { FreeFormNumber: freeFormNumber }
+  }
+  const primaryEmail = source.PrimaryEmailAddr
+  if (primaryEmail && typeof primaryEmail === 'object' && !Array.isArray(primaryEmail)) {
+    const address = optionalString((primaryEmail as Record<string, unknown>).Address)
+    if (address !== undefined) employee.PrimaryEmailAddr = { Address: address }
+  }
+
+  employee.PrimaryAddr = sanitizeEmployeeAddress(source.PrimaryAddr)
+  const metadata = source.MetaData
+  if (metadata && typeof metadata === 'object' && !Array.isArray(metadata)) {
+    const metadataSource = metadata as Record<string, unknown>
+    const createTime = optionalString(metadataSource.CreateTime)
+    const lastUpdatedTime = optionalString(metadataSource.LastUpdatedTime)
+    if (createTime !== undefined || lastUpdatedTime !== undefined) {
+      employee.MetaData = {
+        ...(createTime !== undefined ? { CreateTime: createTime } : {}),
+        ...(lastUpdatedTime !== undefined ? { LastUpdatedTime: lastUpdatedTime } : {}),
+      }
+    }
+  }
+
+  return employee
+}
+
+function sanitizeMasterDataRecord(
+  recordType: QuickBooksReadMasterDataParams['recordType'],
+  value: QuickBooksMasterDataRecord
+): QuickBooksMasterDataRecord {
+  return recordType === 'employee' ? sanitizeEmployee(value) : value
+}
+
 export const quickbooksReadMasterDataTool: ToolConfig<
   QuickBooksReadMasterDataParams,
   QuickBooksReadMasterDataResponse
@@ -121,6 +219,9 @@ export const quickbooksReadMasterDataTool: ToolConfig<
         output: {
           recordType: params.recordType,
           ...result.output,
+          items: result.output.items.map((item) =>
+            sanitizeMasterDataRecord(params.recordType, item)
+          ),
         },
       }
     }
@@ -133,7 +234,7 @@ export const quickbooksReadMasterDataTool: ToolConfig<
         success: true,
         output: {
           recordType: params.recordType,
-          item: result.item,
+          item: sanitizeMasterDataRecord(params.recordType, result.item),
           time: result.time,
         },
       }
diff --git a/apps/sim/tools/quickbooks/types.ts b/apps/sim/tools/quickbooks/types.ts
@@ -98,11 +98,9 @@ export interface QuickBooksEmployee {
   Mobile?: QuickBooksPhoneNumber
   PrimaryEmailAddr?: QuickBooksEmailAddress
   PrimaryAddr?: QuickBooksAddress
-  SSN?: string
   BillableTime?: boolean
   MetaData?: QuickBooksMetaData
   sparse?: boolean
-  [key: string]: unknown
 }
 
 export interface QuickBooksItem {
