fix(quickbooks): validate delete and document payloads

Author: Bill Leoutsakos

apps/sim/blocks/blocks/quickbooks.test.ts

@@ -85,4 +85,30 @@ describe('QuickBooksBlock', () => {
       file,
     })
   })
+
+  it('requires full entity payloads for non-simplified deletes', () => {
+    const payload = QuickBooksBlock.subBlocks.find((subBlock) => subBlock.id === 'payload')
+    if (!payload || typeof payload.required !== 'function') {
+      throw new Error('Expected QuickBooks payload to use conditional required state')
+    }
+
+    expect(
+      payload.required({
+        operation: 'delete_record',
+        deleteEntity: 'InventoryAdjustment',
+      })
+    ).toEqual({
+      field: 'deleteEntity',
+      value: ['Attachable', 'Deposit', 'InventoryAdjustment', 'Transfer'],
+    })
+    expect(
+      payload.required({
+        operation: 'create_record',
+        createEntity: 'Vendor',
+      })
+    ).toEqual({
+      field: 'operation',
+      value: ['create_record', 'update_record', 'update_exchange_rate', 'update_preferences'],
+    })
+  })
 })

apps/sim/blocks/blocks/quickbooks.ts

@@ -7,6 +7,7 @@ import type { QuickBooksResponse } from '@/tools/quickbooks/types'
 import {
   QUICKBOOKS_CREATABLE_ENTITIES,
   QUICKBOOKS_DELETABLE_ENTITIES,
+  QUICKBOOKS_FULL_DELETE_ENTITIES,
   QUICKBOOKS_PDF_ENTITIES,
   QUICKBOOKS_QUERYABLE_ENTITIES,
   QUICKBOOKS_READABLE_ENTITIES,
@@ -199,10 +200,18 @@ export const QuickBooksBlock: BlockConfig<QuickBooksResponse> = {
           'update_preferences',
         ],
       },
-      required: {
-        field: 'operation',
-        value: ['create_record', 'update_record', 'update_exchange_rate', 'update_preferences'],
-      },
+      required: (values) =>
+        values?.operation === 'delete_record'
+          ? { field: 'deleteEntity', value: [...QUICKBOOKS_FULL_DELETE_ENTITIES] }
+          : {
+              field: 'operation',
+              value: [
+                'create_record',
+                'update_record',
+                'update_exchange_rate',
+                'update_preferences',
+              ],
+            },
       wandConfig: {
         enabled: true,
         prompt:

apps/sim/tools/quickbooks/download_document.ts

@@ -4,7 +4,11 @@ import type {
   QuickBooksDownloadDocumentParams,
   QuickBooksFileResponse,
 } from '@/tools/quickbooks/types'
-import { buildQuickBooksDocumentUrl, buildQuickBooksHeaders } from '@/tools/quickbooks/utils'
+import {
+  assertQuickBooksPdfResponse,
+  buildQuickBooksDocumentUrl,
+  buildQuickBooksHeaders,
+} from '@/tools/quickbooks/utils'
 import type { ToolConfig } from '@/tools/types'
 
 const QUICKBOOKS_MAX_PDF_BYTES = 25 * 1024 * 1024
@@ -76,6 +80,7 @@ export const quickBooksDownloadDocumentTool: ToolConfig<
         `QuickBooks API error (${response.status}): ${truncate(buffer.toString('utf8'), 500) || response.statusText || 'Request failed'}`
       )
     }
+    assertQuickBooksPdfResponse(response, buffer, 'PDF download')
     return {
       success: true,
       output: {

apps/sim/tools/quickbooks/generic_operations.test.ts

@@ -580,7 +580,7 @@ describe('QuickBooks generic operations', () => {
     })
 
     const documentResult = await quickBooksDownloadDocumentTool.transformResponse?.(
-      new Response(new Uint8Array([37, 80, 68, 70]), {
+      new Response(new Uint8Array([37, 80, 68, 70, 45]), {
         headers: { 'content-type': 'application/pdf' },
         status: 200,
       }),
@@ -595,15 +595,15 @@ describe('QuickBooks generic operations', () => {
       file: {
         name: 'PurchaseOrder-42.pdf',
         mimeType: 'application/pdf',
-        data: 'JVBERg==',
-        size: 4,
+        data: 'JVBERi0=',
+        size: 5,
       },
       entity: 'PurchaseOrder',
       recordId: '42',
     })
 
     const sentDocumentResult = await quickBooksSendDocumentTool.transformResponse?.(
-      new Response(new Uint8Array([37, 80, 68, 70]), {
+      new Response(new Uint8Array([37, 80, 68, 70, 45]), {
         headers: { 'content-type': 'application/octet-stream' },
         status: 200,
       }),
@@ -619,8 +619,8 @@ describe('QuickBooks generic operations', () => {
       file: {
         name: 'PurchaseOrder-42.pdf',
         mimeType: 'application/pdf',
-        data: 'JVBERg==',
-        size: 4,
+        data: 'JVBERi0=',
+        size: 5,
       },
       entity: 'PurchaseOrder',
       recordId: '42',
@@ -642,6 +642,37 @@ describe('QuickBooks generic operations', () => {
     })
   })
 
+  it('rejects successful document responses that are not PDFs', async () => {
+    const params = {
+      accessToken: 'token',
+      realmId: '123145',
+      entity: 'PurchaseOrder' as const,
+      recordId: '42',
+    }
+
+    await expect(
+      quickBooksDownloadDocumentTool.transformResponse?.(
+        new Response(JSON.stringify({ Fault: { Error: [{ Message: 'Unexpected response' }] } }), {
+          headers: { 'content-type': 'application/json' },
+          status: 200,
+        }),
+        params
+      )
+    ).rejects.toThrow('QuickBooks PDF download returned a non-PDF response (application/json)')
+
+    await expect(
+      quickBooksSendDocumentTool.transformResponse?.(
+        new Response('', {
+          headers: { 'content-type': 'text/plain' },
+          status: 200,
+        }),
+        params
+      )
+    ).rejects.toThrow(
+      'QuickBooks sent document returned a non-PDF response (text/plain): Empty response'
+    )
+  })
+
   it('transforms QuickBooks batch item responses without hiding item faults', async () => {
     const response = new Response(
       JSON.stringify({

apps/sim/tools/quickbooks/send_document.ts

@@ -1,7 +1,11 @@
 import { truncate } from '@sim/utils/string'
 import { readResponseToBufferWithLimit } from '@/lib/core/utils/stream-limits'
 import type { QuickBooksFileResponse, QuickBooksSendDocumentParams } from '@/tools/quickbooks/types'
-import { buildQuickBooksHeaders, buildQuickBooksSendDocumentUrl } from '@/tools/quickbooks/utils'
+import {
+  assertQuickBooksPdfResponse,
+  buildQuickBooksHeaders,
+  buildQuickBooksSendDocumentUrl,
+} from '@/tools/quickbooks/utils'
 import type { ToolConfig } from '@/tools/types'
 
 const QUICKBOOKS_MAX_SENT_DOCUMENT_BYTES = 25 * 1024 * 1024
@@ -79,6 +83,7 @@ export const quickBooksSendDocumentTool: ToolConfig<
         `QuickBooks API error (${response.status}): ${truncate(buffer.toString('utf8'), 500) || response.statusText || 'Request failed'}`
       )
     }
+    assertQuickBooksPdfResponse(response, buffer, 'sent document')
     return {
       success: true,
       output: {

apps/sim/tools/quickbooks/types.ts

@@ -119,14 +119,18 @@ export const QUICKBOOKS_SIMPLIFIED_DELETE_ENTITIES = [
   'VendorCredit',
 ] as const
 
-export const QUICKBOOKS_DELETABLE_ENTITIES = [
-  ...QUICKBOOKS_SIMPLIFIED_DELETE_ENTITIES,
+export const QUICKBOOKS_FULL_DELETE_ENTITIES = [
   'Attachable',
   'Deposit',
   'InventoryAdjustment',
   'Transfer',
 ] as const
 
+export const QUICKBOOKS_DELETABLE_ENTITIES = [
+  ...QUICKBOOKS_SIMPLIFIED_DELETE_ENTITIES,
+  ...QUICKBOOKS_FULL_DELETE_ENTITIES,
+] as const
+
 export const QUICKBOOKS_CDC_ENTITIES = QUICKBOOKS_READABLE_ENTITIES.filter(
   (entity) => !['TaxAgency', 'TaxCode', 'TaxRate', 'TimeActivity'].includes(entity)
 ) as Exclude<

apps/sim/tools/quickbooks/utils.ts

@@ -81,6 +81,22 @@ export function buildQuickBooksHeaders(accessToken: string): Record<string, stri
   }
 }
 
+export function assertQuickBooksPdfResponse(
+  response: Response,
+  buffer: Buffer,
+  label: string
+): void {
+  const header = buffer.subarray(0, Math.min(buffer.length, 1024))
+  if (header.indexOf(Buffer.from('%PDF-')) >= 0) return
+
+  const contentType = response.headers.get('content-type')?.split(';', 1)[0]?.trim()
+  const detail = truncate(buffer.toString('utf8').trim(), 500)
+  const contentTypeDetail = contentType ? ` (${contentType})` : ''
+  throw new Error(
+    `QuickBooks ${label} returned a non-PDF response${contentTypeDetail}: ${detail || 'Empty response'}`
+  )
+}
+
 export function buildQuickBooksQueryEndpoint(params: {
   realmId: string
   apiEnvironment?: QuickBooksEnvironment | string