fix(quickbooks): validate bill payment accounts

Bill Leoutsakos · Bill Leoutsakos · commit ff29690ca7cd · 2026-08-03T00:29:17.000-07:00
diff --git a/apps/sim/tools/quickbooks/create_bill_payment.ts b/apps/sim/tools/quickbooks/create_bill_payment.ts
@@ -1,7 +1,9 @@
-import { ErrorExtractorId } from '@/tools/error-extractors'
+import { readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
+import { ErrorExtractorId, extractErrorMessage } from '@/tools/error-extractors'
 import { QUICKBOOKS_MAX_RESPONSE_BYTES } from '@/tools/quickbooks/client'
 import { buildQuickBooksCreateBillPaymentBody } from '@/tools/quickbooks/purchasing_utils'
 import type {
+  QuickBooksAccount,
   QuickBooksCreateBillPaymentParams,
   QuickBooksMutationResponse,
   QuickBooksPurchasingTransaction,
@@ -14,10 +16,59 @@ import {
   addQuickBooksRequestId,
   buildQuickBooksEntityUrl,
   getQuickBooksToolHeaders,
+  transformQuickBooksEntityResponse,
   transformQuickBooksMutationResponse,
 } from '@/tools/quickbooks/utils'
 import type { ToolConfig } from '@/tools/types'
 
+async function getQuickBooksDirectExecutionError(
+  response: Response,
+  signal?: AbortSignal
+): Promise<Error> {
+  let data: unknown = null
+  try {
+    data = await readResponseJsonWithLimit<unknown>(response, {
+      maxBytes: QUICKBOOKS_MAX_RESPONSE_BYTES,
+      label: 'QuickBooks BillPayment error response',
+      signal,
+    })
+  } catch {
+    signal?.throwIfAborted()
+  }
+
+  const errorInfo = {
+    status: response.status,
+    statusText: response.statusText,
+    data,
+    headers: response.headers,
+  }
+  return Object.assign(
+    new Error(extractErrorMessage(errorInfo, ErrorExtractorId.QUICKBOOKS_FAULT)),
+    errorInfo
+  )
+}
+
+function assertCompatiblePaymentAccount(
+  account: QuickBooksAccount,
+  paymentType: QuickBooksCreateBillPaymentParams['paymentType'],
+  paymentAccountId: string
+): void {
+  const accountId = account.Id.trim()
+  if (accountId !== paymentAccountId) {
+    throw new Error('QuickBooks returned a different payment account than requested')
+  }
+  if (account.Active === false) {
+    throw new Error('QuickBooks payment account is inactive. Select an active account.')
+  }
+
+  const expectedAccountType = paymentType === 'check' ? 'Bank' : 'Credit Card'
+  if (account.AccountType !== expectedAccountType) {
+    throw new Error(
+      `${paymentType === 'check' ? 'Check' : 'Credit-card'} Bill Payments require a QuickBooks ${expectedAccountType} account. Account ${paymentAccountId} is ${account.AccountType || 'missing an account type'}.`
+    )
+  }
+}
+
 export const quickbooksCreateBillPaymentTool: ToolConfig<
   QuickBooksCreateBillPaymentParams,
   QuickBooksMutationResponse<QuickBooksPurchasingTransaction>
@@ -106,6 +157,51 @@ export const quickbooksCreateBillPaymentTool: ToolConfig<
     retry: { enabled: false },
     maxResponseBytes: QUICKBOOKS_MAX_RESPONSE_BYTES,
   },
+  directExecution: async (params, signal) => {
+    const paymentAccountId = params.paymentAccountId.trim()
+    if (!paymentAccountId) throw new Error('paymentAccountId is required')
+
+    const accountResponse = await fetch(
+      buildQuickBooksEntityUrl(params.realmId, 'account', paymentAccountId),
+      {
+        method: 'GET',
+        headers: getQuickBooksToolHeaders(params.accessToken),
+        signal,
+      }
+    )
+    if (!accountResponse.ok) {
+      throw await getQuickBooksDirectExecutionError(accountResponse, signal)
+    }
+    const { item: account } = await transformQuickBooksEntityResponse<QuickBooksAccount>(
+      accountResponse,
+      'Account',
+      signal
+    )
+    assertCompatiblePaymentAccount(account, params.paymentType, paymentAccountId)
+    signal?.throwIfAborted()
+
+    const paymentResponse = await fetch(
+      addQuickBooksRequestId(
+        buildQuickBooksEntityUrl(params.realmId, 'billpayment'),
+        params.requestId
+      ),
+      {
+        method: 'POST',
+        headers: getQuickBooksToolHeaders(params.accessToken, 'application/json'),
+        body: JSON.stringify(buildQuickBooksCreateBillPaymentBody(params)),
+        signal,
+      }
+    )
+    if (!paymentResponse.ok) {
+      throw await getQuickBooksDirectExecutionError(paymentResponse, signal)
+    }
+    return transformQuickBooksMutationResponse<QuickBooksPurchasingTransaction>(
+      paymentResponse,
+      'BillPayment',
+      undefined,
+      signal
+    )
+  },
   transformResponse: (r) =>
     transformQuickBooksMutationResponse<QuickBooksPurchasingTransaction>(r, 'BillPayment'),
   outputs: {
diff --git a/apps/sim/tools/quickbooks/purchasing.test.ts b/apps/sim/tools/quickbooks/purchasing.test.ts
@@ -1,5 +1,5 @@
 import { resetEnvMock, setEnv } from '@sim/testing'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { QuickBooksBlock } from '@/blocks/blocks/quickbooks'
 import {
   quickbooksCreateBillPaymentTool,
@@ -52,7 +52,10 @@ const itemLine = {
 }
 
 beforeEach(() => setEnv({ QUICKBOOKS_ENV: 'sandbox' }))
-afterEach(resetEnvMock)
+afterEach(() => {
+  vi.unstubAllGlobals()
+  resetEnvMock()
+})
 
 describe('QuickBooks purchasing reader', () => {
   const listParams: QuickBooksReadPurchasingTransactionsParams = {
@@ -447,6 +450,135 @@ describe('QuickBooks purchasing mutation bodies', () => {
   })
 })
 
+describe('QuickBooks BillPayment account compatibility', () => {
+  const params: QuickBooksCreateBillPaymentParams = {
+    ...authParams,
+    vendorId: '30',
+    totalAmount: 25,
+    paymentType: 'check',
+    paymentAccountId: '35',
+    billAllocations: [{ billId: '12', amount: 25 }],
+    requestId: 'sanitized-request-id',
+  }
+
+  function accountResponse(account: Record<string, unknown>): Response {
+    return Response.json({ Account: account, time: 'test-time' })
+  }
+
+  function billPaymentResponse(payType: 'Check' | 'CreditCard'): Response {
+    return Response.json({
+      BillPayment: { Id: '44', SyncToken: '0', PayType: payType },
+      time: 'test-time',
+    })
+  }
+
+  it.each([
+    ['check', 'Bank', 'Check'],
+    ['credit_card', 'Credit Card', 'CreditCard'],
+  ] as const)(
+    'validates the account before creating a %s payment',
+    async (paymentType, accountType, payType) => {
+      const fetchMock = vi
+        .fn()
+        .mockResolvedValueOnce(
+          accountResponse({ Id: '35', SyncToken: '0', Active: true, AccountType: accountType })
+        )
+        .mockResolvedValueOnce(billPaymentResponse(payType))
+      vi.stubGlobal('fetch', fetchMock)
+
+      await expect(
+        quickbooksCreateBillPaymentTool.directExecution!({ ...params, paymentType })
+      ).resolves.toMatchObject({
+        success: true,
+        output: { recordId: '44', record: { PayType: payType } },
+      })
+
+      expect(fetchMock).toHaveBeenCalledTimes(2)
+      expect(new URL(fetchMock.mock.calls[0][0] as URL).pathname).toBe(
+        '/v3/company/123456789/account/35'
+      )
+      const mutationUrl = new URL(fetchMock.mock.calls[1][0] as URL)
+      expect(mutationUrl.pathname).toBe('/v3/company/123456789/billpayment')
+      expect(mutationUrl.searchParams.get('requestid')).toBe('sanitized-request-id')
+      expect(JSON.parse(fetchMock.mock.calls[1][1].body as string)).toMatchObject({
+        PayType: payType,
+      })
+    }
+  )
+
+  it.each([
+    ['check', 'Credit Card', 'Bank'],
+    ['credit_card', 'Bank', 'Credit Card'],
+  ] as const)(
+    'rejects a %s payment when the account is %s without mutating',
+    async (paymentType, accountType, expectedType) => {
+      const fetchMock = vi
+        .fn()
+        .mockResolvedValue(
+          accountResponse({ Id: '35', SyncToken: '0', Active: true, AccountType: accountType })
+        )
+      vi.stubGlobal('fetch', fetchMock)
+
+      await expect(
+        quickbooksCreateBillPaymentTool.directExecution!({ ...params, paymentType })
+      ).rejects.toThrow(`require a QuickBooks ${expectedType} account`)
+      expect(fetchMock).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it('rejects inactive and mismatched account records without mutating', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        accountResponse({ Id: '35', SyncToken: '0', Active: false, AccountType: 'Bank' })
+      )
+      .mockResolvedValueOnce(
+        accountResponse({ Id: '99', SyncToken: '0', Active: true, AccountType: 'Bank' })
+      )
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(quickbooksCreateBillPaymentTool.directExecution!(params)).rejects.toThrow(
+      'payment account is inactive'
+    )
+    await expect(quickbooksCreateBillPaymentTool.directExecution!(params)).rejects.toThrow(
+      'different payment account'
+    )
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('preserves bounded QuickBooks fault guidance from the account preflight', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi
+        .fn()
+        .mockResolvedValue(
+          Response.json(
+            { Fault: { Error: [{ code: '3200', Message: 'Authentication failed' }] } },
+            { status: 401, headers: { intuit_tid: 'tracking-id' } }
+          )
+        )
+    )
+
+    await expect(quickbooksCreateBillPaymentTool.directExecution!(params)).rejects.toThrow(
+      'Reconnect the QuickBooks credential'
+    )
+  })
+
+  it('propagates cancellation and does not create a payment', async () => {
+    const controller = new AbortController()
+    const fetchMock = vi.fn().mockImplementationOnce(() => {
+      controller.abort(new Error('cancelled'))
+      return accountResponse({ Id: '35', SyncToken: '0', Active: true, AccountType: 'Bank' })
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      quickbooksCreateBillPaymentTool.directExecution!(params, controller.signal)
+    ).rejects.toThrow('cancelled')
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+  })
+})
+
 describe('QuickBooks purchasing block', () => {
   it('does not force array-valued wand prompts through JSON-object generation', () => {
     for (const id of ['purchasingLines', 'billAllocations']) {
diff --git a/apps/sim/tools/quickbooks/utils.ts b/apps/sim/tools/quickbooks/utils.ts
@@ -176,13 +176,18 @@ export function addQuickBooksRequestId(url: URL, requestId?: string): URL {
   return url
 }
 
-export async function parseQuickBooksJson<T>(response: Response, label: string): Promise<T> {
+export async function parseQuickBooksJson<T>(
+  response: Response,
+  label: string,
+  signal?: AbortSignal
+): Promise<T> {
   if (!response.ok) {
     throw new Error(`QuickBooks request failed with HTTP ${response.status}`)
   }
   const data = await readResponseJsonWithLimit<T>(response, {
     maxBytes: QUICKBOOKS_MAX_RESPONSE_BYTES,
     label,
+    signal,
   })
   const faultData = sanitizeQuickBooksFaultData(data)
   if (faultData) {
@@ -242,10 +247,15 @@ export async function transformQuickBooksListResponse<T>(
 
 export async function transformQuickBooksEntityResponse<
   T extends { Id: string; SyncToken?: string },
->(response: Response, entity: QuickBooksQueryEntity): Promise<{ item: T; time: string | null }> {
+>(
+  response: Response,
+  entity: QuickBooksQueryEntity,
+  signal?: AbortSignal
+): Promise<{ item: T; time: string | null }> {
   const data = await parseQuickBooksJson<Record<string, unknown> & { time?: string }>(
     response,
-    `QuickBooks ${entity} response`
+    `QuickBooks ${entity} response`,
+    signal
   )
   const candidate = data[entity]
   if (!candidate) {
@@ -262,9 +272,10 @@ export async function transformQuickBooksMutationResponse<
 >(
   response: Response,
   entity: QuickBooksQueryEntity,
-  sanitize: (item: T) => T = (item) => item
+  sanitize: (item: T) => T = (item) => item,
+  signal?: AbortSignal
 ): Promise<QuickBooksMutationResponse<T>> {
-  const parsed = await transformQuickBooksEntityResponse<T>(response, entity)
+  const parsed = await transformQuickBooksEntityResponse<T>(response, entity, signal)
   const item = sanitize(parsed.item)
   const recordId = typeof item.Id === 'string' ? item.Id.trim() : ''
   const syncToken = typeof item.SyncToken === 'string' ? item.SyncToken.trim() : ''
