fix(quickbooks): validate attachment uploads

Author: Bill Leoutsakos

apps/sim/app/api/tools/quickbooks/upload-attachment/route.test.ts

@@ -135,6 +135,64 @@ describe('POST /api/tools/quickbooks/upload-attachment', () => {
     )
   })
 
+  it('normalizes linked entity names before building attachment metadata', async () => {
+    const response = await POST(
+      createMockRequest('POST', {
+        ...baseBody,
+        entity: 'purchaseorder',
+      })
+    )
+    expect(response.status).toBe(200)
+
+    const [, init] = mockFetch.mock.calls[0] as [string, RequestInit]
+    const metadata = (init.body as FormData).get('file_metadata_01')
+    expect(metadata).toBeInstanceOf(Blob)
+    await expect((metadata as Blob).text()).resolves.toContain(
+      '"EntityRef":{"type":"PurchaseOrder","value":"17"}'
+    )
+  })
+
+  it('rejects nested QuickBooks upload faults returned with HTTP 200', async () => {
+    mockFetch.mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          AttachableResponse: [
+            {
+              Fault: {
+                Error: [{ Message: 'ValidationFault', Detail: 'Unsupported entity reference' }],
+              },
+            },
+          ],
+          time: '2026-07-29T23:00:00Z',
+        }),
+        { headers: { 'content-type': 'application/json' }, status: 200 }
+      )
+    )
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(500)
+    await expect(response.json()).resolves.toEqual({
+      success: false,
+      error: 'QuickBooks API error (200): Unsupported entity reference',
+    })
+  })
+
+  it('rejects timestamp-only QuickBooks upload responses', async () => {
+    mockFetch.mockResolvedValueOnce(
+      new Response(JSON.stringify({ time: '2026-07-29T23:00:00Z' }), {
+        headers: { 'content-type': 'application/json' },
+        status: 200,
+      })
+    )
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(500)
+    await expect(response.json()).resolves.toEqual({
+      success: false,
+      error: 'QuickBooks attachment upload returned no attachment',
+    })
+  })
+
   it('rejects files over the QuickBooks 100 MB attachment limit', async () => {
     mockProcessFilesToUserFiles.mockReturnValueOnce([
       { ...baseBody.file, size: 100 * 1024 * 1024 + 1 },

apps/sim/app/api/tools/quickbooks/upload-attachment/route.ts

@@ -12,8 +12,10 @@ import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.
 import { docNotReadyResponse } from '@/lib/uploads/utils/servable-file-response'
 import { assertToolFileAccess } from '@/app/api/files/authorization'
 import {
+  assertQuickBooksAttachmentUploadResponse,
   buildQuickBooksHeaders,
   buildQuickBooksUploadUrl,
+  normalizeQuickBooksAttachmentEntity,
   parseQuickBooksJson,
 } from '@/tools/quickbooks/utils'
 
@@ -65,11 +67,12 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     }
 
     const contentType = downloaded.contentType || userFile.type || 'application/octet-stream'
+    const entity = normalizeQuickBooksAttachmentEntity(params.entity)
     const metadata = {
       AttachableRef: [
         {
           EntityRef: {
-            type: params.entity,
+            type: entity,
             value: params.entityId,
           },
           IncludeOnSend: params.includeOnSend ?? false,
@@ -105,7 +108,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         body: formData,
       }
     )
-    const data = await parseQuickBooksJson(response)
+    const data = assertQuickBooksAttachmentUploadResponse(await parseQuickBooksJson(response))
     return NextResponse.json({ success: true, output: { result: data } })
   } catch (error) {
     const notReady = docNotReadyResponse(error)

apps/sim/blocks/blocks/quickbooks.ts

@@ -264,8 +264,9 @@ export const QuickBooksBlock: BlockConfig<QuickBooksResponse> = {
     {
       id: 'attachmentEntity',
       title: 'Linked Entity Type',
-      type: 'short-input',
-      placeholder: 'PurchaseOrder',
+      type: 'dropdown',
+      options: buildEntityOptions(QUICKBOOKS_READABLE_ENTITIES),
+      value: () => 'PurchaseOrder',
       condition: { field: 'operation', value: 'upload_attachment' },
       required: { field: 'operation', value: 'upload_attachment' },
     },

apps/sim/tools/quickbooks/types.ts

@@ -290,6 +290,10 @@ export interface QuickBooksFault {
 }
 
 export interface QuickBooksApiEnvelope extends QuickBooksRecord {
+  AttachableResponse?: Array<{
+    Attachable?: QuickBooksRecord
+    Fault?: QuickBooksFault
+  }>
   QueryResponse?: Record<string, unknown> & {
     Fault?: QuickBooksFault
   }

apps/sim/tools/quickbooks/utils.ts

@@ -477,6 +477,20 @@ export async function parseQuickBooksJson(response: Response): Promise<QuickBook
   return data
 }
 
+export function assertQuickBooksAttachmentUploadResponse(
+  data: QuickBooksApiEnvelope
+): QuickBooksApiEnvelope {
+  const uploaded = data.AttachableResponse?.some((item) => isQuickBooksRecord(item.Attachable))
+  if (!uploaded) {
+    throw new Error('QuickBooks attachment upload returned no attachment')
+  }
+  return data
+}
+
+export function normalizeQuickBooksAttachmentEntity(value: string): QuickBooksEntityName {
+  return normalizeQuickBooksEntity(value, QUICKBOOKS_READABLE_ENTITIES, 'linked to an attachment')
+}
+
 export function extractQuickBooksRecords(
   data: QuickBooksApiEnvelope,
   preferredEntity?: QuickBooksEntityName
@@ -730,6 +744,7 @@ function extractQuickBooksError(data: QuickBooksApiEnvelope): string | null {
   const errors = [
     ...extractFaultErrors(data.Fault),
     ...extractFaultErrors(data.QueryResponse?.Fault),
+    ...(data.AttachableResponse ?? []).flatMap((item) => extractFaultErrors(item.Fault)),
   ]
   const message = errors
     .map((error) => error.Detail || error.Message || error.code)