feat(quickbooks): add read-only procurement integration

apps/docs/components/icons.tsx

@@ -2581,6 +2581,25 @@ export function BrexIcon(props: SVGProps<SVGSVGElement>) {
   )
 }
 
+/**
+ * Official QuickBooks circular mark, cropped from the user-supplied
+ * Intuit_QuickBooks_logo.svg wordmark.
+ */
+export function QuickBooksIcon(props: SVGProps<SVGSVGElement>) {
+  return (
+    <svg {...props} viewBox='0 0 61.54 61.54' fill='none' xmlns='http://www.w3.org/2000/svg'>
+      <path
+        fill='#2CA01C'
+        d='M30.77 61.54c16.99 0 30.77-13.78 30.77-30.77S47.76 0 30.77 0 0 13.78 0 30.77s13.77 30.77 30.77 30.77Z'
+      />
+      <path
+        fill='#FFF'
+        d='M20.51 18.8c-6.61 0-11.97 5.36-11.97 11.97s5.35 11.96 11.97 11.96h1.71v-4.44h-1.71c-4.15 0-7.52-3.37-7.52-7.52 0-4.15 3.37-7.52 7.52-7.52h4.11V46.5c0 2.45 1.99 4.44 4.44 4.44V18.8h-8.55Zm20.52 23.93c6.61 0 11.97-5.36 11.97-11.96S47.65 18.81 41.03 18.81h-1.71v4.44h1.71c4.15 0 7.52 3.37 7.52 7.52s-3.37 7.52-7.52 7.52h-4.11V15.04c0-2.45-1.99-4.44-4.44-4.44v32.13h8.55Z'
+      />
+    </svg>
+  )
+}
+
 export function BrightDataIcon(props: SVGProps<SVGSVGElement>) {
   return (
     <svg

apps/docs/components/ui/icon-mapping.ts

@@ -176,6 +176,7 @@ import {
   PulseIcon,
   QdrantIcon,
   QuartrIcon,
+  QuickBooksIcon,
   QuiverIcon,
   RailwayIcon,
   RB2BIcon,
@@ -456,6 +457,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   pulse_v2: PulseIcon,
   qdrant: QdrantIcon,
   quartr: QuartrIcon,
+  quickbooks: QuickBooksIcon,
   quiver: QuiverIcon,
   railway: RailwayIcon,
   rb2b: RB2BIcon,

apps/docs/content/docs/en/integrations/meta.json

@@ -187,6 +187,7 @@
     "pulse",
     "qdrant",
     "quartr",
+    "quickbooks",
     "quiver",
     "railway",
     "rb2b",

apps/sim/.env.example

@@ -121,6 +121,11 @@ CRON_SECRET=your_cron_secret # Use `openssl rand -hex 32` to generate. Authentic
 # TIKTOK_CLIENT_ID=
 # TIKTOK_CLIENT_SECRET=
 
+# QuickBooks Online OAuth (Optional - credentials from the Intuit Developer Portal)
+# QUICKBOOKS_CLIENT_ID=
+# QUICKBOOKS_CLIENT_SECRET=
+# QUICKBOOKS_ENV=sandbox                         # Required when QuickBooks is configured: sandbox or production
+
 # Azure Blob Storage takes precedence over S3 if both are configured
 # AZURE_ACCOUNT_NAME=                             # Azure storage account name
 # AZURE_ACCOUNT_KEY=                              # Azure storage account key

apps/sim/app/api/auth/[...all]/route.test.ts

@@ -30,6 +30,7 @@ vi.mock('@/lib/auth/anonymous', () => ({
   createAnonymousSession: handlerMocks.createAnonymousSession,
 }))
 
+import { getQuickBooksCallbackRealm } from '@/lib/oauth/quickbooks'
 import { GET, POST } from '@/app/api/auth/[...all]/route'
 
 afterAll(resetEnvFlagsMock)
@@ -132,3 +133,67 @@ describe('auth catch-all route organization mutations', () => {
     expect(json).toEqual({ data: { ok: true } })
   })
 })
+
+describe('auth catch-all route QuickBooks callback', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    setEnvFlags({ isAuthDisabled: false })
+  })
+
+  it('binds the callback realm only while Better Auth processes the OAuth response', async () => {
+    const { NextResponse } = await import('next/server')
+    handlerMocks.betterAuthGET.mockImplementationOnce(async () => {
+      await Promise.resolve()
+      expect(getQuickBooksCallbackRealm()).toBe('123456789')
+      return new NextResponse(null, { status: 302 })
+    })
+
+    const req = createMockRequest(
+      'GET',
+      undefined,
+      {},
+      'http://localhost:3000/api/auth/oauth2/callback/quickbooks?code=test&state=test&realmId=123456789'
+    )
+
+    const res = await GET(req as any)
+
+    expect(res.status).toBe(302)
+    expect(handlerMocks.betterAuthGET).toHaveBeenCalledTimes(1)
+    expect(() => getQuickBooksCallbackRealm()).toThrow(/did not include a company identity/)
+  })
+
+  it('delegates a denied callback without requiring a realm', async () => {
+    const { NextResponse } = await import('next/server')
+    handlerMocks.betterAuthGET.mockImplementationOnce(async () => {
+      expect(() => getQuickBooksCallbackRealm()).toThrow(/did not include a company identity/)
+      return new NextResponse(null, { status: 302 })
+    })
+
+    const req = createMockRequest(
+      'GET',
+      undefined,
+      {},
+      'http://localhost:3000/api/auth/oauth2/callback/quickbooks?error=access_denied&state=test'
+    )
+
+    const res = await GET(req as any)
+
+    expect(res.status).toBe(302)
+    expect(handlerMocks.betterAuthGET).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([
+    ['missing', 'http://localhost:3000/api/auth/oauth2/callback/quickbooks?code=test&state=test'],
+    [
+      'invalid',
+      'http://localhost:3000/api/auth/oauth2/callback/quickbooks?code=test&state=test&realmId=not-a-company',
+    ],
+  ])('rejects a %s callback realm before Better Auth exchanges the code', async (_, url) => {
+    const req = createMockRequest('GET', undefined, {}, url)
+
+    const res = await GET(req as any)
+
+    expect(res.status).toBe(400)
+    expect(handlerMocks.betterAuthGET).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/auth/[...all]/route.ts

@@ -4,6 +4,7 @@ import { auth } from '@/lib/auth'
 import { createAnonymousSession, ensureAnonymousUserExists } from '@/lib/auth/anonymous'
 import { isAuthDisabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { normalizeQuickBooksRealmId, withQuickBooksCallbackRealm } from '@/lib/oauth/quickbooks'
 
 export const dynamic = 'force-dynamic'
 
@@ -27,6 +28,32 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     return NextResponse.json(createAnonymousSession())
   }
 
+  if (path === 'oauth2/callback/quickbooks') {
+    const authorizationCode = request.nextUrl.searchParams.get('code')
+    if (!authorizationCode) {
+      return betterAuthGET(request)
+    }
+
+    const realmId = request.nextUrl.searchParams.get('realmId')
+    if (!realmId) {
+      return NextResponse.json(
+        { error: 'QuickBooks callback did not include a company identity.' },
+        { status: 400 }
+      )
+    }
+
+    try {
+      normalizeQuickBooksRealmId(realmId)
+    } catch {
+      return NextResponse.json(
+        { error: 'QuickBooks callback included an invalid company identity.' },
+        { status: 400 }
+      )
+    }
+
+    return withQuickBooksCallbackRealm(realmId, () => betterAuthGET(request))
+  }
+
   return betterAuthGET(request)
 })
 

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -67,12 +67,74 @@ describe('OAuth Token API Routes', () => {
 
       expect(response.status).toBe(200)
       expect(data).toHaveProperty('accessToken', 'fresh-token')
+      expect(data).not.toHaveProperty('realmId')
 
       expect(mockAuthorizeCredentialUse).toHaveBeenCalled()
       expect(authOAuthUtilsMockFns.mockGetCredential).toHaveBeenCalled()
       expect(authOAuthUtilsMockFns.mockRefreshTokenIfNeeded).toHaveBeenCalled()
     })
 
+    it('returns realmId only for QuickBooks credentials', async () => {
+      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+        ok: true,
+        authType: 'session',
+        requesterUserId: 'test-user-id',
+        credentialOwnerUserId: 'owner-user-id',
+      })
+      authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce({
+        id: 'credential-id',
+        accountId: 'quickbooks:123456789:intuit-subject-01234567-89ab-4def-8abc-0123456789ab',
+        accessToken: 'test-token',
+        refreshToken: 'refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() + 3600 * 1000),
+        providerId: 'quickbooks',
+      })
+      authOAuthUtilsMockFns.mockRefreshTokenIfNeeded.mockResolvedValueOnce({
+        accessToken: 'fresh-token',
+        refreshed: false,
+      })
+
+      const response = await POST(
+        createMockRequest('POST', {
+          credentialId: 'credential-id',
+        })
+      )
+
+      expect(response.status).toBe(200)
+      expect(await response.json()).toEqual({
+        accessToken: 'fresh-token',
+        realmId: '123456789',
+      })
+    })
+
+    it('rejects a malformed QuickBooks company identity with reconnect guidance', async () => {
+      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+        ok: true,
+        authType: 'session',
+        requesterUserId: 'test-user-id',
+        credentialOwnerUserId: 'owner-user-id',
+      })
+      authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce({
+        id: 'credential-id',
+        accountId: 'malformed',
+        accessToken: 'test-token',
+        refreshToken: 'refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() + 3600 * 1000),
+        providerId: 'quickbooks',
+      })
+
+      const response = await POST(
+        createMockRequest('POST', {
+          credentialId: 'credential-id',
+        })
+      )
+      const data = await response.json()
+
+      expect(response.status).toBe(401)
+      expect(data.error).toMatch(/Reconnect the QuickBooks credential/)
+      expect(authOAuthUtilsMockFns.mockRefreshTokenIfNeeded).not.toHaveBeenCalled()
+    })
+
     it('should handle workflowId for server-side authentication', async () => {
       mockAuthorizeCredentialUse.mockResolvedValueOnce({
         ok: true,
@@ -517,6 +579,33 @@ describe('OAuth Token API Routes', () => {
       expect(data).toHaveProperty('error')
     })
 
+    it('rejects a malformed QuickBooks identity before reporting a missing token', async () => {
+      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+        ok: true,
+        authType: 'session',
+        requesterUserId: 'test-user-id',
+        credentialOwnerUserId: 'test-user-id',
+      })
+      authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce({
+        id: 'credential-id',
+        accountId: 'malformed',
+        accessToken: null,
+        refreshToken: 'refresh-token',
+        providerId: 'quickbooks',
+      })
+
+      const response = await GET(
+        new NextRequest(
+          'http://localhost:3000/api/auth/oauth/token?credentialId=credential-id'
+        ) as any
+      )
+      const data = await response.json()
+
+      expect(response.status).toBe(401)
+      expect(data.error).toMatch(/Reconnect the QuickBooks credential/)
+      expect(authOAuthUtilsMockFns.mockRefreshTokenIfNeeded).not.toHaveBeenCalled()
+    })
+
     it('should handle token refresh failure', async () => {
       mockAuthorizeCredentialUse.mockResolvedValueOnce({
         ok: true,

apps/sim/app/api/auth/oauth/token/route.ts

@@ -12,6 +12,7 @@ import { AuthType, checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
+import { parseQuickBooksAccountId } from '@/lib/oauth/quickbooks'
 import { captureServerEvent } from '@/lib/posthog/server'
 import {
   getCredential,
@@ -254,6 +255,23 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     const oauthActorId = authz.requesterUserId
     const oauthWorkspaceId = authz.workspaceId ?? null
 
+    let realmId: string | undefined
+    if (credential.providerId === 'quickbooks') {
+      try {
+        realmId = parseQuickBooksAccountId(credential.accountId).realmId
+      } catch (error) {
+        return NextResponse.json(
+          {
+            error: getErrorMessage(
+              error,
+              'QuickBooks company identity is invalid. Reconnect the QuickBooks credential.'
+            ),
+          },
+          { status: 401 }
+        )
+      }
+    }
+
     try {
       const { accessToken } = await refreshTokenIfNeeded(
         requestId,
@@ -311,6 +329,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           accessToken,
           idToken: credential.idToken || undefined,
           ...(instanceUrl && { instanceUrl }),
+          ...(realmId && { realmId }),
           ...(apiDomain && { apiDomain }),
         },
         { status: 200 }
@@ -369,14 +388,31 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
     }
 
+    const actorId = authz.requesterUserId
+    const workspaceId = authz.workspaceId ?? null
+
+    let realmId: string | undefined
+    if (credential.providerId === 'quickbooks') {
+      try {
+        realmId = parseQuickBooksAccountId(credential.accountId).realmId
+      } catch (error) {
+        return NextResponse.json(
+          {
+            error: getErrorMessage(
+              error,
+              'QuickBooks company identity is invalid. Reconnect the QuickBooks credential.'
+            ),
+          },
+          { status: 401 }
+        )
+      }
+    }
+
     if (!credential.accessToken) {
       logger.warn(`[${requestId}] No access token available for credential`)
       return NextResponse.json({ error: 'No access token available' }, { status: 400 })
     }
 
-    const actorId = authz.requesterUserId
-    const workspaceId = authz.workspaceId ?? null
-
     try {
       const { accessToken } = await refreshTokenIfNeeded(
         requestId,
@@ -435,6 +471,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
           accessToken,
           idToken: credential.idToken || undefined,
           ...(instanceUrl && { instanceUrl }),
+          ...(realmId && { realmId }),
           ...(apiDomain && { apiDomain }),
         },
         { status: 200 }