feat(quickbooks): add documents and attachments

[BillLeoutsakosvl346]

Summary

• add Email Transaction, Download Transaction PDF, Read Attachments, Add Attachment, and Download Attachment
• add authenticated bounded file routes for PDF and attachment transfer
• enforce workspace file authorization, fixed QuickBooks endpoint maps, MIME/filename validation, 100 MiB limits, and pinned-IP temporary URL downloads
• expand the QuickBooks block from 40 to 45 operations and regenerate its catalog/docs

Validation

• 15 relevant test files, 546 tests passing
• type-check, format, lint, tool metadata, API validation, bare-icon, client-boundary, and diff checks passing
• independent full-stack review against staging: no remaining PR-6-actionable findings
• sandbox verified email override, all exposed transaction PDFs, note/file creation, attachment listing/read, byte-for-byte file download, and note-only download guidance

Stack

Targets feat/quickbooks-05-reports at frozen parent 1edbb5010e9bce820268202c57078d42bcf23a67. This PR must not be merged automatically.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 3, 2026 11:50pm

[cursor]

PR Summary

Medium Risk
New file-transfer and external-email paths touch OAuth credentials, user file storage, and outbound fetches to third-party URLs; mitigations (auth, size limits, pinned IP, explicit confirmations) are substantial but the surface area is security-sensitive.

Overview
Extends the QuickBooks block with transaction delivery and document workflows: email supported transactions (with explicit confirmSend), download transaction PDFs, list/read attachment metadata, upload one file or note per entity, and download attachment binaries into Sim execution/copilot files. New authenticated API routes enforce workspace file authorization, MIME/filename validation, 100 MiB caps, and DNS-pinned fetches for Intuit’s short-lived attachment URLs; secureFetchWithPinnedIP now respects abort signals before opening requests and during redirect validation.

Also adds non-payroll employee create/update, list filters on master-data reads (activeStatus) and transaction reads (date range, customer/vendor where supported), and Transaction List financial report controls (type, group-by, paid/cleared status, document number, source account type). Docs, integration catalog, and block skills/templates are updated to reflect attachments and delivery (operation count 40 → 47).

^{Reviewed by Cursor Bugbot for commit 69d5c90. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Adds five QuickBooks document-delivery and attachment operations with authenticated, bounded file-transfer routes.

• Supports emailing transactions and downloading transaction PDFs.
• Supports listing, creating, and downloading QuickBooks attachments.
• Adds workspace-file authorization, MIME and filename validation, transfer-size limits, pinned-IP temporary URL downloads, contracts, generated metadata, documentation, and tests.

Confidence Score: 5/5

The PR appears safe to merge from the reviewed follow-up scope.

No blocking failure remains; the previously reported download response-cap mismatch is addressed for both file-producing tools.

Important Files Changed

Filename	Overview
apps/sim/tools/quickbooks/download_attachment.ts	Defines the attachment-download tool and applies a response cap sized for a base64-encoded 100 MiB file plus JSON overhead.
apps/sim/tools/quickbooks/download_transaction_pdf.ts	Defines bounded transaction-PDF downloads using the same corrected executor response limit.
apps/sim/tools/quickbooks/documents_utils.ts	Centralizes QuickBooks document mappings, validation helpers, error handling, and transfer-size constants.
apps/sim/app/api/tools/quickbooks/download-attachment/route.ts	Implements authenticated attachment transfer through DNS validation and pinned-IP fetching with bounded streaming.
apps/sim/app/api/tools/quickbooks/download-transaction-pdf/route.ts	Implements authenticated, size-bounded PDF retrieval and safe execution-file serialization.
apps/sim/app/api/tools/quickbooks/add-attachment/route.ts	Implements authorized workspace-file and note attachment creation with MIME, filename, and size validation.
apps/sim/blocks/blocks/quickbooks.ts	Exposes the five new document and attachment operations through the QuickBooks block.

Sequence Diagram

sequenceDiagram
  participant Workflow
  participant Tool as QuickBooks Tool
  participant Route as Authenticated File Route
  participant QBO as QuickBooks API
  participant Storage as Execution Files
  Workflow->>Tool: Run document operation
  Tool->>Route: Authenticated bounded request
  Route->>QBO: Request PDF, attachment metadata, or temporary URL
  QBO-->>Route: Document response
  Route->>Route: Validate size, MIME, filename, and URL
  Route-->>Tool: Base64 file response
  Tool-->>Storage: Store execution file
  Storage-->>Workflow: File reference and metadata

Loading

_{Reviews (3): Last reviewed commit: "test(quickbooks): cover attachment MIME ..." | Re-trigger Greptile}

[BillLeoutsakosvl346]

@greptile-apps please review the latest commit 8e35624. The prior response-size finding was fixed by setting both file tools to a base64-aware bounded response cap with regression coverage.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8e35624. Configure here.}

[BillLeoutsakosvl346]

@greptile-apps please review the latest commit 371586c. The only change since your 5/5 review makes the attachment MIME fallback explicit and adds a missing-Content-Type regression test.