feat(quickbooks): add documents and attachments by BillLeoutsakosvl346 · Pull Request #6200 · simstudioai/sim

BillLeoutsakosvl346 · 2026-08-03T01:52:09Z

Summary

add Email Transaction, Download Transaction PDF, Read Attachments, Add Attachment, and Download Attachment
add authenticated bounded file routes for PDF and attachment transfer
enforce workspace file authorization, fixed QuickBooks endpoint maps, MIME/filename validation, 100 MiB limits, and pinned-IP temporary URL downloads
expand the QuickBooks block from 40 to 45 operations and regenerate its catalog/docs

Validation

15 relevant test files, 546 tests passing
type-check, format, lint, tool metadata, API validation, bare-icon, client-boundary, and diff checks passing
independent full-stack review against staging: no remaining PR-6-actionable findings
sandbox verified email override, all exposed transaction PDFs, note/file creation, attachment listing/read, byte-for-byte file download, and note-only download guidance

Stack

Targets feat/quickbooks-05-reports at frozen parent 1edbb5010e9bce820268202c57078d42bcf23a67. This PR must not be merged automatically.

vercel · 2026-08-03T01:52:15Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 3, 2026 8:34am

cursor · 2026-08-03T01:52:19Z

PR Summary

Medium Risk
Touches external email, file upload/download, and SSRF-sensitive temporary URL fetching with new abort handling; scope is bounded by auth, size limits, and pinned IP, but mistakes could leak credentials or fetch unintended hosts.

Overview
Adds five QuickBooks block operations (email transaction, download transaction PDF, read/add/download attachments), expanding the integration from 40 to 45 operations with matching docs and catalog metadata.

Workflow block gains conditional sub-blocks for transaction types, explicit email send confirmation, attachment targets, file/note modes, and file outputs (file, mimeType, size) for downloads.

New authenticated API routes handle bounded PDF and attachment transfer: workspace file authorization on upload, 100 MiB caps, PDF/MIME validation, and pinned-IP fetches for short-lived Intuit attachment URLs (auth stripped on redirect). secureFetchWithPinnedIP now respects abort signals before opening requests and during redirect DNS validation.

Zod route contracts define request/response shapes for the three file-oriented endpoints; attachment add enforces file-vs-note mode in validation.

^{Reviewed by Cursor Bugbot for commit af5a745. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-08-03T01:55:47Z

Greptile Summary

Adds five QuickBooks document-delivery and attachment operations with authenticated, bounded file-transfer routes.

Supports emailing transactions and downloading transaction PDFs.
Supports listing, creating, and downloading QuickBooks attachments.
Adds workspace-file authorization, MIME and filename validation, transfer-size limits, pinned-IP temporary URL downloads, contracts, generated metadata, documentation, and tests.

Confidence Score: 5/5

The PR appears safe to merge from the reviewed follow-up scope.

No blocking failure remains; the previously reported download response-cap mismatch is addressed for both file-producing tools.

Important Files Changed

Filename	Overview
apps/sim/tools/quickbooks/download_attachment.ts	Defines the attachment-download tool and applies a response cap sized for a base64-encoded 100 MiB file plus JSON overhead.
apps/sim/tools/quickbooks/download_transaction_pdf.ts	Defines bounded transaction-PDF downloads using the same corrected executor response limit.
apps/sim/tools/quickbooks/documents_utils.ts	Centralizes QuickBooks document mappings, validation helpers, error handling, and transfer-size constants.
apps/sim/app/api/tools/quickbooks/download-attachment/route.ts	Implements authenticated attachment transfer through DNS validation and pinned-IP fetching with bounded streaming.
apps/sim/app/api/tools/quickbooks/download-transaction-pdf/route.ts	Implements authenticated, size-bounded PDF retrieval and safe execution-file serialization.
apps/sim/app/api/tools/quickbooks/add-attachment/route.ts	Implements authorized workspace-file and note attachment creation with MIME, filename, and size validation.
apps/sim/blocks/blocks/quickbooks.ts	Exposes the five new document and attachment operations through the QuickBooks block.

Sequence Diagram

sequenceDiagram
  participant Workflow
  participant Tool as QuickBooks Tool
  participant Route as Authenticated File Route
  participant QBO as QuickBooks API
  participant Storage as Execution Files
  Workflow->>Tool: Run document operation
  Tool->>Route: Authenticated bounded request
  Route->>QBO: Request PDF, attachment metadata, or temporary URL
  QBO-->>Route: Document response
  Route->>Route: Validate size, MIME, filename, and URL
  Route-->>Tool: Base64 file response
  Tool-->>Storage: Store execution file
  Storage-->>Workflow: File reference and metadata

_{Reviews (3): Last reviewed commit: "test(quickbooks): cover attachment MIME ..." | Re-trigger Greptile}

BillLeoutsakosvl346 · 2026-08-03T02:00:55Z

@greptile-apps please review the latest commit 8e35624. The prior response-size finding was fixed by setting both file tools to a base64-aware bounded response cap with regression coverage.

cursor

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8e35624. Configure here.}

BillLeoutsakosvl346 · 2026-08-03T02:09:40Z

@greptile-apps please review the latest commit 371586c. The only change since your 5/5 review makes the attachment MIME fallback explicit and adds a missing-Content-Type regression test.

cursor Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/quickbooks/download-transaction-pdf/route.ts

greptile-apps Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread apps/sim/tools/quickbooks/download_attachment.ts

vercel Bot deployed to Preview August 3, 2026 01:57 View deployment

vercel Bot temporarily deployed to Preview August 3, 2026 01:58 Inactive

vercel Bot temporarily deployed to Preview August 3, 2026 01:59 Inactive

cursor Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread apps/sim/app/api/tools/quickbooks/download-attachment/route.ts

vercel Bot temporarily deployed to Preview August 3, 2026 02:06 Inactive

vercel Bot temporarily deployed to Preview August 3, 2026 02:59 Inactive

BillLeoutsakosvl346 force-pushed the feat/quickbooks-05-reports branch from 1edbb50 to 33d4ad2 Compare August 3, 2026 05:06

BillLeoutsakosvl346 force-pushed the feat/quickbooks-06-documents branch from 43119de to 3df14ef Compare August 3, 2026 05:10

vercel Bot deployed to Preview August 3, 2026 05:16 View deployment

BillLeoutsakosvl346 force-pushed the feat/quickbooks-05-reports branch from 33d4ad2 to fc1bfdc Compare August 3, 2026 07:54

Bill Leoutsakos added 11 commits August 3, 2026 01:00

feat(quickbooks): add document and attachment tools

631177a

feat(quickbooks): add bounded document file routes

7c726ab

feat(quickbooks): expose document workflows

ab39f4e

fix(quickbooks): enforce attachment upload bounds

6278a01

fix(quickbooks): tighten document handling

87e353e

fix(quickbooks): align file response limits

0421404

test(quickbooks): cover missing PDF content type

1f5006d

test(quickbooks): cover attachment MIME fallback

e78f232

fix(quickbooks): redact attachment access URLs

b35dfd5

fix(quickbooks): store downloaded documents safely

5726709

fix(quickbooks): stop cancelled attachment downloads

af5a745

BillLeoutsakosvl346 force-pushed the feat/quickbooks-06-documents branch from 3df14ef to af5a745 Compare August 3, 2026 08:29

vercel Bot deployed to Preview August 3, 2026 08:34 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(quickbooks): add documents and attachments - #6200

feat(quickbooks): add documents and attachments#6200
BillLeoutsakosvl346 wants to merge 11 commits into
feat/quickbooks-05-reportsfrom
feat/quickbooks-06-documents

BillLeoutsakosvl346 commented Aug 3, 2026

Uh oh!

vercel Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

greptile-apps Bot commented Aug 3, 2026 •

edited

Loading

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Aug 3, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

BillLeoutsakosvl346 commented Aug 3, 2026

Summary

Validation

Stack

Uh oh!

vercel Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

greptile-apps Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Aug 3, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Aug 3, 2026 •

edited

Loading

cursor Bot commented Aug 3, 2026 •

edited

Loading

greptile-apps Bot commented Aug 3, 2026 •

edited

Loading