fix(quickbooks): sanitize customer tax identifiers

Author: Bill Leoutsakos

apps/sim/tools/quickbooks/create_customer.ts

@@ -17,6 +17,7 @@ import {
   quickBooksEmailAddress,
   quickBooksPhoneNumber,
   requiredQuickBooksString,
+  sanitizeQuickBooksCustomer,
   transformQuickBooksMutationResponse,
 } from '@/tools/quickbooks/utils'
 import type { ToolConfig } from '@/tools/types'
@@ -123,7 +124,11 @@ export const quickbooksCreateCustomerTool: ToolConfig<
     maxResponseBytes: QUICKBOOKS_MAX_RESPONSE_BYTES,
   },
   transformResponse: (response) =>
-    transformQuickBooksMutationResponse<QuickBooksCustomer>(response, 'Customer'),
+    transformQuickBooksMutationResponse<QuickBooksCustomer>(
+      response,
+      'Customer',
+      sanitizeQuickBooksCustomer
+    ),
   outputs: {
     record: {
       type: 'json',

apps/sim/tools/quickbooks/quickbooks.test.ts

@@ -397,6 +397,35 @@ describe('QuickBooks master-data reader', () => {
     expect(byIdResult.output.item).not.toHaveProperty('TaxIdentifier')
   })
 
+  it('removes customer tax identifiers from list and by-ID output', async () => {
+    const customer = {
+      Id: '4',
+      SyncToken: '1',
+      DisplayName: 'Sanitized Customer',
+      TaxIdentifier: 'sensitive-tax-id',
+    }
+    const customerParams: QuickBooksReadMasterDataParams = {
+      ...listParams,
+      recordType: 'customer',
+    }
+
+    const listResult = await quickbooksReadMasterDataTool.transformResponse!(
+      Response.json({ QueryResponse: { Customer: [customer] } }),
+      customerParams
+    )
+    expect(listResult.output.items?.[0]).toEqual({
+      Id: '4',
+      SyncToken: '1',
+      DisplayName: 'Sanitized Customer',
+    })
+
+    const byIdResult = await quickbooksReadMasterDataTool.transformResponse!(
+      Response.json({ Customer: customer }),
+      { ...customerParams, readMode: 'by_id', recordId: '4' }
+    )
+    expect(byIdResult.output.item).not.toHaveProperty('TaxIdentifier')
+  })
+
   it('rejects missing IDs, unknown types and unknown modes before a request', () => {
     const requestUrl = quickbooksReadMasterDataTool.request.url as (
       params: QuickBooksReadMasterDataParams
@@ -556,6 +585,27 @@ describe('QuickBooks customer and vendor mutations', () => {
       })
     }
   })
+
+  it('removes customer tax identifiers from mutation output', async () => {
+    const response = {
+      Customer: {
+        Id: '22',
+        SyncToken: '0',
+        DisplayName: 'Sanitized Customer',
+        TaxIdentifier: 'sensitive-tax-id',
+      },
+      time: 'test-time',
+    }
+
+    for (const tool of [quickbooksCreateCustomerTool, quickbooksUpdateCustomerTool]) {
+      const result = await tool.transformResponse!(Response.json(response))
+      expect(result.output.record).toEqual({
+        Id: '22',
+        SyncToken: '0',
+        DisplayName: 'Sanitized Customer',
+      })
+    }
+  })
 })
 
 describe('QuickBooks item mutations', () => {

apps/sim/tools/quickbooks/read_master_data.ts

@@ -2,6 +2,7 @@ import { ErrorExtractorId } from '@/tools/error-extractors'
 import { QUICKBOOKS_MAX_RESPONSE_BYTES } from '@/tools/quickbooks/client'
 import type {
   QuickBooksAddress,
+  QuickBooksCustomer,
   QuickBooksEmployee,
   QuickBooksMasterDataRecord,
   QuickBooksReadMasterDataParams,
@@ -14,6 +15,7 @@ import {
   buildQuickBooksQueryUrl,
   getQuickBooksMasterDataEntity,
   getQuickBooksToolHeaders,
+  sanitizeQuickBooksCustomer,
   sanitizeQuickBooksVendor,
   transformQuickBooksEntityResponse,
   transformQuickBooksListResponse,
@@ -114,6 +116,7 @@ function sanitizeMasterDataRecord(
   value: QuickBooksMasterDataRecord
 ): QuickBooksMasterDataRecord {
   if (recordType === 'employee') return sanitizeEmployee(value)
+  if (recordType === 'customer') return sanitizeQuickBooksCustomer(value as QuickBooksCustomer)
   if (recordType === 'vendor') return sanitizeQuickBooksVendor(value as QuickBooksVendor)
   return value
 }

apps/sim/tools/quickbooks/update_customer.ts

@@ -19,6 +19,7 @@ import {
   quickBooksEmailAddress,
   quickBooksPhoneNumber,
   requiredQuickBooksString,
+  sanitizeQuickBooksCustomer,
   transformQuickBooksMutationResponse,
 } from '@/tools/quickbooks/utils'
 import type { ToolConfig } from '@/tools/types'
@@ -151,7 +152,11 @@ export const quickbooksUpdateCustomerTool: ToolConfig<
     maxResponseBytes: QUICKBOOKS_MAX_RESPONSE_BYTES,
   },
   transformResponse: (response) =>
-    transformQuickBooksMutationResponse<QuickBooksCustomer>(response, 'Customer'),
+    transformQuickBooksMutationResponse<QuickBooksCustomer>(
+      response,
+      'Customer',
+      sanitizeQuickBooksCustomer
+    ),
   outputs: {
     record: {
       type: 'json',

apps/sim/tools/quickbooks/utils.ts

@@ -10,6 +10,7 @@ import { sanitizeQuickBooksFaultData } from '@/tools/quickbooks/fault'
 import type {
   QuickBooksActiveStatus,
   QuickBooksAddress,
+  QuickBooksCustomer,
   QuickBooksListResponse,
   QuickBooksMasterDataRecord,
   QuickBooksMasterDataRecordType,
@@ -207,6 +208,10 @@ export function sanitizeQuickBooksVendor(vendor: QuickBooksVendor): QuickBooksVe
   return omit(vendor, ['TaxIdentifier']) as QuickBooksVendor
 }
 
+export function sanitizeQuickBooksCustomer(customer: QuickBooksCustomer): QuickBooksCustomer {
+  return omit(customer, ['TaxIdentifier']) as QuickBooksCustomer
+}
+
 export function quickBooksWritableItemType(itemType: QuickBooksWritableItemType): string {
   const types: Record<QuickBooksWritableItemType, string> = {
     service: 'Service',