fix(quickbooks): tighten document handling

Author: Bill Leoutsakos

apps/sim/blocks/blocks/quickbooks.ts

@@ -2344,8 +2344,11 @@ export const QuickBooksBlock: BlockConfig<QuickBooksResponse> = {
     record: {
       type: 'json',
       description:
-        'Created, updated, or voided master-data, sales, purchasing, or accounting record with native QuickBooks fields',
-      condition: { field: 'operation', value: [...MUTATION_OPERATIONS] },
+        'Created, updated, voided, or emailed record with native QuickBooks fields when QuickBooks returns one',
+      condition: {
+        field: 'operation',
+        value: [...MUTATION_OPERATIONS, EMAIL_TRANSACTION_OPERATION],
+      },
     },
     recordId: {
       type: 'string',

apps/sim/tools/quickbooks/documents.test.ts

@@ -188,6 +188,28 @@ describe('QuickBooks attachment metadata reads', () => {
     })
   })
 
+  it('surfaces sanitized faults from successful upload envelopes', async () => {
+    const response = Response.json({
+      AttachableResponse: [
+        {
+          Fault: {
+            Error: [
+              {
+                Message: 'Invalid Uploaded File',
+                Detail: 'The uploaded file is invalid',
+                code: '6041',
+              },
+            ],
+          },
+        },
+      ],
+    })
+
+    await expect(parseQuickBooksAttachableResponse(response)).rejects.toThrow(
+      '6041: Invalid Uploaded File: The uploaded file is invalid'
+    )
+  })
+
   it('rejects unsupported targets and modes before fetch', () => {
     expect(() =>
       requestUrl({ ...auth, readMode: 'list', targetType: 'unknown' as never, targetId: '1' })
@@ -201,9 +223,22 @@ describe('QuickBooks document validation and block parity', () => {
     expect(sanitizeQuickBooksFileName('../unsafe/receipt?.pdf', 'fallback.pdf')).toBe(
       'receipt_.pdf'
     )
+    expect(sanitizeQuickBooksFileName(undefined, '..')).toBe('quickbooks-file')
+    expect(sanitizeQuickBooksFileName('\u0000', '../../safe-fallback.pdf')).toBe(
+      'safe-fallback.pdf'
+    )
     expect(validateQuickBooksAttachmentFileType('receipt.pdf', 'application/pdf')).toBe(
       'application/pdf'
     )
+    expect(() => validateQuickBooksAttachmentFileType('scan.tiff', 'image/tiff')).toThrow(
+      'does not support'
+    )
+    expect(() => validateQuickBooksAttachmentFileType('note.rtf', 'application/rtf')).toThrow(
+      'does not support'
+    )
+    expect(() => validateQuickBooksAttachmentFileType('data.xml', 'application/xml')).toThrow(
+      'does not support'
+    )
     expect(() =>
       validateQuickBooksAttachmentFileType('script.exe', 'application/octet-stream')
     ).toThrow('does not support')
@@ -224,6 +259,10 @@ describe('QuickBooks document validation and block parity', () => {
     expect(operation?.options?.map((option) => option.id).sort()).toEqual(
       [...(QuickBooksBlock.tools?.access ?? [])].sort()
     )
+    expect(QuickBooksBlock.outputs?.record.condition).toEqual({
+      field: 'operation',
+      value: expect.arrayContaining(['quickbooks_email_transaction']),
+    })
     const fileBlocks = QuickBooksBlock.subBlocks.filter(
       (block) => block.canonicalParamId === 'attachmentFile'
     )

apps/sim/tools/quickbooks/documents_utils.ts

@@ -47,13 +47,12 @@ const QUICKBOOKS_FILE_TYPES: Record<string, readonly string[]> = {
   ods: ['application/vnd.oasis.opendocument.spreadsheet'],
   pdf: ['application/pdf'],
   png: ['image/png'],
-  rtf: ['application/rtf', 'text/rtf'],
+  rtf: ['text/rtf'],
   tif: ['image/tiff'],
-  tiff: ['image/tiff'],
   txt: ['text/plain'],
   xls: ['application/vnd.ms-excel'],
   xlsx: ['application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'],
-  xml: ['application/xml', 'text/xml'],
+  xml: ['text/xml'],
 }
 
 export function getQuickBooksDocumentTransaction(type: QuickBooksDocumentTransactionType) {
@@ -79,15 +78,17 @@ export function validateQuickBooksRecipient(recipient?: string): string | undefi
 }
 
 export function sanitizeQuickBooksFileName(value: string | undefined, fallback: string): string {
-  const raw = value?.trim() || fallback
-  const leaf = raw.split(/[\\/]/).pop() || fallback
-  const sanitized = leaf
-    .replace(/[\u0000-\u001f\u007f]/g, '')
-    .replace(/[^\w.() -]/g, '_')
-    .trim()
-  const bounded = sanitized.slice(0, 180)
-  if (!bounded || bounded === '.' || bounded === '..') return fallback
-  return bounded
+  const sanitize = (candidate: string): string | undefined => {
+    const leaf = candidate.trim().split(/[\\/]/).pop() ?? ''
+    const bounded = leaf
+      .replace(/[\u0000-\u001f\u007f]/g, '')
+      .replace(/[^\w.() -]/g, '_')
+      .trim()
+      .slice(0, 180)
+    return bounded && bounded !== '.' && bounded !== '..' ? bounded : undefined
+  }
+
+  return (value ? sanitize(value) : undefined) ?? sanitize(fallback) ?? 'quickbooks-file'
 }
 
 export function validateQuickBooksAttachmentFileType(fileName: string, mimeType: string): string {
@@ -123,6 +124,13 @@ export async function parseQuickBooksAttachableResponse(
     response,
     'QuickBooks Attachable response'
   )
+  const nestedFault = data.AttachableResponse?.find((entry) => entry.Fault)?.Fault
+  const sanitizedFault = sanitizeQuickBooksFaultData({ Fault: nestedFault })
+  if (sanitizedFault) {
+    throw new Error(
+      `QuickBooks attachment upload failed: ${formatQuickBooksFaultDetail(sanitizedFault)}`
+    )
+  }
   const attachment = data.Attachable ?? data.AttachableResponse?.[0]?.Attachable
   if (!attachment || typeof attachment !== 'object' || Array.isArray(attachment)) {
     throw new Error('QuickBooks Attachable response is missing a valid attachment')