fix(quickbooks): redact attachment access URLs

Author: Bill Leoutsakos

apps/sim/app/api/tools/quickbooks/documents.test.ts

@@ -149,7 +149,15 @@ describe('QuickBooks document API routes', () => {
 
   it('creates a note attachment with one JSON request', async () => {
     mockFetch.mockResolvedValueOnce(
-      Response.json({ Attachable: { Id: '9', Note: 'Audit note' }, time: '2026-08-02' })
+      Response.json({
+        Attachable: {
+          Id: '9',
+          Note: 'Audit note',
+          TempDownloadUri: 'https://example.invalid/temp?token=secret',
+          ThumbnailTempDownloadUri: 'https://example.invalid/thumbnail?token=secret',
+        },
+        time: '2026-08-02',
+      })
     )
 
     const response = await addAttachment(
@@ -165,6 +173,7 @@ describe('QuickBooks document API routes', () => {
 
     expect(response.status).toBe(200)
     expect(body.output).toMatchObject({ attachmentId: '9', attachmentKind: 'note' })
+    expect(body.output.attachment).toEqual({ Id: '9', Note: 'Audit note' })
     expect(mockFetch).toHaveBeenCalledTimes(1)
     expect(JSON.parse(mockFetch.mock.calls[0][1].body)).toMatchObject({
       Note: 'Audit note',

apps/sim/tools/generated/tool-metadata.ts

@@ -5,6 +5,7 @@ import {
   getQuickBooksAttachmentTarget,
   parseQuickBooksAttachableResponse,
   QUICKBOOKS_FILE_TOOL_RESPONSE_MAX_BYTES,
+  sanitizeQuickBooksAttachable,
   sanitizeQuickBooksFileName,
   validateQuickBooksAttachmentFileType,
 } from '@/tools/quickbooks/documents_utils'
@@ -191,6 +192,45 @@ describe('QuickBooks attachment metadata reads', () => {
     })
   })
 
+  it('removes Intuit attachment access URLs from parsed and listed metadata', async () => {
+    const attachment = {
+      Id: '9',
+      FileName: 'receipt.pdf',
+      FileAccessUri: 'https://example.invalid/file',
+      TempDownloadUri: 'https://example.invalid/temp?token=secret',
+      TemporaryDownloadUri: 'https://example.invalid/temporary?token=secret',
+      ThumbnailFileAccessUri: 'https://example.invalid/thumbnail',
+      ThumbnailTempDownloadUri: 'https://example.invalid/thumbnail-temp?token=secret',
+    }
+
+    expect(sanitizeQuickBooksAttachable(attachment)).toEqual({
+      Id: '9',
+      FileName: 'receipt.pdf',
+    })
+
+    await expect(
+      parseQuickBooksAttachableResponse(Response.json({ Attachable: attachment }))
+    ).resolves.toEqual({
+      attachment: { Id: '9', FileName: 'receipt.pdf' },
+      time: null,
+    })
+
+    const params: QuickBooksReadAttachmentsParams = {
+      ...auth,
+      readMode: 'list',
+      targetType: 'invoice',
+      targetId: '88',
+    }
+    await expect(
+      quickbooksReadAttachmentsTool.transformResponse!(
+        Response.json({ QueryResponse: { Attachable: [attachment] } }),
+        params
+      )
+    ).resolves.toMatchObject({
+      output: { items: [{ Id: '9', FileName: 'receipt.pdf' }] },
+    })
+  })
+
   it('surfaces sanitized faults from successful upload envelopes', async () => {
     const response = Response.json({
       AttachableResponse: [

apps/sim/tools/quickbooks/documents.test.ts

@@ -118,6 +118,25 @@ export interface QuickBooksAttachableEnvelope {
   time?: string
 }
 
+/**
+ * Removes Intuit-managed attachment URLs before records enter tool outputs or execution logs.
+ * These URLs can be short-lived capability links and are not needed by callers because file
+ * downloads go through the authenticated Download Attachment operation.
+ */
+export function sanitizeQuickBooksAttachable(
+  attachment: QuickBooksAttachable
+): QuickBooksAttachable {
+  const {
+    FileAccessUri: _fileAccessUri,
+    TempDownloadUri: _tempDownloadUri,
+    TemporaryDownloadUri: _temporaryDownloadUri,
+    ThumbnailFileAccessUri: _thumbnailFileAccessUri,
+    ThumbnailTempDownloadUri: _thumbnailTempDownloadUri,
+    ...safeAttachment
+  } = attachment
+  return safeAttachment as QuickBooksAttachable
+}
+
 export async function parseQuickBooksAttachableResponse(
   response: Response
 ): Promise<{ attachment: QuickBooksAttachable; time: string | null }> {
@@ -140,7 +159,10 @@ export async function parseQuickBooksAttachableResponse(
     throw new Error('QuickBooks Attachable response is missing a valid attachment ID')
   }
   const responseTime = data.time ?? data.AttachableResponse?.[0]?.time
-  return { attachment, time: typeof responseTime === 'string' ? responseTime : null }
+  return {
+    attachment: sanitizeQuickBooksAttachable(attachment),
+    time: typeof responseTime === 'string' ? responseTime : null,
+  }
 }
 
 export function buildQuickBooksAttachableMetadata(

apps/sim/tools/quickbooks/documents_utils.ts

@@ -4,6 +4,7 @@ import {
   escapeQuickBooksQueryLiteral,
   getQuickBooksAttachmentTarget,
   parseQuickBooksAttachableResponse,
+  sanitizeQuickBooksAttachable,
 } from '@/tools/quickbooks/documents_utils'
 import type {
   QuickBooksAttachable,
@@ -144,9 +145,10 @@ export const quickbooksReadAttachmentsTool: ToolConfig<
     ) {
       throw new Error('QuickBooks Attachable response is missing QueryResponse')
     }
-    const items = data.QueryResponse.Attachable ?? []
-    if (!Array.isArray(items))
+    const attachments = data.QueryResponse.Attachable ?? []
+    if (!Array.isArray(attachments))
       throw new Error('QuickBooks Attachable response contains a malformed attachment list')
+    const items = attachments.map(sanitizeQuickBooksAttachable)
     const startPosition = Number.isInteger(data.QueryResponse.startPosition)
       ? data.QueryResponse.startPosition!
       : pagination.startPosition

apps/sim/tools/quickbooks/read_attachments.ts

@@ -443,9 +443,6 @@ export interface QuickBooksAttachable {
   Size?: number
   Note?: string
   Category?: string
-  TemporaryDownloadUri?: string
-  FileAccessUri?: string
-  TempDownloadUri?: string
   AttachableRef?: QuickBooksAttachableReference[]
   MetaData?: QuickBooksMetaData
   domain?: string