fix(quickbooks): finalize OAuth configuration handling

Author: waleedlatif1

apps/docs/openapi-v2-resources.json

@@ -8006,7 +8006,8 @@
                         "type": "string",
                         "minLength": 1,
                         "maxLength": 512,
-                        "description": "Write-only client secret for the caller-managed Intuit OAuth application."
+                        "description": "Write-only client secret for the caller-managed Intuit OAuth application.",
+                        "writeOnly": true
                       },
                       "environment": {
                         "type": "string",
@@ -8017,7 +8018,8 @@
                         "type": "string",
                         "minLength": 1,
                         "maxLength": 512,
-                        "description": "Write-only verifier token for webhook signatures from the caller-managed app."
+                        "description": "Write-only verifier token for webhook signatures from the caller-managed app.",
+                        "writeOnly": true
                       }
                     },
                     "required": ["clientId", "clientSecret", "environment", "webhookVerifierToken"],
@@ -8125,10 +8127,10 @@
                 "type": "string",
                 "minLength": 1,
                 "maxLength": 255,
-                "description": "Existing OAuth credential to reconnect in place."
+                "description": "Existing OAuth credential to reconnect in place. QuickBooks reconnects also require oauthClientConfig with the Intuit client ID, client secret, environment, and webhook verifier token."
               },
               "oauthClientConfig": {
-                "description": "Write-only OAuth app configuration when required by the provider.",
+                "description": "Write-only Intuit OAuth app configuration. Required when credentialId identifies a QuickBooks credential; omit it for other providers.",
                 "type": "object",
                 "properties": {
                   "clientId": {
@@ -8141,7 +8143,8 @@
                     "type": "string",
                     "minLength": 1,
                     "maxLength": 512,
-                    "description": "Write-only client secret for the caller-managed Intuit OAuth application."
+                    "description": "Write-only client secret for the caller-managed Intuit OAuth application.",
+                    "writeOnly": true
                   },
                   "environment": {
                     "type": "string",
@@ -8152,7 +8155,8 @@
                     "type": "string",
                     "minLength": 1,
                     "maxLength": 512,
-                    "description": "Write-only verifier token for webhook signatures from the caller-managed app."
+                    "description": "Write-only verifier token for webhook signatures from the caller-managed app.",
+                    "writeOnly": true
                   }
                 },
                 "required": ["clientId", "clientSecret", "environment", "webhookVerifierToken"],

apps/sim/app/api/auth/oauth2/authorize/route.test.ts

@@ -303,7 +303,7 @@ describe('OAuth2 authorize route', () => {
         providerId: 'quickbooks',
         workspaceId: WORKSPACE_ID,
         credentialId: null,
-        encryptedOAuthClientConfig: 'encrypted-config',
+        oauthConfig: 'encrypted-config',
       },
     })
     const callbackURL = `${BASE_URL}/workspace/${WORKSPACE_ID}/integrations`

apps/sim/app/api/auth/oauth2/authorize/route.ts

@@ -59,7 +59,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         workspaceId = draft.workspaceId
         credentialId = draft.credentialId ?? undefined
         connectionDraftId = draft.id
-        encryptedQuickBooksClientConfig = draft.encryptedOAuthClientConfig
+        encryptedQuickBooksClientConfig = draft.oauthConfig
         fromConnectionDraft = true
       } catch (error) {
         if (!(error instanceof OrchestrationError)) throw error
@@ -132,7 +132,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
           input: { draftId: connectionDraftId },
           request,
         })
-        encryptedQuickBooksClientConfig = draft.encryptedOAuthClientConfig
+        encryptedQuickBooksClientConfig = draft.oauthConfig
       }
       if (!encryptedQuickBooksClientConfig) {
         throw new Error('QuickBooks OAuth client configuration is missing')

apps/sim/app/api/webhooks/quickbooks/[appKey]/route.test.ts

@@ -6,8 +6,8 @@ import { NextRequest } from 'next/server'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 import { WEBHOOK_MAX_BODY_BYTES } from '@/lib/webhooks/constants'
 
-const { mockClientConfig, mockEnqueue, mockRelease } = vi.hoisted(() => ({
-  mockClientConfig: vi.fn(),
+const { mockVerifierTokens, mockEnqueue, mockRelease } = vi.hoisted(() => ({
+  mockVerifierTokens: vi.fn(),
   mockEnqueue: vi.fn(),
   mockRelease: vi.fn(),
 }))
@@ -20,7 +20,7 @@ vi.mock('@/lib/core/admission/gate', () => ({
   tryAdmit: vi.fn(() => ({ release: mockRelease })),
 }))
 vi.mock('@/lib/webhooks/quickbooks-credentials', () => ({
-  getQuickBooksWebhookClientConfigByAppKey: mockClientConfig,
+  getQuickBooksWebhookVerifierTokensByAppKey: mockVerifierTokens,
 }))
 vi.mock('@/lib/core/utils/with-route-handler', () => ({
   withRouteHandler:
@@ -58,9 +58,9 @@ function request(body: string, signature?: string): NextRequest {
   })
 }
 
-function signedRequest(value: unknown): NextRequest {
+function signedRequest(value: unknown, verifierToken = 'verifier'): NextRequest {
   const body = JSON.stringify(value)
-  const signature = crypto.createHmac('sha256', 'verifier').update(body).digest('base64')
+  const signature = crypto.createHmac('sha256', verifierToken).update(body).digest('base64')
   return request(body, signature)
 }
 
@@ -71,7 +71,7 @@ function callPost(webhookRequest: NextRequest, appKey = APP_KEY): Promise<Respon
 describe('QuickBooks webhook ingress route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockClientConfig.mockResolvedValue({ webhookVerifierToken: 'verifier' })
+    mockVerifierTokens.mockResolvedValue(['verifier'])
     requestUtilsMockFns.mockGenerateRequestId.mockReturnValue('request-1')
     mockEnqueue.mockResolvedValue('job-1')
   })
@@ -85,7 +85,7 @@ describe('QuickBooks webhook ingress route', () => {
       signedRequest([validEvent, { ...validEvent, id: 'event-2', intuitaccountid: '789' }])
     )
     expect(response.status).toBe(200)
-    expect(mockClientConfig).toHaveBeenCalledWith(APP_KEY)
+    expect(mockVerifierTokens).toHaveBeenCalledWith(APP_KEY)
     expect(mockEnqueue).toHaveBeenCalledWith(
       expect.objectContaining({
         appKey: APP_KEY,
@@ -96,9 +96,15 @@ describe('QuickBooks webhook ingress route', () => {
     expect(mockRelease).toHaveBeenCalledOnce()
   })
 
+  it('accepts any verifier token configured by a connection for the same Intuit app', async () => {
+    mockVerifierTokens.mockResolvedValue(['stale-verifier', 'current-verifier'])
+
+    expect((await callPost(signedRequest([validEvent], 'current-verifier'))).status).toBe(200)
+  })
+
   it('fails closed for unknown app keys and missing signatures', async () => {
     expect((await callPost(signedRequest([validEvent]), 'invalid')).status).toBe(404)
-    mockClientConfig.mockResolvedValueOnce(null)
+    mockVerifierTokens.mockResolvedValueOnce([])
     expect((await callPost(signedRequest([validEvent]))).status).toBe(404)
     expect((await callPost(request(JSON.stringify([validEvent])))).status).toBe(401)
     expect(mockEnqueue).not.toHaveBeenCalled()
@@ -119,7 +125,7 @@ describe('QuickBooks webhook ingress route', () => {
     oversizedRequest.headers.set('content-length', String(WEBHOOK_MAX_BODY_BYTES + 1))
 
     expect((await callPost(oversizedRequest)).status).toBe(413)
-    expect(mockClientConfig).not.toHaveBeenCalled()
+    expect(mockVerifierTokens).not.toHaveBeenCalled()
     expect(mockEnqueue).not.toHaveBeenCalled()
   })
 

apps/sim/app/api/webhooks/quickbooks/[appKey]/route.ts

@@ -14,8 +14,8 @@ import {
 } from '@/lib/core/utils/stream-limits'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { WEBHOOK_MAX_BODY_BYTES } from '@/lib/webhooks/constants'
-import { verifyQuickBooksSignature } from '@/lib/webhooks/providers/quickbooks'
-import { getQuickBooksWebhookClientConfigByAppKey } from '@/lib/webhooks/quickbooks-credentials'
+import { verifyQuickBooksSignatureAgainstVerifierTokens } from '@/lib/webhooks/providers/quickbooks'
+import { getQuickBooksWebhookVerifierTokensByAppKey } from '@/lib/webhooks/quickbooks-credentials'
 import {
   enqueueQuickBooksWebhookIngress,
   type QuickBooksWebhookIngressPayload,
@@ -62,14 +62,14 @@ export const POST = withRouteHandler(
         throw error
       }
 
-      const clientConfig = await getQuickBooksWebhookClientConfigByAppKey(appKey)
-      if (!clientConfig) {
+      const verifierTokens = await getQuickBooksWebhookVerifierTokensByAppKey(appKey)
+      if (verifierTokens.length === 0) {
         return NextResponse.json({ error: 'Webhook not found' }, { status: 404 })
       }
-      const authError = verifyQuickBooksSignature(
+      const authError = verifyQuickBooksSignatureAgainstVerifierTokens(
         rawBody,
         request.headers.get('intuit-signature'),
-        clientConfig.webhookVerifierToken,
+        verifierTokens,
         requestId
       )
       if (authError) return authError

apps/sim/lib/api/contracts/credentials.ts

@@ -315,7 +315,8 @@ export const quickBooksOAuthClientConfigSchema = z
       .trim()
       .min(1, 'QuickBooks client secret is required')
       .max(512, 'QuickBooks client secret must be at most 512 characters')
-      .describe('Write-only client secret for the caller-managed Intuit OAuth application.'),
+      .describe('Write-only client secret for the caller-managed Intuit OAuth application.')
+      .meta({ writeOnly: true }),
     environment: z
       .enum(['sandbox', 'production'], {
         error: 'QuickBooks environment must be sandbox or production',
@@ -326,7 +327,8 @@ export const quickBooksOAuthClientConfigSchema = z
       .trim()
       .min(1, 'QuickBooks webhook verifier token is required')
       .max(512, 'QuickBooks webhook verifier token must be at most 512 characters')
-      .describe('Write-only verifier token for webhook signatures from the caller-managed app.'),
+      .describe('Write-only verifier token for webhook signatures from the caller-managed app.')
+      .meta({ writeOnly: true }),
   })
   .strict()
 

apps/sim/lib/api/contracts/v2/credentials.test.ts

@@ -2,6 +2,7 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
+import { z } from 'zod'
 import {
   V2_OAUTH_CONNECTION_PROVIDER_IDS,
   v2CreateCredentialConnectionBodySchema,
@@ -16,6 +17,20 @@ const QUICKBOOKS_CONFIG = {
   webhookVerifierToken: 'verifier-token',
 }
 
+interface CredentialConnectionJsonSchema {
+  anyOf?: CredentialConnectionJsonSchema[]
+  properties?: {
+    credentialId?: { description?: string }
+    oauthClientConfig?: {
+      description?: string
+      properties?: {
+        clientSecret?: { writeOnly?: boolean }
+        webhookVerifierToken?: { writeOnly?: boolean }
+      }
+    }
+  }
+}
+
 describe('v2CreateCredentialConnectionBodySchema', () => {
   it('keeps the documented provider enum in sync with provider discovery', () => {
     const discoveredProviderIds = getAllOAuthServices()
@@ -63,4 +78,23 @@ describe('v2CreateCredentialConnectionBodySchema', () => {
       }).success
     ).toBe(true)
   })
+
+  it('publishes QuickBooks reconnect requirements and secret fields accurately', () => {
+    const published = z.toJSONSchema(v2CreateCredentialConnectionBodySchema, {
+      io: 'input',
+      unrepresentable: 'any',
+    }) as CredentialConnectionJsonSchema
+    const newQuickBooksConfig = published.anyOf?.[0]?.anyOf?.[0]?.properties?.oauthClientConfig
+    const reconnect = published.anyOf?.[1]
+    const reconnectConfig = reconnect?.properties?.oauthClientConfig
+
+    expect(reconnect?.properties?.credentialId?.description).toContain(
+      'QuickBooks reconnects also require oauthClientConfig'
+    )
+    expect(reconnectConfig?.description).toContain('Required when credentialId identifies')
+    for (const config of [newQuickBooksConfig, reconnectConfig]) {
+      expect(config?.properties?.clientSecret?.writeOnly).toBe(true)
+      expect(config?.properties?.webhookVerifierToken?.writeOnly).toBe(true)
+    }
+  })
 })

apps/sim/lib/api/contracts/v2/credentials.ts

@@ -341,10 +341,14 @@ const v2CreateCredentialConnectionByCredentialSchema = z
       .trim()
       .min(1, 'credentialId cannot be empty')
       .max(255, 'credentialId must be at most 255 characters')
-      .describe('Existing OAuth credential to reconnect in place.'),
+      .describe(
+        'Existing OAuth credential to reconnect in place. QuickBooks reconnects also require oauthClientConfig with the Intuit client ID, client secret, environment, and webhook verifier token.'
+      ),
     oauthClientConfig: quickBooksOAuthClientConfigSchema
       .optional()
-      .describe('Write-only OAuth app configuration when required by the provider.'),
+      .describe(
+        'Write-only Intuit OAuth app configuration. Required when credentialId identifies a QuickBooks credential; omit it for other providers.'
+      ),
   })
   .strict()
 

apps/sim/lib/credentials/application/complete-quickbooks-connection.test.ts

@@ -74,7 +74,7 @@ describe('completeQuickBooksConnection', () => {
       credentialId: null,
       displayName: 'QuickBooks Sandbox',
       description: null,
-      encryptedOAuthClientConfig: 'encrypted-client-config',
+      oauthConfig: 'encrypted-client-config',
       createdAt: new Date('2026-09-04T18:00:00.000Z'),
       expiresAt: new Date('2026-09-04T18:10:00.000Z'),
     })
@@ -147,7 +147,7 @@ describe('completeQuickBooksConnection', () => {
         accountId:
           'quickbooks:v2:bGFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE:sandbox:1234567890:dXNlci0x',
         providerId: 'quickbooks',
-        encryptedOAuthClientConfig: 'encrypted-client-config',
+        oauthConfig: 'encrypted-client-config',
         scope: 'com.intuit.quickbooks.accounting openid',
       })
     )
@@ -166,7 +166,7 @@ describe('completeQuickBooksConnection', () => {
       workspaceId: 'workspace-1',
       providerId: 'quickbooks',
       credentialId: null,
-      encryptedOAuthClientConfig: null,
+      oauthConfig: null,
     })
 
     await expect(

apps/sim/lib/credentials/application/complete-quickbooks-connection.ts

@@ -63,11 +63,11 @@ export const completeQuickBooksConnection = defineAuthorizedWorkspaceUseCase({
       throw new OrchestrationError('conflict', 'OAuth connection provider no longer matches')
     }
 
-    const encryptedOAuthClientConfig = context.draft.encryptedOAuthClientConfig
-    if (!encryptedOAuthClientConfig) {
+    const oauthConfig = context.draft.oauthConfig
+    if (!oauthConfig) {
       throw new OrchestrationError('validation', 'QuickBooks OAuth client configuration is missing')
     }
-    const clientConfig = await decryptQuickBooksOAuthClientConfig(encryptedOAuthClientConfig)
+    const clientConfig = await decryptQuickBooksOAuthClientConfig(oauthConfig)
     const tokens = await exchangeQuickBooksAuthorizationCode({
       code: input.code,
       redirectUri: input.redirectUri,
@@ -102,7 +102,7 @@ export const completeQuickBooksConnection = defineAuthorizedWorkspaceUseCase({
       accessTokenExpiresAt,
       refreshTokenExpiresAt,
       scope: tokens.scope || getCanonicalScopesForProvider('quickbooks').join(' '),
-      encryptedOAuthClientConfig,
+      oauthConfig,
       updatedAt: now,
     }
     if (existing) {