fix(quickbooks): harden OAuth returns and webhook lookup

Author: waleedlatif1

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -825,9 +825,12 @@ describe('OAuth Token API Routes', () => {
       })
 
       const response = await GET(
-        new NextRequest(
+        createMockRequest(
+          'GET',
+          undefined,
+          {},
           'http://localhost:3000/api/auth/oauth/token?credentialId=credential-id'
-        ) as any
+        )
       )
       const data = await response.json()
 

apps/sim/app/api/auth/oauth2/callback/quickbooks/route.test.ts

@@ -100,6 +100,28 @@ describe('QuickBooks OAuth callback', () => {
     )
   })
 
+  it('returns completion failures to the signed initiating surface', async () => {
+    mockCompleteQuickBooksConnection.mockRejectedValueOnce(new Error('Token exchange failed'))
+    const state = createQuickBooksOAuthState({
+      userId: 'user-1',
+      draftId: 'draft-1',
+      returnUrl: 'https://sim.test/desktop/connect/complete?state=handoff',
+    })
+    const response = await GET(
+      callbackRequest(
+        new URLSearchParams({
+          code: 'authorization-code',
+          state,
+          realmId: '1234567890',
+        })
+      )
+    )
+
+    expect(response.headers.get('location')).toBe(
+      'https://sim.test/desktop/connect/complete?state=handoff&error=quickbooks_callback_error'
+    )
+  })
+
   it('rejects signed cross-origin return destinations', async () => {
     const state = createQuickBooksOAuthState({
       userId: 'user-1',

apps/sim/app/api/auth/oauth2/callback/quickbooks/route.ts

@@ -17,6 +17,7 @@ export const dynamic = 'force-dynamic'
 export const GET = withRouteHandler(async (request: NextRequest) => {
   const baseUrl = getBaseUrl()
   const fallbackUrl = `${baseUrl}/workspace`
+  let validatedReturnUrl: URL | null = null
 
   try {
     const session = await getSession()
@@ -33,14 +34,14 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     if (!isSameOrigin(state.returnUrl)) {
       throw new Error('QuickBooks OAuth state contains an invalid return URL')
     }
-    const returnUrl = new URL(state.returnUrl)
+    validatedReturnUrl = new URL(state.returnUrl)
     if (parsed.data.query.error) {
       logger.warn('QuickBooks OAuth authorization was not completed', {
         error: parsed.data.query.error,
         hasDescription: Boolean(parsed.data.query.error_description),
       })
-      returnUrl.searchParams.set('error', 'quickbooks_access_denied')
-      return NextResponse.redirect(returnUrl)
+      validatedReturnUrl.searchParams.set('error', 'quickbooks_access_denied')
+      return NextResponse.redirect(validatedReturnUrl)
     }
     if (!parsed.data.query.code || !parsed.data.query.realmId) {
       throw new Error('QuickBooks callback is missing its authorization code or company identity')
@@ -62,10 +63,12 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       request,
     })
 
-    returnUrl.searchParams.set('quickbooks_connected', 'true')
-    return NextResponse.redirect(returnUrl)
+    validatedReturnUrl.searchParams.set('quickbooks_connected', 'true')
+    return NextResponse.redirect(validatedReturnUrl)
   } catch (error) {
     logger.error('QuickBooks OAuth callback failed', { error })
-    return NextResponse.redirect(`${fallbackUrl}?error=quickbooks_callback_error`)
+    const errorUrl = validatedReturnUrl ?? new URL(fallbackUrl)
+    errorUrl.searchParams.set('error', 'quickbooks_callback_error')
+    return NextResponse.redirect(errorUrl)
   }
 })

apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.test.tsx

@@ -206,6 +206,7 @@ describe('ConnectOAuthModal reauthorization', () => {
     mocks.onConnect.mockResolvedValue(undefined)
     mocks.getServiceConfigByProviderId.mockReturnValue(null)
     mocks.workspaceCredentials.mockReturnValue({ data: [], isPending: false })
+    window.history.replaceState({}, '', '/')
     ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
     container = document.createElement('div')
     document.body.appendChild(container)
@@ -300,6 +301,23 @@ describe('ConnectOAuthModal reauthorization', () => {
     })
   })
 
+  it('does not carry a prior OAuth result into a new provider callback URL', async () => {
+    window.history.replaceState(
+      {},
+      '',
+      '/?keep=1&error=stale&error_description=stale-detail&quickbooks_connected=true'
+    )
+    renderReauthorizeModal()
+
+    await clickConnect()
+
+    expect(mocks.connectOAuthService).toHaveBeenCalledWith({
+      providerId: 'slack',
+      callbackURL: 'http://localhost:3000/?keep=1',
+      draftId: undefined,
+    })
+  })
+
   it('keeps an onConnect override ahead of credential-bound reauthorization', async () => {
     renderReauthorizeModal({
       reconnectTarget: {

apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.tsx

@@ -439,6 +439,9 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
       }
 
       const callbackURL = new URL(window.location.href)
+      callbackURL.searchParams.delete('error')
+      callbackURL.searchParams.delete('error_description')
+      callbackURL.searchParams.delete('quickbooks_connected')
       if (connectorType) {
         callbackURL.searchParams.set(ADD_CONNECTOR_SEARCH_PARAM, connectorType)
       }

apps/sim/lib/webhooks/quickbooks-credentials.test.ts

@@ -79,6 +79,22 @@ describe('QuickBooks webhook credential lookup', () => {
     ])
   })
 
+  it('fails closed instead of loading an unbounded number of app accounts', async () => {
+    queueTableRows(
+      account,
+      Array.from({ length: 1001 }, (_, index) => ({
+        accountId: createQuickBooksAccountId(String(index + 1), `subject-${index}`, CLIENT_CONFIG),
+        oauthConfig: 'encrypted-config',
+      }))
+    )
+
+    await expect(getQuickBooksWebhookVerifierTokensByAppKey(APP_KEY)).rejects.toThrow(
+      'QuickBooks webhook app account limit exceeded'
+    )
+    expect(dbChainMockFns.limit).toHaveBeenCalledWith(1001)
+    expect(mockDecryptSecret).not.toHaveBeenCalled()
+  })
+
   it('binds a deployed credential to the same app and company identity', async () => {
     queueTableRows(account, [
       {

apps/sim/lib/webhooks/quickbooks-credentials.ts

@@ -16,6 +16,7 @@ import {
 } from '@/lib/oauth/quickbooks-client-config'
 
 const QUICKBOOKS_ACCOUNT_PREFIX = 'quickbooks:v2:'
+const MAX_QUICKBOOKS_WEBHOOK_APP_ACCOUNTS = 1000
 
 export interface QuickBooksWebhookCredentialContext {
   clientConfig: QuickBooksOAuthClientConfig
@@ -75,6 +76,11 @@ export async function getQuickBooksWebhookVerifierTokensByAppKey(
         like(account.accountId, buildQuickBooksWebhookAccountIdPattern(normalizedAppKey))
       )
     )
+    .limit(MAX_QUICKBOOKS_WEBHOOK_APP_ACCOUNTS + 1)
+
+  if (rows.length > MAX_QUICKBOOKS_WEBHOOK_APP_ACCOUNTS) {
+    throw new Error('QuickBooks webhook app account limit exceeded')
+  }
 
   const verifierTokens = new Set<string>()
   for (const row of rows) {