feat(quickbooks): add core webhook triggers - #6245
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview Ingress: New fixed callback Deploy & lifecycle: Trigger deploy resolves the connected OAuth company to a routing key (realm ID); credential removal deactivates bound QuickBooks webhook rows alongside Slack. Copilot / VFS: Multi-select dropdown subblocks are validated and serialized so trigger Docs and integration metadata list trigger configuration outputs; Reviewed by Cursor Bugbot for commit 6e6494d. Bugbot is set up for automated code reviews on this repo. Configure here. |
Greptile SummaryThe PR adds authenticated QuickBooks webhook ingestion and routes company-scoped events through durable workflow dispatch.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains; the previously reported batch-termination issue is resolved because target and lookup failures are isolated until all later events have been processed.
|
| Filename | Overview |
|---|---|
| apps/sim/app/api/webhooks/quickbooks/route.ts | Adds bounded, signature-authenticated app-level webhook ingress that acknowledges deliveries only after durable enqueue. |
| apps/sim/background/quickbooks-webhook-ingress.ts | Routes every accepted event by QuickBooks company, isolates target failures, and retries after processing the complete batch. |
| apps/sim/lib/webhooks/providers/quickbooks.ts | Adds QuickBooks signature verification, event matching, normalization, and event-ID extraction for idempotency. |
| apps/sim/lib/webhooks/deploy.ts | Integrates QuickBooks with the app-level trigger deployment lifecycle. |
| apps/sim/triggers/quickbooks/index.ts | Exports the new QuickBooks event trigger catalog for registry consumption. |
| apps/sim/blocks/blocks/quickbooks.ts | Enables trigger mode and exposes the registered QuickBooks trigger options on the existing block. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
QB[QuickBooks] --> Route[Signed webhook route]
Route --> Validate[Verify signature and validate bounded envelope]
Validate --> Ingress[Durable ingress job]
Ingress --> Lookup[Find deployed targets by company realm]
Lookup --> Dispatch[Dispatch each event to matching workflows]
Dispatch --> Idempotency[Webhook execution idempotency]
Idempotency --> Execute[Execute workflow]
Reviews (4): Last reviewed commit: "refactor(quickbooks): align webhook trig..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
* feat(quickbooks): complete webhook trigger matrix * fix(quickbooks): document webhook event selectors * fix(quickbooks): clarify webhook setup --------- Co-authored-by: Bill Leoutsakos <billleoutsakos@Mac.localdomain>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit afb7009. Configure here.
QuickBooks trigger file classificationThe implementation has been kept mostly within Sim’s normal trigger patterns. I’ve classified the files as:
StandardThese are the normal files expected when adding triggers to an existing integration. Trigger definitions
These contain the conventional trigger definitions, the fixed Intuit entity/action matrix, trigger matching, input formatting, and shared QuickBooks trigger options. Block and registries
These expose the 29 grouped trigger choices through the existing QuickBooks block, register them, and update the generated integration catalogue and documentation. Standard trigger tests
This provides table-driven behavioral coverage for all 29 choices and 101 supported entity/action combinations, including matching, formatting, event-type isolation, and Intuit Semi-standardThese files are needed because QuickBooks uses one app-level webhook endpoint rather than giving every workflow its own webhook URL. Comparable patterns exist in integrations such as TikTok and Slack: they authenticate a shared provider callback, route an event to deployed workflows using provider-owned identity information, and then use Sim’s shared webhook dispatcher. App-level webhook callback
The route receives Intuit’s app-level callback, reads a bounded raw body, verifies the This belongs in the trigger PR because Intuit cannot deliver events to the QuickBooks triggers without a public authenticated callback. Test:
Webhook provider handling
The provider handles QuickBooks-specific signature authentication, entity/action matching, output formatting, and event-ID idempotency while still using Sim’s standard dispatcher. TikTok and Slack have comparable provider handlers because their webhook authentication and payload formats are provider-specific. This belongs here because these are the minimum adapters required to translate Intuit events into Sim’s standard trigger execution model. Test:
Deployment-time company routing
When a QuickBooks trigger is deployed, Sim stores the connected company’s Deleting the credential also deactivates its deployed triggers. TikTok similarly stores an account identity in These changes belong in this PR because correct company isolation and credential cleanup are essential parts of deploying the trigger safely. Tests:
Provider configuration
These register the server-only Intuit webhook verifier token used to authenticate callback signatures. This is comparable to the signing secrets or verifier configuration required by other authenticated webhook providers and is directly required for the QuickBooks endpoint to reject forged deliveries. Mothership multi-select support
QuickBooks trigger actions use Sim’s existing These are small provider-neutral corrections to support an existing block feature—not QuickBooks-specific branches or new abstractions. They belong in this PR because without them most of the trigger matrix was impossible to configure through Mothership. Tests:
UniqueThere is one unique runtime component: the durable QuickBooks batch-ingress job.
Test:
Intuit may send a single webhook request containing multiple events for multiple QuickBooks companies, while requiring the endpoint to acknowledge the delivery within roughly three seconds and recommending asynchronous processing. The ingress job lets the callback perform only: |
1 participant
Summary
Validation
Live Intuit delivery remains dependent on configuring the public callback and QUICKBOOKS_WEBHOOK_VERIFIER_TOKEN; signed raw-body fixtures cover ingress locally.