fix(quickbooks): stop persisting the Intuit identity token and share the webhook batch ceiling

The OIDC identity JWT is only meaningful at connection time, where profile.accountId
is already derived from it. Persisting it projected the token into the credential
payload of every QuickBooks tool call, none of which read it. Gating it in
token-resolution instead would break Shopify, which reads params.idToken as a shop
domain fallback.

Also exports QUICKBOOKS_WEBHOOK_MAX_EVENTS from the contract so the route no longer
carries a second copy of the batch ceiling.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RB5M2gk7zZgGomnQqr7WRB

Author: waleedlatif1

apps/sim/app/api/webhooks/quickbooks/[appKey]/route.ts

@@ -2,6 +2,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
+  QUICKBOOKS_WEBHOOK_MAX_EVENTS,
   type QuickBooksWebhookEvent,
   quickBooksWebhookEventSchema,
   quickBooksWebhookParamsSchema,
@@ -24,8 +25,6 @@ import {
 
 const logger = createLogger('QuickBooksWebhookIngress')
 const BODY_LABEL = 'QuickBooks webhook body'
-/** Mirrors the batch ceiling `quickBooksWebhookEventsSchema` declares for the same envelope. */
-const MAX_WEBHOOK_EVENTS = 1000
 
 export const dynamic = 'force-dynamic'
 export const runtime = 'nodejs'
@@ -79,7 +78,11 @@ export const POST = withRouteHandler(
       } catch {
         return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
       }
-      if (!Array.isArray(json) || json.length === 0 || json.length > MAX_WEBHOOK_EVENTS) {
+      if (
+        !Array.isArray(json) ||
+        json.length === 0 ||
+        json.length > QUICKBOOKS_WEBHOOK_MAX_EVENTS
+      ) {
         logger.warn(`[${requestId}] Invalid QuickBooks webhook envelope`)
         return NextResponse.json({ error: 'Invalid webhook envelope' }, { status: 400 })
       }

apps/sim/lib/api/contracts/webhooks.ts

@@ -359,7 +359,13 @@ export const quickBooksWebhookEventSchema = z.object({
   data: z.unknown().optional(),
 })
 
-export const quickBooksWebhookEventsSchema = z.array(quickBooksWebhookEventSchema).min(1).max(1000)
+/** Maximum CloudEvents Intuit batches into a single webhook delivery. */
+export const QUICKBOOKS_WEBHOOK_MAX_EVENTS = 1000
+
+export const quickBooksWebhookEventsSchema = z
+  .array(quickBooksWebhookEventSchema)
+  .min(1)
+  .max(QUICKBOOKS_WEBHOOK_MAX_EVENTS)
 
 export type QuickBooksWebhookEvent = z.input<typeof quickBooksWebhookEventSchema>
 

apps/sim/lib/credentials/application/complete-quickbooks-connection.test.ts

@@ -159,6 +159,30 @@ describe('completeQuickBooksConnection', () => {
     })
   })
 
+  it('never persists the Intuit identity token', async () => {
+    queueTableRows(account, [])
+    mocks.exchangeAuthorizationCode.mockResolvedValue({
+      accessToken: 'access-token',
+      refreshToken: 'refresh-token',
+      idToken: 'intuit-oidc-identity-jwt',
+      accessTokenExpiresIn: 3600,
+      refreshTokenExpiresIn: 8_726_400,
+      scope: '',
+    })
+
+    await completeQuickBooksConnection.execute({
+      principal,
+      input: {
+        draftId: 'draft-1',
+        code: 'authorization-code',
+        realmId: '1234567890',
+        redirectUri: 'https://sim.test/api/auth/oauth2/callback/quickbooks',
+      },
+    })
+
+    expect(dbChainMockFns.values).toHaveBeenCalledWith(expect.objectContaining({ idToken: null }))
+  })
+
   it('fails before token exchange when the draft does not carry encrypted app credentials', async () => {
     mocks.getActiveDraft.mockResolvedValueOnce({
       id: 'draft-1',

apps/sim/lib/credentials/application/complete-quickbooks-connection.ts

@@ -98,7 +98,13 @@ export const completeQuickBooksConnection = defineAuthorizedWorkspaceUseCase({
     const accountValues = {
       accessToken: tokens.accessToken,
       refreshToken: tokens.refreshToken,
-      idToken: tokens.idToken ?? null,
+      /**
+       * Intuit's OIDC identity JWT is only meaningful at connection time, where
+       * `profile.accountId` is already derived from it. Persisting it would project
+       * the token into the credential payload of every QuickBooks tool call, none of
+       * which read it.
+       */
+      idToken: null,
       accessTokenExpiresAt,
       refreshTokenExpiresAt,
       scope: tokens.scope || getCanonicalScopesForProvider('quickbooks').join(' '),