feat(quickbooks): add core webhook triggers

[BillLeoutsakosvl346]

Summary

• add authenticated app-level QuickBooks webhook ingress with durable bounded processing
• route events to deployed workflows for the matching QuickBooks company
• add seven representative QuickBooks trigger options to the existing block
• document the fixed callback and verifier-token setup using the established app-level trigger pattern

Validation

• QuickBooks webhook route/provider/worker/target/trigger tests (15 passing)
• Sim type-check
• API, icon, client-boundary, and tool-registry-boundary validation
• format, lint, documentation generation, and git diff checks
• independent max-reasoning trigger review: no actionable findings

Live Intuit delivery remains dependent on configuring the public callback and QUICKBOOKS_WEBHOOK_VERIFIER_TOKEN; signed raw-body fixtures cover ingress locally.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 5, 2026 8:28am

[cursor]

PR Summary

Medium Risk
Touches authenticated webhook ingress, async fan-out to workflows, and company-scoped target resolution; misconfiguration could drop or misroute events, but the pattern mirrors existing provider ingress (e.g. TikTok) with signature checks and bounded batch handling.

Overview
Adds QuickBooks Online webhook triggers so workflows can start on Intuit CloudEvents (customers, invoices, payments, vendors, bills, bill payments, purchase orders) with per-trigger event type selection and OAuth company binding.

Introduces a fixed POST /api/webhooks/quickbooks ingress that verifies intuit-signature (HMAC-SHA256 over the raw body via QUICKBOOKS_WEBHOOK_VERIFIER_TOKEN), accepts batches up to 1,000 events, and durably enqueues processing before responding. A quickbooks-webhook-ingress job fans out each event by realm/company ID, resolves active webhook targets in 100-row keyset pages, and dispatches matching workflows through the existing webhook processor.

The QuickBooks block is enabled for triggers; integration metadata and docs describe the seven triggers and setup (Intuit callback URL + verifier token).

^{Reviewed by Cursor Bugbot for commit 28c04b1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR adds authenticated QuickBooks webhook ingestion and routes company-scoped events through durable workflow dispatch.

• Verifies Intuit signatures and validates bounded webhook envelopes before durable acceptance.
• Adds QuickBooks trigger definitions, registry entries, deployment support, and generated integration documentation.
• Processes all events and targets in an accepted delivery before retrying failures.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported batch-termination issue is resolved because target and lookup failures are isolated until all later events have been processed.

Important Files Changed

Filename	Overview
apps/sim/app/api/webhooks/quickbooks/route.ts	Adds bounded, signature-authenticated app-level webhook ingress that acknowledges deliveries only after durable enqueue.
apps/sim/background/quickbooks-webhook-ingress.ts	Routes every accepted event by QuickBooks company, isolates target failures, and retries after processing the complete batch.
apps/sim/lib/webhooks/providers/quickbooks.ts	Adds QuickBooks signature verification, event matching, normalization, and event-ID extraction for idempotency.
apps/sim/lib/webhooks/deploy.ts	Integrates QuickBooks with the app-level trigger deployment lifecycle.
apps/sim/triggers/quickbooks/index.ts	Exports the new QuickBooks event trigger catalog for registry consumption.
apps/sim/blocks/blocks/quickbooks.ts	Enables trigger mode and exposes the registered QuickBooks trigger options on the existing block.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  QB[QuickBooks] --> Route[Signed webhook route]
  Route --> Validate[Verify signature and validate bounded envelope]
  Validate --> Ingress[Durable ingress job]
  Ingress --> Lookup[Find deployed targets by company realm]
  Lookup --> Dispatch[Dispatch each event to matching workflows]
  Dispatch --> Idempotency[Webhook execution idempotency]
  Idempotency --> Execute[Execute workflow]

Loading

_{Reviews (4): Last reviewed commit: "refactor(quickbooks): align webhook trig..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 937ec78. Configure here.}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@greptile