OUT-3275: account dropdowns in QB settings

[SandipBajracharya]

Summary

Adds an Other Settings accordion section to the QuickBooks integration's settings dashboard that lets portal admins pick which QBO accounts the integration uses:

• Income account — default income account assigned to services synced from Assembly.
• Expense account — where absorbed invoice payment fees are recorded as expenses.
• Bank account — funds those expenses (paired with the expense account).

Linear: https://linear.app/assemblycom/issue/OUT-3275

Scope note: This PR is the dropdown half of OUT-3275 only. The "colon in product name causes duplicate items" half of the same ticket is descoped to a separate effort.

Architecture

• Server — single route src/app/api/quickbooks/accounts/route.ts exports both GET (returns { options, selected } per bucket) and PATCH (validates each ref's AccountType against QBO, then updates qb_portal_connections scoped by portalId).
• Validation safety — token fields can't leak: the response uses QBPortalConnectionSelectSchema.pick({...}) as an allowlist; tests assert accessToken/refreshToken/tokenType are absent from the response.
• Multi-tenancy — every read/write scoped via eq(QBPortalConnection.portalId, this.user.workspaceId); tenant-isolation integration test confirms portal A's token cannot mutate portal B's row.
• QBO query parser quirk — _getAccountsForProductMapping uses three flat queries (one per AccountType); OR, parentheses, and IN-on-AccountType all rejected by QBO's parser. Verified empirically in sandbox.
• UI — useOtherSettings hook gates the GET on syncFlag && portalConnectionStatus; when disconnected, shows an inline "Connect to QuickBooks" message and never calls the API. Custom button-based dropdown mirrors the existing QuickBooks-items dropdown styling (no search, no sticky options).

Commits

edbde4c fix(OUT-3275): address pre-push review
1a84634 test(OUT-3275): unit + integration coverage for account-ref endpoints
6b99712 feat(OUT-3275): Other Settings accordion with QBO account dropdowns
1dc37d8 feat(OUT-3275): GET/PATCH /api/quickbooks/accounts and supporting helpers

Test plan

• yarn test — 211/211 pass (34 files, unit + integration via testcontainers)
• npx tsc --noEmit — zero errors
• yarn lint:check + yarn prettier:check — clean (10 pre-existing warnings, none new)
• Manual smoke against QBO sandbox — opening "Other Settings" loads all three dropdowns; changing the income account and syncing a Copilot product produces a QBO item with the chosen income account.
• Reviewer to spot-check the _getAnAccount SELECT extension (AccountType added) doesn't surprise any existing callers (verified: all 5 existing callers only read Id/Name/SyncToken/Active).
• Reviewer to confirm the QBO AccountType narrowing (income subtype = SalesOfProductIncome, asset = Bank) matches product intent; "user will refine subtypes later" is captured.

Testing Criteria

https://www.loom.com/share/95f84287758c4917af56ca099e948e9f

Known follow-ups (separate tickets)

• checkAndUpdateAccountStatus self-heal audit — confirm it doesn't silently overwrite a user-chosen ref. Pre-existing concern flagged in the spec, not part of this PR.
• Custom dropdown ARIA: this PR adds aria-haspopup/aria-expanded/role="listbox"/role="option"; full keyboard navigation (arrow keys, Escape) deferred.

🤖 Generated with Claude Code

[linear-code]

OUT-3275

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
quickbooks-sync	Ready	Preview, Comment	May 20, 2026 9:59am

[greptile-apps]

Greptile Summary

This PR adds an "Other Settings" accordion to the QuickBooks integration dashboard, letting portal admins choose QBO accounts for income, expense, and bank buckets via three custom dropdowns backed by a new GET/PATCH /api/quickbooks/accounts endpoint.

• API layer: AccountService fetches active accounts per bucket with three separate flat QBO queries; TokenService.updateAccountRefs validates each supplied ID against QBO before updating the scoped portal connection row. A Zod allowlist (SafePortalConnectionSchema) ensures token fields can never appear in the response.
• UI layer: useOtherSettings gates the SWR fetch behind syncFlag && portalConnectionStatus, tracks dirty state, and handles optimistic cancel. OtherSettings.tsx adds a stale-ID hint when a previously saved account no longer appears in the dropdown options.
• Test coverage: 211 tests pass; unit and integration tests cover happy paths, wrong AccountType rejections, empty-body 422s, all-three-refs updates, tenant isolation, and auth guards.

Confidence Score: 4/5

Safe to merge — the new endpoint is correctly scoped per tenant, token fields are allowlisted out of responses, and account validation against QBO runs before any DB write.

The core GET/PATCH flows, validation, and tenant isolation are solid. Two style-level concerns hold the score back slightly: AccountOption is defined identically in both common.ts and useSettings.ts (drift risk), and the accordion save/cancel button visibility is gated on index === 2 which will silently misfire if sections are ever reordered.

src/components/dashboard/settings/SettingAccordion.tsx for the positional index coupling; src/hook/useSettings.ts and src/type/common.ts for the duplicated AccountOption type.

Important Files Changed

Filename	Overview
src/app/api/quickbooks/accounts/accounts.controller.ts	New controller for GET/PATCH; uses SafePortalConnectionSchema allowlist to strip token fields. Auth and error handling look correct.
src/app/api/quickbooks/accounts/accounts.service.ts	Thin service wrapping IntuitAPI.getAccountsForProductMapping, maps QBO rows to {id, name} options. Error handling for missing portal connection is correct.
src/app/api/quickbooks/token/token.service.ts	New updateAccountRefs validates each account ID against QBO then updates the portal connection row scoped by workspaceId. Payload is parsed twice (controller + service), redundant but harmless.
src/utils/intuitAPI.ts	Adds AccountType to QB_ACCOUNT_COLUMNS and adds _getAccountsForProductMapping with three flat queries to work around QBO parser limitations.
src/hook/useSettings.ts	New useOtherSettings hook with SWR gating, dirty-state tracking, and optimistic cancel. AccountOption is re-declared instead of imported from common.ts.
src/components/dashboard/settings/SettingAccordion.tsx	Wires in OtherSettings accordion; button visibility uses fragile index === 2 pattern.
src/components/dashboard/settings/sections/other/OtherSettings.tsx	New AccountSelect with click-outside, ARIA attributes, and stale-ID hint. Disconnect/error states handled correctly.
src/type/common.ts	Adds AccountOption, AccountsListResponse, AccountRefsUpdateSchema, AccountRefsUpdateType. AccountOption duplicated in useSettings.ts.
test/integration/quickbooks/accounts/updateAccountRefs.test.ts	Thorough integration coverage: happy path, wrong AccountType, empty body 422, all-three-refs, tenant isolation, auth guard.

Sequence Diagram

sequenceDiagram
    participant UI as OtherSettings (React)
    participant Hook as useOtherSettings
    participant GETRoute as GET /api/quickbooks/accounts
    participant PATCHRoute as PATCH /api/quickbooks/accounts
    participant AccountSvc as AccountService
    participant TokenSvc as TokenService
    participant QBO as QuickBooks Online
    participant DB as qb_portal_connections

    UI->>Hook: mount
    Hook->>GETRoute: SWR fetch
    GETRoute->>AccountSvc: listAccountsForProductMapping()
    AccountSvc->>DB: getPortalTokens(portalId)
    DB-->>AccountSvc: tokens + selected refs
    AccountSvc->>QBO: 3x customQuery (Income/Expense/Bank)
    QBO-->>AccountSvc: account lists
    AccountSvc-->>GETRoute: options + selected
    GETRoute-->>Hook: 200
    Hook-->>UI: render dropdowns
    UI->>Hook: changeSettings()
    Hook-->>UI: "showButton=true"
    UI->>Hook: submitOtherSettings()
    Hook->>PATCHRoute: PATCH changed fields
    PATCHRoute->>TokenSvc: updateAccountRefs(payload)
    TokenSvc->>DB: getPortalTokens(portalId)
    loop for each changed ref
        TokenSvc->>QBO: getAnAccount(id)
        QBO-->>TokenSvc: account row
        TokenSvc->>TokenSvc: validate AccountType
    end
    TokenSvc->>DB: updateQBPortalConnection
    DB-->>TokenSvc: updated row
    TokenSvc-->>PATCHRoute: conn
    PATCHRoute-->>Hook: 200 portalConnection
    Hook->>GETRoute: mutate

Loading

Comments Outside Diff (1)

1. src/components/dashboard/settings/SettingAccordion.tsx, line 267 (link)

   Fragile positional index for button render gating

   The index === 2 guard follows the same pre-existing pattern as index === 0 (product-mapping) and index === 1 (invoice-detail), but extending it makes the coupling harder to notice. If a future section is inserted before "Other Settings" in accordionItems, the save/cancel buttons will render in the wrong accordion panel with no compile-time indication. Consider keying the footer buttons on item.id === 'other-settings' instead of the positional index.

_{Reviews (1): Last reviewed commit: "fix(OUT-3275): address pre-push review" | Re-trigger Greptile}

[priosshrsth]

lgtm