[Due for payment 2025-03-27] [$250] 2FA - Hybrid - User asked to again validate account after disabling 2FA

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.1.15-0
Reproducible in staging?: Yes
Reproducible in production?: No
If this was caught on HybridApp, is this reproducible on New Expensify Standalone?: No, reproducible on hybrid only
If this was caught during regression testing, add the test name, ID and link from TestRail: https://expensify.testrail.io/index.php?/tests/view/5766528
Email or phone of affected tester (no customers): applausetester+ck3182510@applause.expensifail.com
Issue reported by: Applause Internal Team
Device used: Pixel 8a/Android 15
App Component: User Settings

Action Performed:

1. Launch Hybrid app
2. Log in with new validated account
3. Go to Settings >> Security >> 2FA
4. Enter the magic code to validate account to use 2FA feature
5. Go through the 2FA process
6. Once the 2FA is enabled, log out of the account
7. Log in with same account >> enter magic account >> enter 2FA code
8. Go to Settings >> Security >> 2FA
9. Disable 2FA
10. Enter 2FA code from authenticator app
11. Observe user asked to again validate account

Expected Result:

User should not be prompted to validate account again after disabling 2FA.

Actual Result:

User asked to again validate account to enter magic code after disabling 2FA

Workaround:

Unknown

Platforms:

• Android: Standalone
• Android: HybridApp
• Android: mWeb Chrome
• iOS: Standalone
• iOS: HybridApp
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

1.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021902273993490623286
• Upwork Job ID: 1902273993490623286
• Last Price Increase: 2025-03-19
• Automatic offers:
• allgandalf | Reviewer | 106585286

Issue Owner

Current Issue Owner: @sakluger

[melvin-bot]

Triggered auto assignment to @MariaHCD (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[melvin-bot]

Triggered auto assignment to @sakluger (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[dukenv0307]

Proposal

Please re-state the problem that we are trying to solve in this issue.

User asked to again validate account to enter magic code after disabling 2FA

What is the root cause of that problem?

When we redirect to ND after signing in, account?.validated is undefined then the validate modal appears again after we disabled the 2FA

App/src/pages/settings/Security/TwoFactorAuth/CopyCodesPage.tsx

Line 48 in cb0d374

const isUserValidated = account?.validated;

What changes do you think we should make in order to solve the problem?

To check the isUserValidated we should use user?.validated

const [isUserValidated] = useOnyx(ONYXKEYS.USER, {selector: (user) => !!user?.validated});

App/src/pages/settings/Security/TwoFactorAuth/CopyCodesPage.tsx

Line 48 in cb0d374

const isUserValidated = account?.validated;

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

None

What alternative solutions did you explore? (Optional)

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~021902273993490623286