[Due for payment 2026-03-30] NetSuite - Not able to connect the integration with correct tokens, when edit incorrect input

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.37-0
Reproducible in staging?: Yes
Reproducible in production?: No
If this was caught during regression testing, add the test name, ID and link from BrowserStack: https://test-management.browserstack.com/projects/2219752/test-runs/TR-8760/folder/13176904/41237417/1247678955?sort=%2Bidentifier
Email or phone of affected tester (no customers): forexmater+332323423424@gmail.com
Issue reported by: Applause Internal Team
Bug source: Regression TC Execution
Device used: Windows 10/Chrome
App Component: Workspace Settings

Action Performed:

Preconditions: Create fresh account; Create workspace;

1. Go to https://staging.new.expensify.com/
2. Enable "Accounting" on the created workspace
3. Click "Connect" at NetSuite (upgrade the workspace)
4. Enter incorrect the NetSuite tokens
5. Click on the 3 dot menu next to the connection
6. Enter the correct tokens > Confirm
7. Disconnect the integration
8. Click "Connect" at NetSuite
9. Enter the correct tokens > Confirm

Expected Result:

Entering the Netsuite credentials incorrectly should trigger an error state and RBRs to indicate the connection error, but after edit the credentials should clear the error and connect Netsuite successful.

Actual Result:

Entering the Netsuite credentials incorrectly trigger an error state and RBRs, but after edit the credentials with correct tokens trigger the error "Can’t connect to NetSuite due to an authentication error. Learn more." again and the integration is not connected.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

bandicam.2026-03-13.09-13-31-790.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @ShridharGoel

[melvin-bot]

Triggered auto assignment to @madmax330 (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

Investigation Summary

Classification: Frontend bug
Causing PR: #83434 - "Fix: Allow updating NetSuite tokens without resetting connection configuration" by @imgyf (High confidence)
Related Issues: #82339

Recommendation: ROLL FORWARD

PR #83434 fixes an important issue (preventing configuration reset when updating tokens), but introduced this bug. The fix is simpler than reverting - add optimistic data to clear the authentication error flag when submitting new credentials.

Labels: No changes needed. Keeping DeployBlockerCash as this is a frontend bug requiring an App PR fix.

Detailed Analysis

Evidence

PR #83434 was merged on March 12, 2026 and is included in the v9.3.37-0 staging deploy. It adds a new updateNetSuiteTokens command to allow users to update NetSuite credentials without resetting their entire connection configuration.

The bug reproduction steps match exactly with the new code path introduced by this PR:

1. Enter incorrect NetSuite tokens → backend sets isAuthenticationError: true on the connection
2. Click 3-dot menu > Enter credentials
3. The form detects isAuthenticationError(policy) and calls updateNetSuiteTokens instead of connectPolicyToNetSuite
4. User enters correct credentials and submits
5. Error persists because the isAuthenticationError flag is not optimistically cleared

Verification

The bug is in /home/runner/_work/App/App/src/libs/actions/connections/NetSuiteCommands.ts:

The writeNetSuiteCredentials function (lines 21-42) only sets optimistic data for POLICY_CONNECTION_SYNC_PROGRESS:

const optimisticData: Array<OnyxUpdate<typeof ONYXKEYS.COLLECTION.POLICY_CONNECTION_SYNC_PROGRESS>> = [
    {
        onyxMethod: Onyx.METHOD.MERGE,
        key: `${ONYXKEYS.COLLECTION.POLICY_CONNECTION_SYNC_PROGRESS}${policyID}`,
        value: {
            stageInProgress: CONST.POLICY.CONNECTIONS.SYNC_STAGE_NAME.NETSUITE_SYNC_CONNECTION,
            connectionName: CONST.POLICY.CONNECTIONS.NAME.NETSUITE,
            timestamp: new Date().toISOString(),
        },
    },
];

It does NOT clear the isAuthenticationError flag in the POLICY collection, which is checked by isAuthenticationError() function in /home/runner/_work/App/App/src/libs/actions/connections/index.ts line 264:

function isAuthenticationError(policy: OnyxEntry<Policy>, connectionName: PolicyConnectionName) {
    const connection = policy?.connections?.[connectionName];
    return connection?.lastSync?.isAuthenticationError === true;
}

Root Cause

When a user submits correct credentials after an authentication error, the frontend should optimistically clear the error state to provide immediate UI feedback. The backend will eventually update this when the sync completes successfully, but without optimistic updates, the error message persists on screen even though the user entered valid credentials.

The fix needs to add optimistic data to clear connections.netsuite.lastSync.isAuthenticationError when updateNetSuiteTokens is called.

[MelvinBot]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When a user connects NetSuite with incorrect tokens, an authentication error is shown (expected). However, after editing the credentials with correct tokens (via the 3-dot menu > Enter credentials) or disconnecting and reconnecting with correct tokens, the error "Can't connect to NetSuite due to an authentication error" persists and the integration cannot be connected.

What is the root cause of that problem?

PR Expensify/App#83434 (merged March 12, 2026) introduced a regression in NetSuiteTokenInputForm.tsx. It changed the form submission logic to call updateNetSuiteTokens() (which sends the UpdateNetSuiteTokens backend command) when isAuthenticationError is true, instead of always calling connectPolicyToNetSuite() (which sends ConnectPolicyToNetSuite).

The UpdateNetSuiteTokens backend command is designed for existing, fully-initialized connections — it updates credentials and triggers a sync while preserving existing configuration. However, it skips initConnection on the backend.

The problem: when a first-time connection fails with incorrect tokens, the backend sets lastSync.isAuthenticationError = true on the connection object. On the next attempt with correct tokens, isAuthenticationError() at src/libs/actions/connections/index.ts:262-264 returns true, so the form sends UpdateNetSuiteTokens instead of ConnectPolicyToNetSuite. Since the connection was never successfully initialized, the update command fails, and the user is stuck in an error loop.

The critical code is at src/pages/workspace/accounting/netsuite/NetSuiteTokenInput/subPages/NetSuiteTokenInputForm.tsx:52-56:

if (isAuthenticationError(policy, CONST.POLICY.CONNECTIONS.NAME.NETSUITE)) {
    updateNetSuiteTokens(policyID, formValues);
} else {
    connectPolicyToNetSuite(policyID, formValues);
}

The isAuthenticationError check does not distinguish between a first-time connection that failed (needs initConnection via ConnectPolicyToNetSuite) and an existing verified connection that lost authentication (can use UpdateNetSuiteTokens).

What changes do you think we should make in order to solve the problem?

The fix should add a check for whether the connection was ever successfully initialized before choosing which API command to use. The isConnectionUnverified() function already exists at src/libs/actions/connections/index.ts:267-273 and checks the NetSuite-specific verified property.

In NetSuiteTokenInputForm.tsx, update the conditional to:

• If isAuthenticationError AND the connection is verified (previously working) → use updateNetSuiteTokens (preserves configuration)
• If isAuthenticationError AND the connection is unverified (never successfully connected) → use connectPolicyToNetSuite (runs full initConnection)

This preserves the original intent of PR #83434 (not resetting configuration for existing connections) while fixing the regression for first-time connection failures.

What alternative solutions did you explore? (Optional)

1. Revert PR Fix: Allow updating NetSuite tokens without resetting connection configuration #83434 entirely — This would fix the regression but would re-introduce the original issue ([$250] Allow updating NetSuite tokens without resetting connection configuration #82339) where re-entering credentials on existing connections resets all configuration. Not recommended.

2. Always use ConnectPolicyToNetSuite and handle config preservation on the backend — This would avoid the client-side branching but requires backend changes. More invasive than necessary.

---

Next Steps for Contributor+ team: Reply with @MelvinBot implement this to create a draft PR, @MelvinBot <your feedback> to refine this analysis, or explain why you are rejecting Melvin's proposal.