EU/UK virtual card reveal broken if private personal details not set

[MelvinBot]

Problem

When a user attempts to reveal a virtual card number for an EU/UK Expensify Card, the flow is broken due to several issues in how the frontend handles the personal details and PIN collection steps.

Discovered while investigating why dylan+1@cardtest.expensify.com was unable to reveal EU virtual card details on staging — the App was calling SetPersonalDetailsAndShipExpensifyCards (which skips EU cards and fails) instead of RevealExpensifyCardDetails.

cc @joekaufmanexpensify @heyjennahay @heekinho

Issues to Fix

1. Unnecessary personal details requirement for virtual card reveal

   • We currently require users to set their private personal details before revealing EU/UK virtual card details. This was added to ensure we'd have KBA questions.
   • Since we're no longer using KBA for 3DS, we should probably remove this behavior.
   • Handling for this was introduced in Handle errors for missing KBA data #68749 but we might be able to fix it in Auth by not throwing if personal details are missing.

2. PIN collection should only apply to physical cards

   • If we enter the personal details flow, we ask the user to set a PIN.
   • We should only do this if it's a physical card, so the flow needs to be updated.

3. Wrong API command called for virtual card reveal

   • We should not call the SetPersonalDetailsAndShipExpensifyCards (or ...WithPIN) API at all in this flow, because it causes cards to be shipped, which is unexpected when revealing a virtual card number.
   • The correct command for this flow is SetPersonalDetailsAndRevealExpensifyCard.

4. Auth error when no cards to ship (open question)

   • In this flow, Auth throws an error because there are no cards to ship. It may be better not to change this if we stop calling the API altogether per (3). If we decide to keep the details-updating behavior, we'll need to change Auth not to throw in this case.

Issue Owner

Current Issue Owner: @DylanDylann

[rafecolton]

Thinking on this further, unless Joe or Jenna feels strongly we should keep it, we probably want to rip out all the SetPersonalDetailsAndReveal... code from both the FE and BE. Setting the KBA questions too - we aren't using them and setting them requires extra API calls, so extra points of failure.

The only part we want to keep is always requiring users to verify their address before shipping their physical card. It's functionally necessary for PIN setting, and we agreed that it's generally a good improvement.

[DylanDylann]

I will check this tomorrow

[chuckdries]

These sound like code issues worth solving, but I'm wondering how we discovered this in the first place? In my testing, it's not possible to issue a virtual card to a user who is missing personal details in the first place. In order to trigger this behavior, the user needs to delete their personal details after a card has been issued, which I'm pretty sure isn't possible? Am I missing something?

cannot.issue.card.to.user.missing.personal.details.mp4

[chuckdries]

Note: filed the above behavior as backend ticket https://github.com/Expensify/Expensify/issues/613081