fix: No recovery codes in 2FA page by etCoderDysto · Pull Request #44635 · Expensify/App

etCoderDysto · 2024-06-28T17:58:08Z

Details

Fixed Issues

$ #43603
PROPOSAL: #43603 (comment)

Tests

Two Factor Auth Page

Unvalidated account:

Sign up with a new account > click on Settings > Security > Two-factor authentication.

Verify that there is an error message saying validate your account first
Verify that Next button is disabled on RHP footer

Unvalidated account > validate your account in Contact methods:

Sign up with a new account > click on Settings > Security > Two-factor authentication.
Click on 'Verify your account here' link

Verify that you are navigated to contact methods details page

Validate your account

Verify that you are redirected to 2FA page
Verify that 2FA code is displayed
Verify that that there is no error message

Click on Copy > click on Next button

Verify that you can proceed to step 2 of adding 2FA

Unvalidated account > Sign out scenario:

Sign up with a new account > click on Settings > Security > Two-factor authentication.
Click on 'Sign back with a magic code' link

Verify that you are navigated to sign in page

Sign back in with the same account > navigate to Two-factor authentication

Verify that 2FA code is displayed

Click on Copy > click on Next button

Verify that you can proceed to step 2 of adding 2FA

Connect To BankAccount Page

Sign up with a new account
Create a Workspace
Enable Workflows
Go to Workflows
Click on Connect bank account
Click on 'Verify your account here' link

Verify that you are navigated to contact methods details page

Navigate back
Click on 'Sign back with a magic code' link
Sign in back with the same account
Navigate back to Connect bank account page

Verify that you don't see validate your account first message
Verify that no errors appear in the JS console

Offline tests

N/A

QA Steps

Same as test steps

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

Android: Native

Security

Security.android.mp4

Bank

Bank.android.mp4

Android: mWeb Chrome

Security

security.android.chrome.mp4

Bank

chrome.android.bank.mp4

iOS: Native

Security

Security.ios.mp4

Bank

bank.ios.mp4

iOS: mWeb Safari

Security

Security.safari.mp4

Bank

bank.safari.mp4

MacOS: Chrome / Safari

Security

Web.security.mp4

Bank

Web.Bank.account.mp4

MacOS: Desktop

Security

Desktop.security.mp4

Bank

Desktop.Bank.account.mp4

Merge main to fix branch

Merge main to fixing branch

…utton

…unt here

…back navigation after validating account

Merge main to fixing branch.

Merge main to fixing branch

etCoderDysto · 2024-07-02T09:19:42Z

Note: Video is added for only desktop web since there is navigation issue that I haven't fixed yet.

melvin-bot · 2024-07-02T09:19:54Z

@mollfpr Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

etCoderDysto · 2024-07-02T09:22:15Z

Error to fix

User is not navigated back to 2FA page when clicking browser back button from contact methods section
Background below RHP turns to profile section when clicking 'verify your account here' link

Navigation.error.mp4

Expected behaviour for navigation error

User should be able to navigate back to 2fa page when clicking browser's back button
On clicking validate your account here link, only the rhp should navigate to contact details page, and the background below RHP shouldn't change to profile page.

Expected.navigation.behaviour.mp4

Note: After fixing the issue. I will remove the error component form BankAccountStep and use the new ValidateAccountMessage there

etCoderDysto · 2024-07-02T12:36:02Z

Above is the console log error I am having on back navigation.

mollfpr · 2024-07-02T16:41:17Z

@etCoderDysto I'm not sure what the issue is, but I think the screen for Settings_Security is not stacked correctly.

App/src/SCREENS.ts

Lines 35 to 47 in 519d096

    
           SETTINGS: { 
        
               ROOT: 'Settings_Root', 
        
               SHARE_CODE: 'Settings_Share_Code', 
        
               WORKSPACES: 'Settings_Workspaces', 
        
               SECURITY: 'Settings_Security', 
        
               ABOUT: 'Settings_About', 
        
               SAVE_THE_WORLD: 'Settings_TeachersUnite', 
        
               APP_DOWNLOAD_LINKS: 'Settings_App_Download_Links', 
        
               ADD_DEBIT_CARD: 'Settings_Add_Debit_Card', 
        
               ADD_PAYMENT_CARD_CHANGE_CURRENCY: 'Settings_Add_Payment_Card_Change_Currency', 
        
               ADD_BANK_ACCOUNT: 'Settings_Add_Bank_Account', 
        
               CLOSE: 'Settings_Close', 
        
               TWO_FACTOR_AUTH: 'Settings_TwoFactorAuth',

The screen for security and the 2FA page should be stacked together.

        SECURITY: {
            ROOT: 'Settings_Security',
            TWO_FACTOR_AUTH: 'Settings_TwoFactorAuth',
        },

mollfpr · 2024-07-02T16:55:58Z

I got the same error #44635 (comment) after try fixing the screen stack.

etCoderDysto · 2024-07-02T17:47:15Z

I found a documentation in navigation.md that talks about similar issue I am facing. I will try to understand what is casuing the issue.

Back button in the browser resets the navigation state with the state saved in step two.

The full explanation starts here

mollfpr

Looks good to me! Just had one issue to fixed.

mollfpr · 2024-08-12T13:59:53Z

src/pages/settings/Security/TwoFactorAuth/Steps/CodesStep.tsx

        Session.toggleTwoFactorAuth(true);
        // eslint-disable-next-line react-compiler/react-compiler, react-hooks/exhaustive-deps -- We want to run this when component mounts
-    }, []);
+    }, [isUserValidated]);


I think it's expected to be called on component mount. Also, I got this issue that the code is not show after refreshing the page.

Screen.Recording.2024-08-12.at.21.04.12.mp4

It works fine when you refresh the page if you set USE_REACT_STRICT_MODE:false in CONFIG.ts. I added isUserValidated to run the useEffect when the user returns back from validating their account. If the dependency is not added it will fail to run the useEffect.

The result when I add isUserValidated dependency

isvalidated.mp4

The result when I don't add isUserValidated dependency

Screen.Recording.2024-08-13.at.1.08.49.in.the.afternoon.mp4

mollfpr · 2024-08-15T13:31:18Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified tests pass on all platforms & I tested again on:
- Android: Native
- Android: mWeb Chrome
- iOS: Native
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- MacOS: Desktop
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: Native

44635.Android.1.mp4

44635.Android.2.mp4

Android: mWeb Chrome

44635.mWeb-Chrome.1.mp4

44635.mWeb-Chrome.2.mp4

iOS: Native

44635.iOS.1.mov

44635.iOS.2.mov

iOS: mWeb Safari

44635.mWeb-Safari.1.mov

44635.mWeb-Safari.2.mov

MacOS: Chrome / Safari

44635.Web.1.mp4

44635.Web.2.mp4

MacOS: Desktop

44635.Desktop.1.mp4

44635.Desktop.2.mp4

mollfpr

LGTM 👍

techievivek · 2024-08-16T05:43:19Z

@etCoderDysto Great job on this! ❤️ I just have a quick question about the verify your account here link. When we click on that link, does it trigger a backend request to send a magic code, or does that only happen when you click didn't receive a magic code?

etCoderDysto · 2024-08-16T06:28:43Z

@etCoderDysto Great job on this! ❤️ I just have a quick question about the verify your account here link. When we click on that link, does it trigger a backend request to send a magic code, or does that only happen when you click didn't receive a magic code?

Thanks @techievivek 🙇🏻‍♂️. It doesn't rigger a backend request. The request is triggered only when the user clicks didn't receive a magic code.

techievivek · 2024-08-16T06:57:48Z

@etCoderDysto Ok, thanks for confirming. I think we can improve this, as it might be confusing for users who expect a magic code email to arrive in their inbox when we navigate them to that page. Could we call the backend to schedule a magic code email before navigating them to the page? CC @mollfpr @trjExpensify, do you have any thoughts on this?

mollfpr · 2024-08-16T07:13:25Z

Ok, thanks for confirming. I think we can improve this, as it might be confusing for users who expect a magic code email to arrive in their inbox when we navigate them to that page.

+1! But I'm unsure if this is on purpose.

etCoderDysto · 2024-08-16T08:42:21Z

Could we call the backend to schedule a magic code email before navigating them to the page?

@techievivek I thin we can do that. If we have to do that, I believe we should also make the same change to 'Contact methods' page to make the behaviour consistent across pages. Currently, we are not making BE request when a user navigates from contact methods page to Contact methods details page.

Screen.Recording.2024-08-16.at.11.39.02.in.the.morning.mov

trjExpensify · 2024-08-17T10:57:47Z

Could we call the backend to schedule a magic code email before navigating them to the page? CC @mollfpr @trjExpensify, do you have any thoughts on this?

Yes, that makes sense. I'm on mobile, but I think someone tried to fix this recently with contact methods and we had to revert it because whatever solution was used triggered two API calls. I think that might be because when adding. a secondary login we automatically send an email to verify the login - so it doesn't need a second one sent when navigating to the page. Would be good to check and test that (sorry I can't find it on mobile, and I'm OOO until end of next week).

techievivek · 2024-08-20T04:36:09Z

. I think that might be because when adding. a secondary login we automatically send an email to verify the login - so it doesn't need a second one sent when navigating to the page.

Yeah, I tested this out and can confirm that we automatically send an email to verify the login when a user adds a new secondary login so for the above case we don't need an another magic email when we navigate the user to the page.

techievivek · 2024-08-20T04:43:20Z

After revisiting this, I realized that sending a magic code email every time a user clicks on the verify your account here link could lead to confusion. We need a mechanism to avoid resending a new magic code email unless the previous one's timer has expired. In other words, we should send a magic code email the first time the user clicks the link, but if they navigate back and click it again shortly after, we shouldn't resend the email. Given this, I think it's best to leave the current functionality as is, allowing users to request a new magic code explicitly by clicking didn't receive a magic code. We can address this issue separately without blocking this PR.

techievivek

Thanks for fixing this up.

OSBotify · 2024-08-20T05:01:38Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2024-08-20T22:58:10Z

🚀 Deployed to staging by https://github.com/techievivek in version: 9.0.23-0 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

OSBotify · 2024-08-22T17:11:33Z

🚀 Deployed to production by https://github.com/chiragsalian in version: 9.0.23-0 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

etCoderDysto added 6 commits June 24, 2024 12:18

Create ValidateAccountMessage file and declare a function

495f8e3

Import utils and components required for the component

8071028

Intialize theme, styles, and transalte hooks

f3c883b

Add BankAccountStep Error message style with SignOut functionality

99fc4ec

Merge branch 'main' into validateAccount

c01fb71

Merge main to fix branch

Merge branch 'main' into validateAccount

07ae854

Merge main to fixing branch

etCoderDysto mentioned this pull request Jun 28, 2024

[HOLD for payment 2024-08-29] [$250] 2FA - No recovery codes in 2FA page for unverified account #43603

Closed

6 tasks

etCoderDysto added 11 commits June 29, 2024 18:41

Add user type BaseTwoFactorAuthFormOnyxProps

ffb7bda

Fetch user from Onyx

32853b5

When user is not validated, hide 2FA section except header and next b…

bc5eb7d

…utton

Disable Next button when user is not validated

2d16e04

Display validate your account first message when user is not validated

4bb103d

Navigate to contact methods section when user clicks verify your acco…

871f632

…unt here

Make EnableTwoFactorAuth request to prevent stale empty auth page on …

24883fb

…back navigation after validating account

Prevent making EnableTwoFactorAuth request when user is not validated

3ae577e

Merge branch 'main' into validateAccount

26cde25

Merge main to fixing branch.

Make user type optional to fix typesctipt error

dfee1db

Merge branch 'main' into validateAccount

bedf96c

Merge main to fixing branch

etCoderDysto marked this pull request as ready for review July 2, 2024 09:19

etCoderDysto requested a review from a team as a code owner July 2, 2024 09:19

melvin-bot bot requested review from mollfpr and removed request for a team July 2, 2024 09:19

etCoderDysto mentioned this pull request Jul 3, 2024

feature: Add validation flow to bank account set up #38726

Merged

50 tasks

etCoderDysto added 8 commits July 27, 2024 21:59

Merge branch 'main' into validateAccount

aa1b650

Merge branch 'main' into validateAccount

01c3340

Merge branch 'main' into validateAccount

0004ac2

Merge branch 'main' into validateAccount

57cb032

Add optional backTo param to contact methods

defc959

fix rhp navigation

f787b1c

fix navigation issue from security page

8bfd7dc

Use ValidateAccountMessage on BankAccountStep

3612ea6

mollfpr reviewed Aug 12, 2024

View reviewed changes

mollfpr approved these changes Aug 15, 2024

View reviewed changes

melvin-bot bot requested a review from techievivek August 15, 2024 13:39

techievivek assigned etCoderDysto Aug 16, 2024

techievivek approved these changes Aug 20, 2024

View reviewed changes

techievivek merged commit 80236f5 into Expensify:main Aug 20, 2024

github-actions bot mentioned this pull request Aug 20, 2024

Deploy Checklist: New Expensify 2024-08-20 #47760

Closed

38 tasks

lanitochka17 mentioned this pull request Aug 21, 2024

Contact methods - User is nor navigated to contact methods details page #47814

Closed

6 tasks

adamgrzybowski mentioned this pull request Aug 23, 2024

[HOLD for Payment 2024-10-07][$250][Search v2.1] Web - App navigates from search page to inbox when refreshing #46773

Closed

6 tasks

bernhardoj mentioned this pull request Aug 26, 2024

[$250] Tax - Refreshing the page while tax code RHP is open disrupts navigation #46878

Closed

6 tasks

Conversation

etCoderDysto commented Jun 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Fixed Issues

Tests

Two Factor Auth Page

Connect To BankAccount Page

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

etCoderDysto commented Jul 2, 2024

Uh oh!

melvin-bot bot commented Jul 2, 2024

Uh oh!

etCoderDysto commented Jul 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Error to fix

Expected behaviour for navigation error

Uh oh!

etCoderDysto commented Jul 2, 2024

Uh oh!

mollfpr commented Jul 2, 2024

Uh oh!

mollfpr commented Jul 2, 2024

Uh oh!

etCoderDysto commented Jul 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mollfpr left a comment

Choose a reason for hiding this comment

Uh oh!

mollfpr Aug 12, 2024

Choose a reason for hiding this comment

Uh oh!

etCoderDysto Aug 13, 2024

Choose a reason for hiding this comment

Uh oh!

mollfpr commented Aug 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

mollfpr left a comment

Choose a reason for hiding this comment

Uh oh!

techievivek commented Aug 16, 2024

Uh oh!

etCoderDysto commented Aug 16, 2024

Uh oh!

techievivek commented Aug 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mollfpr commented Aug 16, 2024

Uh oh!

etCoderDysto commented Aug 16, 2024

Uh oh!

trjExpensify commented Aug 17, 2024

Uh oh!

techievivek commented Aug 20, 2024

Uh oh!

techievivek commented Aug 20, 2024

Uh oh!

techievivek left a comment

Choose a reason for hiding this comment

Uh oh!

OSBotify commented Aug 20, 2024

Uh oh!

OSBotify commented Aug 20, 2024

Uh oh!

OSBotify commented Aug 22, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

etCoderDysto commented Jun 28, 2024 •

edited

Loading

etCoderDysto commented Jul 2, 2024 •

edited

Loading

etCoderDysto commented Jul 2, 2024 •

edited

Loading

mollfpr commented Aug 15, 2024 •

edited

Loading

techievivek commented Aug 16, 2024 •

edited

Loading