Require a 2FA code to disable 2FA by tgolen · Pull Request #48030 · Expensify/App

tgolen · 2024-08-26T20:56:01Z

Details

At first, the 2FA code won't actually be validated on the server. Once this has been deployed to production, then I will update the server to start validating the 2FA tokens. If you want to test out the actual validation you will need both of these PRs checked out locally:

Fixed Issues

Part of https://github.com/Expensify/Expensify/issues/422144

Tests

Go to Settings > Security and make sure 2FA is turned on
Try to disable 2FA and verify that you are prompted for a 2FA code
Enter a 2FA code and verify the setting is disabled

Verify that no errors appear in the JS console

Offline tests

None, this must be done online.

QA Steps

Same as the above tests

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

Android: Native

2024-08-28_13-07-27.mp4

Android: mWeb Chrome

iOS: Native

2024-08-26_15-42-01.mp4

iOS: mWeb Safari

2024-08-28_13-57-26.mp4

MacOS: Chrome / Safari

2024-08-26_14-40-31.mp4

MacOS: Desktop

2024-08-26_14-45-54.mp4

melvin-bot · 2024-08-28T20:19:16Z

@ Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

tgolen · 2024-08-28T20:19:37Z

src/languages/es.ts

            'La autenticación de dos factores (2FA) ayuda a mantener tu cuenta segura. Al iniciar sesión, deberás ingresar un código generado por tu aplicación de autenticación preferida.',
        disableTwoFactorAuth: 'Deshabilitar la autenticación de dos factores',
-        disableTwoFactorAuthConfirmation: 'La autenticación de dos factores mantiene tu cuenta más segura. ¿Estás seguro de que quieres desactivarla?',
+        explainProcessToRemove: 'In order to disable Two-factor authentication, please enter a valid code from your authentication app.',


I'm still holding for the official translation for this

parasharrajat · 2024-08-28T20:20:07Z

Do you want me to review it now?

tgolen · 2024-08-28T20:25:15Z

Yep, you can go ahead and review it, please!

tgolen · 2024-08-28T20:29:32Z

src/pages/workspace/expensifyCard/WorkspaceExpensifyCardDetailsPage.tsx(165,51): error TS2345: Argument of type '"search.offlinePrompt"' is not assignable to parameter of type 'TranslationPaths'.

The typescript error must be coming from main? I don't quite get it, but I've ensured my branch is up-to-date with main.

parasharrajat · 2024-08-29T15:47:37Z

src/pages/settings/Security/TwoFactorAuth/Steps/GetCode.tsx

+
+type CodesStepProps = BaseTwoFactorAuthFormOnyxProps & BackToParams;
+
+function CodesStep({account}: CodesStepProps) {


Shouldn't the component name match the file name?

Yes! I'll update

parasharrajat · 2024-08-30T12:24:48Z

src/pages/settings/Security/TwoFactorAuth/Steps/GetCode.tsx

+        >
+            <ScrollView contentContainerStyle={styles.flexGrow1}>
+                <View style={[styles.ph5, styles.mt3]}>
+                    <Text style={styles.textLabel}>{translate('twoFactorAuth.explainProcessToRemove')}</Text>


This should be normal text. Check other pages like the Close account page.

I'll check that out, thanks.

parasharrajat · 2024-08-30T12:26:57Z

src/pages/settings/Security/TwoFactorAuth/Steps/GetCode.tsx

+                        validateInsteadOfDisable={false}
+                    />
+                </View>
+                <Button


Technically, it should have bottom margin. I think we can leave this as it is as all of the page for 2FA flow does not have this.

Hm, OK. We should maybe make a followup GH issue to have someone fix that.

Yeah, I can fix that.

parasharrajat · 2024-08-30T12:27:24Z

Screenshots

🔲 iOS / native

30.08.2024_17.58.04_REC.mp4

🔲 iOS / Safari

30.08.2024_18.34.44_REC.mp4

🔲 MacOS / Desktop

30.08.2024_18.30.42_REC.mp4

🔲 MacOS / Chrome

30.08.2024_17.59.55_REC.mp4

🔲 Android / Chrome

30.08.2024_18.36.22_REC.mp4

🔲 Android / native

30.08.2024_18.02.53_REC.mp4

parasharrajat · 2024-08-30T12:39:50Z

BUG: (Might be unrelated) After disabling the 2FA, the 2FA setup does not work sometimes. The backup codes are blank and the secret key is null during QR code scanning.

Steps:

Disable the 2FA.
Reopen the 2Fa setup page.
Press Download on the backup code screen even though the back code is not visible. Go to QR scanning page.
Notice the security key.

tgolen · 2024-08-30T16:22:32Z

I noticed that same bug, however, I was able to reproduce it in main. I tried debugging it, but didn't have a whole lot of luck. I did report and open #48034 which was semi-related and it could be that it fixes the problem. I think it's some kind of race condition. I was able to reproduce it pretty easily by closing the RHP while the recovery codes were still in a loading state. Once you reopen the RHP, the codes are blank and nothing is loading.

tgolen · 2024-08-30T16:31:07Z

Updated the component name and text styling. I looked at the bottom margin, and it looks the same as the close account screens and a few other RHP screens I looked at, so I think it's OK?

parasharrajat · 2024-08-30T16:53:23Z

Yeah, same on web. But It is not same on iOS.

parasharrajat

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified tests pass on all platforms & I tested again on:
- Android: Native
- Android: mWeb Chrome
- iOS: Native
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- MacOS: Desktop
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is approved by marketing by adding the Waiting for Copy label for a copy review on the original GH to get the correct copy.
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

🎀 👀 🎀 C+ reviewed

melvin-bot · 2024-08-30T16:55:50Z

@lakchote Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

melvin-bot · 2024-08-30T16:55:53Z

🎯 @parasharrajat, thanks for reviewing and testing this PR! 🎉

An E/App issue has been created to issue payment here: #48352.

lakchote

One comment, other than that LGTM.

src/pages/settings/Security/TwoFactorAuth/Steps/EnabledStep.tsx

OSBotify · 2024-09-02T14:51:28Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2024-09-02T23:45:09Z

🚀 Deployed to staging by https://github.com/tgolen in version: 9.0.28-0 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

Julesssss · 2024-09-03T12:13:21Z

Hey all, just sharing a bug that was noticed by QA. The input form is hidden by soft keyboard.

I don't think it's a blocker as users can still use the form, and we want to ship this security improvement.

OSBotify · 2024-09-03T23:25:44Z

🚀 Deployed to production by https://github.com/roryabraham in version: 9.0.28-3 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

alitoshmatov · 2024-10-06T08:22:07Z

src/pages/settings/Security/TwoFactorAuth/Steps/GetCode.tsx

+    return (
+        <StepWrapper
+            title={translate('twoFactorAuth.disableTwoFactorAuth')}
+            shouldEnableKeyboardAvoidingView={false}


shouldEnableKeyboardAvoidingView caused an issue here. where code input was left behind keyboard

tgolen added 6 commits August 26, 2024 11:10

Add get codes page

06a0010

Merge branch 'main' into tgolen-require-2fa-to-disable

1f706ca

Start building out view and API commands

d833650

Redirect to the correct step at the end

0042dd3

Clean up imports

61af1b2

Add comment and fix parameter

65c3218

tgolen self-assigned this Aug 26, 2024

tgolen added 4 commits August 26, 2024 14:57

Remove unused translations

48360bc

Lint

5cd9a8e

Remove unused language

0b6168b

Merge branch 'main' into tgolen-require-2fa-to-disable

7e4afd8

tgolen requested a review from parasharrajat August 28, 2024 20:19

tgolen marked this pull request as ready for review August 28, 2024 20:19

tgolen requested a review from a team as a code owner August 28, 2024 20:19

melvin-bot bot removed the request for review from a team August 28, 2024 20:19

tgolen commented Aug 28, 2024

View reviewed changes

Use spanish translation

170d24d

tgolen added 2 commits August 28, 2024 14:44

Lower case

1f6147e

addd 2FA

c4e1a64

tgolen mentioned this pull request Aug 29, 2024

[hold for payment 2024-09-10] [$250] Require a 2FA code to disable 2FA #48215

Closed

parasharrajat suggested changes Aug 30, 2024

View reviewed changes

Merge branch 'main' into tgolen-require-2fa-to-disable

411ba53

Rename component and style text as normal

782e954

tgolen requested a review from parasharrajat August 30, 2024 16:29

parasharrajat approved these changes Aug 30, 2024

View reviewed changes

melvin-bot bot requested a review from lakchote August 30, 2024 16:55

melvin-bot bot mentioned this pull request Aug 30, 2024

Payment issue for E/App PR#48030 #48352

Closed

lakchote reviewed Sep 2, 2024

View reviewed changes

src/pages/settings/Security/TwoFactorAuth/Steps/EnabledStep.tsx Outdated Show resolved Hide resolved

Remove unused code

6066f8d

tgolen requested a review from lakchote September 2, 2024 13:56

lakchote approved these changes Sep 2, 2024

View reviewed changes

tgolen merged commit c7934c5 into main Sep 2, 2024

tgolen deleted the tgolen-require-2fa-to-disable branch September 2, 2024 14:33

mollfpr mentioned this pull request Sep 2, 2024

[HOLD for payment - waiting on deploy][$250] Opening Two-Factor Authentication settings causes two duplicate API requests for EnableTwoFactorAuth #48034

Closed

6 tasks

github-actions bot mentioned this pull request Sep 2, 2024

Deploy Checklist: New Expensify 2024-09-02 #48438

Closed

46 tasks

izarutskaya mentioned this pull request Sep 3, 2024

[HOLD for payment SEPT 23][$250] iOS - 2FA code input is hidden by keyboard when disabling 2FA #48461

Closed

6 tasks

alitoshmatov reviewed Oct 6, 2024

View reviewed changes


		type CodesStepProps = BaseTwoFactorAuthFormOnyxProps & BackToParams;

		function CodesStep({account}: CodesStepProps) {

Conversation

tgolen commented Aug 26, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot bot commented Aug 28, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

parasharrajat commented Aug 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tgolen commented Aug 28, 2024

Uh oh!

tgolen commented Aug 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

parasharrajat Aug 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

parasharrajat commented Aug 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Screenshots

🔲 iOS / native

🔲 iOS / Safari

🔲 MacOS / Desktop

🔲 MacOS / Chrome

🔲 Android / Chrome

🔲 Android / native

Uh oh!

parasharrajat commented Aug 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tgolen commented Aug 30, 2024

Uh oh!

tgolen commented Aug 30, 2024

Uh oh!

parasharrajat commented Aug 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

parasharrajat left a comment

Choose a reason for hiding this comment

Reviewer Checklist

Uh oh!

melvin-bot bot commented Aug 30, 2024

Uh oh!

melvin-bot bot commented Aug 30, 2024

Uh oh!

lakchote left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

OSBotify commented Sep 2, 2024

Uh oh!

OSBotify commented Sep 2, 2024

Uh oh!

Julesssss commented Sep 3, 2024

Uh oh!

OSBotify commented Sep 3, 2024

Uh oh!

Choose a reason for hiding this comment

tgolen commented Aug 26, 2024 •

edited

Loading

parasharrajat commented Aug 28, 2024 •

edited

Loading

tgolen commented Aug 28, 2024 •

edited

Loading

parasharrajat Aug 30, 2024 •

edited

Loading

parasharrajat commented Aug 30, 2024 •

edited

Loading

parasharrajat commented Aug 30, 2024 •

edited

Loading

parasharrajat commented Aug 30, 2024 •

edited

Loading