[SAML Configuration] Verify Domain flow by mhawryluk · Pull Request #73016 · Expensify/App

mhawryluk · 2025-10-20T16:17:02Z

Explanation of Change

Creates a domain verification flow, accessible by clicking on a non-verified domain's row in the Workspaces tab.

Fixed Issues

$ #72599
PROPOSAL: N/A

Tests

Log in to an Expensify account that is a member (but not an admin) of an unverfied domain
Navigate to the “Workspaces” tab
You should see a "Domains" section below the list of workspaces. This section should not contain any "Not verified" badges. No three-dot menu should be visible in the row too. Clicking on the row should be disabled.

also:

Log in to an Expensify account that is an admin of an unverified domain
Navigate to the “Workspaces” tab
Verify you see a “not verified” badge next to your domain
Click on the three-dot menu for the domain
Verify you see a menu option saying “Verify domain”
Click on “Verify Domain”
Verify it opens up the “Verify your domain” RHP, and a verification code is displayed
Validate your domain following the To Verify a Domain help site instructions and click “Verify domain”. Trying to verify without the correct DNS record should fail and the error should be displayed above the button.
Verify you’re routed to the confirmation RHP page
Click on the confirm button.
Verify you’re back on the workspaces list page
No "not verified" badge should be visible on the domain row (consulted this decision with the design team)
Check if accessing RHPs via URL is possible only when it should (so domain-verified page should only be for verified domains, verify-domain only for non verified)
Check that refreshing the page when on RHP makes it reload with Workspaces list page still below (web only)
Clicking on the row of a domain that has been verified should still open old-dot domains setting page in a new tab.

Offline tests

Log in to an account that has claimed but not validated a domain
Navigate to the “Workspaces” tab
Click on the three-dot menu for an unverified domain
Select the “Verify Domain” option
Verify that the “Verify Domain” RHP opens up
Verify that the “Verify Domain” button is inactionable, and an indicator is displayed saying you’re offline.
Instead of a validation code there should be an error saying the fetch failed and the "Retry" button should be disabled.

QA Steps

Same as tests.

PR Author Checklist

Screenshots/Videos

Android: Native

Nagranie.z.ekranu.2025-10-31.o.18.26.40.mov

Android: mWeb Chrome

Nagranie.z.ekranu.2025-10-31.o.19.09.35.mov

Nagranie.z.ekranu.2025-10-31.o.19.18.06.mov

iOS: Native

Simulator.Screen.Recording.-.iPhone.16.Pro.Max.-.2025-10-31.at.18.19.07.mp4

iOS: mWeb Safari

Simulator.Screen.Recording.-.iPhone.16.Pro.Max.-.2025-10-31.at.19.11.22.mp4

MacOS: Chrome / Safari

Nagranie.z.ekranu.2025-10-31.o.18.54.44.mov

Nagranie.z.ekranu.2025-10-31.o.19.18.06.mov

MacOS: Desktop

Nagranie.z.ekranu.2025-10-31.o.19.15.53.mov

Nagranie.z.ekranu.2025-10-31.o.19.17.08.mov

melvin-bot · 2025-10-27T15:07:19Z

Hey, I noticed you changed src/languages/en.ts in a PR from a fork. If you want to automatically generate translations for other locales, you can run the Generate static translations GitHub workflow.

Please look at the code and make sure there are no malicious changes before running the workflow.

If you have the K2 extension, you can simply click: [this button]

src/components/Domain/DomainsListRow.tsx

src/languages/en.ts

src/libs/actions/Domain.ts

blazejkustra · 2025-10-30T07:40:52Z

src/libs/Navigation/helpers/getAdaptedStateFromPath.ts

        return {
            name: SCREENS.WORKSPACES_LIST,
-            path: ROUTES.WORKSPACES_LIST.route,
+            path: normalizePath(ROUTES.WORKSPACES_LIST.route),


Could you share a bit more about the reasoning for this change? 🤔

after refreshing an RHP that is shown above the Workspaces list page and then closing it, the url is wrong. in this case it would go back to /workspaces/verify-domain/workspaces instead of /workspaces. it's because react navigation invokes history.replaceState with workspaces instead of /workspaces. so we prepend a slash here. right now this is happening for all RHPs above the workspaces tab, this change fixes it for ones that don't use backTo. consulted this with the navigation team

Can you add a comment to the code explaining why we need to use the normalize here so its easy to understand for any developer reading it, please?

src/libs/Navigation/linkingConfig/RELATIONS/WORKSPACES_LIST_TO_RHP.ts

src/pages/domain/DomainVerifiedPage.tsx

src/pages/workspace/WorkspacesListPage.tsx

src/pages/domain/VerifyDomainPage.tsx

jmusial · 2025-10-30T09:09:31Z

src/pages/domain/VerifyDomainPage.tsx

+
+    const accountID = route.params?.accountID;
+    const [domain] = useOnyx(`${ONYXKEYS.COLLECTION.DOMAIN}${accountID}`, {canBeMissing: true});
+    const domainName = domain ? Str.extractEmailDomain(domain.email) : '';


this is reused couple times, maybe worth to wrap it in an util ? Like getDomainName(domain) ?

not sure. it would essentially just wrap Str.extractEmailDomain and encourage fetching full domain from onyx, even when email is enough

src/pages/domain/VerifyDomainPage.tsx

jmusial · 2025-10-30T09:13:31Z

src/pages/workspace/WorkspacesListPage.tsx

+                    : undefined;
+
+            return (
+                <OfflineWithFeedback


This Page file is already huge, maybe extract this to a separate file / hook ?

agreed. I made DomainMenuItem and WorkspacesEmptyStateComponent separate components and moved them to dedicated files. domains and workspaces implementations differ now, but I guess it's okay (?). refactoring the workspaces part is a bigger task

OSBotify · 2025-10-30T10:05:40Z

🦜 Polyglot Parrot! 🦜

Squawk! Looks like you added some shiny new English strings. Allow me to parrot them back to you in other tongues:

The diff is too large to include in this comment (355KB), so I've created a gist for you:

📋 View the translation diff here 📋

Note

You can apply these changes to your branch by copying the patch to your clipboard, then running pbpaste | git apply, or directly by running gh gist view --raw 1a2f5d14911392673771d92135258fc0 | git apply 😉

melvin-bot · 2025-10-30T13:25:22Z

Hey, I noticed you changed src/languages/en.ts in a PR from a fork. For security reasons, translations are not generated automatically for PRs from forks.

If you want to automatically generate translations for other locales, an Expensify employee will have to:

Look at the code and make sure there are no malicious changes.
Run the Generate static translations GitHub workflow. If you have write access and the K2 extension, you can simply click: [this button]

Alternatively, if you are an external contributor, you can run the translation script locally with your own OpenAI API key. To learn more, try running:

npx ts-node ./scripts/generateTranslations.ts --help

Typically, you'd want to translate only what you changed by running npx ts-node ./scripts/generateTranslations.ts --compare-ref main

ZhenjaHorbach · 2025-11-06T10:43:53Z

Small issue
But after reloading the screen
We have not here page for a split second

2025-11-06.11.35.52.mov

…s loading

mhawryluk · 2025-11-06T11:13:26Z

Small issue But after reloading the screen We have not here page for a split second

I added showing full-screen spinner when domain onyx data is loading; this should fix this

ZhenjaHorbach · 2025-11-06T11:20:06Z

Small issue But after reloading the screen We have not here page for a split second

I added showing full-screen spinner when domain onyx data is loading; this should fix this

Good idea!

ZhenjaHorbach · 2025-11-06T13:04:53Z

LGTM!

mountiny

Thanks @ZhenjaHorbach @mhawryluk

@NikkiWines wanna do the final blessing?

mountiny · 2025-11-06T13:08:26Z

src/pages/domain/VerifyDomainPage.tsx

+    const doesDomainExist = !!domain;
+
+    useEffect(() => {
+        if (!domain?.validated) {


Makes sense, thanks!

ZhenjaHorbach · 2025-11-06T13:28:04Z

But wait
One more issue
On not here page we use the wrong link
I suppose we just need to close modal

2025-11-06.14.28.20.mov

mhawryluk · 2025-11-06T14:07:24Z

But wait One more issue On not here page we use the wrong link I suppose we just need to close modal

changed onLinkPress to close the modal. let me know if I should change the link text too, but I think it's a minor issue and we can adjust the text in the following PRs to not block this one

NikkiWines

Couple NABs otherwise looks good

cspell.json

NikkiWines · 2025-11-06T13:50:48Z

src/types/onyx/Domain.ts


-    /** Whether validation code is currently loading */
+    /** Errors that occurred when validating the domain */
+    domainValidationError?: OnyxCommon.Errors;


NAB: Should this be domainVerificationError instead? (Though i guess this would involve changing the backend too if so)

Just for linguistic consistency, maybe we can do a follow up if we decide to change it

we use the term "validation" internally, and "verification" for user facing parts. the ideal here imo would be "validationError", to not repeat "domain" unnecessarily, but I think it's fine. we can change it in the future though

src/pages/workspace/WorkspacesListPage.tsx

src/components/Domain/DomainMenuItem.tsx

NikkiWines · 2025-11-06T14:08:47Z

src/pages/domain/DomainVerifiedPage.tsx

+            return;
+        }
+        Navigation.setNavigationActionToMicrotaskQueue(() => Navigation.navigate(ROUTES.WORKSPACES_VERIFY_DOMAIN.getRoute(accountID), {forceReplace: true}));
+    }, [accountID, domain?.validated, doesDomainExist]);


NAB: you don't really need doesDomainExist

Suggested change

}, [accountID, domain?.validated, doesDomainExist]);

useEffect(() => {

if (!domain || domain?.validated) {

return;

}

Navigation.setNavigationActionToMicrotaskQueue(() => Navigation.navigate(ROUTES.WORKSPACES_VERIFY_DOMAIN.getRoute(accountID), {forceReplace: true}));

}, [accountID, domain]);

this would make the effect run on every change within domain. not a huge deal, wouldn't really break anything, but I think I prefer !doesDomainExist or domain?.accountID === undefined instead of !domain

cool, i don't feel too strongly about it, so this is fine

NikkiWines · 2025-11-06T14:13:11Z

src/pages/domain/VerifyDomainPage.tsx

+    const domainName = domain ? Str.extractEmailDomain(domain.email) : '';
+    const {isOffline} = useNetwork();
+
+    const doesDomainExist = !!domain;


I first implemented it with domain?.accountID === undefined to not put the whole domain in effect dependencies, in some effects putting it there would actually break stuff, but then I thought doesDomainExist better communicates the intent

mountiny

Thanks!

NikkiWines

thnks

OSBotify · 2025-11-06T15:16:42Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2025-11-06T23:51:07Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.2.46-0 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

IuliiaHerets · 2025-11-07T08:44:31Z

@mhawryluk @NikkiWines I think the QA team can't execute this PR. Can you check it internally?
The QA team was able to go only up to step 7 of the PR. After that, domain verification is required — and it needs a real domain, not a temporary one.

2025-11-07.11-54-30.mp4

m-natarajan · 2025-11-07T13:11:24Z

@mhawryluk @NikkiWines @mountiny Can this PR be tested internally? Applause testers don’t have access to the private domain required for this test.

mhawryluk · 2025-11-07T15:30:32Z

I tested it with a real private domain of mine, although it would be good for someone else to test too

OSBotify · 2025-11-07T23:31:14Z

🚀 Deployed to production by https://github.com/luacmartins in version: 9.2.46-3 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	failure ❌

parasharrajat · 2026-01-01T12:42:14Z

src/pages/domain/VerifyDomainPage.tsx

+                        <Text style={styles.webViewStyles.baseFontStyle}>
+                            <RenderHTML html={translate('domain.verifyDomain.beforeProceeding', {domainName})} />
+                        </Text>
+
+                        <Text style={styles.webViewStyles.baseFontStyle}>
+                            <OrderedListRow index={1}>
+                                <RenderHTML html={translate('domain.verifyDomain.accessYourDNS', {domainName})} />
+                            </OrderedListRow>
+                        </Text>


We need a block layout here for renderHTML to correctly calculate parent dimensions for rendering. It caused #77419

Create domain validation pages

7f2cc8a

melvin-bot bot assigned mhawryluk Oct 20, 2025

mhawryluk added 6 commits October 22, 2025 13:26

Merge branch 'feat/saml-display-domain-list' into feat/domain-validation

92832de

Merge branch 'main' into feat/domain-validation

6f14e73

Extend navigation, actions and loading states

4ce735b

Add link and error message to Verify Domain RHP

47c3a3c

Display error from BE in Verify Domain page

7188e71

Fix RHP refresh behavior

3ece949

mhawryluk added 5 commits October 27, 2025 17:08

Display verification badge only to admins

3c1cc9c

Support offline status in Verify Domain RHP

b9ed09a

Normalize workspaces path in getMatchingFullScreenRoute

3f8cf0e

Fix spell check

d99e562

Use FormAlertWithSubmitButton in VerifyDomainPage

45f4a4d

mhawryluk mentioned this pull request Oct 28, 2025

[SAML Configuration] Domain settings page #73636

Merged

52 tasks

mhawryluk changed the title ~~[SAML Configuration] Create Verify Domain flow~~ [SAML Configuration] Verify Domain flow Oct 28, 2025

mhawryluk added 6 commits October 28, 2025 16:03

Fixes and refactors to the verify domain flow

d98f0de

Rename the new modal stack navigator

a2aa3d0

Change validation code loading UI + add error state

ae0b941

Adjust domain validate code loading and error state UI

a932956

Remove unnecessary (for now) translation key

ee45ed8

Fix backend integration in the verify domain flow

ae41ec6

blazejkustra suggested changes Oct 30, 2025

View reviewed changes

jmusial reviewed Oct 30, 2025

View reviewed changes

Review fixes and translations

e1fa943

mhawryluk added 2 commits October 30, 2025 15:09

Improve spanish translations

9bd80f6

Update jsdoc

fe3b4b6

blazejkustra approved these changes Oct 30, 2025

View reviewed changes

mountiny mentioned this pull request Nov 5, 2025

[AI Reviewer] Investigate no reaction left on the issue #74392

Closed

mhawryluk added 2 commits November 6, 2025 11:57

More review fixes

3835b07

Show full screen spinner instead of not-found when onyx domain data i…

857953e

…s loading

Merge branch 'main' into feat/domain-validation

1165888

ZhenjaHorbach approved these changes Nov 6, 2025

View reviewed changes

melvin-bot bot requested a review from mountiny November 6, 2025 13:05

mountiny previously approved these changes Nov 6, 2025

View reviewed changes

Change onLinkPress for not found page

b5b1440

mhawryluk dismissed mountiny’s stale review via b5b1440 November 6, 2025 14:05

NikkiWines reviewed Nov 6, 2025

View reviewed changes

Remove unnecessary whitespace

03f935e

mountiny approved these changes Nov 6, 2025

View reviewed changes

NikkiWines approved these changes Nov 6, 2025

View reviewed changes

mountiny merged commit 203b9a2 into Expensify:main Nov 6, 2025
29 checks passed

OSBotify mentioned this pull request Nov 6, 2025

Deploy Checklist: New Expensify 2025-11-06 #74515

Closed

64 tasks

melvin-bot bot mentioned this pull request Nov 7, 2025

[Due for payment 2025-11-14] [SAML Configuration][Release 2] Add verify domain flow on the Workspaces page #72599

Closed

11 tasks

mountiny mentioned this pull request Nov 9, 2025

[Due for payment 2025-11-26] [SAML Configuration][Release 2] Add Domain Settings Page and verification flow #72603

Closed

11 tasks

parasharrajat reviewed Jan 1, 2026

View reviewed changes

Conversation

mhawryluk commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot bot commented Oct 27, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mhawryluk Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

OSBotify commented Oct 30, 2025

🦜 Polyglot Parrot! 🦜

Uh oh!

melvin-bot bot commented Oct 30, 2025

Uh oh!

ZhenjaHorbach commented Nov 6, 2025

Uh oh!

mhawryluk commented Nov 6, 2025

Uh oh!

ZhenjaHorbach commented Nov 6, 2025

Uh oh!

ZhenjaHorbach commented Nov 6, 2025

Uh oh!

mountiny left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ZhenjaHorbach commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mhawryluk commented Nov 6, 2025

Uh oh!

NikkiWines left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mhawryluk Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

mhawryluk commented Oct 20, 2025 •

edited

Loading

mhawryluk Oct 30, 2025 •

edited

Loading

ZhenjaHorbach commented Nov 6, 2025 •

edited

Loading

mhawryluk Nov 6, 2025 •

edited

Loading

mhawryluk Nov 6, 2025 •

edited

Loading

IuliiaHerets commented Nov 7, 2025 •

edited

Loading

mhawryluk commented Nov 7, 2025 •

edited

Loading

parasharrajat Jan 1, 2026 •

edited

Loading