[Release 3.3] [Domain Control] Report suspicious activity by jmusial · Pull Request #78372 · Expensify/App

jmusial · 2025-12-23T14:52:16Z

Explanation of Change

Part for Domain Control project. This PR adds reporting suspicious activity (locking users account).

Based on the design doc & discussion it resembles Report Suspicious Activity from the Settings/Account page.

Fixed Issues

$ #79568

PROPOSAL:

Tests

Pre requisites:
Have a domain and be an admin there.

Open the app
Go to Workspaces -> your domain -> Domain members
Click on a member
Click "Report suspicious activity" and confirm 2 modals
Account is locked
Click "Unlock account"
Dismiss modal

Offline tests

QA Steps

Same as tests.

PR Author Checklist

Screenshots/Videos

Android: Native

0093.android.native.mov

Android: mWeb Chrome

0093.android.chrome.mov

iOS: Native

0093.ios.native.mov

iOS: mWeb Safari

0093.ios.safari.mov

MacOS: Chrome / Safari

0093.desktop.chrome.mov

melvin-bot · 2025-12-23T14:52:21Z

Hey, I noticed you changed src/languages/en.ts in a PR from a fork. For security reasons, translations are not generated automatically for PRs from forks.

If you want to automatically generate translations for other locales, an Expensify employee will have to:

Look at the code and make sure there are no malicious changes.
Run the Generate static translations GitHub workflow. If you have write access and the K2 extension, you can simply click: [this button]

Alternatively, if you are an external contributor, you can run the translation script locally with your own OpenAI API key. To learn more, try running:

npx ts-node ./scripts/generateTranslations.ts --help

Typically, you'd want to translate only what you changed by running npx ts-node ./scripts/generateTranslations.ts --compare-ref main

codecov · 2025-12-23T15:07:17Z

Codecov Report

✅ Changes either increased or maintained existing code coverage, great job!

Files with missing lines	Coverage Δ
src/CONST/index.ts	`92.68% <ø> (+0.12%)`	⬆️
src/SCREENS.ts	`100.00% <ø> (ø)`
...ents/HTMLEngineProvider/BaseHTMLEngineProvider.tsx	`87.50% <100.00%> (+0.46%)`	⬆️
...mponents/HTMLEngineProvider/HTMLRenderers/index.ts	`100.00% <ø> (ø)`
src/components/RenderHTML.tsx	`100.00% <100.00%> (ø)`
src/components/VacationDelegateMenuItem.tsx	`0.00% <ø> (ø)`
...avigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts	`100.00% <ø> (ø)`
src/libs/Navigation/linkingConfig/config.ts	`75.00% <ø> (ø)`
src/libs/actions/User.ts	`30.10% <100.00%> (+4.76%)`	⬆️
.../pages/domain/BaseDomainMemberDetailsComponent.tsx	`0.00% <ø> (ø)`
... and 13 more
... and 43 files with indirect coverage changes

rayane-d · 2026-02-04T16:48:36Z

src/pages/settings/Security/LockAccount/LockAccountPageBase.tsx

+        }
+
+        setIsLoading(true);
+        const response = await lockAccount(accountID);


Let's add a domainAccountID parameter to LockAccount so that we can return Onyx data for errors

Related BE issue: #81420

rayane-d · 2026-02-09T10:21:24Z

src/CONST/index.ts

        /** Onyx prefix for domain security groups */
        DOMAIN_SECURITY_GROUP_PREFIX: 'domain_securityGroup_',
+        /** Onyx prefix for lock account IDs */
+        EXPENSIFY_LOCKED_ACCOUNT_PREFIX: 'expensify_lockAccountDetails_',


Suggested change

EXPENSIFY_LOCKED_ACCOUNT_PREFIX: 'expensify_lockAccountDetails_',

PRIVATE_LOCKED_ACCOUNT_PREFIX: 'private_lockAccountDetails_',

situchan · 2026-03-02T11:07:40Z

src/components/VacationDelegateMenuItem.tsx

            description={translate('common.vacationDelegate')}
            shouldShowRightIcon
            onPress={onPress}
-            containerStyle={styles.pr2}


This causes regression

staging:

Based on the discussion on this PR I'd say the custom mr on Clear after should be adjusted instead ? cc. @Expensify/design

@Expensify/design What do you think?

The staging screenshot looks more correct to me - but maybe I've missed a discussion somewhere? Let's see what the rest of @Expensify/design thinks.

situchan · 2026-03-02T11:22:53Z

src/languages/en.ts

            resetDomainExplanation: ({domainName}: {domainName?: string}) => `Please type <strong>${domainName}</strong> to confirm the domain reset.`,
            enterDomainName: 'Enter your domain name here',
-            resetDomainInfo: `This action is <strong>permanent</strong> and the following data will be deleted: <br/> <ul><li>Company card connections and any unreported expenses from those cards</li> <li>SAML and group settings</li> </ul> All accounts, workspaces, reports, expenses, and other data will remain. <br/><br/>Note: You can clear this domain from your domains list by removing the associated email from your <a href="#">contact methods</a>.`,
+            resetDomainInfo: `This action is <strong>permanent</strong> and the following data will be deleted: <br/> <bullet-list><bullet-item>Company card connections and any unreported expenses from those cards</bullet-item><bullet-item>SAML and group settings</bullet-item></bullet-list> All accounts, workspaces, reports, expenses, and other data will remain. <br/><br/>Note: You can clear this domain from your domains list by removing the associated email from your <a href="#">contact methods</a>.`,


This change seems not working as expected. No longer list type:

staging:

Do you know why it worked for closeAccountInfo?

Yes, when you pass a link to the RenderHTML it is using a different RenderHTMLConfigProvider. It does not have custom rendereres passed to it.

Before it was ok, bc the bullet list was using plain html

situchan · 2026-03-02T11:26:02Z

src/languages/en.ts

            closeAccountInfo: () => ({
-                one: 'We recommend closing the account safely to skip closing it in case there are: <ul><li>Pending approvals</li><li>Active reimbursements</li><li>No alternative login methods</li></ul>Otherwise, you can ignore the safety precautions above and force close the selected account.',
-                other: 'We recommend closing the accounts safely to skip closing it in case there are: <ul><li>Pending approvals</li><li>Active reimbursements</li><li>No alternative login methods</li></ul>Otherwise, you can ignore the safety precautions above and force close the selected accounts.',
+                one: 'We recommend closing the account safely to skip closing it in case there are: <bullet-list><bullet-item>Pending approvals</bullet-item><bullet-item>Active reimbursements</bullet-item><bullet-item>No alternative login methods</bullet-item></bullet-list>Otherwise, you can ignore the safety precautions above and force close the selected account.',


Btw was this change requested? Please share discussion link for context.

Before:

After:

#78372 (comment)

#78372 (comment)

mountiny · 2026-03-02T23:23:42Z

Just waiting for @Expensify/design on #78372 (comment)

dubielzyk-expensify · 2026-03-03T00:05:28Z

Visually this looks great! Approved on my end

situchan · 2026-03-03T03:15:41Z

Visually this looks great! Approved on my end

@dubielzyk-expensify are you saying that this inconsistency is fine?

556851821-ea985182-74ea-468d-936d-712c55b24fc9

dubielzyk-expensify · 2026-03-03T04:08:14Z

No that's not fine, but that's the status screen. What's that got to do with the domain control part?

Sorry if I've missed something

situchan · 2026-03-03T07:14:48Z

@dubielzyk-expensify ok then, is this inconsistency fine?

Right padding is different between same components.

556851821-ea985182-74ea-468d-936d-712c55b24fc9 copy

jmusial · 2026-03-03T08:55:14Z

@dubielzyk-expensify we had a conversation with @shawnborton above about the right padding on arrows

#78372 (comment)
#78372 (comment) <- @situchan answer to your question

And the decision was to not modify the standard MenuItem styles for our buttons.

They are modified (less margin right) in one other place in the app, and unlucky for us this place is Clear after, is why I suggested to modify this one as well here

situchan · 2026-03-03T09:53:56Z

@jmusial ok let's do what we landed and push the fix.

jmusial · 2026-03-03T10:01:05Z

@jmusial ok let's do what we landed and push the fix.

Waiting for @Expensify/design to confirm before making changes

dubielzyk-expensify · 2026-03-03T23:03:53Z

I'm a bit confused, but if Shawn suggested a way forward then lets go with that.

In general we don't wanna specifically tweak these components per screen. They should work the same everywhere since they're just a bunch of list components.

mountiny

Changes look good to me, I dont want to hold this one any further, we can clean up the padding on the menu item later in case we will decide that way

github-actions · 2026-03-03T23:21:07Z

🚧 @mountiny has triggered a test Expensify/App build. You can view the workflow run here.

github-actions · 2026-03-03T23:26:37Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #78372.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-7eea908-61b500b-1558caf1ad8da8a7153699e6ca9894543ea443ea/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-7eea908-61b500b-fb1eabc35d8de10ea9a8ea1c4175b82f13a9aad4/index.html

Web 🕸️
https://78372.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

OSBotify · 2026-03-04T18:34:18Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.3.31-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	failure ❌
🍎 iOS 🍎	success ✅

vincdargento · 2026-03-04T23:18:30Z

Deploy Blocker #84214 was identified to be related to this PR.

jmusial · 2026-03-05T09:31:30Z

Deploy Blocker #84214 was identified to be related to this PR.

Opened a PR with a fix

mountiny · 2026-03-05T22:19:38Z

Fix cped

OSBotify · 2026-03-06T03:46:59Z

🚀 Deployed to production by https://github.com/blimpich in version: 9.3.31-12 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

jmusial added 4 commits December 23, 2025 10:41

Merge branch 'main' into feat/domain-report-sus-activity

cb73c03

Merge branch 'main' into feat/domain-report-sus-activity

779270c

Merge branch 'main' into feat/domain-report-sus-activity

3c12ed1

unify lock account pages

17edfc2

melvin-bot bot assigned jmusial Dec 23, 2025

Merge branch 'main' into feat/domain-report-sus-activity

7a332c7

jmusial added 2 commits December 23, 2025 16:43

update lock account to use same component

97b70ba

fix lock account

396798d

jmusial changed the title ~~Feat/domain report sus activity~~ HOLD] [Release 2] [Domain Control] Report suspicious activity Dec 23, 2025

jmusial changed the title ~~HOLD] [Release 2] [Domain Control] Report suspicious activity~~ [HOLD] [Release 2] [Domain Control] Report suspicious activity Dec 23, 2025

jmusial changed the title ~~[HOLD] [Release 2] [Domain Control] Report suspicious activity~~ [HOLD] [Release 3] [Domain Control] Report suspicious activity Dec 23, 2025

jmusial added 9 commits January 7, 2026 10:06

Merge branch 'main' into feat/domain-report-sus-activity

ebfc482

Merge branch 'main' into feat/domain-report-sus-activity

343c97e

fix some merge issues

c4a5333

restore AdminDetails to main

630acf1

fix merge issues

c28462f

Merge branch 'main' into feat/domain-report-sus-activity

ce446ad

initial after merge cleanup

24e932f

cleanup old member page

469e237

style

f3788c0

jmusial added this to Bring Domain Control to NewDot Jan 14, 2026

jmusial moved this to In Progress in Bring Domain Control to NewDot Jan 14, 2026

jmusial changed the title ~~[HOLD] [Release 3] [Domain Control] Report suspicious activity~~ [HOLD] [Release 3.3] [Domain Control] Report suspicious activity Jan 14, 2026

jmusial added 3 commits February 3, 2026 07:28

Merge branch 'main' into feat/domain-report-sus-activity

45650e7

add account unlock

9944b71

fix lint

e261b76

rayane-d suggested changes Feb 4, 2026

View reviewed changes

rayane-d suggested changes Feb 9, 2026

View reviewed changes

ZhenjaHorbach approved these changes Mar 2, 2026

View reviewed changes

situchan reviewed Mar 2, 2026

View reviewed changes

add bullet list to html renderer when link is present

06636c4

dubielzyk-expensify self-requested a review March 3, 2026 00:05

mountiny approved these changes Mar 3, 2026

View reviewed changes

mountiny merged commit 7eea908 into Expensify:main Mar 3, 2026
35 checks passed

github-project-automation bot moved this from Ready for Review to Done in Bring Domain Control to NewDot Mar 3, 2026

This was referenced Mar 4, 2026

Investigate workflow job failing on main: test / test (job 1) #84096

Closed

Investigate workflow job failing on main: test / test (job 8) #84097

Closed

OSBotify mentioned this pull request Mar 4, 2026

Deploy Checklist: New Expensify 2026-03-04 #84164

Closed

vincdargento mentioned this pull request Mar 4, 2026

Domains - Long email overflows on Report suspicious activity RHP #84214

Closed

7 tasks

melvin-bot bot mentioned this pull request Mar 6, 2026

[Due for payment 2026-03-13] [Domain Control] [Release 3.3] Report suspicious activity #79568

Closed

	EXPENSIFY_LOCKED_ACCOUNT_PREFIX: 'expensify_lockAccountDetails_',
	PRIVATE_LOCKED_ACCOUNT_PREFIX: 'private_lockAccountDetails_',

Conversation

jmusial commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot bot commented Dec 23, 2025

Uh oh!

codecov bot commented Dec 23, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jmusial Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mountiny commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dubielzyk-expensify commented Mar 3, 2026

Uh oh!

situchan commented Mar 3, 2026

Uh oh!

dubielzyk-expensify commented Mar 3, 2026

Uh oh!

situchan commented Mar 3, 2026

Uh oh!

jmusial commented Mar 3, 2026

Uh oh!

situchan commented Mar 3, 2026

Uh oh!

jmusial commented Mar 3, 2026

Uh oh!

dubielzyk-expensify commented Mar 3, 2026

Uh oh!

mountiny left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Mar 3, 2026

Uh oh!

github-actions bot commented Mar 3, 2026

Uh oh!

OSBotify commented Mar 4, 2026

Uh oh!

vincdargento commented Mar 4, 2026

Uh oh!

jmusial commented Mar 5, 2026

Uh oh!

mountiny commented Mar 5, 2026

Uh oh!

jmusial commented Dec 23, 2025 •

edited

Loading

codecov bot commented Dec 23, 2025 •

edited by github-actions bot

Loading

jmusial Mar 2, 2026 •

edited

Loading

mountiny commented Mar 2, 2026 •

edited

Loading