[Release 3.2] [Domain control] Enable, disable or reset their 2FA by war-in · Pull Request #82135 · Expensify/App

war-in · 2026-02-11T14:15:44Z

Explanation of Change

PR implements Force two-factor authentication toggle and Reset two-factor authentication button

Fixed Issues

$ #79569
PROPOSAL:

Tests

Open domain/<domainID>/members
Click on member row
Verify there are Force two-factor authentication toggle and Reset two-factor authentication entries in RHP
Click on toggle
4.1 When toggle was disabled - verify it's now enabled
4.2 If toggle is enabled

and you don't have 2FA - verify it's disabled after the click
you have 2FA - verify that another screen with 2FA code input opens
- enter invalid code and see an error
- enter valid code and verify that the page is closed after the request finishes, and you're taken back to member details

Click on the member who has 2FA setup
Click on Reset two-factor authentication
On 2FA code input page enter invalid code
Verify that RHP closes and there is an error under selected member (Invalid code)
Go to the details again and enter valid code
Verify that this user doesn't have 2FA anymore
Sign in as another admin that doesn't have 2FA and verify there is no Reset two-factor authentication item in member details

Offline tests

QA Steps

Open domain/<domainID>/members
Click on member row
Verify there are Force two-factor authentication toggle and Reset two-factor authentication (if you have 2FA enabled) entries in RHP
Click on toggle
4.1 When toggle was disabled - verify it's now enabled
4.2 If toggle is enabled

and you don't have 2FA - verify it's disabled after the click
you have 2FA - verify that another screen with 2FA code input opens
- enter invalid code and see an error
- enter valid code and verify that the page is closed after the request finishes, and you're taken back to member details

Click on the member who has 2FA setup
Click on Reset two-factor authentication
On 2FA code input page enter invalid code
Verify that RHP closes and there is an error under selected member (Invalid code)
Go to the details again and enter valid code
Verify that this user doesn't have 2FA anymore
Sign in as another admin that doesn't have 2FA and verify there is no Reset two-factor authentication item in member details

PR Author Checklist

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

Reset 2FA flow:

Screen.Recording.2026-02-13.at.13.53.12.mov

Force 2FA flow:

Screen.Recording.2026-02-13.at.13.55.36.mov

…' into war-in/add-2FA-toggle-to-member-details # Conflicts: # src/ROUTES.ts # src/SCREENS.ts # src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/libs/Navigation/linkingConfig/config.ts # src/libs/Navigation/types.ts # src/pages/domain/Members/DomainMembersPage.tsx

…to war-in/add-2FA-toggle-to-member-details # Conflicts: # src/languages/en.ts # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/libs/actions/Domain.ts # src/pages/domain/Admins/DomainAdminDetailsPage.tsx # src/pages/domain/BaseDomainMembersPage.tsx

…etails_page' into war-in/add-2FA-toggle-to-member-details # Conflicts: # src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx # src/pages/domain/Admins/DomainAdminDetailsPage.tsx # src/pages/domain/BaseDomainMemberDetailsComponent.tsx

…dd-2FA-toggle-to-member-details # Conflicts: # src/ROUTES.ts # src/SCREENS.ts # src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/libs/Navigation/linkingConfig/config.ts # src/libs/Navigation/types.ts

…dd-2FA-toggle-to-member-details # Conflicts: # src/languages/en.ts # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

…dd-2FA-toggle-to-member-details # Conflicts: # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts

…dd-2FA-toggle-to-member-details

…dd-2FA-toggle-to-member-details # Conflicts: # src/ROUTES.ts # src/languages/en.ts # src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/pages/domain/BaseDomainMembersPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx # src/types/onyx/DomainErrors.ts # src/types/onyx/DomainPendingActions.ts

…dd-2FA-toggle-to-member-details # Conflicts: # src/pages/domain/Members/DomainMembersSettingsPage.tsx # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

…dd-2FA-toggle-to-member-details

…dd-2FA-toggle-to-member-details # Conflicts: # src/libs/actions/Domain.ts # src/pages/domain/BaseDomainMembersPage.tsx # src/pages/domain/Members/DomainMemberDetailsPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx

…etails # Conflicts: # src/pages/domain/Admins/DomainAdminsPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx # src/pages/domain/Members/DomainMembersSettingsPage.tsx # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

melvin-bot · 2026-02-11T14:15:49Z

Hey, I noticed you changed src/languages/en.ts in a PR from a fork. For security reasons, translations are not generated automatically for PRs from forks.

If you want to automatically generate translations for other locales, an Expensify employee will have to:

Look at the code and make sure there are no malicious changes.
Run the Generate static translations GitHub workflow. If you have write access and the K2 extension, you can simply click: [this button]

Alternatively, if you are an external contributor, you can run the translation script locally with your own OpenAI API key. To learn more, try running:

npx ts-node ./scripts/generateTranslations.ts --help

Typically, you'd want to translate only what you changed by running npx ts-node ./scripts/generateTranslations.ts --compare-ref main

…etails # Conflicts: # src/pages/domain/BaseDomainMembersPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx

war-in · 2026-02-24T18:36:34Z

@situchan fixed! and merged main

situchan · 2026-02-24T20:19:30Z

job 7 is broken on main but job2 is related to this PR

situchan · 2026-02-24T20:25:50Z

Bug: Offline case is not handled in disable / reset 2fa flow

Screen.Recording.2026-02-25.at.2.23.36.AM.mov

I think we should follow same offline pattern as account settings:

…e flow

war-in · 2026-02-25T09:44:26Z

Bug: Offline case is not handled in disable / reset 2fa flow

@situchan fixed!

Screen.Recording.2026-02-25.at.10.43.51.mov

situchan

Copilot

Pull request overview

Adds domain-admin controls for member-level 2FA management by introducing a per-member “Force two-factor authentication” toggle (via exemption list management) and a “Reset two-factor authentication” action, along with supporting API commands, navigation routes, Onyx types, translations, and unit tests.

Changes:

Added new domain actions/API commands for managing 2FA-exempt emails and resetting a member’s 2FA, including optimistic/pending/error handling.
Added new member 2FA modal pages and updated member details UI to expose the toggle + reset entry; refactored domain 2FA code-entry UI into a shared base page.
Updated Onyx types and translations; added/expanded unit tests for selectors and domain actions.

Reviewed changes

Copilot reviewed 35 out of 35 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/unit/selectors/AccountTest.ts	Adds unit tests for the new `requiresTwoFactorAuthSelector`.
tests/actions/DomainTest.ts	Adds tests covering new domain actions for 2FA exemption + reset flows.
src/types/onyx/DomainPendingActions.ts	Extends pending actions to include member-level `twoFactorAuthExemptEmails` and makes base pendingAction optional.
src/types/onyx/DomainErrors.ts	Adds `twoFactorAuthExemptEmailsError` to member errors shape.
src/types/onyx/CardFeeds.ts	Extends domain settings type with `twoFactorAuthExemptEmails`.
src/selectors/Account.ts	Adds `requiresTwoFactorAuthSelector`.
src/pages/domain/Members/TwoFactorAuth/DomainMemberResetTwoFactorAuthPage.tsx	New page to submit admin 2FA code to reset a member’s 2FA.
src/pages/domain/Members/TwoFactorAuth/DomainMemberForceTwoFactorAuthPage.tsx	New page to submit admin 2FA code when exempting a member from forced 2FA.
src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx	Refactors domain-level disable flow to reuse the new shared base 2FA-code page.
src/pages/domain/Members/DomainMembersSettingsPage.tsx	Switches translation keys to `domain.common.*` for the domain-level force-2FA toggle.
src/pages/domain/Members/DomainMembersPage.tsx	Ensures member-row error merging includes the new 2FA exemption error field.
src/pages/domain/Members/DomainMemberDetailsPage.tsx	Adds per-member force-2FA toggle and reset-2FA menu item in the member details RHP.
src/pages/domain/BaseDomainRequireTwoFactorAuthPage.tsx	Introduces shared 2FA-code entry page used by domain + member flows.
src/libs/actions/Domain.ts	Implements new write actions: set 2FA-exempt email, clear related errors, reset member 2FA; updates error translation key.
src/libs/Navigation/types.ts	Adds params for the new member 2FA screens.
src/libs/Navigation/linkingConfig/config.ts	Registers deeplink paths for new member 2FA routes.
src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts	Adds new member 2FA screens to the Domain→RHP relations.
src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx	Registers the new member 2FA pages in the settings modal stack.
src/libs/DomainUtils.ts	Updates domain-member details error detection to include 2FA exemption errors.
src/libs/API/types.ts	Adds new WRITE commands for exempt-email management and member 2FA reset.
src/libs/API/parameters/index.ts	Exports new API parameter types.
src/libs/API/parameters/SetTwoFactorAuthExemptEmailForDomainParams.ts	Defines request params for exempt-email toggle write.
src/libs/API/parameters/ResetDomainMemberTwoFactorAuthParams.ts	Defines request params for member 2FA reset write.
src/languages/zh-hans.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/pt-BR.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/pl.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/nl.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/ja.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/it.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/fr.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/es.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/en.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/languages/de.ts	Adds `domain.common.resetTwoFactorAuth` and moves force-2FA strings under `domain.common`.
src/SCREENS.ts	Adds new screen constants for member force/reset 2FA flows.
src/ROUTES.ts	Adds new routes for member force/reset 2FA flows.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-25T10:56:11Z

src/pages/domain/BaseDomainRequireTwoFactorAuthPage.tsx

+                <HeaderWithBackButton
+                    title={translate('twoFactorAuth.disableTwoFactorAuth')}
+                    onBackButtonPress={onBackButtonPress}
+                    shouldDisplayHelpButton={false}
+                />


BaseDomainRequireTwoFactorAuthPage hardcodes the header title to twoFactorAuth.disableTwoFactorAuth, but this component is also used for member 2FA flows (force/reset). That will show an incorrect/misleading title in those contexts. Consider making the title configurable via props (e.g. a headerTitle/headerTitleTranslationKey prop) and passing the appropriate copy from each caller.

Copilot · 2026-02-25T10:56:12Z

src/pages/domain/BaseDomainRequireTwoFactorAuthPage.tsx

+                        <Button
+                            success
+                            large
+                            text={translate('common.disable')}
+                            isLoading={!!pendingAction}
+                            onPress={() => baseTwoFactorAuthRef.current?.validateAndSubmitForm()}
+                        />


The submit button label is hardcoded to common.disable, which doesn’t fit all uses of this shared page (e.g. “Reset two-factor authentication”). Making the button text configurable (and optionally the button style) will avoid incorrect copy when reusing this component.

src/libs/actions/Domain.ts

Copilot · 2026-02-25T10:56:12Z

tests/actions/DomainTest.ts

+        it('adds targetEmail to exempt emails in optimisticData when force2FA is false and no twoFactorAuthCode is provided', () => {
+            const apiWriteSpy = jest.spyOn(require('@libs/API'), 'write').mockImplementation(() => Promise.resolve());
+
+            setTwoFactorAuthExemptEmailForDomain(domainAccountID, accountID, exemptEmails, targetEmail, false);
+
+            expect(apiWriteSpy).toHaveBeenCalledWith(
+                WRITE_COMMANDS.SET_TWO_FACTOR_AUTH_EXEMPT_EMAIL_FOR_DOMAIN,
+                expect.objectContaining({enabled: true}),
+                expect.objectContaining({
+                    optimisticData: expect.arrayContaining([
+                        expect.objectContaining({
+                            key: `${ONYXKEYS.COLLECTION.SHARED_NVP_PRIVATE_DOMAIN_MEMBER}${domainAccountID}`,
+                            value: {settings: {twoFactorAuthExemptEmails: [...exemptEmails, targetEmail]}},
+                        }),
+                    ]),


This test currently expects targetEmail to be appended even though exemptEmails already contains it, which enshrines duplicate entries in twoFactorAuthExemptEmails. If the action is made idempotent by de-duping, update this expectation to assert the email is present only once.

Copilot · 2026-02-25T10:56:13Z

src/libs/API/parameters/ResetDomainMemberTwoFactorAuthParams.ts

+type ResetDomainMemberTwoFactorAuth = {
+    domainAccountID: number;
+    targetAccountID: number;
+    targetEmail: string;
+    twoFactorAuthCode: string;
+};
+
+export default ResetDomainMemberTwoFactorAuth;


The exported default type name (ResetDomainMemberTwoFactorAuth) doesn’t match the filename / re-export name (ResetDomainMemberTwoFactorAuthParams). Renaming the type to ResetDomainMemberTwoFactorAuthParams will make TS errors and IDE symbol search clearer and keep parameter types consistent.

Suggested change

type ResetDomainMemberTwoFactorAuth = {

domainAccountID: number;

targetAccountID: number;

targetEmail: string;

twoFactorAuthCode: string;

};

export default ResetDomainMemberTwoFactorAuth;

type ResetDomainMemberTwoFactorAuthParams = {

domainAccountID: number;

targetAccountID: number;

targetEmail: string;

twoFactorAuthCode: string;

};

export default ResetDomainMemberTwoFactorAuthParams;

OSBotify · 2026-02-25T10:56:27Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

github-actions · 2026-02-25T10:59:52Z

🚧 @mountiny has triggered a test Expensify/App build. You can view the workflow run here.

github-actions · 2026-02-25T11:04:19Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #82135.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-022adf1-b795e6a-8f65bc2f8dc243866de4689a2f3c2c46ccd62f89/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-022adf1-b795e6a-187fbbc6e887bd0930e49f7a9a6996796c0b4262/index.html

Web 🕸️
https://82135.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

OSBotify · 2026-02-25T18:24:18Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.3.26-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

izarutskaya · 2026-02-26T15:08:22Z

Hi @war-in We don't see Reset two-factor authentication. Do we need any special account settings?

war-in · 2026-02-26T15:39:11Z

Hi @war-in We don't see Reset two-factor authentication. Do we need any special account settings?

@izarutskaya yes, you need to have 2FA enabled in the Settings -> Security -> Two-factor authentication. I'll add that to the test steps, sorry!

izarutskaya · 2026-02-26T16:14:18Z

@war-in Probably, we can't test it for now as we can't edit domain group settings or members still (details here) Could you please check this internally? Thank you in advance

mountiny · 2026-02-26T22:14:15Z

Let's retest this once you are allowed

war-in · 2026-02-27T10:06:02Z

From my testing on staging, it looks like the Reset two-factor authentication is working correctly

OSBotify · 2026-02-27T14:55:51Z

🚀 Deployed to production by https://github.com/puneetlath in version: 9.3.26-8 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

war-in added 26 commits January 7, 2026 15:32

feat: add 2FA toggle to member details

c7712cc

refactor: adjust toggle isActive logic

d4f17f5

feat: add reset 2FA wip

3bdce91

feat: add 2FA required page for reset 2FA feature

fbcbe92

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

fad09c8

…dd-2FA-toggle-to-member-details # Conflicts: # src/languages/en.ts # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

feat: add call to API command

b341319

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

6cda713

…dd-2FA-toggle-to-member-details # Conflicts: # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts

refactor: update the called command

721731d

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

80107d8

…dd-2FA-toggle-to-member-details

fix: post-merge

1d992aa

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

b3e6ddf

…dd-2FA-toggle-to-member-details # Conflicts: # src/pages/domain/Members/DomainMembersSettingsPage.tsx # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

fix: post-merge fixes

a7ab578

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

ab5a966

…dd-2FA-toggle-to-member-details

feat: add optimistic data

b8afc4a

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

19cbe59

…dd-2FA-toggle-to-member-details

fix: split pages

69203aa

fix: error handling

b1dbd7e

refactor: use presonalDetailsSelector

2ead859

refactor: adjust code to the most-recent changes

4f7d7e8

melvin-bot bot assigned war-in Feb 11, 2026

war-in mentioned this pull request Feb 11, 2026

[Release 3.2] [Domain control] Enable, disable or reset their 2FA software-mansion-labs/expensify-app-fork#281

Closed

53 tasks

Merge branch 'refs/heads/main' into war-in/add-2FA-toggle-to-member-d…

01e3b0d

…etails # Conflicts: # src/pages/domain/BaseDomainMembersPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx

war-in added 2 commits February 24, 2026 19:33

fix: offline behaviour

f6662e5

Merge branch 'main' into war-in/add-2FA-toggle-to-member-details

035ff94

war-in added 3 commits February 25, 2026 10:23

Merge branch 'main' into war-in/add-2FA-toggle-to-member-details

369bf65

tests: fix setTwoFactorAuthExemptEmailForDomain after changes in th…

7874141

…e flow

fix: show offline blocking view on 2FA pages

21fecd2

situchan approved these changes Feb 25, 2026

View reviewed changes

melvin-bot bot requested a review from mountiny February 25, 2026 10:15

mountiny approved these changes Feb 25, 2026

View reviewed changes

mountiny requested review from Copilot and removed request for sobitneupane February 25, 2026 10:49

mountiny merged commit 022adf1 into Expensify:main Feb 25, 2026
29 checks passed

github-project-automation bot moved this from Ready for Review to Done in Bring Domain Control to NewDot Feb 25, 2026

Copilot started reviewing on behalf of mountiny February 25, 2026 10:50 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

OSBotify mentioned this pull request Feb 25, 2026

Deploy Checklist: New Expensify 2026-02-25 #83466

Closed

war-in mentioned this pull request Mar 18, 2026

Hide member 2FA toggle when domain 2FA is not enabled #85241

Merged

51 tasks

Conversation

war-in commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot bot commented Feb 11, 2026

Uh oh!

war-in commented Feb 24, 2026

Uh oh!

situchan commented Feb 24, 2026

Uh oh!

situchan commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

war-in commented Feb 25, 2026

Uh oh!

situchan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

OSBotify commented Feb 25, 2026

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

OSBotify commented Feb 25, 2026

Uh oh!

izarutskaya commented Feb 26, 2026

Uh oh!

war-in commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

izarutskaya commented Feb 26, 2026

Uh oh!

mountiny commented Feb 26, 2026

Uh oh!

war-in commented Feb 27, 2026

Uh oh!

OSBotify commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

war-in commented Feb 11, 2026 •

edited

Loading

situchan commented Feb 24, 2026 •

edited

Loading

war-in commented Feb 26, 2026 •

edited

Loading