[No QA][ECUK In-App 3DS] Implement transaction approval flow by JakubKorytko · Pull Request #82704 · Expensify/App

JakubKorytko · 2026-02-17T18:20:10Z

Explanation of Change

This PR introduces support for 3DS transaction approval flows, enhances eReceipt theming flexibility, and adds a new custom HTML tag renderer for transaction history links. It also includes various supporting updates to constants, routes, Onyx keys, and illustrations to enable these new features.

3DS Transaction Approval and Multifactor Authentication Enhancements:

Added a new scenario AUTHORIZE_SCENARIO
Added two new actions - approveTransaction & denyTransaction
Added new report action type ACTIONABLE_CARD_3DS_TRANSACTION_APPROVAL in CONST to support 3DS transaction approval messages.
Introduced new Onyx keys for managing pending 3DS transaction reviews and locally processed 3DS transaction reviews, and updated the Onyx value mapping accordingly.
Added new route and screen constants for multifactor authentication transaction authorization.
Improved state management and callback handling in multifactor authentication context and state reducer to better support scenario payloads and type safety.
Removed the now-obsolete MultifactorAuthenticationTriggerCancelConfirmModal component. Modals follow the pattern of component as a value same as screens.

eReceipt Component Theming and Flexibility:

Added overrideTheme prop to EReceipt and EReceiptWithSizeCalculation components, allowing custom theming (colors, icons, background image, and title text) via the new OverrideThemeProps type.

Custom HTML Tag Renderer for Transaction History Links:

Added support for the <transaction-history-link> custom HTML tag in the HTML engine provider and implemented a new renderer that navigates to the transaction history search page.

Asset and Illustration Updates:

Added new illustrations for approved and denied transaction hands, and encryption man, for multifactor authentication flows.

Fixed Issues

$ #79379
$ #79380
$ #82616
PROPOSAL: N/A

Tests

These tests should only be performed in native mobile apps. The changes are not supported on the web or mWeb.

Open the Expensify App when a transaction awaits your approval.
Verify that you are redirected to the transaction approval screen.
Approve the Transaction:
1. Enter the magic code.
2. Authenticate yourself.
3. Verify that the success screen appears.
Out of Time Flow:
- Wait on this screen for approximately 8 minutes:
  1. Verify that your screen changes to the "Out of Time" failure screen.
- Accept the transaction:
  1. Enter the magic code.
  2. Wait for approximately 8 minutes.
  3. Authenticate yourself.
  4. Verify that your screen changes to the "Out of Time" failure screen.
Already Reviewed Flow:
1. Do not continue the flow on this device.
2. Switch to device B and approve the transaction.
3. Verify that on device A, the "Already Reviewed" screen appears.
Deny Transaction:
1. Proceed with the transaction approval flow.
2. Attempt to exit the RHP using the back button, header back button, or by clicking outside the RHP.
3. Verify that the cancel confirmation modal appears.
4. Confirm that you want to deny the transaction.
5. Verify that the "Denied Transaction" failure screen appears.
Failure Test:
- Attempt to fail at any stage in the flow, either by failing the authentication, providing an incorrect magic code, or through any other possible failures, and verify that the appropriate success or failure outcome is correctly captured.

Offline tests

N/A, D - Full Page Blocking UI Pattern for this project.

QA Steps

QA cannot test this

PR Author Checklist

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

…tion-action-and-scenario

melvin-bot · 2026-02-17T18:20:16Z

Hey, I noticed you changed src/languages/en.ts in a PR from a fork. For security reasons, translations are not generated automatically for PRs from forks.

If you want to automatically generate translations for other locales, an Expensify employee will have to:

Look at the code and make sure there are no malicious changes.
Run the Generate static translations GitHub workflow. If you have write access and the K2 extension, you can simply click: [this button]

Alternatively, if you are an external contributor, you can run the translation script locally with your own OpenAI API key. To learn more, try running:

npx ts-node ./scripts/generateTranslations.ts --help

Typically, you'd want to translate only what you changed by running npx ts-node ./scripts/generateTranslations.ts --compare-ref main

github-actions · 2026-02-17T18:20:19Z

⚠️ This PR is possibly changing native code and/or updating libraries, it may cause problems with HybridApp. Please check if any patch updates are required in the HybridApp repo and run an AdHoc build to verify that HybridApp will not break. Ask Contributor Plus for help if you are not sure how to handle this. ⚠️

melvin-bot · 2026-02-17T18:20:19Z

@DylanDylann Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

…thorizationChallenge

…ale files

src/libs/actions/MultifactorAuthentication/index.ts

src/libs/Navigation/useNavigateTo3DSAuthorizationChallenge.ts

…view

chuckdries · 2026-02-27T20:39:49Z

I noticed something weird with the receipt preview in 400 Transaction already reviewed response - is that an actual issue or just a glitch with the recording?

Glitch with the recording

…issing

rafecolton · 2026-02-27T21:06:08Z

src/libs/ReportActionsUtils.ts

+        return undefined;
+    }
+    const {amount, currency, merchant} = originalMessage;
+    const formattedAmount = amount ? convertToDisplayString(amount, currency) : '';


Noting that if there is no currency, we need to omit the symbol rather than show USD

rafecolton · 2026-02-27T21:06:38Z

src/libs/TransactionPreviewUtils.ts

+        return '';
+    }
+    const digitsOnly = String(lastFourPAN).replaceAll(/\D/g, '');
+    return digitsOnly ? digitsOnly.slice(-4).padStart(4, '0') : '';


Per discussion we should pad with X's.

Suggested change

return digitsOnly ? digitsOnly.slice(-4).padStart(4, '0') : '';

return digitsOnly ? digitsOnly.slice(-4).padStart(4, 'X') : '';

rafecolton · 2026-02-27T21:09:01Z

src/libs/TransactionPreviewUtils.ts

+ * If the number is shorter than 4 digits, it will be padded with zeros.
+ */
+function formatLastFourPAN(lastFourPAN?: number | string): string {
+    if (lastFourPAN === undefined || lastFourPAN === null) {


Right? Since if we have no digits, we don't want to show as all padding XXXX

Suggested change

if (lastFourPAN === undefined || lastFourPAN === null) {

if (lastFourPAN === undefined || lastFourPAN === null || lastFourPAN === '') {

rafecolton · 2026-02-27T21:11:10Z

...pages/MultifactorAuthentication/AuthorizeTransactionPage/AuthorizeCardTransactionPreview.tsx

+
+    // Show skeleton when transaction data is not yet available (e.g. initial load before parent has received it from Onyx).
+    // Data is loaded by the parent; this component does not fetch.
+    const shouldShowSkeleton = !amount && !currency && !merchant && !created && !lastFourPAN;


Only require non-optional fields before showing

Suggested change

const shouldShowSkeleton = !amount && !currency && !merchant && !created && !lastFourPAN;

const shouldShowSkeleton = !created && !transactionID;

rafecolton · 2026-02-27T21:13:08Z

src/pages/MultifactorAuthentication/OutcomePage.tsx

 import type {ErrorState} from '@components/MultifactorAuthentication/Context/State';
-import CONST from '@src/CONST';

+/** Show server failure screen when status is 5xx or unknown (e.g. network/parse error). Otherwise treat as client error (4xx). */


NAB

Suggested change

/** Show server failure screen when status is 5xx or unknown (e.g. network/parse error). Otherwise treat as client error (4xx). */

/** Server failure screen generally represents "unknown error" so also show when status is unknown (e.g. network/parse error). */

rafecolton · 2026-02-27T21:15:54Z

src/types/onyx/TransactionPending3DSReview.ts

+    expires: string;
+
+    /** Last 4 digits of the card PAN */
+    lastFourPAN: number;


Should be a string, else we'll lose leading 0's and replace with X's

Confirmed it is a string in Auth

…s undefined

rafecolton

🎉🎉🎉

chuckdries · 2026-02-27T22:10:40Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified there are no new alerts related to the canBeMissing param for useOnyx
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

See above comments for videos

OSBotify · 2026-02-27T22:21:59Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

github-actions · 2026-02-27T22:22:26Z

🚧 @chuckdries has triggered a test Expensify/App build. You can view the workflow run here.

github-actions · 2026-02-27T22:26:43Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #82704.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-530b93a-a7ff231-083b281ba8c2e19ba65ad61330de91de04fca4f8/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-530b93a-a7ff231-c026ae5c3b58288df26ff1c018bffc611a8be030/index.html

Web 🕸️
https://82704.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

OSBotify · 2026-03-02T23:02:08Z

🚀 Deployed to staging by https://github.com/chuckdries in version: 9.3.28-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

OSBotify · 2026-03-04T03:16:56Z

🚀 Deployed to staging by https://github.com/chuckdries in version: 9.3.30-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

OSBotify · 2026-03-04T18:07:17Z

🚀 Deployed to production by https://github.com/blimpich in version: 9.3.30-3 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

shubham1206agra · 2026-03-19T13:15:13Z

src/libs/ReportActionsUtils.ts

 }

+// Renders content of ACTIONABLE_CARD_3DS_TRANSACTION_APPROVAL reportActions
+function getActionableCard3DSTransactionApprovalMessage(


@chuckdries @JakubKorytko You have not used this custom report action renderer in multiple places which will cause mismatch in report name when you create thread on this message. Also, copying this message will also mismatch. Can you please fix this?

Raised here for discussion

Made an issue for it here: #86008

JakubKorytko and others added 18 commits January 28, 2026 21:19

assets: add 3rd release assets

06cde34

chore: add 3rd release translations

c4daf02

feat: add 3rd release screens, config & notification type

31c7dd4

Merge branch 'main' into korytko/ecuk/3ds/implement-authorize-transac…

92b0a74

…tion-action-and-scenario

fix: linkingConfig

756596e

fix: PR comments

974232f

Merge branch 'main' into korytko/ecuk/3ds/implement-authorize-transac…

d141132

…tion-action-and-scenario

fix: after merge

de681b3

feat: improve push notifications on iOS

9711ed6

fix: shell check

9a81379

fix: notifications & temporary RHP close

7dab587

Merge branch 'main' into korytko/ecuk/3ds/implement-authorize-transac…

d0fd91e

…tion-action-and-scenario

fix: remove Timing after merge

2bb57b9

Merge branch 'main' into korytko/ecuk/3ds/implement-authorize-transac…

383968c

…tion-action-and-scenario

Merge branch 'main' into korytko/ecuk/3ds/implement-authorize-transac…

92f3c87

…tion-action-and-scenario

fix: after merge

5d554fd

Created new AuthorizeCardTransactionPreview component for MFA

17e2a8f

fix: defaultScreens import & eslint

8cc71a2

JakubKorytko requested review from a team as code owners February 17, 2026 18:20

melvin-bot bot assigned JakubKorytko Feb 17, 2026

melvin-bot bot requested review from a team, DylanDylann and heyjennahay and removed request for a team February 17, 2026 18:20

chuckdries added 4 commits February 27, 2026 09:16

Address PR feedback and improve organization in MFA actions file

4b468ee

Address PR Feedback on comments and readability in useNavigateTo3DSAu…

5af87db

…thorizationChallenge

Update TransactionPending3DSReview types

3dcef27

Update type signature for actionableCard3DSTransactionApproval in loc…

807f350

…ale files

rafecolton reviewed Feb 27, 2026

View reviewed changes

src/libs/actions/MultifactorAuthentication/index.ts Outdated Show resolved Hide resolved

src/libs/Navigation/useNavigateTo3DSAuthorizationChallenge.ts Outdated Show resolved Hide resolved

src/libs/Navigation/useNavigateTo3DSAuthorizationChallenge.ts Outdated Show resolved Hide resolved

JakubKorytko and others added 3 commits February 27, 2026 21:08

address remaining PR comments

347885b

improvement: removed code duplicates from AuthorizeCardTransactionPre…

5717e6f

…view

refactor: group authorize transaction page returns

04ba6d9

JakubKorytko requested a review from rafecolton February 27, 2026 20:17

fix: typo

6dd065b

Pad last four of PAN with X's rather than 0's, and omit entirely if m…

e46db34

…issing

rafecolton reviewed Feb 27, 2026

View reviewed changes

chuckdries added 3 commits February 27, 2026 13:17

Omit currency symbol in AuthorizeCardTransactionPreview if currency i…

d9aab03

…s undefined

Address PR feedback regarding transaction previews and types

f2cdc4a

Always vertically center amount in AuthorizeCardTransactionPreview

2d1c53e

chuckdries changed the title ~~[ECUK In-App 3DS] Implement transaction approval flow~~ [No QA][ECUK In-App 3DS] Implement transaction approval flow Feb 27, 2026

rafecolton approved these changes Feb 27, 2026

View reviewed changes

chuckdries merged commit 530b93a into Expensify:main Feb 27, 2026
31 of 32 checks passed

OSBotify mentioned this pull request Mar 2, 2026

Deploy Checklist: New Expensify 2026-03-02 #83947

Closed

shubham1206agra reviewed Mar 19, 2026

View reviewed changes

	return digitsOnly ? digitsOnly.slice(-4).padStart(4, '0') : '';
	return digitsOnly ? digitsOnly.slice(-4).padStart(4, 'X') : '';

	if (lastFourPAN === undefined \|\| lastFourPAN === null) {
	if (lastFourPAN === undefined \|\| lastFourPAN === null \|\| lastFourPAN === '') {

	const shouldShowSkeleton = !amount && !currency && !merchant && !created && !lastFourPAN;
	const shouldShowSkeleton = !created && !transactionID;

	/** Show server failure screen when status is 5xx or unknown (e.g. network/parse error). Otherwise treat as client error (4xx). */
	/** Server failure screen generally represents "unknown error" so also show when status is unknown (e.g. network/parse error). */

Conversation

JakubKorytko commented Feb 17, 2026 • edited by chuckdries Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot bot commented Feb 17, 2026

Uh oh!

github-actions bot commented Feb 17, 2026

Uh oh!

melvin-bot bot commented Feb 17, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chuckdries commented Feb 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rafecolton left a comment

Choose a reason for hiding this comment

Uh oh!

chuckdries commented Feb 27, 2026

Reviewer Checklist

Screenshots/Videos

Uh oh!

Uh oh!

OSBotify commented Feb 27, 2026

Uh oh!

github-actions bot commented Feb 27, 2026

Uh oh!

github-actions bot commented Feb 27, 2026

Uh oh!

OSBotify commented Mar 2, 2026

Uh oh!

OSBotify commented Mar 4, 2026

Uh oh!

OSBotify commented Mar 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

JakubKorytko commented Feb 17, 2026 •

edited by chuckdries

Loading