[Release 3.2] [Domain control] Enable, disable or reset their 2FA by war-in · Pull Request #82135 · Expensify/App

war-in · 2026-02-11T14:15:44Z

Explanation of Change

PR implements Force two-factor authentication toggle and Reset two-factor authentication button

Fixed Issues

$ #79569
PROPOSAL:

Tests

Open domain/<domainID>/members
Click on member row
Verify there are Force two-factor authentication toggle and Reset two-factor authentication entries in RHP
Click on toggle
4.1 When toggle was disabled - verify it's now enabled
4.2 If toggle is enabled

and you don't have 2FA - verify it's disabled after the click
you have 2FA - verify that another screen with 2FA code input opens
- enter invalid code and see an error
- enter valid code and verify that the page is closed after the request finishes, and you're taken back to member details

Click on the member who has 2FA setup
Click on Reset two-factor authentication
On 2FA code input page enter invalid code
Verify that RHP closes and there is an error under selected member (Invalid code)
Go to the details again and enter valid code
Verify that this user doesn't have 2FA anymore
Sign in as another admin that doesn't have 2FA and verify there is no Reset two-factor authentication item in member details

Offline tests

QA Steps

Open domain/<domainID>/members
Click on member row
Verify there are Force two-factor authentication toggle and Reset two-factor authentication entries in RHP
Click on toggle
4.1 When toggle was disabled - verify it's now enabled
4.2 If toggle is enabled

and you don't have 2FA - verify it's disabled after the click
you have 2FA - verify that another screen with 2FA code input opens
- enter invalid code and see an error
- enter valid code and verify that the page is closed after the request finishes, and you're taken back to member details

Click on the member who has 2FA setup
Click on Reset two-factor authentication
On 2FA code input page enter invalid code
Verify that RHP closes and there is an error under selected member (Invalid code)
Go to the details again and enter valid code
Verify that this user doesn't have 2FA anymore
Sign in as another admin that doesn't have 2FA and verify there is no Reset two-factor authentication item in member details

PR Author Checklist

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

Reset 2FA flow:

Screen.Recording.2026-02-13.at.13.53.12.mov

Force 2FA flow:

Screen.Recording.2026-02-13.at.13.55.36.mov

…' into war-in/add-2FA-toggle-to-member-details # Conflicts: # src/ROUTES.ts # src/SCREENS.ts # src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/libs/Navigation/linkingConfig/config.ts # src/libs/Navigation/types.ts # src/pages/domain/Members/DomainMembersPage.tsx

…to war-in/add-2FA-toggle-to-member-details # Conflicts: # src/languages/en.ts # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/libs/actions/Domain.ts # src/pages/domain/Admins/DomainAdminDetailsPage.tsx # src/pages/domain/BaseDomainMembersPage.tsx

…etails_page' into war-in/add-2FA-toggle-to-member-details # Conflicts: # src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx # src/pages/domain/Admins/DomainAdminDetailsPage.tsx # src/pages/domain/BaseDomainMemberDetailsComponent.tsx

…dd-2FA-toggle-to-member-details # Conflicts: # src/ROUTES.ts # src/SCREENS.ts # src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/libs/Navigation/linkingConfig/config.ts # src/libs/Navigation/types.ts

…dd-2FA-toggle-to-member-details # Conflicts: # src/languages/en.ts # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

…dd-2FA-toggle-to-member-details # Conflicts: # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts

…dd-2FA-toggle-to-member-details

…dd-2FA-toggle-to-member-details # Conflicts: # src/ROUTES.ts # src/languages/en.ts # src/libs/Navigation/AppNavigator/ModalStackNavigators/index.tsx # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/pages/domain/BaseDomainMembersPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx # src/types/onyx/DomainErrors.ts # src/types/onyx/DomainPendingActions.ts

…dd-2FA-toggle-to-member-details # Conflicts: # src/pages/domain/Members/DomainMembersSettingsPage.tsx # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

…dd-2FA-toggle-to-member-details

…dd-2FA-toggle-to-member-details # Conflicts: # src/libs/actions/Domain.ts # src/pages/domain/BaseDomainMembersPage.tsx # src/pages/domain/Members/DomainMemberDetailsPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx

…etails # Conflicts: # src/pages/domain/Admins/DomainAdminsPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx # src/pages/domain/Members/DomainMembersSettingsPage.tsx # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

melvin-bot · 2026-02-11T14:15:49Z

Hey, I noticed you changed src/languages/en.ts in a PR from a fork. For security reasons, translations are not generated automatically for PRs from forks.

If you want to automatically generate translations for other locales, an Expensify employee will have to:

Look at the code and make sure there are no malicious changes.
Run the Generate static translations GitHub workflow. If you have write access and the K2 extension, you can simply click: [this button]

Alternatively, if you are an external contributor, you can run the translation script locally with your own OpenAI API key. To learn more, try running:

npx ts-node ./scripts/generateTranslations.ts --help

Typically, you'd want to translate only what you changed by running npx ts-node ./scripts/generateTranslations.ts --compare-ref main

…etails # Conflicts: # src/pages/domain/BaseDomainMembersPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx

war-in · 2026-02-19T17:13:29Z

@codex review

src/types/onyx/DomainPendingActions.ts

src/types/onyx/DomainErrors.ts

src/pages/domain/BaseDomainRequireTwoFactorAuthPage.tsx

src/pages/domain/Members/TwoFactorAuth/DomainMemberResetTwoFactorAuthPage.tsx

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 435557791f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

src/libs/actions/Domain.ts

src/libs/DomainUtils.ts

…rs function

src/pages/domain/Members/TwoFactorAuth/DomainMemberForceTwoFactorAuthPage.tsx

# Conflicts: # src/languages/de.ts # src/languages/en.ts # src/languages/es.ts # src/languages/fr.ts # src/languages/it.ts # src/languages/ja.ts # src/languages/nl.ts # src/languages/pl.ts # src/languages/pt-BR.ts # src/languages/zh-hans.ts # src/libs/API/parameters/index.ts # src/libs/DomainUtils.ts # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts # src/libs/Navigation/types.ts # src/libs/actions/Domain.ts # src/pages/domain/Members/DomainMemberDetailsPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx # src/types/onyx/DomainErrors.ts

ZhenjaHorbach · 2026-02-20T12:03:32Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified there are no new alerts related to the canBeMissing param for useOnyx
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

2026-02-20.13.37.10.mov

src/types/onyx/DomainPendingActions.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5036e4ebb0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

src/pages/domain/BaseDomainRequireTwoFactorAuthPage.tsx

src/libs/actions/Domain.ts

ZhenjaHorbach · 2026-02-20T12:51:33Z

Changes look good
But as I understand correctly
We can use 2FA with SAML now ?

war-in · 2026-02-20T13:02:34Z

We can use 2FA with SAML now ?

@ZhenjaHorbach Those are only exempt emails, so when the toggle is on, the member is not in the exempt array and if the domain requires 2FA they'll have to set it up
But if the toggle is off, the member is in the exempt array and won't have to setup 2FA

We don't consider SAML in this flow (like we don't in OD)

Screen.Recording.2026-02-20.at.14.02.01.mov

ZhenjaHorbach · 2026-02-20T13:07:03Z

Small issue
But we have space between Reset two-factor authentication and Profile

2026-02-20.14.05.07.mov

2026-02-20.14.06.14.mov

ZhenjaHorbach · 2026-02-20T13:07:15Z

We can use 2FA with SAML now ?

@ZhenjaHorbach Those are only exempt emails, so when the toggle is on, the member is not in the exempt array and if the domain requires 2FA they'll have to set it up But if the toggle is off, the member is in the exempt array and won't have to setup 2FA

We don't consider SAML in this flow (like we don't in OD)

Screen.Recording.2026-02-20.at.14.02.01.mov

Oh
Good then!

ZhenjaHorbach · 2026-02-20T13:19:37Z

For some reason, after resetting 2FA, I was logged out

2026-02-20.13.37.10.mov

war-in · 2026-02-20T13:22:49Z

For some reason, after resetting 2FA, I was logged out

Are you sure it's related? Have you been able to reproduce it again?

ZhenjaHorbach · 2026-02-20T13:25:46Z

Probably it's related to SetTwoFactorAuthExemptEmailForDomain
But this time I wasn't logged out

war-in · 2026-02-20T14:06:36Z

Hmm, so you're resetting 2FA for yourself, right? Could you verify what happens in OD in this flow?

war-in · 2026-02-20T14:07:36Z

Hmm ok, it looks like in OD you can't do it for admins 🤔

ZhenjaHorbach · 2026-02-20T14:16:04Z

Actually yes
On OD, I was logged out also

war-in · 2026-02-20T14:36:51Z

@ZhenjaHorbach comments addressed

war-in added 26 commits January 7, 2026 15:32

feat: add 2FA toggle to member details

c7712cc

refactor: adjust toggle isActive logic

d4f17f5

feat: add reset 2FA wip

3bdce91

feat: add 2FA required page for reset 2FA feature

fbcbe92

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

fad09c8

…dd-2FA-toggle-to-member-details # Conflicts: # src/languages/en.ts # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

feat: add call to API command

b341319

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

6cda713

…dd-2FA-toggle-to-member-details # Conflicts: # src/libs/Navigation/linkingConfig/RELATIONS/DOMAIN_TO_RHP.ts

refactor: update the called command

721731d

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

80107d8

…dd-2FA-toggle-to-member-details

fix: post-merge

1d992aa

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

b3e6ddf

…dd-2FA-toggle-to-member-details # Conflicts: # src/pages/domain/Members/DomainMembersSettingsPage.tsx # src/pages/domain/Members/DomainRequireTwoFactorAuthPage.tsx

fix: post-merge fixes

a7ab578

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

ab5a966

…dd-2FA-toggle-to-member-details

feat: add optimistic data

b8afc4a

Merge branch 'war-in/domains/add-members-settings-page' into war-in/a…

19cbe59

…dd-2FA-toggle-to-member-details

fix: split pages

69203aa

fix: error handling

b1dbd7e

refactor: use presonalDetailsSelector

2ead859

refactor: adjust code to the most-recent changes

4f7d7e8

melvin-bot bot assigned war-in Feb 11, 2026

war-in mentioned this pull request Feb 11, 2026

[Release 3.2] [Domain control] Enable, disable or reset their 2FA software-mansion-labs/expensify-app-fork#281

Closed

53 tasks

Merge branch 'refs/heads/main' into war-in/add-2FA-toggle-to-member-d…

01e3b0d

…etails # Conflicts: # src/pages/domain/BaseDomainMembersPage.tsx # src/pages/domain/Members/DomainMembersPage.tsx

war-in added 2 commits February 19, 2026 18:06

chore: translations

deeb674

fix: eslint

4355577

ZhenjaHorbach reviewed Feb 19, 2026

View reviewed changes

src/types/onyx/DomainPendingActions.ts Outdated Show resolved Hide resolved

ZhenjaHorbach reviewed Feb 19, 2026

View reviewed changes

src/types/onyx/DomainErrors.ts Show resolved Hide resolved

ZhenjaHorbach reviewed Feb 19, 2026

View reviewed changes

src/pages/domain/BaseDomainRequireTwoFactorAuthPage.tsx Outdated Show resolved Hide resolved

ZhenjaHorbach reviewed Feb 19, 2026

View reviewed changes

src/pages/domain/Members/TwoFactorAuth/DomainMemberResetTwoFactorAuthPage.tsx Outdated Show resolved Hide resolved

chore: add descriptions and remove displayName

400a3c6

chatgpt-codex-connector bot reviewed Feb 19, 2026

View reviewed changes

src/libs/actions/Domain.ts Show resolved Hide resolved

src/libs/DomainUtils.ts Outdated Show resolved Hide resolved

fix: handle optional domainMemberErrors in hasDomainMemberDetailsErro…

1a90dfe

…rs function

ZhenjaHorbach reviewed Feb 20, 2026

View reviewed changes

src/pages/domain/Members/TwoFactorAuth/DomainMemberForceTwoFactorAuthPage.tsx Outdated Show resolved Hide resolved

war-in added 2 commits February 20, 2026 08:44

fix: remove unnecessary displayName

628f25e

ZhenjaHorbach reviewed Feb 20, 2026

View reviewed changes

src/types/onyx/DomainPendingActions.ts Outdated Show resolved Hide resolved

fix: remove duplicated DomainMemberPendingActions

411bf48

chatgpt-codex-connector bot reviewed Feb 20, 2026

View reviewed changes

src/pages/domain/BaseDomainRequireTwoFactorAuthPage.tsx Show resolved Hide resolved

src/libs/actions/Domain.ts Show resolved Hide resolved

war-in added 2 commits February 20, 2026 15:35

fix: remove gap between Reset two-factor auth and Profile

2dcab16

fix: comment

4df0d5a

Comments

Conversation

war-in commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot bot commented Feb 11, 2026

Uh oh!

war-in commented Feb 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ZhenjaHorbach commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ZhenjaHorbach commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

war-in commented Feb 20, 2026

Uh oh!

ZhenjaHorbach commented Feb 20, 2026

Uh oh!

ZhenjaHorbach commented Feb 20, 2026

Uh oh!

ZhenjaHorbach commented Feb 20, 2026

Uh oh!

war-in commented Feb 20, 2026

Uh oh!

ZhenjaHorbach commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

war-in commented Feb 20, 2026

Uh oh!

war-in commented Feb 20, 2026

Uh oh!

ZhenjaHorbach commented Feb 20, 2026

Uh oh!

war-in commented Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

war-in commented Feb 11, 2026 •

edited

Loading

ZhenjaHorbach commented Feb 20, 2026 •

edited

Loading

ZhenjaHorbach commented Feb 20, 2026 •

edited

Loading

ZhenjaHorbach commented Feb 20, 2026 •

edited

Loading