[Due for Payment 10th Nov] [$250] Copilot - After switching account and switching back, magic code page is missing email

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.2.22-1
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail: https://test-management.browserstack.com/projects/2219752/test-runs/TR-1124/41236699/929689829?q=copilot&issue_type=jira
Email or phone of affected tester (no customers): applausetester+021003kh@applause.expensifail.com
Issue reported by: Applause - Internal Team

Action Performed:

Precondition:

• User A adds User B as copilot (any access level)
• Perform the following steps as User B:

1. Go to staging.new.expensify.com
2. Go to Account
3. Open account switcher
4. Select User A account
5. Open account switcher
6. Select User B account to change it back to the original account
7. Go to Security > Add copilot
8. Select any user
9. Select any access level
10. Click Add copilot

Expected Result:

On magic code page, user email will be included in "Please enter the magic code sent to" message

Actual Result:

On magic code page, user email is missing in "Please enter the magic code sent to to add a copilot" message

Workaround:

Unknown

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Platforms Tested:

On which of our officially supported platforms was this issue tested:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6962916_1759415313592.Screen_Recording_2025-10-02_at_22.20.00.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021973898011871510863
• Upwork Job ID: 1973898011871510863
• Last Price Increase: 2025-10-09
• Automatic offers:
• daledah | Contributor | 109073636

Issue Owner

Current Issue Owner: @trjExpensify

[melvin-bot]

Triggered auto assignment to @trjExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[daledah]

Proposal

Please re-state the problem that we are trying to solve in this issue.

On magic code page, user email is missing in "Please enter the magic code sent to to add a copilot" message

What is the root cause of that problem?

after going back from copilot account the onyx key account does not have the primaryLogin field

App/src/pages/settings/Security/AddDelegate/UpdateDelegateRole/UpdateDelegateMagicCodePage.tsx

Line 52 in 49f9ce2

descriptionPrimary={translate('delegate.enterMagicCode', {contactMethod: account?.primaryLogin ?? ''})}

App/src/pages/settings/Security/AddDelegate/ConfirmDelegateMagicCodePage.tsx

Line 55 in 49f9ce2

descriptionPrimary={translate('delegate.enterMagicCode', {contactMethod: account?.primaryLogin ?? ''})}

What changes do you think we should make in order to solve the problem?

we should add session?.email as a fallback

    descriptionPrimary={translate('delegate.enterMagicCode', {contactMethod: account?.primaryLogin ?? session?.email ?? ''})}

Note: We should check other modal code validation and if it has similar issue then fix it in this issue

We can also check other places that use account?.primaryLogin

Note 2: if you log in with email or phone number, session.email will be no different than redentials.login

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

None

What alternative solutions did you explore? (Optional)

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[nkdengineer]

Proposal

Please re-state the problem that we are trying to solve in this issue.

On magic code page, user email is missing in "Please enter the magic code sent to to add a copilot" message

What is the root cause of that problem?

primaryLogin is not in the account Onyx data, so we don't see the login in

App/src/pages/settings/Security/AddDelegate/ConfirmDelegateMagicCodePage.tsx

Line 55 in 49f9ce2

descriptionPrimary={translate('delegate.enterMagicCode', {contactMethod: account?.primaryLogin ?? ''})}

What changes do you think we should make in order to solve the problem?

When sending the code, we use resendValidateCode and pass credentials.login

App/src/libs/actions/Session/index.ts

Line 392 in 49f9ce2

function resendValidateCode(login = credentials.login) {

App/src/pages/signin/ValidateCodeForm/BaseValidateCodeForm.tsx

Line 157 in 49f9ce2

userActionsResendValidateCode(credentials?.login ?? '');

I think to display the login, we should use credentials.login, we can use it as the fallback of account.primaryLogin, the login can be the email or phone the user logged in with, so if we just use session.email it can be wrong

We should fix all places that use account.primaryLogin

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

None

What alternative solutions did you explore? (Optional)

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[ShridharGoel]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When a copilot adds or updates another copilot, the magic code confirmation modal omits the contact email in the string "Please enter the magic code sent to …". This happens after switching back to the original account.

What is the root cause of that problem?

Both magic code modals read the contact method exclusively from account.primaryLogin, which is undefined after switching as a copilot. Because the translation receives an empty string, the rendered text drops the email entirely. The affected places are:

• Confirm add copilot modal:

App/src/pages/settings/Security/AddDelegate/ConfirmDelegateMagicCodePage.tsx

Lines 24 to 57 in 49f9ce2

	const [account] = useOnyx(ONYXKEYS.ACCOUNT, {canBeMissing: true});
	const [validateCodeAction] = useOnyx(ONYXKEYS.VALIDATE_ACTION_CODE, {canBeMissing: true});
	const currentDelegate = account?.delegatedAccess?.delegates?.find((d) => d.email === login);
	const addDelegateErrors = account?.delegatedAccess?.errorFields?.addDelegate?.[login];
	const validateLoginError = getLatestError(addDelegateErrors);
	useEffect(() => {
	if (!currentDelegate || !!currentDelegate.pendingFields?.email || !!addDelegateErrors) {
	return;
	}
	// Dismiss modal on successful magic code verification
	Navigation.goBack(ROUTES.SETTINGS_SECURITY);
	}, [login, currentDelegate, role, addDelegateErrors]);
	const clearError = () => {
	if (isEmptyObject(validateLoginError) && isEmptyObject(validateCodeAction?.errorFields)) {
	return;
	}
	clearDelegateErrorsByField({email: currentDelegate?.email ?? '', fieldName: 'addDelegate', delegatedAccess: account?.delegatedAccess});
	};
	return (
	<ValidateCodeActionContent
	clearError={clearError}
	validateCodeActionErrorField="addDelegate"
	onClose={() => Navigation.goBack(ROUTES.SETTINGS_DELEGATE_CONFIRM.getRoute(login, role))}
	validateError={validateLoginError}
	title={translate('delegate.makeSureItIsYou')}
	sendValidateCode={() => requestValidateCodeAction()}
	handleSubmitForm={(validateCode) => addDelegate({email: login, role, validateCode, delegatedAccess: account?.delegatedAccess})}
	descriptionPrimary={translate('delegate.enterMagicCode', {contactMethod: account?.primaryLogin ?? ''})}
	/>
	);

• Update copilot role modal:

App/src/pages/settings/Security/AddDelegate/UpdateDelegateRole/UpdateDelegateMagicCodePage.tsx

Lines 23 to 54 in 49f9ce2

	const [account] = useOnyx(ONYXKEYS.ACCOUNT, {canBeMissing: true});
	const [validateCodeAction] = useOnyx(ONYXKEYS.VALIDATE_ACTION_CODE, {canBeMissing: true});
	const currentDelegate = account?.delegatedAccess?.delegates?.find((d) => d.email === login);
	const updateDelegateErrors = account?.delegatedAccess?.errorFields?.updateDelegateRole?.[login];
	useEffect(() => {
	if (currentDelegate?.role !== newRole || !!currentDelegate.pendingFields?.role || !!updateDelegateErrors) {
	return;
	}
	// Dismiss modal on successful magic code verification
	Navigation.goBack(ROUTES.SETTINGS_SECURITY);
	}, [login, currentDelegate, updateDelegateErrors, newRole]);
	const clearError = () => {
	if (isEmptyObject(updateDelegateErrors) && isEmptyObject(validateCodeAction?.errorFields)) {
	return;
	}
	clearDelegateErrorsByField({email: currentDelegate?.email ?? '', fieldName: 'updateDelegateRole', delegatedAccess: account?.delegatedAccess});
	};
	return (
	<ValidateCodeActionContent
	clearError={clearError}
	validateCodeActionErrorField="updateDelegateRole"
	onClose={() => Navigation.goBack(ROUTES.SETTINGS_UPDATE_DELEGATE_ROLE.getRoute(login, currentDelegate?.role ?? ''))}
	validateError={updateDelegateErrors}
	title={translate('delegate.makeSureItIsYou')}
	sendValidateCode={() => requestValidateCodeAction()}
	handleSubmitForm={(validateCode) => updateDelegateRole({email: login, role: newRole, validateCode, delegatedAccess: account?.delegatedAccess})}
	descriptionPrimary={translate('delegate.enterMagicCode', {contactMethod: account?.primaryLogin ?? ''})}
	/>
	);

What changes do you think we should make in order to solve the problem?

Update both magic code modals to derive a contact method from any available account context - falling back through the primary login, the delegator email, the current session email, and finally the selected delegate. So the translation always receives a value.

const [session] = useOnyx(ONYXKEYS.SESSION, {canBeMissing: true});
const currentDelegate = account?.delegatedAccess?.delegates?.find((d) => d.email === login);
const contactMethod = account?.primaryLogin
    ?? account?.delegatedAccess?.delegate
    ?? session?.email
    ?? currentDelegate?.email
    ?? '';

return (
    <ValidateCodeActionContent
        /* … */
        descriptionPrimary={translate('delegate.enterMagicCode', {contactMethod})}
    />
);

This would be used to get the contactMethod in both the modals.

account?.delegatedAccess?.delegate is used because once you connect as a copilot, Onyx updates account.delegatedAccess.delegate with the original account owner’s email. That value is the one the UI should surface - it matches the “Please enter the magic code sent to…” context and it is what the backend uses for delegate-specific flows.

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

• A unit test where account.primaryLogin is available.
• A unit test that renders each magic code modal with account.primaryLogin undefined but account.delegatedAccess.delegate populated, ensuring the computed contactMethod matches the delegator email.
• A test where both primaryLogin and delegatedAccess.delegate are missing while session.email is set, verifying the fallback still displays an email.
• A test where primaryLogin, delegatedAccess.delegate and session.email are undefined, but currentDelegate?.email is available. Then currentDelegate?.email would be used.

[trjExpensify]

Haha, what a weird bug. I like the notion of fixing it wherever else throughout the app this might be occurring 👍

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~021973898011871510863

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @ishpaul777 (External)