Fix duplicate supportal sign-in that trips the support-token rate limit - #95042
Conversation
|
@Krishna2323 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
|
@mananjadhav Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
|
@allgandalf I can review this if required. |
Codecov Report❌ Looks like you've decreased code coverage for some files. Please write tests to increase, or at least maintain, the existing level of code coverage. See our documentation here for how to interpret this table.
|
I'm not sure this PR can be tested without access to supportal, asking on slack |
|
🚧 mountiny has triggered a test Expensify/App build. You can view the workflow run here. |
This comment has been minimized.
This comment has been minimized.
|
I supportalled 4 times and it worked all well! No redirect! |
|
@codex review |
mountiny
left a comment
There was a problem hiding this comment.
Reviewer Checklist
- I have verified the author checklist is complete (all boxes are checked off).
- I verified the correct issue is linked in the
### Fixed Issuessection above - I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the
Testssection - I verified the steps for Staging and/or Production testing are in the
QA stepssection - I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
- I verified the steps for local testing are in the
- I checked that screenshots or videos are included for tests on all platforms
- I included screenshots or videos for tests on all platforms
- I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
- I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
- I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e.
toggleReportand notonIconClick). - I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e.
- If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
- I verified that this PR follows the guidelines as stated in the Review Guidelines
- I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like
Avatar, I verified the components usingAvatarhave been tested & I retested again) - If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a
/** comment above it */ - The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to
thisproperly so there are no scoping issues (i.e. foronClick={this.submit}the methodthis.submitshould be bound tothisin the constructor) - Any internal methods bound to
thisare necessary to be bound (i.e. avoidthis.submit = this.submit.bind(this);ifthis.submitis never passed to a component event handler likeonClick) - All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
- If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
- If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e.
StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
- If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
- If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like
Avataris modified, I verified thatAvataris working as expected in all cases) - If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
- If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
- If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added
Designlabel and/or tagged@Expensify/designso the design team can review the changes.
- For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
- If the
mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps. - I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.
Screenshots/Videos
Android: HybridApp
Android: mWeb Chrome
iOS: HybridApp
iOS: mWeb Safari
MacOS: Chrome / Safari
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
There was a problem hiding this comment.
Pull request overview
This PR prevents duplicate supportal sign-ins during /transition flows by ensuring the short-lived support auth token is recorded and by skipping a second SignInWithSupportAuthToken call when the transition screen re-mounts after the navigator swap.
Changes:
- Record handled support tokens in
signInWithSupportAuthToken()viaNetworkStore.setLastShortAuthToken(). - Add a duplicate-token guard in
LogOutPreviousUserPageto avoid re-firing the support sign-in afterPublicScreens → AuthScreensre-mount. - Add a UI test covering the “already-handled support token” scenario to ensure no duplicate support sign-in is triggered.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tests/ui/SessionTest.tsx | Adds a dedicated UI test to assert support-token transitions don’t trigger a duplicate support sign-in when re-processed. |
| src/pages/LogOutPreviousUserPage.tsx | Adds a getLastShortAuthToken() guard before calling signInWithSupportAuthToken() to prevent duplicate requests during remount. |
| src/libs/actions/Session/index.ts | Records the handled support auth token in NetworkStore to enable cross-screen deduping. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if (isSupportalLogin) { | ||
| signInWithSupportAuthToken(shortLivedAuthToken); | ||
| // The public transition page may already have started this exact sign-in before the Public/Auth | ||
| // navigator swap re-mounted us here. Firing it again trips the support-token rate limit, so skip | ||
| // the duplicate but still finish navigating home. | ||
| if (shortLivedAuthToken !== getLastShortAuthToken()) { | ||
| signInWithSupportAuthToken(shortLivedAuthToken); | ||
| } |
There was a problem hiding this comment.
the legacy shortLivedToken is only read on the non-support magic-link path (signInWithShortLivedAuthToken(token)). the supportal branch always uses shortLivedAuthToken, both here and in LogInWithShortLivedAuthTokenPage's support branch, and OldDot's supportLoginNewDot.php only ever sends shortLivedAuthToken for a support transition. so shortLivedToken is always empty on this branch and normalizing wouldn't change anything, keeping shortLivedAuthToken matches how the support token is passed everywhere.
|
✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release. |
|
🚧 danieldoglas has triggered a test Expensify/App build. You can view the workflow run here. |
|
🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
|
Fix duplicate supportal sign-in that trips the support-token rate limit (cherry picked from commit df5850f) (cherry-picked to staging by mountiny)
|
🚀 Cherry-picked to staging by https://github.com/mountiny in version: 9.4.25-2 🚀
|
|
🤖 Help site review: no changes required. This PR is an internal bug fix for the supportal → New Expensify sign-in flow. It makes the short-lived-auth-token dedupe guard symmetric across both transition owners ( Why no help site update is needed:
No draft PR was created since there are no help site changes to make. @allgandalf, please review the linked help site PR and confirm it reflects the current behavior. Then mark the linked help site PR |
|
🚀 Deployed to production by https://github.com/cristipaval in version: 9.4.25-2 🚀
Bundle Size Analysis (Sentry): |
|
🚀 Cherry-picked to staging by https://github.com/mountiny in version: 9.4.26-0 🚀
|
|
🤖 Help site review: no changes required. I reviewed the changes in this PR against the help site files under Why: This PR is an internal bug fix for the supportal → New Expensify sign-in transition. It makes the duplicate-sign-in dedupe guard symmetric across the two transition owners ( This flow is:
Because there is no customer-facing behavior or terminology change, there is nothing to add or correct in the help site, and no draft docs PR was created. @allgandalf, if you believe any customer-facing help article is affected by this change, let me know which article and I'll open a draft docs PR. |
|
🚀 Deployed to production by https://github.com/grgia in version: 9.4.27-2 🚀
Bundle Size Analysis (Sentry): |
Explanation of Change
A supportal
/transitionlink is handled by two different screens depending on auth state:LogInWithShortLivedAuthTokenPageonPublicScreensandLogOutPreviousUserPageonAuthScreens. When the support sign-in setssession.authToken,AppNavigatorswapsPublicScreens→AuthScreens, which re-mounts the transition screen and firessignInWithSupportAuthTokena second time. Each mint hits the same throttled AuthGetSupportAuthTokencommand, and the intended supportal-to-NewDot flow already spends all 3 slots of the 3-in-30ssupportLoginthrottle, so the duplicate call comes back405 throttled. The backend returns that throttle as an empty200, so NewDot ends up with no session and shows the blank "session expired" screen.The dedupe guard (
token === getLastShortAuthToken()) only lived inLogInWithShortLivedAuthTokenPage, andsignInWithSupportAuthTokennever recorded the token, so neither firing site was actually deduped. This PR makes the guard symmetric across both transition owners:signInWithSupportAuthTokennow records the handled token viaNetworkStore.setLastShortAuthToken, matchingsignInWithShortLivedAuthToken.LogOutPreviousUserPagenow checks that guard before firing the supportal sign-in, so the re-mount after the navigator swap does not fire a duplicate.This supersedes #91200 (which added only the
setLastShortAuthTokenhalf). Thanks @dsilva for the handoff.Fixed Issues
$ https://github.com/Expensify/Expensify/issues/647201
$ https://github.com/Expensify/Expensify/issues/383021
PROPOSAL: N/A (internal RCA from production logs)
Tests
SignInWithSupportAuthTokenrequest is sent for the transition (no duplicate that returns405 throttled).Offline tests
N/A. The supportal transition requires an active connection to establish the session.
QA Steps
Same as tests.
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectiontoggleReportand notonIconClick)Avatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari