[Hold #49844] [$250] HybridApp - Can't validate the account of a new sign-up on a controlled private domain

[IuliiaHerets]

If you haven’t already, check out our contributing guidelines for onboarding and email [email protected] to request to join our Slack channel!

---

Version Number: v9.0.89-5
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught on HybridApp, is this reproducible on New Expensify Standalone?: No, reproducible on hybrid only
If this was caught during regression testing, add the test name, ID and link from TestRail: C2593731
Email or phone of affected tester (no customers): [email protected]
Issue reported by: Applause Internal Team
Device used: Samsung A15 Android 14 & iPhone SE 3rd generation (2022) iOS 18.2.1 | Hybrid app.
App Component: Other

Action Performed:

Prerequisite:

• Sign-up with an account on a domain controlled domain (e.g expensifail.com

1. Download the latest HybridApp
2. Sign-up for an expensifail account
3. Click the validation link in the email to be deep linked back to the app

Expected results:

The user is signed-in and the account is validated

Actual results:

Deep linked back to the mobile app home page, but the user is not signed-in and the account is not validated.

Workaround:

Unknown

Platforms:

• Android: Standalone
• Android: HybridApp
• Android: mWeb Chrome
• iOS: Standalone
• iOS: HybridApp
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug6723303_1737760238492.Samsung_A15__Android_14__v9.0.89-5.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021890456886781005940
• Upwork Job ID: 1890456886781005940
• Last Price Increase: 2025-02-28

Issue Owner

Current Issue Owner: @ahmedGaber93

[melvin-bot]

Triggered auto assignment to @alexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[alexpensify]

I see #51090 has been closed since October. I'm still digging if this is a dupe.

[melvin-bot]

@alexpensify Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[alexpensify]

No update

[alexpensify]

Still on the radar

[melvin-bot]

@alexpensify this issue was created 2 weeks ago. Are we close to a solution? Let's make sure we're treating this as a top priority. Don't hesitate to create a thread in #expensify-open-source to align faster in real time. Thanks!

[melvin-bot]

@alexpensify Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[alexpensify]

I didn't get to test over the weekend and I worked limited hours today

[melvin-bot]

@alexpensify Whoops! This issue is 2 days overdue. Let's get this updated quick!

[alexpensify]

[melvin-bot]

@alexpensify @ahmedGaber93 this issue is now 4 weeks old, please consider:

• Finding a contributor to fix the bug
• Closing the issue if BZ has been unable to add the issue to a VIP or Wave project
• If you have any questions, don't hesitate to start a discussion in #expensify-open-source

Thanks!

[trjExpensify]

Have you tried this flow with the newest main? Deeplinks are there again and regular validation link works fine

appversion: '9.1.2.1' - I was testing on that version on Friday?

[war-in]

Oh, it looks like no validation links work in the app 🥶 I'm going to debug it further

[MariaHCD]

Why are we hitting these log lines about closing wallets and merging accounts (code ref)? It's a brand new account being created

Did this account have a secondary account? 👀 This is why we call the wallet merge flow in Authenticate: https://github.com/Expensify/Auth/blob/1ee7f511efdc0c72610da05ea4e5c02951a59dc7/auth/command/Authenticate.cpp#L112-L120

Assuming not, considering it was a brand new account...so I think there might be some logic improvements needed to the code block above

[war-in]

I also found an interesting case, when creating a new account and clicking Resend validation in the inbox the email has been sent. I clicked on the link in the email trying to validate my new account and the app opened but the account hasn't been verified.
It's due to a lack of a SUBMIT_MAGIC_CODE event in app once we're signed in. The deeplink publishes this event but no one is listening so there is no action.

I think it's not related to your issue but still worth fixing

[trjExpensify]

Assuming not, considering it was a brand new account...so I think there might be some logic improvements needed to the code block above

Exactly, brand new account, so nope.. no secondary account attached.

[trjExpensify]

I also found an interesting case, when creating a new account and clicking Resend validation in the inbox the email has been sent. I clicked on the link in the email trying to validate my new account and the app opened but the account hasn't been verified.

Interesting. So in the case of a non-domain controlled sign-up, the user is signed-in, but the account isn't validated. In the domain controlled sign-up case, the user isn't signed-in and the account isn't validated?

[war-in]

So in the case of a non-domain controlled sign-up, the user is signed-in, but the account isn't validated

Yes, but in that case sign-in is performed automatically when clicking Join button

I guess that the flow for domain controlled sign-up is a bit different because AuthenticationController is created (so the event should be handled)

[trjExpensify]

Got it, what are the next steps here? Would it help you test if you use tom+<something>@expensifail.com, and I give you the URL from the email?

[war-in]

@trjExpensify that would definitely help! Let's move to slack with sending the URLs, I'll post an update here if I find something

[trjExpensify]

Sounds good!

[melvin-bot]

@ahmedGaber93 Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[ahmedGaber93]

Not overdue, still discussing.

[war-in]

Hi 👋 together with @trjExpensify we had a debug session when we discovered that the sign-up flow on controlled private domain differs between web and mobile. We think that the web flow was updated (to use magic code), but the Mobile-Expensify part has been omitted for some reason.
The easiest way to fix the issue would be to wait for the sign-in page replacement, which is already in progress. We're changing HybridApp to use the NewDot sign-in page, and the flow works correctly there, so no adjustments are required.

However, it'll take some time because we're waiting for the backend changes and must thoroughly test the PRs.

[trjExpensify]

Yeah, @AndrewGable @Julesssss, it seems like all our woes on mobile stem from not using the same flow with the magic code, which makes me think that's going to be quite the lift to unravel and moving to the NewDot sign-in page means we don't have to do work we'll throw away shortly after. Curious for your takes as well, but that's where my head's at as it stands.

[sosek108]

@war-in @trjExpensify isn't that bug connected to bug posted here?

[melvin-bot]

📣 It's been a week! Do we have any satisfactory proposals yet? Do we need to adjust the bounty for this issue? 💸

[Julesssss]

Thanks for the tag. I agree with this given that we already have the task listed as high priority.

However, it'll take some time because we're waiting for the backend changes and must thoroughly test the PRs.

I know I have said this many times, but I should be able to focus on the backend tasks next week -- the issues I switched too are almost done 🤞

[trjExpensify]

Cool, cool. Glad we're aligned. What's the best issue for me to put this on hold for? We can retest once done.

[trjExpensify]

@war-in @trjExpensify isn't #57367 connected to bug posted here?

If they signed up with an expensifail.com account, probably yes, as it's domain controlled. CC: @joekaufmanexpensify I think you might have a dupe there bud!

[joekaufmanexpensify]

Ah, yeah mine was with an expensifail account. Thanks for flagging, will close in favor of this one!

[Julesssss]

Cool, cool. Glad we're aligned. What's the best issue for me to put this on hold for? We can retest once done.

I think this one. It has the latest overview of remaining tasks.