[$250] Copilot - User will force sign out after issue new card using full delegate access

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.26-4
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #81817
Email or phone of affected tester (no customers): N/A
Issue reported by: Applause Internal Team
Bug source: Pull Request QA execution
Device used: Windows 11 / Chrome, Android 13 / Xiaomi Poco F5, iOS 15.8.3 / iPhone 7 Plus
App Component: Workspace Settings

Action Performed:

Precondition:

• User A, login using Expensifial account, create a workspace, and enable the Expensify Card feature
• User A, add user B as a Copilot account with full delegate access (can use a Gmail account)

1. Login to user B
2. Navigate to Account and switch as user A
3. Go to Workspace > Expensify Card
4. Click the Issue card and follow the issue card flow
5. In the RHP magic code, enter the magic code that was sent to user A's email

Expected Result:

User does not auto sign out after issue new card using full delegate access

Actual Result:

User will force sign out after issue new card using full delegate access
Note:

• Sometimes the user will force sign out after navigating to another section
• The new card is successfully added after the user relogin to user B's account

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

1.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @rushatgabhane

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022026924444293717309
• Upwork Job ID: 2026924444293717309
• Last Price Increase: 2026-02-26

[melvin-bot]

You have been assigned to this deploy blocker because you recently merged this PR: #81817

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[melvin-bot]

Triggered auto assignment to @trjExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

🔍 Investigation Summary

Classification: Frontend bug
Causing PR: #81817 - "Allow full Copilot users to access Expensify Card pages" by @MelvinBot (High confidence)
Related Issues: #79095

Recommendation: REVERT

The frontend PR was merged without the corresponding backend changes being deployed first. The PR description explicitly states: "The backend change (allowing ROLE_ALL auth token type for CreateAdminIssuedVirtualCard command) is out of scope for this frontend PR and needs to be handled separately."

This means the frontend allows full Copilot users to proceed through the card issuance flow, but when they submit the magic code, the backend rejects the request (likely with a 407 NOT_AUTHENTICATED or similar error), which triggers a sign-out.

Labels: Keeping DeployBlockerCash (blocks App deploy). The DeployBlocker label was not present on this issue.

📋 Detailed Analysis

Evidence

PR #81817 changed the delegate access checks from isActingAsDelegate to isDelegateAccessRestricted for Expensify Card pages. This allows full Copilot users (ROLE_ALL delegates) to access the card issuance flow, but the backend API command CreateAdminIssuedVirtualCard has not been updated to accept ROLE_ALL auth token types.

The PR modified these files:

• IssueNewCardPage.tsx - Changed access check from isActingAsDelegate to isDelegateAccessRestricted
• WorkspaceExpensifyCardListPage.tsx - Same change
• WorkspaceExpensifyCardPageEmptyState.tsx - Same change
• WorkspaceExpensifyCardBankAccounts.tsx - Changed DENIED_ACCESS_VARIANTS.DELEGATE to DENIED_ACCESS_VARIANTS.SUBMITTER
• IssueNewCardConfirmMagicCodePage.tsx - Added session email fallback

Verification

The bug is reproducible on staging but not validated on production, which aligns with PR #81817 being in the current staging deploy (v9.3.26-4) at position #87 in the chronologically ordered list.

The issue affects the card issuance flow specifically when:

1. A full Copilot delegate accesses the Expensify Card section
2. They complete the issue card flow
3. They submit the magic code
4. The backend rejects the request due to auth token restrictions
5. The rejection response causes the frontend to sign out the user

Root Cause

Frontend-Backend Mismatch: The frontend was deployed to allow full Copilot users to access card issuance pages, but the backend API was not updated to accept ROLE_ALL delegate auth tokens for the CreateAdminIssuedVirtualCard command. When the magic code is submitted, the backend likely returns an authentication error (jsonCode 407 or similar), which triggers the reauthentication middleware or forces a sign-out.

The fix requires EITHER:

1. Revert PR Allow full Copilot users to access Expensify Card pages #81817 to restore the original delegate access restrictions (recommended for immediate unblock)
2. Deploy backend changes first, then re-merge the frontend PR