[$250] Always show Update credentials for Sage Intacct connections

[MelvinBot]

Currently, the "Enter credentials" / "Update credentials" option in the accounting connection overflow menu is only shown when there's been a sync error due to incorrect credentials. This is controlled by the condition at PolicyAccountingPage.tsx:113:

const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);

This requires lastSync.isAuthenticationError === true (connections/index.ts:263), meaning users can only update credentials reactively after they break — not proactively.

While this makes sense for OAuth-based connections (e.g., QuickBooks, Xero) and NetSuite tokens, Sage Intacct uses a Web Services user with a company ID, user ID, and password. Users should be able to proactively update these credentials (e.g., during a planned password rotation) without waiting for a sync failure.

Proposed Change

For Sage Intacct connections, always show the "Update credentials" option in the overflow menu regardless of whether there's been an authentication error. The "Sync Now" option should still be available alongside it.

Slack thread: https://expensify.slack.com/archives/C03U7DCU4/p1778544534188309

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022054001089532006119
• Upwork Job ID: 2054001089532006119
• Last Price Increase: 2026-05-12

[MelvinBot]

Proposal

What is the root cause of that problem?

The "Enter credentials" option in the accounting overflow menu is gated by shouldShowEnterCredentials, which requires both a sync error and isAuthenticationError returning true:

const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);

isAuthenticationError only returns true when lastSync.isAuthenticationError === true, so the option never appears until a sync has already failed. Additionally, the overflow menu at lines 144-162 treats "Enter credentials" and "Sync now" as mutually exclusive — showing one replaces the other.

What changes do you think we should make in order to solve the problem?

Two files need changes:

1. PolicyAccountingPage.tsx — Expand the condition so it's also true when the connected integration is Sage Intacct, regardless of error state:

const shouldShowEnterCredentials = connectedIntegration && (
    (!!synchronizationError && isAuthenticationError(policy, connectedIntegration)) ||
    connectedIntegration === CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT
);

Then restructure the overflow menu (lines 144-162) so that for Sage Intacct, both "Update credentials" and "Sync now" appear. Currently they're in an either/or ternary — instead, conditionally include each item independently.

2. ConnectToSageIntacctFlow/index.tsx — When a Sage Intacct connection already exists and the user clicks "Update credentials" from the menu, this component currently checks isAuthenticationError at line 17 and navigates to prerequisites/existing-connections if there's no auth error. The condition should also navigate to the enter-credentials page when a Sage Intacct connection already exists (i.e., the user is updating, not setting up fresh). This can be determined by checking if policy?.connections?.intacct exists.

What alternative solutions did you explore?

An alternative would be to pass a prop or route parameter through startIntegrationFlow to signal "update credentials mode" vs "new connection mode." This would avoid changing ConnectToSageIntacctFlow's existing logic, but adds complexity to the integration flow API for what is a Sage Intacct-specific behavior. Checking for an existing connection is simpler and self-contained.

---

Next Steps for Contributor+ team: Reply with @MelvinBot implement this to create a draft PR, @MelvinBot <your feedback> to refine this analysis, or explain why you are rejecting Melvin's proposal.

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @abzokhattab (External)

[KJ21-ENG]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Sage Intacct admins cannot proactively update the Web Services credentials for an existing accounting connection from the workspace Accounting overflow menu. The credential action only appears after the latest sync is already marked as an authentication failure, so planned Sage Intacct password rotation has no in-app update path.

What is the root cause of that problem?

PolicyAccountingPage uses one shared auth-error gate for every accounting connection:

App/src/pages/workspace/accounting/PolicyAccountingPage.tsx

Lines 111 to 113 in b4103e0

	const synchronizationError = connectedIntegration && getSynchronizationErrorMessage(policy, connectedIntegration, isSyncInProgress, translate, styles);
	const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);

That gate depends on isAuthenticationError(), which only returns true when the connection's latest sync has lastSync.isAuthenticationError === true:

App/src/libs/actions/connections/index.ts

Lines 262 to 265 in b4103e0

	function isAuthenticationError(policy: OnyxEntry<Policy>, connectionName: PolicyConnectionName) {
	const connection = policy?.connections?.[connectionName];
	return connection?.lastSync?.isAuthenticationError === true;
	}

The overflow menu then uses shouldShowEnterCredentials as a ternary, so the credential item and Sync Now item are mutually exclusive:

App/src/pages/workspace/accounting/PolicyAccountingPage.tsx

Lines 144 to 162 in b4103e0

	...(shouldShowEnterCredentials
	? [
	{
	icon: icons.Key,
	text: translate('workspace.accounting.enterCredentials'),
	onSelected: () => startIntegrationFlow({name: connectedIntegration}),
	shouldCallAfterModalHide: true,
	disabled: isOffline,
	iconRight: icons.NewWindow,
	},
	]
	: [
	{
	icon: icons.Sync,
	text: translate('workspace.accounting.syncNow'),
	onSelected: () => syncConnection(policy, connectedIntegration),
	disabled: isOffline,
	},
	]),

For Sage Intacct this is too narrow because the connection is keyed by editable Web Services credentials, not only an OAuth/token reconnect state. There is already a Sage Intacct credential form route:

App/src/ROUTES.ts

Lines 3822 to 3825 in b4103e0

	POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS: {
	route: 'workspaces/:policyID/accounting/sage-intacct/enter-credentials',
	getRoute: (policyID: string) => `workspaces/${policyID}/accounting/sage-intacct/enter-credentials` as const,
	},

But the generic Sage setup flow only navigates to that route when isAuthenticationError() is true; otherwise it sends the user to prerequisites or reusable connections:

App/src/components/ConnectToSageIntacctFlow/index.tsx

Lines 17 to 28 in b4103e0

	const shouldGoToEnterCredentials = isAuthenticationError(policy, CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT);
	useEffect(() => {
	if (shouldGoToEnterCredentials) {
	Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS.getRoute(policyID));
	return;
	}
	if (!hasReusablePoliciesConnectedToSageIntacct) {
	Navigation.navigate(`${ROUTES.POLICY_ACCOUNTING.getRoute(policyID)}/${DYNAMIC_ROUTES.SAGE_INTACCT_PREREQUISITES.path}`);
	return;
	}
	Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_EXISTING_CONNECTIONS.getRoute(policyID));

So simply showing the current menu item for Sage Intacct would still route proactive updates through the setup/reuse flow instead of the credential form, and would still hide Sync Now.

What changes do you think we should make in order to solve the problem?

In PolicyAccountingPage, add a Sage-specific credential-menu condition, for example shouldAlwaysShowSageIntacctCredentials = connectedIntegration === CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT, and include it in shouldShowEnterCredentials alongside the existing auth-error condition.

Split the overflow menu construction so the credentials item and sync item are independent entries instead of a ternary. Keep the existing auth-error behavior for non-Sage connections, but for Sage Intacct include both the credential item and Sync Now whenever Sage Intacct is the connected integration.

For the Sage Intacct credential item selected from this existing-connection menu, navigate directly to ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS.getRoute(policyID) instead of calling the generic setup flow. Leave other integrations on startIntegrationFlow() so OAuth/token reconnection behavior is unchanged.

Scope boundaries:

• Files touched: src/pages/workspace/accounting/PolicyAccountingPage.tsx — shouldShowEnterCredentials gate (line 113), overflow credential/sync menu items (lines 144-162).
• Platforms: all platforms via the shared workspace Accounting page.
• Code paths / callers explicitly not touched: Sage Intacct initial setup/prerequisites, reusable Sage Intacct connection selection, NetSuite token flow, QBO/Xero/QBD/Gusto connection flows, backend sync/connect commands.
• API contracts or backend behavior changes: no.

What alternative solutions did you explore? (Optional)

Only changing shouldShowEnterCredentials to ignore synchronizationError for Sage Intacct is incomplete: the menu is currently a ternary, so it would remove Sync Now, and the selected action would still call ConnectToSageIntacctFlow, which routes to the credential form only for auth errors. Updating ConnectToSageIntacctFlow globally is also broader than needed because the existing setup/reuse flow should remain intact; the proactive credential update is a specific action from an already-connected Sage Intacct overflow menu.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022054001089532006119

[aswin-s]

Please re-state the problem that we are trying to solve in this issue.

Sage Intacct uses a Web Services user with a company ID, user ID, and password — not an OAuth token. Because credentials are static secrets that can be rotated on a schedule, users need to be able to update them proactively. Currently the "Update credentials" option in the accounting connection overflow menu is gated behind a live authentication error. There is no way for a user to proactively push new credentials without first letting the sync fail.

What is the root cause of the problem?

In src/pages/workspace/accounting/PolicyAccountingPage.tsx, the overflowMenu useMemo (lines 132–174) uses a single boolean flag to decide between showing "Enter credentials" and "Sync now":

// line 113
const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);

// lines 140–158
...(shouldShowEnterCredentials
    ? [
          {
              icon: icons.Key,
              text: translate('workspace.accounting.enterCredentials'),
              onSelected: () => startIntegrationFlow({name: connectedIntegration}),
              shouldCallAfterModalHide: true,
              disabled: isOffline,
              iconRight: icons.NewWindow,
          },
      ]
    : [
          {
              icon: icons.Sync,
              text: translate('workspace.accounting.syncNow'),
              onSelected: () => syncConnection(policy, connectedIntegration),
              disabled: isOffline,
          },
      ]),

shouldShowEnterCredentials is false during normal operation, so the user always lands on the "Sync now" branch. The menu never offers credential update while the connection is healthy. The problem is specific to Sage Intacct: OAuth-based integrations (QuickBooks, Xero) and NetSuite token-based auth do not have rotatable plaintext passwords, so showing their credential flow only on error is the correct behaviour. We should not change that logic; we need to add a Sage Intacct-specific item in addition to the existing "Sync now" item.

What changes do you think we should make in order to implement this feature?

1. src/pages/workspace/accounting/PolicyAccountingPage.tsx

Add a derived boolean just after the existing shouldShowEnterCredentials line:

const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);
// NEW: always show "Update credentials" for Sage Intacct when no auth error is active
const shouldShowUpdateCredentials =
    !!connectedIntegration &&
    connectedIntegration === CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT &&
    !shouldShowEnterCredentials;

The !!connectedIntegration guard ensures the value is defined before the identity check. !shouldShowEnterCredentials prevents duplication: when an auth error is already surfacing "Enter credentials" we do not add a second credentials item.

In the overflowMenu useMemo, insert the new conditional spread immediately after the existing shouldShowEnterCredentials spread (after line 157, before the "Disconnect" item):

...(shouldShowUpdateCredentials
    ? [
          {
              icon: icons.Key,
              text: translate('workspace.accounting.updateCredentials'),
              onSelected: () => startIntegrationFlow({name: connectedIntegration}),
              shouldCallAfterModalHide: true,
              disabled: isOffline,
              iconRight: icons.NewWindow,
          },
      ]
    : []),

Also add shouldShowUpdateCredentials to the useMemo dependency array.

2. src/languages/en.ts

In the workspace.accounting object, add the new key directly after the existing enterCredentials key (around line 6205):

enterCredentials: 'Enter your credentials',
updateCredentials: 'Update credentials',   // NEW

3. src/languages/es.ts (and all other locale files: de.ts, fr.ts, it.ts, ja.ts, nl.ts, pl.ts, pt-BR.ts, zh-hans.ts)

Mirror the key in every locale file. For es.ts:

enterCredentials: 'Introduce tus credenciales',
updateCredentials: 'Actualizar credenciales',   // NEW

For all other locales the English string 'Update credentials' is an acceptable placeholder until translators provide locale-specific copy; the pattern is consistent with how other recent keys have been introduced.

Offline handling: The new menu item passes disabled: isOffline — the same pattern used by the existing "Enter credentials" and "Sync now" items — so it is automatically disabled with no additional work when the device is offline.

What alternative solutions did you explore?

Broadening shouldShowEnterCredentials to be always-true for Sage Intacct. This was rejected because that flag controls an either/or branch: when it is true the menu shows "Enter credentials" in place of "Sync now". Making it always true for Sage Intacct would remove the ability to manually trigger a sync while credentials are healthy, which is a regression. The correct design is an additive item, not a replacement.

Adding the update-credentials item unconditionally for all integrations. OAuth and token-based integrations should not expose a credentials flow during normal operation — doing so would confuse users and is inconsistent with how those connections work. The connectedIntegration === CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT guard keeps the change narrowly scoped to the only integration where proactive credential rotation is a supported user workflow.

[trasnake87]

Proposal

Admins on Sage Intacct connections cannot rotate Web Services credentials proactively — the "Enter credentials" menu item is hidden until a sync has already failed with an authentication error. Three layered defects prevent a proactive flow from working even if the visibility check is loosened.

Root cause

1 - Visibility is double-gated on a failed sync. src/pages/workspace/accounting/PolicyAccountingPage.tsx:112 requires both an active synchronizationError and isAuthenticationError to be true:

// src/pages/workspace/accounting/PolicyAccountingPage.tsx:112
const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);

isAuthenticationError in src/libs/actions/connections/index.ts:262-265 returns true only when the backend has stamped lastSync.isAuthenticationError === true:

// src/libs/actions/connections/index.ts:262-265
function isAuthenticationError(policy: OnyxEntry<Policy>, connectionName: PolicyConnectionName) {
    const connection = policy?.connections?.[connectionName];
    return connection?.lastSync?.isAuthenticationError === true;
}

So unless the connection is already broken, the option never renders — there is no proactive entry point for the only integration whose credentials (company ID / user ID / password) are user-rotatable.

2 - The overflow menu treats "credentials" and "Sync now" as mutually exclusive. At PolicyAccountingPage.tsx:143-161 the two items live inside a single ternary, so showing one removes the other:

// src/pages/workspace/accounting/PolicyAccountingPage.tsx:143-161
...(shouldShowEnterCredentials
    ? [
          {
              icon: icons.Key,
              text: translate('workspace.accounting.enterCredentials'),
              onSelected: () => startIntegrationFlow({name: connectedIntegration}),
              shouldCallAfterModalHide: true,
              disabled: isOffline,
              iconRight: icons.NewWindow,
          },
      ]
    : [
          {
              icon: icons.Sync,
              text: translate('workspace.accounting.syncNow'),
              onSelected: () => syncConnection(policy, connectedIntegration),
              disabled: isOffline,
          },
      ]),

The issue body explicitly requires both items to appear alongside each other for Sage Intacct, so the ternary must be split into two independent spread blocks.

3 - The flow handler routes to the wrong page when there is no auth error. The onSelected for credentials calls startIntegrationFlow({name: connectedIntegration}), which mounts ConnectToSageIntacctFlow. That component, at src/components/ConnectToSageIntacctFlow/index.tsx:14-30, only navigates to the credentials route when isAuthenticationError is true — the proactive case falls into the else branches and is sent to the prerequisites page or the existing-connections picker instead:

// src/components/ConnectToSageIntacctFlow/index.tsx:14-30
function ConnectToSageIntacctFlow({policyID}: ConnectToSageIntacctFlowProps) {
    const hasReusablePoliciesConnectedToSageIntacct = useHasReusablePoliciesConnectedTo(CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT, policyID);
    const [policy] = useOnyx(`${ONYXKEYS.COLLECTION.POLICY}${policyID}`);
    const shouldGoToEnterCredentials = isAuthenticationError(policy, CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT);

    useEffect(() => {
        if (shouldGoToEnterCredentials) {
            Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS.getRoute(policyID));
            return;
        }
        if (!hasReusablePoliciesConnectedToSageIntacct) {
            Navigation.navigate(`${ROUTES.POLICY_ACCOUNTING.getRoute(policyID)}/${DYNAMIC_ROUTES.SAGE_INTACCT_PREREQUISITES.path}`);
            return;
        }
        Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_EXISTING_CONNECTIONS.getRoute(policyID));
    }, []);

    return null;
}

Loosening shouldShowEnterCredentials alone is not sufficient — the click would land an already-connected admin on the prerequisites/download-package page instead of the credentials form.

Proposed fix

A. Split visibility and add a Sage Intacct-specific proactive flag. Replace PolicyAccountingPage.tsx:112 with:

// src/pages/workspace/accounting/PolicyAccountingPage.tsx
const isSageIntacct = connectedIntegration === CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT;
const hasAuthError = !!connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);
const shouldShowEnterCredentials = !!connectedIntegration && (hasAuthError || isSageIntacct);
// Show Sync now whenever an integration is connected and we're not in a hard auth-error state for non-Intacct connectors.
const shouldShowSyncNow = !!connectedIntegration && !hasAuthError;

B. Make the overflow menu items independent and route Sage Intacct's proactive case directly. Replace PolicyAccountingPage.tsx:143-161 with two separate spread blocks. For Sage Intacct (or any case without an auth error stamped) we bypass startIntegrationFlow and navigate straight to the credentials route so the user lands on the form regardless of the lastSync state:

// src/pages/workspace/accounting/PolicyAccountingPage.tsx
...(shouldShowEnterCredentials
    ? [
          {
              icon: icons.Key,
              text: translate(isSageIntacct && !hasAuthError ? 'workspace.accounting.updateCredentials' : 'workspace.accounting.enterCredentials'),
              onSelected: () => {
                  if (isSageIntacct) {
                      Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS.getRoute(policyID));
                      return;
                  }
                  startIntegrationFlow({name: connectedIntegration});
              },
              shouldCallAfterModalHide: true,
              disabled: isOffline,
              iconRight: icons.NewWindow,
          },
      ]
    : []),
...(shouldShowSyncNow
    ? [
          {
              icon: icons.Sync,
              text: translate('workspace.accounting.syncNow'),
              onSelected: () => syncConnection(policy, connectedIntegration),
              disabled: isOffline,
          },
      ]
    : []),

Update the dependency array at PolicyAccountingPage.tsx:169-182 to include shouldShowSyncNow, isSageIntacct, hasAuthError, and policyID.

C. Add the new copy. Add to src/languages/en.ts near enterCredentials: 'Enter your credentials' (line 6177):

// src/languages/en.ts
enterCredentials: 'Enter your credentials',
updateCredentials: 'Update credentials',

Mirror the key in every other locale file under src/languages/ (es.ts, fr.ts, de.ts, it.ts, nl.ts, pl.ts, pt-BR.ts, ja.ts, zh-hans.ts). For now, English copy can be reused in non-English locales; translators will replace it in the localization sweep.

D. (Optional safety) Harden ConnectToSageIntacctFlow so it also handles proactive entry. Even though step B bypasses the flow for Sage Intacct, startIntegrationFlow({name: SAGE_INTACCT}) is also reachable from other call sites (e.g. the existing-connections picker via createDynamicRoute). To prevent the same wrong-page bug from re-appearing if those entry points are ever used while a connection already exists, change the navigation precedence at src/components/ConnectToSageIntacctFlow/index.tsx:19-30 to send any policy that already has an intacct connection to the credentials page:

// src/components/ConnectToSageIntacctFlow/index.tsx
const hasExistingIntacctConnection = !!policy?.connections?.[CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT];

useEffect(() => {
    if (shouldGoToEnterCredentials || hasExistingIntacctConnection) {
        Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS.getRoute(policyID));
        return;
    }
    if (!hasReusablePoliciesConnectedToSageIntacct) {
        Navigation.navigate(`${ROUTES.POLICY_ACCOUNTING.getRoute(policyID)}/${DYNAMIC_ROUTES.SAGE_INTACCT_PREREQUISITES.path}`);
        return;
    }
    Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_EXISTING_CONNECTIONS.getRoute(policyID));
    // eslint-disable-next-line react-hooks/exhaustive-deps
}, []);

Why this approach

Scope is intentionally limited to Sage Intacct because OAuth-based connectors (QBO, Xero) cannot expose a credential form proactively — there's no password to rotate — and NetSuite's token rotation is already mediated by shouldUseUpdateNetSuiteTokens in src/libs/actions/connections/index.ts:287-289, which deliberately preserves the auth-error gate. Splitting the overflow menu into two independent spreads mirrors how shouldShowReinstallConnectorMenuItem is added independently at PolicyAccountingPage.tsx:131-142, so the pattern is already familiar in this file. Routing the Sage Intacct case directly to POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS rather than expanding ConnectToSageIntacctFlow's state machine for every caller keeps the proactive-update path narrow and avoids accidentally short-circuiting the prerequisites flow for first-time connectors; the optional hardening in step D guards against regressions if other entry points evolve.

[yusufdeveloper2903]

Proposal

What is the root cause of that problem?

The condition that controls visibility of the "Enter credentials" / "Update credentials" menu item requires both a sync error and an authentication error to be true:

const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);

App/src/pages/workspace/accounting/PolicyAccountingPage.tsx

Line 113 in b4103e0

const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);

This is appropriate for OAuth-based integrations (QuickBooks Online, Xero) and token-based ones (NetSuite) where credentials can't be proactively rotated from within Expensify. However, Sage Intacct authenticates via a Web Services username/password/company ID — credentials that users may legitimately need to rotate on a schedule. When there's no existing sync error, shouldShowEnterCredentials evaluates to false and the menu option is hidden entirely, preventing proactive credential updates.

What changes do you think we should make in order to solve the problem?

I'd update the condition in PolicyAccountingPage.tsx to also return true when the connected integration is Sage Intacct — regardless of whether there's been an authentication error:

- const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);
+ const shouldShowEnterCredentials =
+     connectedIntegration &&
+     (connectedIntegration === CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT ||
+         (!!synchronizationError && isAuthenticationError(policy, connectedIntegration)));

This keeps the existing reactive-error behavior for all other integrations (QuickBooks Online, Xero, NetSuite, etc.) and adds an unconditional path for Sage Intacct so the "Update credentials" option always appears in the overflow menu.

No other logic changes are needed — the existing isAuthenticationError path, the credentials navigation route, and the menu item label (TRANSLATE_KEYS.updateCredentials vs enterCredentials) all remain intact. The label shown will depend on whether a connection already exists, which is already handled by existing logic in the menu item construction.

[github-actions]

⚠️ @yusufdeveloper2903 Thanks for your proposal. Please update it to follow the proposal template, as proposals are only reviewed if they follow that format (note the mandatory sections).

[wildan-m]

Proposal

Please re-state the problem that we are trying to solve in this issue.

In the workspace accounting overflow menu, the Update credentials option only appears when the connection has actively failed with an authentication error. This is fine for OAuth-based connections (QuickBooks Online, Xero) and NetSuite tokens, where credentials are normally refreshed automatically and only need manual attention when something breaks.

For Sage Intacct, however, the connection uses a Web Services user with a company ID, user ID, and password. Customers need to be able to rotate these credentials proactively (planned password rotations, employee turnover, security policy compliance) without first having to wait for sync to break. Today, the only way to update Sage Intacct credentials before they break is to disconnect and reconnect — which loses configuration and is destructive.

The fix is to always expose Update credentials in the overflow menu when the connected integration is Sage Intacct, while keeping Sync now available alongside it.

What is the root cause of that problem?

The overflow menu is built around a single boolean flag, shouldShowEnterCredentials, computed inside PolicyAccountingPage:

App/src/pages/workspace/accounting/PolicyAccountingPage.tsx

Line 113 in 388ee01

const shouldShowEnterCredentials = connectedIntegration && !!synchronizationError && isAuthenticationError(policy, connectedIntegration);

That flag requires three things at once: a connected integration, an active synchronization error, AND that the synchronization error specifically be an authentication error. Because the flag is evaluated identically for every connection type, Sage Intacct cannot opt into "always show".

The flag then controls a strict either/or branch in the menu items array:

App/src/pages/workspace/accounting/PolicyAccountingPage.tsx

Lines 144 to 163 in 388ee01

	...(shouldShowEnterCredentials
	? [
	{
	icon: icons.Key,
	text: translate('workspace.accounting.enterCredentials'),
	onSelected: () => startIntegrationFlow({name: connectedIntegration}),
	shouldCallAfterModalHide: true,
	disabled: isOffline,
	iconRight: icons.NewWindow,
	},
	]
	: [
	{
	icon: icons.Sync,
	text: translate('workspace.accounting.syncNow'),
	onSelected: () => syncConnection(policy, connectedIntegration),
	disabled: isOffline,
	},
	]),
	{

When shouldShowEnterCredentials is true, Update credentials is added; when it is false, Sync now is added — never both. So even if we made the flag true for Sage Intacct, the user would lose access to Sync now as a side effect, which contradicts the issue's "Sync Now should still be available alongside it" requirement.

There is also a second-order issue with what happens when Update credentials is invoked outside an authentication-error state. The current onSelected calls startIntegrationFlow({name: connectedIntegration}), which renders ConnectToSageIntacctFlow. That component's effect routes based on isAuthenticationError(...):

App/src/components/ConnectToSageIntacctFlow/index.tsx

Lines 17 to 30 in 388ee01

	const shouldGoToEnterCredentials = isAuthenticationError(policy, CONST.POLICY.CONNECTIONS.NAME.SAGE_INTACCT);
	useEffect(() => {
	if (shouldGoToEnterCredentials) {
	Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS.getRoute(policyID));
	return;
	}
	if (!hasReusablePoliciesConnectedToSageIntacct) {
	Navigation.navigate(`${ROUTES.POLICY_ACCOUNTING.getRoute(policyID)}/${DYNAMIC_ROUTES.SAGE_INTACCT_PREREQUISITES.path}`);
	return;
	}
	Navigation.navigate(ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_EXISTING_CONNECTIONS.getRoute(policyID));
	// eslint-disable-next-line react-hooks/exhaustive-deps
	}, []);

When there is no auth error, it falls through to either the prerequisites screen or the existing connections chooser — neither of which is the credentials update screen the user clicked for. So the menu wiring also needs to route directly to the Sage Intacct enter-credentials screen for the proactive case.

What changes do you think we should make in order to solve the problem?

The change is contained to src/pages/workspace/accounting/PolicyAccountingPage.tsx and has three small parts. No backend, no schema, no new strings.

Part 1 — make the flag Sage-Intacct-aware.

Update the shouldShowEnterCredentials calculation so it is also true whenever the connected integration is Sage Intacct, in addition to the existing auth-error condition. In plain terms: "show the option when there is an authentication error to recover from, OR when this is a Sage Intacct connection where proactive credential rotation is a normal user need". This is the only line whose boolean logic changes; the existing auth-error path for QBO, Xero, NetSuite, QBD, etc. is untouched.

Part 2 — let Update credentials and Sync now coexist for Sage Intacct.

Refactor the either/or branch in the overflow menu's useMemo so that the two items are added independently rather than as exclusive alternatives:

• The Update credentials item is added when shouldShowEnterCredentials is true (same gate as before, but now true for Sage Intacct as well).
• The Sync now item is added when Update credentials is not shown OR when the connected integration is Sage Intacct.

The net effect is that for Sage Intacct both items appear together, and for every other integration the existing exclusive behavior is preserved unchanged. The dependency array of the useMemo needs connectedIntegration added so the menu re-derives when the user switches workspaces.

Part 3 — route Update credentials directly to the credentials screen for Sage Intacct.

Change the onSelected handler of the Update credentials menu item so that when the connected integration is Sage Intacct, it navigates directly to ROUTES.POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS.getRoute(policyID) rather than going through startIntegrationFlow. For all other integrations the handler keeps calling startIntegrationFlow({name: connectedIntegration}), preserving the existing reactive recovery flow for OAuth/token connections.

This direct-navigation approach is preferred over teaching ConnectToSageIntacctFlow to skip its auth-error check, because:

1. It localizes the change to the file already being edited and avoids adding a new prop / behavior switch to a shared flow component.
2. The POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS route already exists and is already used internally by ConnectToSageIntacctFlow for the auth-error case — we are simply reusing the same destination for the proactive case.
3. It keeps ConnectToSageIntacctFlow semantically honest: "decide where a connect/recover flow should land" rather than "also handle proactive rotation".

After the changes, behavior is:

• Sage Intacct, connected, no error → menu shows Update credentials (opens the credentials form directly) and Sync now side by side.
• Sage Intacct, connected, with auth error → menu still shows Update credentials and Sync now; clicking either is a valid recovery action.
• All other integrations (QBO, Xero, NetSuite, QBD, Certinia) → menu shows Update credentials only on auth error, Sync now otherwise — exactly the existing behavior.

What alternative solutions did you explore? (Optional)

I considered modifying ConnectToSageIntacctFlow to accept a prop that forces it to navigate to the enter-credentials route regardless of auth state. That would let us keep the current startIntegrationFlow({name: connectedIntegration}) call shape in the menu. I rejected it because it adds branching to a shared connect-flow component for what is really a menu-item routing concern, and because the existing POLICY_ACCOUNTING_SAGE_INTACCT_ENTER_CREDENTIALS route already gives us a clean direct target.