Pass authMethod=saml on SignInWithShortLivedAuthToken for SAML sign-ins#90722
Conversation
cristipaval
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| function signInWithShortLivedAuthToken(authToken: string, isSAML = false) { | ||
| const {optimisticData, failureData, finallyData} = getShortLivedLoginParams(false, isSAML); | ||
| API.read(READ_COMMANDS.SIGN_IN_WITH_SHORT_LIVED_AUTH_TOKEN, {authToken, skipReauthentication: true}, {optimisticData, failureData, finallyData}); | ||
| const authMethod = isSAML ? 'saml' : undefined; |
There was a problem hiding this comment.
❌ CONSISTENCY-2 (docs)
The string 'saml' is a magic value representing a specific authentication method sent to the backend. It should be defined as a named constant (e.g., in CONST) to improve clarity and prevent typos if used elsewhere.
Suggested fix: define a constant and reference it here:
// In CONST/index.ts or a relevant auth constants file
AUTH_METHOD: {
SAML: 'saml',
},// In Session/index.ts
const authMethod = isSAML ? CONST.AUTH_METHOD.SAML : undefined;Reviewed at: a0ef6b7 | Please rate this suggestion with 👍 or 👎 to help us improve! Reactions are used to monitor reviewer efficiency.
There was a problem hiding this comment.
This is more or less what I had in mind with the other comment
|
Adding @mjasikowski as reviewer since he already has context on this topic. |
|
Making this a WIP until I test it with an adhoc build |
|
🚧 @cristipaval has triggered a test Expensify/App build. You can view the workflow run here. |
|
🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
|
|
PR doesn’t need product input as a refactor PR. Unassigning and unsubscribing myself. |
cristipaval
changed the title
|
This is now ready for review @mjasikowski @Valforte 🙏 |
| * SAML sign-in and OldDot → NewDot deep-link handovers — so callers should set this when the upstream | ||
| * method is known. | ||
| */ | ||
| authMethod?: string; |
There was a problem hiding this comment.
I think possible auth methods should be extracted to a constant or a union type and this should be a typed property, rather than just string
| function signInWithShortLivedAuthToken(authToken: string, isSAML = false) { | ||
| const {optimisticData, failureData, finallyData} = getShortLivedLoginParams(false, isSAML); | ||
| API.read(READ_COMMANDS.SIGN_IN_WITH_SHORT_LIVED_AUTH_TOKEN, {authToken, skipReauthentication: true}, {optimisticData, failureData, finallyData}); | ||
| const authMethod = isSAML ? 'saml' : undefined; |
There was a problem hiding this comment.
This is more or less what I had in mind with the other comment
|
@cristipaval can you reply or adress @mjasikowski comments? |
|
I was sprinting last week. I'll address your feedback asap. |
|
this is ready again for review, @mjasikowski , @Valforte 🙏 |
|
✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release. |
5 participants
SignInWithShortLivedAuthTokenis reached from multiple flows (e.g. SAML sign-in viaSAMLSignInPage, deep-link session handovers from OldDot viaLogInWithShortLivedAuthTokenPage/LogOutPreviousUserPage), so callers should set this to identify which one when known.Explanation of Change
Upstream saml auth method forwarded to the fraud protection backend as the session's
authenticationattribute.Fixed Issues
https://github.com/Expensify/Expensify/issues/632349
PROPOSAL:
Tests
Tested that saml login is not broken and works as before.
Offline tests
QA Steps
// TODO: These must be filled out, or the issue title must include "[No QA]."
Ping @cristipaval to QA this.
authenticationattribute on the session is set assamlPR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectioncanBeMissingparam foruseOnyxtoggleReportand notonIconClick)src/languages/*files and using the translation methodSTYLE.md) were followedAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.ScrollViewcomponent to make it scrollable when more elements are added to the page.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari
Screen.Recording.2026-05-15.at.12.14.42.mov