[No QA] [ECUK In-App 3DS] Add `BIOMETRICS_TEST` scenario screens & routes + add test biometrics button to the troubleshoot menu by JakubKorytko · Pull Request #79475 · Expensify/App

JakubKorytko · 2026-01-13T14:29:01Z

Explanation of Change

This PR adds the components & pages used for the BIOMETRICS_TEST Multifactor Authentication Scenario.
At the current state, the screens simply navigate between each other - the correct logic will be added as a part of this PR: #79482

This allows us to test the UI, animations, and overall appearance.
It also adds the test biometrics button to the Troubleshoot menu so we can start the navigation flow.
For now, the native biometrics flow is available on the web, though it will be context-restricted in the future.

This is because the same components & pages with different images & text will be used for the passkeys later on, so their appearance can be tested on the web now.

co-author: @jakubkalinski0

Fixed Issues

$ #79373
$ #79377
PROPOSAL: N/A

Tests

Open Expensify App
Navigate to the Settings -> Troubleshoot
Click on the "Test" button next to the "Biometrics (Not registered)" text.
Click on the "Test" button in the RHP view.
Verify that the validate code screen matches the one in the 3DS UI mocks
Fill the magic code input with any valid number (it is not validated for now)
Verify that the "Verify yourself" screen matches the one in the 3DS UI mocks
Click on the "Got it" button
Verify that the "Authentication successful" screen matches the one in the 3DS UI mocks
Repeat steps 1-7
Click on the back arrow
Verify that the reject confirmation modal matches the one in the 3DS UI mocks
Click on the "Reject authentication" button
Verify that the "Authentication unsuccessful" screen matches the one in the 3DS UI mocks

Offline tests

N/A, D - Full Page Blocking UI Pattern for this project.

QA Steps

Same as tests.

PR Author Checklist

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

Web.mp4

melvin-bot · 2026-01-15T18:39:38Z

@DylanDylann Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

src/pages/MultifactorAuthentication/ValidateCodePage.tsx

src/components/MultifactorAuthentication/NoEligibleMethodsDescription.tsx

src/pages/MultifactorAuthentication/ValidateCodePage.tsx

src/components/TestToolMenu.tsx

src/pages/MultifactorAuthentication/NotificationPage.tsx

src/components/MultifactorAuthentication/ValidateCodeResendButton.tsx

src/components/MultifactorAuthentication/PromptContent.tsx

src/pages/MultifactorAuthentication/PromptPage.tsx

src/pages/MultifactorAuthentication/BiometricsTestPage.tsx

src/pages/MultifactorAuthentication/ValidateCodePage.tsx

trjExpensify

Reapproving. 👍

src/ROUTES.ts

rafecolton

Overall feedback:

Add lots of comments explaining both what (if not extremely obvious) and especially why
Seems like some duplication of magic code screens, I wonder it can be DRY'd
Wondering if the MFA context needs to be included in this PR - discussing in Slack here

src/SCREENS.ts

src/components/MultifactorAuthentication/NoEligibleMethodsDescription.tsx

src/components/MultifactorAuthentication/PromptContent.tsx

src/components/MultifactorAuthentication/TriggerCancelConfirmModal.tsx

src/components/MultifactorAuthentication/ValidateCodeResendButton.tsx

rafecolton · 2026-01-16T21:49:43Z

src/pages/MultifactorAuthentication/BiometricsTestPage.tsx

+                onBackButtonPress={onGoBackPress}
+                shouldShowBackButton
+            />
+            <FullPageOfflineBlockingView>


This is a little bit different from the mocks and my understanding of how we were going to design this. I understand that we need to open an RHP / modal in order to do the biometrics and show success/failure screens. However, I expected that there would be no starting screen. Basically, when you press the button on the row in the settings page, it would do what the "Biometrics test" page does in your recording. There might be an invisible RHP page (implementation detail) but no need for the user to tap an additional button to initiate the test. That also result in the FaceID prompt displaying over top of the settings page, rather than over top of the "Biometrics test" page.

Am I understanding that right or did we change the decision somewhere? Is it possible to do it the way I've described above?

@JakubKorytko I have no context for this, will you reply?

Screen.Recording.2026-01-19.at.12.42.29.mov

resolving, invisible screen added

Unresolving so future reviewers can see the video. This is very cool! 😍

src/pages/MultifactorAuthentication/NotificationPage.tsx

rafecolton · 2026-01-16T21:57:54Z

src/pages/MultifactorAuthentication/ValidateCodePage.tsx

+    inputCode?: TranslationPaths;
+};
+
+function MultifactorAuthenticationValidateCodePage() {


This seems to be reimplementing a validate code page that I'm fairly certain we use elsewhere in the app - can we reuse that content from anywhere else for DRY purposes?

Hmm, you might be right that we can reuse the ValidateCodeForm component. But that carries the risk that its implementation is missing something necessary for MFA.

I've talked to Kuba about this, and we want to add the current code to make MFA faster, and then we can revisit this issue.

It might be a good idea to create a refactor issue on Github.

Yes, we do have something like this page, but those pages do much more than we need and we would have to adjust already big components in order to make them fit our case. More reasonable approach would be to refactor all those validateCodeForm components

We can consider using ValidateCodeActionContent component here

Discussed in Slack here. If you feel there are other components that can be easily reused, please make a follow-up issue. If not, the we can leave it. Any change that requires a major refactor of an unrelated flow is not worth making IMO, as it has a high risk of introducing bugs and will require extensive testing. Not to mention validate code flows are extremely important.

We can consider using ValidateCodeActionContent component here

@DylanDylann @rafecolton @JakubKorytko
After revisiting the topic, I remembered what originally led us to creating a completely new ValidateCodePage. It was because of the fallback flow. I have completely forgotten about it's removal (or existence 😅).

At the time, this approach made a lot of sense. We supported a fallback to magic code + 2FA/SMS when biometric authentication failed, which meant we had to handle those 2 code-based factors (I mean 2FA/SMS) anyway, so it made sense to just keep everything MFA-related in one place and just add MFA magic code handling there too.

The main arguments for this approach were:

We kept the handling of all code-based MFA validation factors in one place - whether it was magic code, SMS OTP, or authenticator code. Since we had to introduce a new page anyway, it felt more reasonable to include magic code validation there (especially that we wanted a singular call to BE with 2 factors so it had to behave differently) rather than modifying the well-established ValidateCodeActionContent component.

ValidateCodeActionContent is a “one code -> one action” component, which was problematic for the fallback flow. In that flow, we first had to collect both factors and only then make a single BE call. Supporting this would have required significant changes to ValidateCodeActionContent (specifically ValidateCodeForm), which didn’t seem like a good idea.

Now that this flow is no longer in place, whenever a magic code is required it always involves a single code triggering a single action. In this context, reusing ValidateCodeActionContent does seem reasonable, although it would still require some BE adjustments, making it a moderate-sized refactor, which would be better to do as a followup without rushing.

Interesting, thanks for the explanation. What BE adjustments would it require? I'm not sure whether it's worth it to make BE adjustments and do a "moderate-sized refactor" even if we give ourselves plenty of time. But I'm open to it 😄 and curious to learn more.

@jakubkalinski0 bump, perhaps move this convo to slack?

tests/unit/NetworkTest.tsx

- Improve MFA component naming and styles - Reuse ValidateCodeCountdown in MFA ValidateCodeResendButton - Move ValidateCodeCountdown from pages/signin/ to components/ for reusability - Refactor MultifactorAuthenticationValidateCodeResendButton to use ValidateCodeCountdown instead of duplicating timer logic - Update imports in BaseValidateCodeForm (signin and ValidateCodeActionModal) - Adjust BiometricsTestPage - Rename constants in NoEligibleMethodsDescription for clarity: - base -> baseTranslationPath - tPaths -> translationPaths - Add dedicated mfaBlockingViewAnimation style instead of reusing emptyLHNAnimation - Update PromptContent to use the new MFA-specific animation style - Add TODO comments for mocked configs in NotificationPage - Add TODO comment for mockedConfig in TriggerCancelConfirmModal

src/pages/MultifactorAuthentication/NotificationPage.tsx

src/pages/MultifactorAuthentication/ValidateCodePage.tsx

DylanDylann · 2026-01-19T17:04:35Z

src/pages/MultifactorAuthentication/ValidateCodePage.tsx

+    inputCode?: TranslationPaths;
+};
+
+function MultifactorAuthenticationValidateCodePage() {


We can consider using ValidateCodeActionContent component here

src/components/TestToolMenu.tsx

src/components/MultifactorAuthentication/ValidateCodeResendButton.tsx

src/components/MultifactorAuthentication/TriggerCancelConfirmModal.tsx

src/components/TestToolMenu.tsx

src/pages/MultifactorAuthentication/NotificationPage.tsx

rafecolton · 2026-01-19T19:54:01Z

src/pages/MultifactorAuthentication/ValidateCodePage.tsx

+    inputCode?: TranslationPaths;
+};
+
+function MultifactorAuthenticationValidateCodePage() {


Discussed in Slack here. If you feel there are other components that can be easily reused, please make a follow-up issue. If not, the we can leave it. Any change that requires a major refactor of an unrelated flow is not worth making IMO, as it has a high risk of introducing bugs and will require extensive testing. Not to mention validate code flows are extremely important.

tests/unit/NetworkTest.tsx

rafecolton · 2026-01-19T20:01:32Z

src/pages/MultifactorAuthentication/BiometricsTestPage.tsx

+                onBackButtonPress={onGoBackPress}
+                shouldShowBackButton
+            />
+            <FullPageOfflineBlockingView>


Unresolving so future reviewers can see the video. This is very cool! 😍

rafecolton · 2026-01-19T20:03:39Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified there are no new alerts related to the canBeMissing param for useOnyx
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

OSBotify · 2026-01-19T20:32:09Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2026-01-20T17:42:38Z

🚀 Deployed to staging by https://github.com/rafecolton in version: 9.3.5-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

IuliiaHerets · 2026-01-20T18:33:20Z

@jakubkalinski0 @rafecolton is it no QA PR, right?

rafecolton · 2026-01-20T22:48:38Z

@IuliiaHerets correct

OSBotify · 2026-01-21T23:07:07Z

🚀 Deployed to production by https://github.com/Beamanator in version: 9.3.5-7 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

melvin-bot bot assigned JakubKorytko Jan 13, 2026

JakubKorytko mentioned this pull request Jan 13, 2026

[Due for payment 2026-01-28] [ECUK In-App 3DS] [App] Add BIOMETRICS_TEST scenario screens & routes #79373

Closed

JakubKorytko force-pushed the korytko/ecuk/3ds/add-biometrics-test-screens-and-routes branch from b3af9c4 to ecc621d Compare January 15, 2026 18:13

JakubKorytko changed the title ~~[WIP] [ECUK In-App 3DS] Add BIOMETRICS_TEST scenario screens & routes~~ [WIP] [ECUK In-App 3DS] Add BIOMETRICS_TEST scenario screens & routes + add test biometrics button to the troubleshoot menu Jan 15, 2026

JakubKorytko changed the title ~~[WIP] [ECUK In-App 3DS] Add BIOMETRICS_TEST scenario screens & routes + add test biometrics button to the troubleshoot menu~~ [ECUK In-App 3DS] Add BIOMETRICS_TEST scenario screens & routes + add test biometrics button to the troubleshoot menu Jan 15, 2026

JakubKorytko force-pushed the korytko/ecuk/3ds/add-biometrics-test-screens-and-routes branch 2 times, most recently from 70ab22a to 6cd18f7 Compare January 15, 2026 18:36

JakubKorytko mentioned this pull request Jan 15, 2026

[Due for payment 2026-01-28] [ECUK In-App 3DS] [App] Add test biometrics button to the troubleshoot menu #79377

Closed

JakubKorytko marked this pull request as ready for review January 15, 2026 18:39

JakubKorytko requested review from a team as code owners January 15, 2026 18:39

melvin-bot bot requested review from DylanDylann and trjExpensify and removed request for a team January 15, 2026 18:39

melvin-bot bot removed the request for review from a team January 15, 2026 18:39