Login - Unable to sign in with magic link

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.11-17
Reproducible in staging?: Yes
Reproducible in production?: No
If this was caught during regression testing, add the test name, ID and link from BrowserStack: https://test-management.browserstack.com/projects/2219752/test-runs/TR-3953/folder/13176924/41237540/1160418246?p=2
Email or phone of affected tester (no customers): applausetester+omqq1@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Regression TC Execution
Device used: iPhone 15 Pro Max/iOS 26.2, Pixel 6/Android 16
App Component: User Settings

Action Performed:

Precondition: user is logged out

1. Open app
2. Type a valid login email
3. Tap on Continue button
4. Change the magic link to staging and paste in any messenger app (changing magic link to staging is optional)
5. Tap on the magic link from the main device

Expected Result:

User should be successfully signed in to the account

Actual Result:

User navigated to the app and remains on the “Enter magic code” screen without being signed in. The issue occurs with both staging and production magic links

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

1.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @laurenreidexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Triggered auto assignment to @carlosmiceli (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

Investigation Summary

Classification: Frontend bug
Causing PR: #78261 - "fix: Signing with magic link doesnt lead to 2FA page for account with 2FA enabled" by @nkdengineer (High confidence)
Related Issues: #77410 (original issue that PR #78261 fixed)

Recommendation: REVERT

PR #78261 should be reverted as it has broken the magic link sign-in flow for users. While the PR successfully fixed the SAML + 2FA flow, it introduced a regression that prevents users from signing in via magic links.

Labels: Keeping DeployBlockerCash label (App deploy remains blocked)

Detailed Analysis

Evidence

PR #78261 modified src/pages/signin/SignInPage.tsx by adding "&& !hasValidateCode" to the shouldShowChooseSSOOrMagicCode condition on line 105. This change was intended to fix issue #77410 where SAML + 2FA users clicking a magic link would see the "Choose SSO or Magic Code" screen instead of going directly to the 2FA prompt.

However, this change appears to have introduced a regression in the magic link sign-in flow for regular users (and possibly SAML users as well), causing them to remain stuck on the "Enter magic code" screen without being signed in.

Verification

• The change from PR fix: Signing with magic link doesn't lead to 2FA page for account with 2FA enabled #78261 is confirmed to be present in the current codebase (line 105 of SignInPage.tsx)
• PR fix: Signing with magic link doesn't lead to 2FA page for account with 2FA enabled #78261 merged on 2025-12-29, which is within the timeframe for the current staging deploy (9.3.11-17)
• The bug is reproducible on staging but NOT on production, indicating it was introduced by a recent change
• The bug affects the exact area of code modified by PR fix: Signing with magic link doesn't lead to 2FA page for account with 2FA enabled #78261 (magic link / validateCode handling on SignInPage)

Root Cause

The addition of "&& !hasValidateCode" to the shouldShowChooseSSOOrMagicCode condition altered the sign-in page display logic in a way that appears to break the magic link authentication flow. When a user clicks a magic link:

1. On native apps, ValidateLoginPage calls signInWithValidateCodeAndNavigate
2. If authentication requires additional steps or fails, the user is navigated back to SignInPage
3. SignInPage should display the appropriate form based on the authentication state
4. The modified condition may be preventing the correct form from being displayed or causing the automatic sign-in process to fail

The exact mechanism of failure requires further investigation, but the timing, affected area, and symptoms all point to PR #78261 as the root cause.