From f9030f8a272a62e6e33291ae29ebe62f95f6ef77 Mon Sep 17 00:00:00 2001 From: Jan Nowakowski Date: Wed, 18 Feb 2026 13:10:57 +0100 Subject: [PATCH 1/4] Do not log out user if they cancel --- src/libs/actions/Session/index.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/libs/actions/Session/index.ts b/src/libs/actions/Session/index.ts index 45b54c095f57..74e35b21aa33 100644 --- a/src/libs/actions/Session/index.ts +++ b/src/libs/actions/Session/index.ts @@ -1,5 +1,6 @@ import HybridAppModule from '@expensify/react-native-hybrid-app'; import {openAuthSessionAsync} from 'expo-web-browser'; +import type {WebBrowserAuthSessionResult} from 'expo-web-browser'; import throttle from 'lodash/throttle'; import type {ChannelAuthorizationData} from 'pusher-js/types/src/core/auth/options'; import type {ChannelAuthorizationCallback} from 'pusher-js/with-encryption'; @@ -263,7 +264,10 @@ function callSAMLSignOut(params: LogOutParams, authToken: string): Promise { Log.hmmm('SAML sign out failed', {error}); }) - .then(() => { + .then((result) => { + if (result && result.type !== 'success'){ + return Promise.reject("Logout cancelled"); + } // We always want to sign out the user from the app // eslint-disable-next-line rulesdir/no-api-side-effects-method return API.makeRequestWithSideEffects(SIDE_EFFECT_REQUEST_COMMANDS.LOG_OUT, params, {}); From f41adc585ee0c06ebfcdce9a56fe5672873dc7cb Mon Sep 17 00:00:00 2001 From: Jan Nowakowski Date: Wed, 18 Feb 2026 13:16:03 +0100 Subject: [PATCH 2/4] Remove unused type --- src/libs/actions/Session/index.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/src/libs/actions/Session/index.ts b/src/libs/actions/Session/index.ts index 74e35b21aa33..b7c499cf9d74 100644 --- a/src/libs/actions/Session/index.ts +++ b/src/libs/actions/Session/index.ts @@ -1,6 +1,5 @@ import HybridAppModule from '@expensify/react-native-hybrid-app'; import {openAuthSessionAsync} from 'expo-web-browser'; -import type {WebBrowserAuthSessionResult} from 'expo-web-browser'; import throttle from 'lodash/throttle'; import type {ChannelAuthorizationData} from 'pusher-js/types/src/core/auth/options'; import type {ChannelAuthorizationCallback} from 'pusher-js/with-encryption'; From 2130ff9b93c7bba6f8fd0fd57abbcdc5b2bc074d Mon Sep 17 00:00:00 2001 From: Jan Nowakowski Date: Wed, 18 Feb 2026 13:34:15 +0100 Subject: [PATCH 3/4] fix linter --- src/libs/actions/Session/index.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libs/actions/Session/index.ts b/src/libs/actions/Session/index.ts index b7c499cf9d74..1e85e045f746 100644 --- a/src/libs/actions/Session/index.ts +++ b/src/libs/actions/Session/index.ts @@ -264,8 +264,8 @@ function callSAMLSignOut(params: LogOutParams, authToken: string): Promise { - if (result && result.type !== 'success'){ - return Promise.reject("Logout cancelled"); + if (result && result.type !== 'success') { + return Promise.reject(Error('Logout cancelled')); } // We always want to sign out the user from the app // eslint-disable-next-line rulesdir/no-api-side-effects-method From 06d9a553e74f6bef1f72c03ffeed9a77193c13c5 Mon Sep 17 00:00:00 2001 From: Jan Nowakowski Date: Wed, 18 Feb 2026 13:50:49 +0100 Subject: [PATCH 4/4] Sign out from OldDot only on success --- src/libs/actions/Session/index.ts | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/libs/actions/Session/index.ts b/src/libs/actions/Session/index.ts index 1e85e045f746..485236a3d265 100644 --- a/src/libs/actions/Session/index.ts +++ b/src/libs/actions/Session/index.ts @@ -336,11 +336,6 @@ function signOutAndRedirectToSignIn(shouldResetToHome?: boolean, shouldStashSess return; } - // When signing out from the HybridApp, we need to sign out from the oldDot app as well - if (CONFIG.IS_HYBRID_APP && shouldSignOutFromOldDot) { - HybridAppModule.signOutFromOldDot(); - } - const isSupportal = isSupportAuthToken(); const shouldRestoreStashedSession = isSupportal || shouldForceUseStashedSession; @@ -404,6 +399,10 @@ function signOutAndRedirectToSignIn(shouldResetToHome?: boolean, shouldStashSess // Wait for signOut (if called), then redirect and update Onyx. return signOutPromise .then((response) => { + // When signing out from the HybridApp, we need to sign out from the oldDot app as well + if (CONFIG.IS_HYBRID_APP && shouldSignOutFromOldDot) { + HybridAppModule.signOutFromOldDot(); + } if (isSupportal) { // Send event to Fraud Protection backend, otherwise it might consider the user as being suspicious FraudProtection.sendEvent(FRAUD_PROTECTION_EVENT.STOP_SUPPORT_SESSION);