[Domain Control] Force 2FA - Force 2fa policy changes are not applied in real-time to active member

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.18-2
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #79361
Email or phone of affected tester (no customers): admin: admin@expplause.com, member: admin+vq1202@expplause.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Windows 11 / Chrome | Pixel 7 Pro/Android 16
App Component: Workspace Settings

Action Performed:

Precondition: 2 accounts, 1 admin: admin@expplause.com, 1 member: admin+vq1202@expplause.com of the domain, log in on 2 environments or devices

1. Open the New Dot app
2. Admin: Open https://staging.new.expensify.com/domain/21139263/members/settings
3. Admin: Toggle on the Force two-factor authentication
4. Member: Try to close the app and reopen, log out/relogin
5. Note the 2FA screen appears after re-login
6. Admin: Toggle off the Force two-factor authentication
7. Member: Try to force close the app, clear the cache
8. Note that the 2FA screen remains and doesn't dismiss

Expected Result:

Step 3: When the admin enables "Force 2FA", the policy should be enforced immediately for all active member sessions without requiring logout/login.

Step 7: When the admin disables "Force 2FA", members currently on the forced 2FA setup screen should be able to proceed normally without being blocked, and the enforcement screen should no longer be displayed.

Actual Result:

Step 3: When the domain admin enables "Force 2FA" while a member is already logged in, the member is not required to set up 2FA until they log out and log in again.

Step 7: When the admin disables "Force 2FA" while a member is on the forced 2FA setup screen, the member remains stuck on the 2FA enforcement screen even after the policy is turned off and the cache is cleared.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

1.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @rayane-d

[melvin-bot]

Triggered auto assignment to @johncschuster (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.