Merge pull request Expensify#87368 from s77rt/handle-saml-required-reauth

[Payment due @huult] [Internal QA] Trigger SAML sign-in when trying to re-auth a SAML required account

Author: mountiny

src/libs/Reauthentication.ts

@@ -130,6 +130,13 @@ function reauthenticate(command = ''): Promise<boolean> {
         const partnerName = shouldUseNewPartnerName ? CONFIG.EXPENSIFY.PARTNER_NAME : CONFIG.EXPENSIFY.LEGACY_PARTNER_NAME;
         const partnerPassword = shouldUseNewPartnerName ? CONFIG.EXPENSIFY.PARTNER_PASSWORD : CONFIG.EXPENSIFY.LEGACY_PARTNER_PASSWORD;
 
+        if (account?.isSAMLRequired) {
+            Log.info(`[Reauthenticate] Redirecting to Sign In because SAML is required`);
+            setIsAuthenticating(false);
+            redirectToSignIn(undefined, true);
+            return false;
+        }
+
         // Prevent reauthentication if credentials are missing (e.g. after sign out)
         if (!credentials?.autoGeneratedLogin || !credentials?.autoGeneratedPassword) {
             Log.info('[Reauthenticate] No credentials available, redirecting to sign in');

src/libs/actions/SignInRedirect.ts

@@ -12,6 +12,7 @@ import {clearAllPolicies} from './Policy/Policy';
 let currentShouldForceOffline: boolean | undefined;
 let currentIsUsingImportedState: boolean | undefined;
 let currentSessionAuthToken: string | undefined;
+let currentSessionEmail: string | undefined;
 let currentCredentialsValidateCode: string | undefined;
 
 Onyx.connectWithoutView({
@@ -32,6 +33,7 @@ Onyx.connectWithoutView({
     key: ONYXKEYS.SESSION,
     callback: (session) => {
         currentSessionAuthToken = session?.authToken;
+        currentSessionEmail = session?.email;
     },
 });
 
@@ -42,7 +44,7 @@ Onyx.connectWithoutView({
     },
 });
 
-function clearStorageAndRedirect(errorMessage?: string): Promise<void> {
+function clearStorageAndRedirect(errorMessage?: string, isSAMLReauthentication?: boolean): Promise<void> {
     // Under certain conditions, there are key-values we'd like to keep in storage even when a user is logged out.
     // We pass these into the clear() method in order to avoid having to reset them on a delayed tick and getting
     // flashes of unwanted default state.
@@ -79,6 +81,14 @@ function clearStorageAndRedirect(errorMessage?: string): Promise<void> {
         keysToPreserve.push(ONYXKEYS.ACCOUNT);
     }
 
+    // Mark the account as loading and set the login in credentials to trigger the `SAML_SIGN_IN` transition
+    if (isSAMLReauthentication) {
+        keysToPreserve.push(ONYXKEYS.CREDENTIALS);
+        keysToPreserve.push(ONYXKEYS.ACCOUNT);
+        Onyx.merge(ONYXKEYS.CREDENTIALS, {login: currentSessionEmail, autoGeneratedLogin: null, autoGeneratedPassword: null});
+        Onyx.merge(ONYXKEYS.ACCOUNT, {isLoading: true});
+    }
+
     return Onyx.clear(keysToPreserve).then(() => {
         if (CONFIG.IS_HYBRID_APP) {
             resetSignInFlow();
@@ -108,10 +118,11 @@ function clearStorageAndRedirect(errorMessage?: string): Promise<void> {
  *
  * Normally this method would live in Session.js, but that would cause a circular dependency with Network.js.
  *
- * @param [errorMessage] error message to be displayed on the sign in page
+ * @param errorMessage Error message to be displayed on the sign in page
+ * @param isSAMLReauthentication Whether the redirection was triggered by reauthentication for SAML required account
  */
-function redirectToSignIn(errorMessage?: string): Promise<void> {
-    return clearStorageAndRedirect(errorMessage).then(() => {
+function redirectToSignIn(errorMessage?: string, isSAMLReauthentication?: boolean): Promise<void> {
+    return clearStorageAndRedirect(errorMessage, isSAMLReauthentication).then(() => {
         clearSessionStorage();
     });
 }