Merge remote-tracking branch 'origin/main' into claude-timerCountdownAccessibility

MelvinBot · youssef-lr · MelvinBot · commit b9108e559769 · 2026-03-23T14:12:59.000Z
Co-authored-by: Youssef Lourayad &lt;youssef-lr@users.noreply.github.com&gt;
diff --git a/Mobile-Expensify b/Mobile-Expensify
@@ -1 +1 @@
-Subproject commit 9be7b50b4ecad14778fa30f616886515ea7f8902
+Subproject commit d6051eb539e52a75a250bec7f9439bfb846cee13
diff --git a/android/app/build.gradle b/android/app/build.gradle
@@ -111,8 +111,8 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         multiDexEnabled rootProject.ext.multiDexEnabled
-        versionCode 1009034103
-        versionName "9.3.41-3"
+        versionCode 1009034200
+        versionName "9.3.42-0"
         // Supported language variants must be declared here to avoid from being removed during the compilation.
         // This also helps us to not include unnecessary language variants in the APK.
         resConfigs "en", "es"
diff --git a/contributingGuides/NAVIGATION.md b/contributingGuides/NAVIGATION.md
@@ -710,7 +710,7 @@ Do not use dynamic routes when:
 `DYNAMIC_ROUTES` in `src/ROUTES.ts`: each entry has:
 
 - `path`: The URL suffix (e.g. `'verify-account'`).
-- `entryScreens`: List of screen names that are allowed to have this suffix appended (access control; see [Entry Screens (Access Control)](#entry-screens-access-control)).
+- `entryScreens`: List of screen names that are allowed to have this suffix appended (access control; see [Entry Screens (Access Control)](#entry-screens-access-control)). Use `['*']` to allow all screens.
 
 `createDynamicRoute(suffix)` — [`createDynamicRoute.ts`](src/libs/Navigation/helpers/createDynamicRoute.ts). Accepts a `DynamicRouteSuffix` (from `DYNAMIC_ROUTES`), appends it to the current active route and returns the full route. Use the following when navigating to a dynamic route:
 
@@ -731,6 +731,24 @@ When parsing a URL, `src/libs/Navigation/helpers/getStateFromPath.ts` resolves t
 
 When adding or extending a dynamic route, list every screen that should be able to open it (e.g. `SCREENS.SETTINGS.WALLET.ROOT` for Verify Account from Wallet).
 
+#### Wildcard access (`'*'`)
+
+Setting `entryScreens` to `['*']` grants access to the dynamic route from any screen. This bypasses per-screen authorization entirely for that route.
+
+```ts
+KEYBOARD_SHORTCUTS: {
+    path: 'keyboard-shortcuts',
+    entryScreens: ['*'],
+},
+```
+
+> [!CAUTION]
+> **Use `'*'` only when the dynamic route genuinely needs to be reachable from every screen.**
+> If only a subset of screens should access the route, list them explicitly.
+> Overusing `'*'` weakens the access control that `entryScreens` provides
+> and makes it harder to reason about which screens can trigger a given flow.
+> When in doubt, prefer an explicit list.
+
 ### Current limitations (work in progress)
 
 - **Path parameters:** Suffixes must not include path params (e.g. `a/:reportID`). Query parameters are supported - see [Dynamic routes with query parameters](#dynamic-routes-with-query-parameters).
diff --git a/ios/AppDelegate.swift b/ios/AppDelegate.swift
@@ -9,9 +9,8 @@ import UIKit
 import React
 import React_RCTAppDelegate
 import ReactAppDependencyProvider
-import ExpoModulesCore
 import Firebase
-import Expo
+internal import Expo
 import ActivityKit
 import AirshipFrameworkProxy
 
@@ -25,12 +24,11 @@ class AppDelegate: ExpoAppDelegate, UNUserNotificationCenterDelegate {
     let appStartTimePreferencesKey = "AppStartTime"
     UserDefaults.standard.set(Date().timeIntervalSince1970 * 1000, forKey: appStartTimePreferencesKey)
     let delegate = ReactNativeDelegate()
-    let factory = RCTReactNativeFactory(delegate: delegate)
+    let factory = ExpoReactNativeFactory(delegate: delegate)
     delegate.dependencyProvider = RCTAppDependencyProvider()
 
     reactNativeDelegate = delegate
     reactNativeFactory = factory
-    bindReactNativeFactory(factory)
 
     window = UIWindow(frame: UIScreen.main.bounds)
     factory.startReactNative(
diff --git a/ios/NewExpensify/Info.plist b/ios/NewExpensify/Info.plist
@@ -23,7 +23,7 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>9.3.41</string>
+	<string>9.3.42</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleURLTypes</key>
@@ -44,7 +44,7 @@
 		</dict>
 	</array>
 	<key>CFBundleVersion</key>
-	<string>9.3.41.3</string>
+	<string>9.3.42.0</string>
 	<key>FullStory</key>
 	<dict>
 		<key>OrgId</key>
diff --git a/ios/NotificationServiceExtension/Info.plist b/ios/NotificationServiceExtension/Info.plist
@@ -11,9 +11,9 @@
 	<key>CFBundleName</key>
 	<string>$(PRODUCT_NAME)</string>
 	<key>CFBundleShortVersionString</key>
-	<string>9.3.41</string>
+	<string>9.3.42</string>
 	<key>CFBundleVersion</key>
-	<string>9.3.41.3</string>
+	<string>9.3.42.0</string>
 	<key>NSExtension</key>
 	<dict>
 		<key>NSExtensionPointIdentifier</key>
diff --git a/ios/ShareViewController/Info.plist b/ios/ShareViewController/Info.plist
@@ -11,9 +11,9 @@
 	<key>CFBundleName</key>
 	<string>$(PRODUCT_NAME)</string>
 	<key>CFBundleShortVersionString</key>
-	<string>9.3.41</string>
+	<string>9.3.42</string>
 	<key>CFBundleVersion</key>
-	<string>9.3.41.3</string>
+	<string>9.3.42.0</string>
 	<key>NSExtension</key>
 	<dict>
 		<key>NSExtensionAttributes</key>
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "new.expensify",
-  "version": "9.3.41-3",
+  "version": "9.3.42-0",
   "author": "Expensify, Inc.",
   "homepage": "https://new.expensify.com",
   "description": "New Expensify is the next generation of Expensify: a reimagination of payments based atop a foundation of chat.",
diff --git a/src/ROUTES.ts b/src/ROUTES.ts
@@ -55,7 +55,7 @@ const VERIFY_ACCOUNT = 'verify-account';
 
 type DynamicRouteConfig = {
     path: string;
-    entryScreens: Screen[];
+    entryScreens: ReadonlyArray<Screen | '*'>;
     getRoute?: (...args: never[]) => string;
     queryParams?: readonly string[];
 };
diff --git a/src/components/MoneyReportHeader.tsx b/src/components/MoneyReportHeader.tsx
@@ -117,6 +117,7 @@ import {
     rejectMoneyRequestReason,
     shouldBlockSubmitDueToStrictPolicyRules,
 } from '@libs/ReportUtils';
+import shouldPopoverUseScrollView from '@libs/shouldPopoverUseScrollView';
 import {shouldRestrictUserBillableActions} from '@libs/SubscriptionUtils';
 import type {SkeletonSpanReasonAttributes} from '@libs/telemetry/useSkeletonSpan';
 import {
@@ -2322,6 +2323,7 @@ function MoneyReportHeader({reportID: reportIDProp, shouldDisplayBackButton = fa
     ]);
 
     const shouldShowSelectedTransactionsButton = !!selectedTransactionsOptions.length && !transactionThreadReportID;
+    const popoverUseScrollView = shouldPopoverUseScrollView(selectedTransactionsOptions);
 
     const hasPayInSelectionMode = allExpensesSelected && hasPayAction;
 
@@ -2403,6 +2405,7 @@ function MoneyReportHeader({reportID: reportIDProp, shouldDisplayBackButton = fa
                     customText={translate('workspace.common.selected', {count: selectedTransactionIDs.length})}
                     isSplitButton={false}
                     shouldAlwaysShowDropdownMenu
+                    shouldPopoverUseScrollView={popoverUseScrollView}
                     wrapperStyle={wrapperStyle}
                 />
             ),
@@ -2417,6 +2420,7 @@ function MoneyReportHeader({reportID: reportIDProp, shouldDisplayBackButton = fa
             translate,
             selectedTransactionIDs.length,
             kycWallRef,
+            popoverUseScrollView,
         ],
     );
 
diff --git a/src/components/MoneyRequestReportView/MoneyRequestReportActionsList.tsx b/src/components/MoneyRequestReportView/MoneyRequestReportActionsList.tsx
@@ -59,6 +59,7 @@ import {
     wasMessageReceivedWhileOffline,
 } from '@libs/ReportActionsUtils';
 import {canUserPerformWriteAction, chatIncludesChronosWithID, getOriginalReportID, getReportLastVisibleActionCreated, isHarvestCreatedExpenseReport, isUnread} from '@libs/ReportUtils';
+import shouldPopoverUseScrollView from '@libs/shouldPopoverUseScrollView';
 import markOpenReportEnd from '@libs/telemetry/markOpenReportEnd';
 import type {SkeletonSpanReasonAttributes} from '@libs/telemetry/useSkeletonSpan';
 import {isTransactionPendingDelete} from '@libs/TransactionUtils';
@@ -313,6 +314,8 @@ function MoneyRequestReportActionsList({
         });
     }, [originalSelectedTransactionsOptions, dismissedRejectUseExplanation, isDelegateAccessRestricted, showDelegateNoAccessModal]);
 
+    const popoverUseScrollView = shouldPopoverUseScrollView(selectedTransactionsOptions);
+
     const dismissRejectModalBasedOnAction = useCallback(() => {
         if (rejectModalAction === CONST.REPORT.TRANSACTION_SECONDARY_ACTIONS.REJECT_BULK) {
             dismissRejectUseExplanation();
@@ -808,6 +811,7 @@ function MoneyRequestReportActionsList({
                         })}
                         isSplitButton={false}
                         shouldAlwaysShowDropdownMenu
+                        shouldPopoverUseScrollView={popoverUseScrollView}
                         wrapperStyle={[styles.w100, styles.ph5]}
                     />
                     <View style={[styles.alignItemsCenter, styles.userSelectNone, styles.flexRow, styles.pt6, styles.ph8, styles.pb3]}>
diff --git a/src/components/MultifactorAuthentication/config/scenarios/ChangePIN.tsx b/src/components/MultifactorAuthentication/config/scenarios/ChangePIN.tsx
@@ -47,7 +47,7 @@ const ChangePINSuccessScreen = createScreenWithDefaults(
  * This scenario is used when a UK/EU cardholder changes the PIN of their physical card.
  */
 export default {
-    allowedAuthenticationMethods: [CONST.MULTIFACTOR_AUTHENTICATION.TYPE.BIOMETRICS],
+    allowedAuthenticationMethods: [CONST.MULTIFACTOR_AUTHENTICATION.TYPE.BIOMETRICS, CONST.MULTIFACTOR_AUTHENTICATION.TYPE.PASSKEYS],
     action: changePINForCard,
     successScreen: <ChangePINSuccessScreen />,
     defaultClientFailureScreen: <ClientFailureScreen />,
diff --git a/src/components/MultifactorAuthentication/config/scenarios/RevealPIN.tsx b/src/components/MultifactorAuthentication/config/scenarios/RevealPIN.tsx
@@ -52,7 +52,7 @@ const ServerFailureScreen = createScreenWithDefaults(
  * - Authentication failure: Return SHOW_OUTCOME_SCREEN to show failure screen
  */
 export default {
-    allowedAuthenticationMethods: [CONST.MULTIFACTOR_AUTHENTICATION.TYPE.BIOMETRICS],
+    allowedAuthenticationMethods: [CONST.MULTIFACTOR_AUTHENTICATION.TYPE.BIOMETRICS, CONST.MULTIFACTOR_AUTHENTICATION.TYPE.PASSKEYS],
     action: revealPINForCard,
     callback: async (isSuccessful, callbackInput, payload) => {
         if (isSuccessful && isRevealPINPayload(payload)) {
diff --git a/src/components/MultifactorAuthentication/config/scenarios/SetPINOrderCard.tsx b/src/components/MultifactorAuthentication/config/scenarios/SetPINOrderCard.tsx
@@ -65,7 +65,7 @@ const ServerFailureScreen = createScreenWithDefaults(
  * - Authentication failure: Return SHOW_OUTCOME_SCREEN to show failure screen
  */
 export default {
-    allowedAuthenticationMethods: [CONST.MULTIFACTOR_AUTHENTICATION.TYPE.BIOMETRICS],
+    allowedAuthenticationMethods: [CONST.MULTIFACTOR_AUTHENTICATION.TYPE.BIOMETRICS, CONST.MULTIFACTOR_AUTHENTICATION.TYPE.PASSKEYS],
     action: setPersonalDetailsAndShipExpensifyCardsWithPIN,
 
     callback: async (isSuccessful, _callbackInput, payload) => {
diff --git a/src/components/Search/SearchBulkActionsButton.tsx b/src/components/Search/SearchBulkActionsButton.tsx
@@ -20,6 +20,7 @@ import useThemeStyles from '@hooks/useThemeStyles';
 import {handleBulkPayItemSelected} from '@libs/actions/Search';
 import Navigation from '@libs/Navigation/Navigation';
 import {isExpenseReport} from '@libs/ReportUtils';
+import shouldPopoverUseScrollView from '@libs/shouldPopoverUseScrollView';
 import CONST from '@src/CONST';
 import ONYXKEYS from '@src/ONYXKEYS';
 import ROUTES from '@src/ROUTES';
@@ -76,8 +77,7 @@ function SearchBulkActionsButton({queryJSON}: SearchBulkActionsButtonProps) {
     const selectedTransactionsKeys = Object.keys(selectedTransactions ?? {});
     const isExpenseReportType = queryJSON.type === CONST.SEARCH.DATA_TYPES.EXPENSE_REPORT;
 
-    const shouldPopoverUseScrollView =
-        headerButtonsOptions.length >= CONST.DROPDOWN_SCROLL_THRESHOLD || headerButtonsOptions.some((option) => (option.subMenuItems?.length ?? 0) >= CONST.DROPDOWN_SCROLL_THRESHOLD);
+    const popoverUseScrollView = shouldPopoverUseScrollView(headerButtonsOptions);
 
     const selectedItemsCount = useMemo(() => {
         if (!selectedTransactions) {
@@ -123,7 +123,7 @@ function SearchBulkActionsButton({queryJSON}: SearchBulkActionsButtonProps) {
                                 shouldAlwaysShowDropdownMenu
                                 isDisabled={headerButtonsOptions.length === 0}
                                 onPress={() => null}
-                                shouldPopoverUseScrollView={shouldPopoverUseScrollView}
+                                shouldPopoverUseScrollView={popoverUseScrollView}
                                 onSubItemSelected={(subItem) =>
                                     handleBulkPayItemSelected({
                                         item: subItem,
@@ -163,7 +163,7 @@ function SearchBulkActionsButton({queryJSON}: SearchBulkActionsButtonProps) {
                                 buttonSize={CONST.DROPDOWN_BUTTON_SIZE.SMALL}
                                 customText={selectionButtonText}
                                 options={headerButtonsOptions}
-                                shouldPopoverUseScrollView={shouldPopoverUseScrollView}
+                                shouldPopoverUseScrollView={popoverUseScrollView}
                                 onSubItemSelected={(subItem) =>
                                     handleBulkPayItemSelected({
                                         item: subItem,
diff --git a/src/components/SettlementButton/index.tsx b/src/components/SettlementButton/index.tsx
@@ -38,6 +38,7 @@ import {
     isIOUReport,
 } from '@libs/ReportUtils';
 import {handleUnvalidatedUserNavigation, useSettlementButtonPaymentMethods} from '@libs/SettlementButtonUtils';
+import shouldPopoverUseScrollView from '@libs/shouldPopoverUseScrollView';
 import {shouldRestrictUserBillableActions} from '@libs/SubscriptionUtils';
 import {setPersonalBankAccountContinueKYCOnSuccess} from '@userActions/BankAccounts';
 import {approveMoneyRequest} from '@userActions/IOU';
@@ -579,8 +580,7 @@ function SettlementButton({
 
     const shouldUseSplitButton = hasPreferredPaymentMethod || !!lastPaymentPolicy || ((isExpenseReport || isInvoiceReport) && hasIntentToPay);
     const shouldLimitWidth = shouldUseShortForm && shouldUseSplitButton && !paymentButtonOptions.length;
-    const shouldPopoverUseScrollView =
-        paymentButtonOptions.length >= CONST.DROPDOWN_SCROLL_THRESHOLD || paymentButtonOptions.some((option) => (option.subMenuItems?.length ?? 0) >= CONST.DROPDOWN_SCROLL_THRESHOLD);
+    const popoverUseScrollView = shouldPopoverUseScrollView(paymentButtonOptions);
 
     return (
         <KYCWall
@@ -625,7 +625,7 @@ function SettlementButton({
                     }}
                     style={style}
                     shouldUseShortForm={shouldUseShortForm}
-                    shouldPopoverUseScrollView={shouldPopoverUseScrollView}
+                    shouldPopoverUseScrollView={popoverUseScrollView}
                     containerStyles={paymentButtonOptions.length > 5 ? styles.settlementButtonListContainer : {}}
                     wrapperStyle={[wrapperStyle, shouldLimitWidth ? styles.settlementButtonShortFormWidth : {}]}
                     disabledStyle={disabledStyle}
diff --git a/src/libs/Navigation/helpers/getStateFromPath.ts b/src/libs/Navigation/helpers/getStateFromPath.ts
@@ -34,11 +34,11 @@ function getStateFromPath(path: Route): PartialState<NavigationState> {
 
         // Get the currently focused route from the base path to check permissions
         const focusedRoute = findFocusedRouteWithOnyxTabGuard(getStateFromPath(pathWithoutDynamicSuffix) ?? {});
-        const entryScreens: Screen[] = DYNAMIC_ROUTES[dynamicRoute as DynamicRouteKey]?.entryScreens ?? [];
+        const entryScreens: ReadonlyArray<Screen | '*'> = DYNAMIC_ROUTES[dynamicRoute as DynamicRouteKey]?.entryScreens ?? [];
 
         // Check if the focused route is allowed to access this dynamic route
         if (focusedRoute?.name) {
-            if (entryScreens.includes(focusedRoute.name as Screen)) {
+            if (entryScreens.some((s) => s === '*' || s === focusedRoute.name)) {
                 // Generate navigation state for the dynamic route
                 const dynamicRouteState = getStateForDynamicRoute(normalizedPath, dynamicRoute as DynamicRouteKey, focusedRoute?.params as Record<string, unknown> | undefined);
                 return dynamicRouteState;
diff --git a/src/libs/shouldPopoverUseScrollView.ts b/src/libs/shouldPopoverUseScrollView.ts
@@ -0,0 +1,8 @@
+import type {DropdownOption} from '@components/ButtonWithDropdownMenu/types';
+import CONST from '@src/CONST';
+
+function shouldPopoverUseScrollView<T>(options: Array<DropdownOption<T>>): boolean {
+    return options.length >= CONST.DROPDOWN_SCROLL_THRESHOLD || options.some((option) => (option.subMenuItems?.length ?? 0) >= CONST.DROPDOWN_SCROLL_THRESHOLD);
+}
+
+export default shouldPopoverUseScrollView;
diff --git a/tests/navigation/getStateFromPathTests.ts b/tests/navigation/getStateFromPathTests.ts
@@ -44,6 +44,10 @@ jest.mock('@src/ROUTES', () => ({
             path: 'suffix-b-from-multi',
             entryScreens: ['DynamicMultiSegScreen'],
         },
+        WILDCARD_SUFFIX: {
+            path: 'wildcard-suffix',
+            entryScreens: ['*'],
+        },
     },
 }));
 
@@ -62,6 +66,7 @@ describe('getStateFromPath', () => {
     const dynamicSuffixBState = {routes: [{name: 'DynamicSuffixBScreen'}]};
     const dynamicMultiSegState = {routes: [{name: 'DynamicMultiSegScreen', params: focusedRouteParams}]};
     const dynamicMultiSegLayerState = {routes: [{name: 'DynamicMultiSegLayerScreen'}]};
+    const dynamicWildcardState = {routes: [{name: 'DynamicWildcardScreen'}]};
 
     beforeEach(() => {
         jest.clearAllMocks();
@@ -79,6 +84,9 @@ describe('getStateFromPath', () => {
             if (dynamicRouteKey === 'MULTI_SEG_LAYER') {
                 return dynamicMultiSegLayerState;
             }
+            if (dynamicRouteKey === 'WILDCARD_SUFFIX') {
+                return dynamicWildcardState;
+            }
             return {routes: [{name: 'UnknownDynamic'}]};
         });
     });
@@ -159,4 +167,27 @@ describe('getStateFromPath', () => {
             expect(mockGetStateForDynamicRoute).toHaveBeenCalledWith(fullPath, 'MULTI_SEG_LAYER', focusedRouteParams);
         });
     });
+
+    describe('wildcard entryScreens', () => {
+        it('should authorize any focused screen when entryScreens contains wildcard', () => {
+            const fullPath = '/base/wildcard-suffix';
+
+            const result = getStateFromPath(fullPath as unknown as Route);
+
+            expect(result).toBe(dynamicWildcardState);
+            expect(mockGetStateForDynamicRoute).toHaveBeenCalledWith(fullPath, 'WILDCARD_SUFFIX', focusedRouteParams);
+            expect(mockLogWarn).not.toHaveBeenCalled();
+        });
+
+        it('should authorize wildcard in a layered scenario where the inner screen is not explicitly listed', () => {
+            const fullPath = '/base/suffix-a/wildcard-suffix';
+
+            const result = getStateFromPath(fullPath as unknown as Route);
+
+            expect(result).toBe(dynamicWildcardState);
+            expect(mockGetStateForDynamicRoute).toHaveBeenCalledWith('/base/suffix-a', 'SUFFIX_A', focusedRouteParams);
+            expect(mockGetStateForDynamicRoute).toHaveBeenCalledWith(fullPath, 'WILDCARD_SUFFIX', focusedRouteParams);
+            expect(mockLogWarn).not.toHaveBeenCalled();
+        });
+    });
 });
diff --git a/tests/unit/components/MultifactorAuthentication/config/scenarios/index.test.ts b/tests/unit/components/MultifactorAuthentication/config/scenarios/index.test.ts
@@ -108,7 +108,7 @@ describe('MultifactorAuthentication Scenarios Config', () => {
             const setPinScenario = config[CONST.MULTIFACTOR_AUTHENTICATION.SCENARIO.SET_PIN_ORDER_CARD];
 
             expect(setPinScenario).toBeDefined();
-            expect(setPinScenario.allowedAuthenticationMethods).toStrictEqual([CONST.MULTIFACTOR_AUTHENTICATION.TYPE.BIOMETRICS]);
+            expect(setPinScenario.allowedAuthenticationMethods).toStrictEqual([CONST.MULTIFACTOR_AUTHENTICATION.TYPE.BIOMETRICS, CONST.MULTIFACTOR_AUTHENTICATION.TYPE.PASSKEYS]);
             expect(setPinScenario.action).toBeDefined();
             expect(setPinScenario.callback).toBeDefined();
             expect(typeof setPinScenario.callback).toBe('function');
diff --git a/tests/unit/shouldPopoverUseScrollViewTest.ts b/tests/unit/shouldPopoverUseScrollViewTest.ts

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "new.expensify",`
`3`		`- "version": "9.3.41-3",`
	`3`	`+ "version": "9.3.42-0",`
`4`	`4`	`"author": "Expensify, Inc.",`
`5`	`5`	`"homepage": "https://new.expensify.com",`
`6`	`6`	`"description": "New Expensify is the next generation of Expensify: a reimagination of payments based atop a foundation of chat.",`