Merge branch 'main' into fix/54290

.github/actionlint.yaml

@@ -2,7 +2,7 @@
 self-hosted-runner:
   labels:
     - ubuntu-latest-xl
-    - macos-13-large
-    - macos-13-xlarge
+    - macos-15-large
+    - macos-15-xlarge
     - ubuntu-latest-reassure-tests
     - macos-12

.github/workflows/deploy.yml

@@ -137,7 +137,7 @@ jobs:
       - name: Setup Node
         id: setup-node
         uses: ./.github/actions/composite/setupNode
-        with: 
+        with:
           IS_HYBRID_BUILD: 'true'
 
       - name: Run grunt build
@@ -166,8 +166,9 @@ jobs:
         env:
           OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
         run: |
-          op document get --output ./upload-key.keystore upload-key.keystore 
-          op document get --output ./android-fastlane-json-key.json android-fastlane-json-key.json
+          op read op://Mobile-Deploy-CI/firebase.json/firebase.json --force --out-file ./firebase.json
+          op read op://Mobile-Deploy-CI/upload-key.keystore/upload-key.keystore --force --out-file ./upload-key.keystore
+          op read op://Mobile-Deploy-CI/android-fastlane-json-key.json/android-fastlane-json-key.json --force --out-file ./android-fastlane-json-key.json
           # Copy the keystore to the Android directory for Fullstory
           cp ./upload-key.keystore Mobile-Expensify/Android 
 
@@ -218,7 +219,7 @@ jobs:
           else
               echo "Skipping the completion of the previous version rollout"
           fi
-          
+
           # Submit the new version for review and slow rollout when it's approved
           bundle exec fastlane android upload_google_play_production_hybrid_rollout
         env:
@@ -230,6 +231,31 @@ jobs:
         env:
           BROWSERSTACK: ${{ secrets.BROWSERSTACK }}
 
+      - name: Generate APK from AAB
+        run: |
+          json=$(curl -s https://api.github.com/repos/google/bundletool/releases/latest)
+          downloadUrl=$(echo "$json" | jq -r ".assets | .[].browser_download_url")
+          curl "$downloadUrl" -4 -sL -o 'bundletool.jar'
+          java -jar bundletool.jar build-apks --bundle=${{ env.aabPath }} --output=Expensify.apks \
+            --mode=universal \
+            --ks=upload-key.keystore \
+            --ks-pass=pass:${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_PASSWORD }} \
+            --ks-key-alias=${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_ALIAS }} \
+            --key-pass=pass:${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEY_PASSWORD }}
+          
+          unzip -p Expensify.apks universal.apk > Expensify.apk
+
+      - name: Upload Android APK build artifact
+        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: android-hybrid-apk-artifact
+          path: Expensify.apk
+
+      - name: Upload Android build to Firebase distribution
+        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
+        run: bundle exec fastlane android upload_firebase_distribution
+
       - name: Upload Android build artifact
         if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
         uses: actions/upload-artifact@v4
@@ -313,8 +339,8 @@ jobs:
     name: Build and deploy iOS
     needs: prep
     env:
-      DEVELOPER_DIR: /Applications/Xcode_15.2.0.app/Contents/Developer
-    runs-on: macos-13-xlarge
+      DEVELOPER_DIR: /Applications/Xcode_16.2.0.app/Contents/Developer
+    runs-on: macos-15-xlarge
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -327,7 +353,7 @@ jobs:
         uses: ./.github/actions/composite/setupNode
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1.190.0
+        uses: ruby/setup-ruby@v1.204.0
         with:
           bundler-cache: true
 
@@ -428,9 +454,9 @@ jobs:
   iOS_hybrid:
     name: Build and deploy iOS HybridApp
     needs: prep
-    runs-on: macos-13-xlarge
+    runs-on: macos-15-xlarge
     env:
-      DEVELOPER_DIR: /Applications/Xcode_15.2.0.app/Contents/Developer
+      DEVELOPER_DIR: /Applications/Xcode_16.2.0.app/Contents/Developer
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -451,11 +477,11 @@ jobs:
       - name: Setup Node
         id: setup-node
         uses: ./.github/actions/composite/setupNode
-        with: 
+        with:
           IS_HYBRID_BUILD: 'true'
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1.190.0
+        uses: ruby/setup-ruby@v1.204.0
         with:
           bundler-cache: true
 
@@ -488,9 +514,10 @@ jobs:
         env:
           OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
         run: |
-          op document get --output ./OldApp_AppStore.mobileprovision OldApp_AppStore
-          op document get --output ./OldApp_AppStore_Share_Extension.mobileprovision OldApp_AppStore_Share_Extension
-          op document get --output ./OldApp_AppStore_Notification_Service.mobileprovision OldApp_AppStore_Notification_Service
+          op read op://Mobile-Deploy-CI/firebase.json/firebase.json --force --out-file ./firebase.json
+          op read op://Mobile-Deploy-CI/OldApp_AppStore/OldApp_AppStore.mobileprovision --force --out-file ./OldApp_AppStore.mobileprovision
+          op read op://Mobile-Deploy-CI/OldApp_AppStore_Share_Extension/OldApp_AppStore_Share_Extension.mobileprovision --force --out-file ./OldApp_AppStore_Share_Extension.mobileprovision
+          op read op://Mobile-Deploy-CI/OldApp_AppStore_Notification_Service/OldApp_AppStore_Notification_Service.mobileprovision --force --out-file ./OldApp_AppStore_Notification_Service.mobileprovision
 
       - name: Decrypt AppStore profile
         run: cd ios && gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output NewApp_AppStore.mobileprovision NewApp_AppStore.mobileprovision.gpg
@@ -537,8 +564,8 @@ jobs:
         run: |
           # Complete the previous version rollout
           bundle exec fastlane ios complete_hybrid_rollout
-          
-          # Submit the new version for review and phased rollout when it's approved 
+
+          # Submit the new version for review and phased rollout when it's approved
           bundle exec fastlane ios submit_hybrid_for_rollout
         env:
           VERSION: ${{ steps.getIOSVersion.outputs.IOS_VERSION }}
@@ -549,6 +576,10 @@ jobs:
         env:
           BROWSERSTACK: ${{ secrets.BROWSERSTACK }}
 
+      - name: Upload iOS build to Firebase distribution
+        if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
+        run: bundle exec fastlane ios upload_firebase_distribution
+
       - name: Upload iOS build artifact
         if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
         uses: actions/upload-artifact@v4
@@ -756,6 +787,7 @@ jobs:
             "./android-sourcemaps-artifact/index.android.bundle.map#android-sourcemap.js.map"
             "./android-aab-artifact/app-production-release.aab#android.aab"
             "./android-hybrid-build-artifact/Expensify-release.aab#android-hybrid.aab"
+            "./android-hybrid-apk-artifact/Expensify.apk#android-hybrid.apk"
             "./android-hybrid-sourcemap-artifact/index.android.bundle.map#android-hybrid-sourcemap.js.map"
             "./desktop-staging-sourcemaps-artifact/desktop-staging-merged-source-map.js.map#desktop-staging-sourcemap.js.map"
             "./desktop-staging-build-artifact/NewExpensify.dmg#desktop-staging.dmg"

.github/workflows/testBuild.yml

@@ -141,8 +141,8 @@ jobs:
     needs: [validateActor, getBranchRef]
     if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }}
     env:
-      DEVELOPER_DIR: /Applications/Xcode_15.2.0.app/Contents/Developer
-    runs-on: macos-13-xlarge
+      DEVELOPER_DIR: /Applications/Xcode_16.2.0.app/Contents/Developer
+    runs-on: macos-15-xlarge
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -163,10 +163,10 @@ jobs:
         uses: ./.github/actions/composite/setupNode
 
       - name: Setup XCode
-        run: sudo xcode-select -switch /Applications/Xcode_15.2.0.app
+        run: sudo xcode-select -switch /Applications/Xcode_16.2.0.app
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1.190.0
+        uses: ruby/setup-ruby@v1.204.0
         with:
           bundler-cache: true
 

.github/workflows/testBuildHybrid.yml

@@ -197,8 +197,8 @@ jobs:
     needs: [validateActor, getBranchRef]
     if: ${{ fromJSON(needs.validateActor.outputs.READY_TO_BUILD) }}
     env:
-      DEVELOPER_DIR: /Applications/Xcode_15.2.0.app/Contents/Developer
-    runs-on: macos-13-xlarge
+      DEVELOPER_DIR: /Applications/Xcode_16.2.0.app/Contents/Developer
+    runs-on: macos-15-xlarge
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -235,7 +235,7 @@ jobs:
           echo "PULL_REQUEST_NUMBER=$PULL_REQUEST_NUMBER" >> .env.adhoc
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1.190.0
+        uses: ruby/setup-ruby@v1.204.0
         with:
           bundler-cache: true
 

Gemfile.lock

@@ -165,6 +165,9 @@ GEM
       apktools (~> 0.7)
       aws-sdk-s3 (~> 1)
       mime-types (~> 3.3)
+    fastlane-plugin-firebase_app_distribution (0.10.0)
+      google-apis-firebaseappdistribution_v1 (~> 0.3.0)
+      google-apis-firebaseappdistribution_v1alpha (~> 0.2.0)
     fastlane-sirp (1.0.0)
       sysrandom (~> 1.0)
     ffi (1.17.0)
@@ -184,6 +187,10 @@ GEM
       representable (~> 3.0)
       retriable (>= 2.0, < 4.a)
       rexml
+    google-apis-firebaseappdistribution_v1 (0.3.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-firebaseappdistribution_v1alpha (0.2.0)
+      google-apis-core (>= 0.11.0, < 2.a)
     google-apis-iamcredentials_v1 (0.17.0)
       google-apis-core (>= 0.11.0, < 2.a)
     google-apis-playcustomapp_v1 (0.13.0)
@@ -229,7 +236,7 @@ GEM
     molinillo (0.8.0)
     multi_json (1.15.0)
     multipart-post (2.4.1)
-    nanaimo (0.4.0)
+    nanaimo (0.3.0)
     nap (1.1.0)
     naturally (2.2.1)
     netrc (0.11.0)
@@ -274,12 +281,12 @@ GEM
     uber (0.1.0)
     unicode-display_width (2.6.0)
     word_wrap (1.0.0)
-    xcodeproj (1.27.0)
+    xcodeproj (1.25.1)
       CFPropertyList (>= 2.3.3, < 4.0)
       atomos (~> 0.1.3)
       claide (>= 1.0.2, < 2.0)
       colored2 (~> 3.1)
-      nanaimo (~> 0.4.0)
+      nanaimo (~> 0.3.0)
       rexml (>= 3.3.6, < 4.0)
     xcpretty (0.3.0)
       rouge (~> 2.0.7)
@@ -298,6 +305,7 @@ DEPENDENCIES
   cocoapods (= 1.15.2)
   fastlane (~> 2, >= 2.222.0)
   fastlane-plugin-aws_s3
+  fastlane-plugin-firebase_app_distribution
   xcodeproj (< 1.26.0)
   xcpretty (~> 0)
 

android/app/build.gradle

@@ -110,8 +110,8 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         multiDexEnabled rootProject.ext.multiDexEnabled
-        versionCode 1009008200
-        versionName "9.0.82-0"
+        versionCode 1009008401
+        versionName "9.0.84-1"
         // Supported language variants must be declared here to avoid from being removed during the compilation.
         // This also helps us to not include unnecessary language variants in the APK.
         resConfigs "en", "es"

docs/_sass/_main.scss

@@ -131,7 +131,7 @@ details[open] > summary {
 
 h1,
 summary {
-    font-family: 'Expensify Mono', 'SFMono-Regular', monospace, Arial, sans-serif;
+    font-family: 'Expensify New Kansas', 'Helvetica Neue', 'Helvetica', Arial, sans-serif;
     font-weight: 500;
     font-size: larger;
 }

docs/articles/expensify-classic/bank-accounts-and-payments/payments/Receive-and-Pay-Bills.md

@@ -42,7 +42,7 @@ Expensify makes it easy to manage and pay vendor bills with a straightforward wo
 ## Bill Pay Workflow  
 
 1. **SmartScan & Create**: When a vendor sends a bill, Expensify automatically SmartScans the document and creates a bill.  
-2. **Submission to Primary Contact**: The bill is submitted to the primary contact, who can review it on the Reports page under their default group policy.  
+2. **Submission to Primary Contact**: The bill is submitted to the primary contact, who can review it on the Reports page under their default group workspace.  
 3. **Communication**: If the approver needs clarification, they can communicate directly with the sender via the invoice linked to the bill.  
 4. **Approval Workflow**: Once reviewed, the bill follows your workspace’s approval process. The final approver handles the payment.  
 5. **Accounting Integration**: During approval, the bill is coded with the correct GL codes from your connected accounting software. Once approved, it can be exported back to your accounting system. 

docs/articles/expensify-classic/connections/quickbooks-desktop/Configure-Quickbooks-Desktop.md

@@ -22,9 +22,9 @@ The following steps will determine how data will be exported from Expensify to Q
         - **Check**: A single itemized check for each Expensify report.
         - **Journal Entry**: A single itemized journal entry for each Expensify report.
 - **Non-reimbursable expenses**: Non-reimbursable options include:
+        - **Credit Card**: Each expense appears as a separate credit card transaction with a post date that matches your credit card statement. If you centrally manage company cards through your domain, you can export expenses from each card to a specific QuickBooks account by clicking Edit Exports next to each user’s card. To display the merchant name in the payee field in QuickBooks Desktop, ensure that a matching Vendor exists in QuickBooks. Expensify searches for an exact match during export. If no match is found, the payee is mapped to a Credit Card Misc. Vendor created by Expensify.
+        - **Check**: Expenses are exported as individual itemized checks for each Expensify report. The check is written to the “vendor,” which is the person who created or submitted the report in Expensify.
         - **Vendor Bill**: Each Expensify report results in a single itemized vendor bill. The bill is associated with the “vendor,” which is the individual responsible for creating or submitting the report in Expensify.
-        - **Credit Card expenses**: Each expense appears as a separate credit card transaction with a post date that matches your credit card statement. If you centrally manage company cards through your domain, you can export expenses from each card to a specific QuickBooks account by clicking Edit Exports next to each user’s card. To display the merchant name in the payee field in QuickBooks Desktop, ensure that a matching Vendor exists in QuickBooks. Expensify searches for an exact match during export. If no match is found, the payee is mapped to a Credit Card Misc. Vendor created by Expensify.
-        - **Debit Card expenses**: Expenses are exported as individual itemized checks for each Expensify report. The check is written to the “vendor,” which is the person who created or submitted the report in Expensify.
 
 # Step 2: Configure coding/import settings
 

docs/articles/expensify-classic/expensify-card/Deactivate-or-cancel-an-Expensify-Card.md

@@ -4,25 +4,41 @@ description: Close an Expensify Card
 ---
 <div id="expensify-classic" markdown="1">
 
-A cardholder or a Domain Admin can cancel an Expensify Card. You may want to cancel a card:
-- To cancel an old Expensify Card after upgrading to the new Expensify Visa® Commercial Card
+A cardholder can cancel an Expensify Card themselves, or a Domain Admin can deactivate it. You may want to cancel or deactivate a card:
 - After a fraudulent or suspicious charge
+- When an Expensify Card is lost or damaged
 - After an employee leaves the company
 
+# Cardholders
+
+To cancel an Expensify Card assigned to you,
+
+1. Hover over Settings, then click **Account**.
+2. Click the **Credit Card Import** tab.
+3. Click **Request a New Card** next to the card.
+4. Choose a reason.
+5. Confirm your address details for shipping a new card.
+6. Consult this [guide](https://help.expensify.com/articles/expensify-classic/expensify-card/Dispute-A-Transaction) for how to dispute fraudulent transactions (where relevant).
+
 # Domain Admins
 
-To cancel an employee's Expensify Card as a Domain Admin,
+To deactivate an employee's Expensify Card as a Domain Admin,
 
 1. Hover over Settings, then click **Domains**.
 2. Click the name of the domain.
-3. Next to the card, click **Terminate**.
+3. Next to the card, click **Edit Limit**.
+4. Ensure the Custom Smart Limit toggle is enabled to be able to set a specific card limit. Otherwise, the card limit will be determined by the limit set for the group that the employee is in.
+5. In the Limit Amount field, set the limit to $0. The card will be disabled for use until the limit is increased.
+6. Click **Save**.
 
-# Cardholders
+Note: If you have concerns about fraudulent access to a Domain Admin's user account, please message Concierge or email [email protected] immediately. If necessary, our support team can manually suspend Expensify cards outside of the Expensify Domain as a temporary measure if your account is compromised.
 
-To cancel an Expensify Card assigned to you,
+# Terminating an old Expensify Card after upgrading to the new Expensify Visa® Commercial Card
 
-1. Hover over Settings, then click **Account**.
-2. Click the **Credit Card Import** tab.
-3. Click **Cancel** next to the card.
+To terminate old Expensify Cards that have since been upgraded,
+
+1. Hover over Settings, then click **Domains**.
+2. Click the name of the domain.
+3. Next to the card, click **Terminate**.
 
 </div>

docs/articles/expensify-classic/settings/Enable-two-factor-authentication.md

@@ -39,10 +39,10 @@ When you log in to Expensify in the future, you’ll be emailed a magic code tha
 
 If you have lost your mobile device and can’t find your recovery codes, your Domain Admin can complete the steps below to reset your 2FA **only if (1) you use a company email address or email address on a domain that you own and (2) the Domain Admin also has 2FA enabled**:
 
-Go to Settings > Domains > Domain Members and click **Edit Settings** for your email address. 
-They then click **Reset** to reset two-factor authentication (2FA) on your account. 
+If your domain has 2FA enabled, a domain admin can follow Settings > Domains > Domain Members and click **Edit Settings** for your email address. 
+They can then click **Reset** to reset two-factor authentication (2FA) on your account. This will allow you to gain access to your account on the web or mobile app and configure 2FA again.
 
-This will allow you to gain access to your account on the web or mobile app and reconfigure 2FA again.
+If your domain does not have 2FA enabled, a domain admin can follow Settings > Domains > Domain Members and enable Two Factor Authentication. Then they can follow the previously mentioned steps to reset 2FA for your account.
 
 {% include info.html %}
 If you use a public email address such as gmail, hotmail, or yahoo, we unfortunately can’t help you disable your 2FA setting. If you are unable to find your recovery codes, you may need to create a new Expensify account with a different email address.