[$250] Hybrid - Wallet - Can't open the PDF Expensify monthly statement from hybrid app

[nlemma]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.3.6-0
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: https://test-management.browserstack.com/projects/2219752/test-runs/TR-3236/folder/13177075/41237822/1141128457
Email or phone of affected tester (no customers): leungbratt6+p2p@gmail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Pixel 7 Pro /Android 16
App Component: Other

Action Performed:

Preconditions: Enable the wallet on 2 accounts you have access to. Both accounts should use USD as the currency. And transfer money over 1 month to have the Expensify statement in Concierge

1. Open the Hybrid app
2. Navigate to the Conciege chat
3. Tap on the "Your December 2025 Expensify statement."
4. Tap on the Download button on the top right
5. Navigate to the PDF file just downloaded
6. Tap on the PDF file to open

Expected Result:

Can open the PDF Expensify statement file like on the Web

Actual Result:

Can't open the PDF Expensify statement file after downloading from the hybrid app

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Bug7055363_1769069450988.statement.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022014736247309060720
• Upwork Job ID: 2014736247309060720
• Last Price Increase: 2026-01-23
• Automatic offers:
• linhvovan29546 | Contributor | 110280548

Issue Owner

Current Issue Owner: @linhvovan29546

[melvin-bot]

Triggered auto assignment to @CortneyOfstad (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022014736247309060720

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @suneox (External)

[yatin-italy]

Proposal

Please re-state the problem that we are trying to solve in this issue.

On the hybrid app (Android/iOS), downloading the Expensify monthly wallet statement produces a file that cannot be opened because the downloaded file is not a valid PDF, while the same download works on web and opens correctly.

What is the root cause of that problem?

In processDownload() in src/pages/wallet/WalletStatementPage.tsx, the secure PDF URL is constructed without adding the encrypted auth token or the required email query parameter. On web, this works because the browser automatically sends session cookies, so the request is authenticated. In the hybrid app, the native download manager does not share those cookies, so the request reaches the secure endpoint unauthenticated. As a result, the backend returns an HTML error/login page instead of a PDF file.

What changes do you think we should make in order to solve the problem?

File: src/pages/wallet/WalletStatementPage.tsx

1. Add imports

// File: src/pages/wallet/WalletStatementPage.tsx
import addEncryptedAuthTokenToURL from '@libs/addEncryptedAuthTokenToURL';
import * as Browser from '@libs/Browser';
import {emailSelector} from '@selectors/Session';

2. Read current user email (inside the component, with the other useOnyx / hooks):

// File: src/pages/wallet/WalletStatementPage.tsx
const [currentUserLogin] = useOnyx(ONYXKEYS.SESSION, {selector: emailSelector});

3. Replace the immediate-download block inside processDownload (the block that runs when walletStatement?.[yearMonth] exists).

Before:

// File: src/pages/wallet/WalletStatementPage.tsx
if (walletStatement?.[yearMonth]) {
    // We already have a file URL for this statement, so we can download it immediately
    const downloadFileName = `Expensify_Statement_${yearMonth}.pdf`;
    const fileName = walletStatement[yearMonth];
    const pdfURL = `${baseURL}secure?secureType=pdfreport&filename=${fileName}&downloadName=${downloadFileName}`;
    fileDownload(translate, pdfURL, downloadFileName).finally(() => setIsDownloading(false));
    return;
}

After:

// File: src/pages/wallet/WalletStatementPage.tsx
if (walletStatement?.[yearMonth] && currentUserLogin) {
    // We already have a file URL for this statement, so we can download it immediately.
    // Auth token and email are required so the hybrid app's native download manager can authenticate with the secure endpoint.
    const downloadFileName = `Expensify_Statement_${yearMonth}.pdf`;
    const fileName = walletStatement[yearMonth];
    const pdfURL = `${baseURL}secure?secureType=pdfreport&filename=${encodeURIComponent(fileName)}&downloadName=${encodeURIComponent(downloadFileName)}&email=${encodeURIComponent(currentUserLogin)}`;
    const pdfURLWithAuth = addEncryptedAuthTokenToURL(pdfURL, true);
    fileDownload(translate, pdfURLWithAuth, downloadFileName, '', Browser.isMobileSafari()).finally(() => setIsDownloading(false));
    return;
}

4. Update the processDownload dependency array to include currentUserLogin:

Before:

// File: src/pages/wallet/WalletStatementPage.tsx
}, [baseURL, isWalletStatementGenerating, translate, walletStatement, yearMonth]);

After:

// File: src/pages/wallet/WalletStatementPage.tsx
}, [baseURL, currentUserLogin, isWalletStatementGenerating, translate, walletStatement, yearMonth]);

What alternative solutions did you explore? (Optional)

None

[CortneyOfstad]

Hey @suneox! There is a proposal above for review when you have a chance. Thanks!

[suneox]

Thanks for all the proposals. I'll take another look at this one sometime today.