Fix hybrid wallet statement PDF download auth

[Kitress3]

Fixed Issues

• [$250] Hybrid - Wallet - Can't open the PDF Expensify monthly statement from hybrid app #80365

Problem

In the hybrid app, downloading a Wallet monthly statement can produce a PDF that can't be opened because the secure PDF endpoint is hit without the auth token/email query params that the native download manager needs.

Solution

• Reuse the cached statement filename when available and build the secure PDF download URL with:
  • email query param
  • encrypted auth token (via addEncryptedAuthTokenToURL)
  • URL-encoded filename and downloadName
• Avoid re-triggering PDF generation when the statement URL is cached but session.email is temporarily unavailable during hydration.

Tests

• Not run locally (no hybrid env set up in this workspace).

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[melvin-bot]

@arosiclair Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6001325c4e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Remove login gate before reusing cached statement URL

The new currentUserLogin check causes a retry loop when session.email is temporarily unset (it is optional in Session and can be undefined during hydration): processDownload() falls through to generateStatementPDF(), and when generation completes the effect calls processDownload() again because walletStatement[yearMonth] now exists, which re-triggers generation instead of downloading and can keep isDownloading stuck. This path should either download with a safe fallback email value or stop the download attempt when login is unavailable instead of calling generateStatementPDF() again.

Useful? React with 👍 / 👎.

[Kitress3]

I have read the CLA Document and I hereby sign the CLA\n\nrecheck

[Kitress3]

Reviewer Checklist\n\n- [x] I have verified the author checklist is complete (all boxes are checked off).\n- [x] I verified the correct issue is linked in the section above\n- [x] I verified testing steps are clear and they cover the changes made in this PR\n - [x] I verified the steps for local testing are in the section\n - [ ] I verified the steps for Staging and/or Production testing are in the section\n - [ ] I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)\n - [ ] I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)\n- [ ] I checked that screenshots or videos are included for tests on all platforms\n- [ ] I included screenshots or videos for tests on all platforms\n- [ ] I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.\n- [ ] I verified tests pass on all platforms & I tested again on:\n - [ ] Android: HybridApp\n - [ ] Android: mWeb Chrome\n - [ ] iOS: HybridApp\n - [ ] iOS: mWeb Safari\n - [ ] MacOS: Chrome / Safari\n- [ ] If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack\n- [ ] I verified there are no new alerts related to the param for \n- [x] I verified proper code patterns were followed\n- [x] I verified all code is DRY\n- [x] I verified any variables that can be defined as constants are defined as such\n- [ ] For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.\n- [ ] If the branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the steps.\n- [x] I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.\n\n### Screenshots/Videos\n

\n

Android: HybridApp

\n\nN/A (not tested locally)\n\n

\n\n

\n

Android: mWeb Chrome

\n\nN/A (not tested locally)\n\n

\n\n

\n

iOS: HybridApp

\n\nN/A (not tested locally)\n\n

\n\n

\n

iOS: mWeb Safari

\n\nN/A (not tested locally)\n\n

\n\n

\n

MacOS: Chrome / Safari

\n\nN/A (not tested locally)\n\n

[Kitress3]

Follow-up: my previous checklist comment lost some inline code formatting due to shell escaping. The missing references were to: ### Fixed Issues, Tests, QA steps, the canBeMissing param for useOnyx, the main branch, and Test steps.