Force Amex to production API

src/libs/ApiUtils.ts

@@ -5,13 +5,13 @@ import CONST from '@src/CONST';
 import ONYXKEYS from '@src/ONYXKEYS';
 import type {Request} from '@src/types/onyx';
 import proxyConfig from '../../config/proxyConfig';
-import * as Environment from './Environment/Environment';
+import {getEnvironment} from './Environment/Environment';
 
 // To avoid rebuilding native apps, native apps use production config for both staging and prod
 // We use the async environment check because it works on all platforms
 let ENV_NAME: ValueOf<typeof CONST.ENVIRONMENT> = CONST.ENVIRONMENT.PRODUCTION;
 let shouldUseStagingServer = false;
-Environment.getEnvironment().then((envName) => {
+getEnvironment().then((envName) => {
     ENV_NAME = envName;
 
     // We connect here, so we have the updated ENV_NAME when Onyx callback runs
@@ -31,13 +31,13 @@ Environment.getEnvironment().then((envName) => {
 });
 
 /**
- * Get the currently used API endpoint
+ * Get the currently used API endpoint, unless forceProduction is set to true
  * (Non-production environments allow for dynamically switching the API)
  */
-function getApiRoot(request?: Request): string {
+function getApiRoot(request?: Request, forceProduction = false): string {
     const shouldUseSecure = request?.shouldUseSecure ?? false;
 
-    if (shouldUseStagingServer) {
+    if (shouldUseStagingServer && forceProduction !== true) {
         if (CONFIG.IS_USING_WEB_PROXY && !request?.shouldSkipWebProxy) {
             return shouldUseSecure ? proxyConfig.STAGING_SECURE : proxyConfig.STAGING;
         }

src/libs/actions/getCompanyCardBankConnection/index.tsx

@@ -25,10 +25,16 @@ export default function getCompanyCardBankConnection(policyID?: string, bankName
         isCorporate: 'true',
         scrapeMinDate: '',
     };
-    const commandURL = getApiRoot({
-        shouldSkipWebProxy: true,
-        command: '',
-    });
     const bank = CONST.COMPANY_CARDS.BANK_CONNECTIONS[bankConnection as keyof typeof CONST.COMPANY_CARDS.BANK_CONNECTIONS];
+
+    // The Amex connection whitelists only our production servers, so we need to always use the production API for American Express
+    const forceProductionAPI = bank === CONST.COMPANY_CARDS.BANK_CONNECTIONS.AMEX;
+    const commandURL = getApiRoot(
+        {
+            shouldSkipWebProxy: true,
+            command: '',
+        },
+        forceProductionAPI,
+    );
     return `${commandURL}partners/banks/${bank}/oauth_callback.php?${new URLSearchParams(params).toString()}`;
 }