[HOLD for payment 2024-06-03] [$250] Workspace - Admin can access member details side bar after member leaves workspace

[izarutskaya]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 1.4.63-0
Reproducible in staging?: Y
Reproducible in production?: No, new feature
Logs: https://stackoverflow.com/c/expensify/questions/4856
Issue reported by: Applause-Internal team

Action Performed:

1. Navigate to staging.new.expensify.com
2. Invite user B to a workspace
3. Open the side bar for the invited member on the admin side
4. As the member leave the workspace
5. Refresh the page for both the member and the admin

Expected Result:

The side bar for the member should not be accessible after member leaves a workspace

Actual Result:

The side bar for the member remains open on the admin side after member leaves the workspace

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug6453311_1713426320100.bandicam_2024-04-18_10-41-05-637.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~014967949b89818bfd
• Upwork Job ID: 1781436162713444352
• Last Price Increase: 2024-04-26
• Automatic offers:
• alitoshmatov | Reviewer | 0
• tienifr | Contributor | 0

Issue Owner

Current Issue Owner: @laurenreidexpensify

[melvin-bot]

Triggered auto assignment to @madmax330 (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

Triggered auto assignment to @laurenreidexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[izarutskaya]

@laurenreidexpensify I haven't added the External label as I wasn't 100% sure about this issue. Please take a look and add the label if you agree it's a bug and can be handled by external contributors.

[izarutskaya]

We think this issue might be related to the #collect project.

[izarutskaya]

Production

bandicam.2024-04-18.12-56-59-071.mp4

[Nodebrute]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Admin can access member details side bar after member leaves workspace

What is the root cause of that problem?

We don't have any logic to handle cases like these.

What changes do you think we should make in order to solve the problem?

We can pass accountID or MemberLogin and then use it in below comment to show NotFoundPage. Then we can check if the user is still the member of policy. If not then we can show the not found page

App/src/pages/workspace/members/WorkspaceMemberDetailsPage.tsx

Line 132 in 3ec8f2f

<AdminPolicyAccessOrNotFoundWrapper policyID={policyID}>

App/src/pages/workspace/AdminPolicyAccessOrNotFoundWrapper.tsx

Line 46 in 3ec8f2f

const shouldShowNotFoundPage = isEmptyObject(props.policy) || !props.policy?.id || !PolicyUtils.isPolicyAdmin(props.policy);

What alternative solutions did you explore? (Optional)

[allgandalf]

Proposal

Please re-state the problem that we are trying to solve in this issue.

We show member details even when we the admin deletes the workspace.

What is the root cause of that problem?

This is surprising but in Workspace members details page we never have a check to see is we should show the content or block it in case the user haspendingAction is delete or is the employee has left the workspace or removed. This causes us to show the details of the deleted member when they have pendingAction of delete.

What changes do you think we should make in order to solve the problem?

We need to make use of FullPageNotFoundView here to not show the contents if the member state is pending for delete action.

We need to wrap ScreenWrapper with FullPageNotFoundView over here.

Then we need to pass shouldShow prop to FullPageNotFoundView component, we can set the value of shouldShow by checking if the current selected user exists or the state is in pending action is delete:

const shouldShowNotFoundPage = !member || member.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE;

And later pass it like:

<FullPageNotFoundView
                    shouldShow={shouldShowNotFoundPage}
                >

Result

Screen.Recording.2024-04-19.at.2.49.27.AM.mov

[thienlnam]

Doesn't look like it needs to be a blocker - I'm making it external though

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~014967949b89818bfd

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @alitoshmatov (External)

[saifelance]

Proposal

Please re-state the problem that we are trying to solve in this issue.

We show member details even when we the admin deletes the workspace.

What is the root cause of that problem?

This is surprising but in Workspace members details page we never have a check to see is we should show the content or block it in case the user haspendingAction is delete or is the employee has left the workspace or removed. This causes us to show the details of the deleted member when they have pendingAction of delete.

What changes do you think we should make in order to solve the problem?

We need to make use of FullPageNotFoundView here to not show the contents if the member state is pending for delete action.

We need to wrap ScreenWrapper with FullPageNotFoundView over here.

Then we need to pass shouldShow prop to FullPageNotFoundView component, we can set the value of shouldShow by checking if the current selected user exists or the state is in pending action is delete:

const shouldShowNotFoundPage = !member || member.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE;

And later pass it like:

<FullPageNotFoundView
                    shouldShow={shouldShowNotFoundPage}
                >

Result

Screen.Recording.2024-04-19.at.2.49.27.AM.mov

Implement a check to determine whether the content should be shown or blocked based on the pendingAction status of the member. You can set a boolean variable shouldShowNotFoundPage to true if the member doesn't exist or if their pendingAction is "delete."

const shouldShowNotFoundPage = !member || member.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE;

Wrap the ScreenWrapper component with the FullPageNotFoundView component, passing the shouldShow prop to it.

<FullPageNotFoundView shouldShow={shouldShowNotFoundPage}>
  <ScreenWrapper>
    {/* Content to be rendered if the member is not pending deletion */}
  </ScreenWrapper>
</FullPageNotFoundView>

[tienifr]

Proposal

Please re-state the problem that we are trying to solve in this issue.

The side bar for the member remains open on the admin side after member leaves the workspace

What is the root cause of that problem?

We never have the logic to disallow accessing member details side bar when member leaves workspace, or even when the "account" is never a member of the workspace at all. As long as the account id and the policy id in the route is correct, we're showing the screen.

What changes do you think we should make in order to solve the problem?

1. We need to show the not found page if the member here is empty, or it's pending delete. So we can add here

const prevMember = usePrevious(member);

    const shouldShowNotFoundPage = !member || (member.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE && prevMember?.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE);

You might notice the prevMember check, why do we need to add that? It's the similar case to here. If we don't check that prevMember.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE too, we'll have a regression where, for an existing member after selecting Remove from workspace in the member details page and confirming, it will show not found page briefly while the modal is closing. We had that same problem for workspace deletion and used the same approach to fix it.

So, if both member and prevMember are pending deletion, that means the user tries to access the member details page when the member is pending deletion. Meanwhile if member is pending deletion but prevMember is not, that means the user just deleted the workspace and we should not show not found page in this case.

2. Then we need to use that to show not found page when shouldShowNotFoundPage is true, by adding here

<FullPageNotFoundView shouldShow={shouldShowNotFoundPage}>

3. Now we have a small edge case where if the user opens workspace member details page in 2 tabs, and delete the member from 1 tab, the member page modal in the other tab will not be dismissed (and only becomes NotFoundPage after back-end API returns)

If we'd like to polish this too, we can again do the same as what we already do for the workspace initial page (see here):

• Do not goBack here
• When the member changes from "not pending delete" to "pending delete", that means the user just deleted the member details page, so we can do goBack now

useEffect(() => {
    if (!prevMember || prevMember?.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE || member?.pendingAction !== CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE) {
        return;
    }
    Navigation.goBack();
}, [member, prevMember]);

This will make sure the other member details tab will be dismissed too when we remove the member in one tab.

What alternative solutions did you explore? (Optional)

NA

[laurenreidexpensify]

@madmax330 yours to assign 👍

[melvin-bot]

📣 @alitoshmatov 🎉 An offer has been automatically sent to your Upwork account for the Reviewer role 🎉 Thanks for contributing to the Expensify app!

Offer link
Upwork job

[melvin-bot]

📣 @tienifr 🎉 An offer has been automatically sent to your Upwork account for the Contributor role 🎉 Thanks for contributing to the Expensify app!

Offer link
Upwork job
Please accept the offer and leave a comment on the Github issue letting us know when we can expect a PR to be ready for review 🧑‍💻
Keep in mind: Code of Conduct | Contributing 📖

[laurenreidexpensify]

@tienifr is there a draft PR up yet? Thanks

[tienifr]

I'm back from the holiday, I'll create the PR in a few hours

[madmax330]

Not overdue, waiting on the PR

[melvin-bot]

@madmax330 @alitoshmatov @laurenreidexpensify @tienifr this issue was created 2 weeks ago. Are we close to approving a proposal? If not, what's blocking us from getting this issue assigned? Don't hesitate to create a thread in #expensify-open-source to align faster in real time. Thanks!

[trjExpensify]

👋 Looks like the PR linked to this issue might have caused a regression here: #42555

[melvin-bot]

Reviewing label has been removed, please complete the "BugZero Checklist".

[melvin-bot]

The solution for this issue has been 🚀 deployed to production 🚀 in version 1.4.75-1 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

• fix: admin can access member details page after member leaves #41492

If no regressions arise, payment will be issued on 2024-06-03. 🎊

For reference, here are some details about the assignees on this issue:

• @alitoshmatov requires payment automatic offer (Reviewer)
• @tienifr requires payment automatic offer (Contributor)

[melvin-bot]

BugZero Checklist: The PR fixing this issue has been merged! The following checklist (instructions) will need to be completed before the issue can be closed:

• [@alitoshmatov] The PR that introduced the bug has been identified. Link to the PR:
• [@alitoshmatov] The offending PR has been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake. Link to comment:
• [@alitoshmatov] A discussion in #expensify-bugs has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner. Link to discussion:
• [@alitoshmatov] Determine if we should create a regression test for this bug.
• [@alitoshmatov] If we decide to create a regression test for the bug, please propose the regression test steps to ensure the same bug will not reach production again.
• [@laurenreidexpensify] Link the GH issue for creating/updating the regression test once above steps have been agreed upon:

[alitoshmatov]

• The PR that introduced the bug has been identified. Link to the PR: #35715 workspace member details page #37715
• The offending PR has been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake. Link to comment: https://github.com/Expensify/App/pull/37715/files#r1623639171
• A discussion in #expensify-bugs has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner. Link to discussion: No need
• Determine if we should create a regression test for this bug. No need

[laurenreidexpensify]

Payment Summary:

• C+ @alitoshmatov $250 paid in Upwork
• Contributor @tienifr $250 paid in Upwork