[ON HOLD for #43065] Workspace - Workspace member can remove the owner

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 1.4.82-0
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail: N/A
Email or phone of affected tester (no customers): gocemate+a247@gmail.com
Issue reported by: Applause - Internal Team

Action Performed:

1. User A creates a Workspace and invite User B and User C
2. User B go to Workspace chat> Members> Add or remove other members and owner

Expected Result:

User B ( member ) should not be allowed to remove the owner

Actual Result:

Workspace member can remove the owner

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6511053_1718209248995.Recording__3186.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @CortneyOfstad (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[lanitochka17]

@CortneyOfstad FYI I haven't added the External label as I wasn't 100% sure about this issue. Please take a look and add the label if you agree it's a bug and can be handled by external contributors

[Krishna2323]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Workspace - Workspace member can remove the owner

What is the root cause of that problem?

Selecting members is always selected.

App/src/pages/RoomMembersPage.tsx

Line 278 in 073ce7f

canSelectMultiple

What changes do you think we should make in order to solve the problem?

We should get the policy and check if the current user is policy admin and only then allow selection.

    const reportPolicy = useMemo(() => policies?.[`${ONYXKEYS.COLLECTION.POLICY}${report?.policyID ?? ''}`], [policies, report?.policyID]);
    const isPolicyAdmin = PolicyUtils.isPolicyAdmin(reportPolicy ?? {});
    const isPolicyExpenseChat = ReportUtils.isPolicyExpenseChat(report);
    
    // Pass to SelectionList
    canSelectMultiple={isPolicyExpenseChat ? isPolicyAdmin : true}

We should also hide the buttons at the top and searchbar if needed.

We also need to update toggleUser, we can either open profile page or we can disable the options by adding optional value (|| !isPolicyAdmin,) to participants object in getMemberOptions.

    /** Toggle user from the selectedMembers list */
    const toggleUser = useCallback(
        ({accountID, pendingAction}: ListItem) => {
            if (pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE || !accountID) {
                return;
            }

            if (!isPolicyAdmin) {
                Navigation.navigate(ROUTES.PROFILE.getRoute(accountID, Navigation.getActiveRoute()));
                return;
            }
            // Add or remove the user if the checkbox is enabled
            if (selectedMembers.includes(accountID)) {
                removeUser(accountID);
            } else {
                addUser(accountID);
            }
        },
        [selectedMembers, addUser, removeUser, isPolicyAdmin],
        
        // If we want to make the options disabled then update `isDisabled` property in `getMemberOptions`.
        isDisabled: accountID === session?.accountID || pendingChatMember?.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE || !isPolicyAdmin

What alternative solutions did you explore? (Optional)

I think we don't even need to check for isPolicyExpenseChat, we can directly create a const and pass it to canSelectMultiple={isPolicyAdmin}.

    const isPolicyAdmin = useMemo(() => {
        if (!report?.policyID || policies === null) {
            return false;
        }
        const reportPolicy = policies?.[`${ONYXKEYS.COLLECTION.POLICY}${report?.policyID ?? ''}`];
        return PolicyUtils.isPolicyAdmin(reportPolicy ?? {});
    }, [report?.policyID, policies]);

[Krishna2323]

Proposal Updated

• Added alternative

[bernhardoj]

I think this is being handled in #43065

[CortneyOfstad]

Yep, this is being tackled within that PR, so going to put this on-hold so we can keep an eye on it 👍

[CortneyOfstad]

Went into production 2 days ago 🎉 Will keep this open until the hold period is open 👍

[CortneyOfstad]

Hold period is complete, so closing!!