[$250] Expense - Submit expense option is not disabled for users who are invited to expense report

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.0.13-3
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail: https://expensify.testrail.io/index.php?/tests/view/4771930
Issue reported by: Applause - Internal Team

Action Performed:

1. Go to staging.new.expensify.com
2. [User A] Submit two expenses to User B
3. [User A] Click on the expense preview in the main chat to go to expense report
4. [User A] Send a user mention containing User C
5. [User A] Click Invite from the whisper message
6. [User A] Send a message in the transaction thread
7. [User C] Open the invited expense report
8. [User C] Click + > Submit expense > Manual
9. [User C] Enter amount > Next

Expected Result:

Submit expense option should be disabled for the users who are invited to the expense rep

Actual Result:

Submit expense option is not disabled for the users who are invited to the expense report
Invited user can go through the flow but blocked at the confirmation page

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6553848_1722011341978.20240727_002330.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01966947a9e891013b
• Upwork Job ID: 1821180390230444112
• Last Price Increase: 2024-08-07
• Automatic offers:
• dukenv0307 | Reviewer | 103502917
• nkdengineer | Contributor | 103502920

Issue Owner

Current Issue Owner: @zanyrenney

[melvin-bot]

Triggered auto assignment to @OfstadC (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[lanitochka17]

@OfstadC FYI I haven't added the External label as I wasn't 100% sure about this issue. Please take a look and add the label if you agree it's a bug and can be handled by external contributors

[lanitochka17]

We think that this bug might be related to #wave-collect - Release 1

[nkdengineer]

Edited by proposal-police: This proposal was edited at 2023-10-21T22:06:00Z.

Proposal

Please re-state the problem that we are trying to solve in this issue.

Submit expense option is not disabled for the users who are invited to the expense report
Invited user can go through the flow but blocked at the confirmation page

What is the root cause of that problem?

For the iou report, the policy is the personal policy of the user so canAddOrDeleteTransactions always returns true without checking whether the user can access the parent report or not.

App/src/libs/ReportUtils.ts

Lines 1604 to 1608 in 5e65276

	function canAddOrDeleteTransactions(moneyRequestReport: OnyxEntry<Report>): boolean {
	if (!isMoneyRequestReport(moneyRequestReport)) {
	return false;
	}

When we submit an expense, we get the participants from the chat report and in this case, the invited user can't access this report so participants is an empty object, and then the confirm button is disabled on the confirmation page

App/src/libs/actions/IOU.ts

Line 7315 in 5e65276

const chatReportOtherParticipants = Object.keys(chatReport?.participants ?? {})

For the expense report, the invited user doesn't have the policy data of the expense report, and canAddTransactions also returns true in this case then the invited user can see the submit expense option in the expense report

App/src/libs/ReportUtils.ts

Line 6123 in 87c116b

return isReportInGroupPolicy(report) ? isOwnPolicyExpenseChat && canAddTransactions : canAddTransactions;

What changes do you think we should make in order to solve the problem?

We should check if the user can not access the parent report we will return false

if (!isMoneyRequestReport(moneyRequestReport) || !getParentReport(moneyRequestReport)?.reportID) {
    return false;
}

App/src/libs/ReportUtils.ts

Lines 1604 to 1608 in 5e65276

	function canAddOrDeleteTransactions(moneyRequestReport: OnyxEntry<Report>): boolean {
	if (!isMoneyRequestReport(moneyRequestReport)) {
	return false;
	}

What alternative solutions did you explore? (Optional)

Or we can check for iou report that will return false if the current user is not the manager and is not the owner of the iou report

if (isIOUReport(moneyRequestReport) && currentUserAccountID !== moneyRequestReport?.managerID && currentUserAccountID !== moneyRequestReport?.ownerAccountID) {
    return false;
}

App/src/libs/ReportUtils.ts

Lines 1604 to 1608 in 5e65276

	function canAddOrDeleteTransactions(moneyRequestReport: OnyxEntry<Report>): boolean {
	if (!isMoneyRequestReport(moneyRequestReport)) {
	return false;
	}

For the expense report, we can add the check isExpenseReport here

return (isReportInGroupPolicy(report) || isExpenseReport(report)) ? isOwnPolicyExpenseChat && canAddTransactions : canAddTransactions; 

App/src/libs/ReportUtils.ts

Line 6123 in 87c116b

return isReportInGroupPolicy(report) ? isOwnPolicyExpenseChat && canAddTransactions : canAddTransactions;

if (isExpenseReport(moneyRequestReport) && currentUserAccountID !== moneyRequestReport?.managerID) {
    return false;
}

or we can add a case in canAddOrDeleteTransactions for the expense report that will return false if the current user isn't the managerID (the submitter) of the expense report

[OfstadC]

Assigned to me while I was OoO - reassigning

[melvin-bot]

Triggered auto assignment to @zanyrenney (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[zanyrenney]

The desired v expected behaviour is a bit odd. I am not sure what the exact behaviour should be here as this seems like a pretty niche use case. Going to keep investigating in the collect room.

[zanyrenney]

Is the reason that there should be disabled, that they are being invited to an expense report of another user? That's the only case I can see that they should be and from submitting an expense on someone else's expense report? But I'm not clear on this otherwise. @lanitochka17 please can you confirm or add to the OP a bit more detail about the specific use case you are testing for. Thanks!

[zanyrenney]

Bump @lanitochka17

[lanitochka17]

Issue was found running the TC https://expensify.testrail.io/index.php?/tests/view/4771930

[zanyrenney]

Thank you!

[zanyrenney]

Adding external

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~01966947a9e891013b

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @dukenv0307 (External)

[dukenv0307]

@nkdengineer's proposal LGTM

🎀👀🎀 C+ reviewed

[melvin-bot]

📣 @dukenv0307 🎉 An offer has been automatically sent to your Upwork account for the Reviewer role 🎉 Thanks for contributing to the Expensify app!

Offer link
Upwork job

[melvin-bot]

📣 @nkdengineer 🎉 An offer has been automatically sent to your Upwork account for the Contributor role 🎉 Thanks for contributing to the Expensify app!

Offer link
Upwork job
Please accept the offer and leave a comment on the Github issue letting us know when we can expect a PR to be ready for review 🧑‍💻
Keep in mind: Code of Conduct | Contributing 📖

[nkdengineer]

@dukenv0307 we have a follow PR here, please take a look

[melvin-bot]

This issue has not been updated in over 15 days. @zanyrenney, @aldo-expensify, @dukenv0307, @nkdengineer eroding to Monthly issue.

P.S. Is everyone reading this sure this is really a near-term priority? Be brave: if you disagree, go ahead and close it out. If someone disagrees, they'll reopen it, and if they don't: one less thing to do!

[nkdengineer]

@zanyrenney The Issue was deployed to production 1 month ago. Should we process payment here

[aldo-expensify]

The payment summary would be:

@dukenv0307 in C+ role: $250
@nkdengineer in contributor role: $250

Correct?

[dukenv0307]

@aldo-expensify I agree

[nkdengineer]

@aldo-expensify I agree

[zanyrenney]

payment summary

@dukenv0307 in C+ role: $250 paid via upwork
@nkdengineer in contributor role: $250 paid via upwork