[$250] Expense - Submit expense option is not disabled for users who are invited to expense report

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.0.13-3
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail: https://expensify.testrail.io/index.php?/tests/view/4771930
Issue reported by: Applause - Internal Team

Action Performed:

1. Go to staging.new.expensify.com
2. [User A] Submit two expenses to User B
3. [User A] Click on the expense preview in the main chat to go to expense report
4. [User A] Send a user mention containing User C
5. [User A] Click Invite from the whisper message
6. [User A] Send a message in the transaction thread
7. [User C] Open the invited expense report
8. [User C] Click + > Submit expense > Manual
9. [User C] Enter amount > Next

Expected Result:

Submit expense option should be disabled for the users who are invited to the expense rep

Actual Result:

Submit expense option is not disabled for the users who are invited to the expense report
Invited user can go through the flow but blocked at the confirmation page

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6553848_1722011341978.20240727_002330.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01966947a9e891013b
• Upwork Job ID: 1821180390230444112
• Last Price Increase: 2024-08-07
• Automatic offers:
• dukenv0307 | Reviewer | 103502917
• nkdengineer | Contributor | 103502920

Issue Owner

Current Issue Owner: @zanyrenney

[melvin-bot]

Triggered auto assignment to @OfstadC (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[lanitochka17]

@OfstadC FYI I haven't added the External label as I wasn't 100% sure about this issue. Please take a look and add the label if you agree it's a bug and can be handled by external contributors

[lanitochka17]

We think that this bug might be related to #wave-collect - Release 1

[nkdengineer]

Edited by proposal-police: This proposal was edited at 2023-10-21T22:06:00Z.

Proposal

Please re-state the problem that we are trying to solve in this issue.

Submit expense option is not disabled for the users who are invited to the expense report
Invited user can go through the flow but blocked at the confirmation page

What is the root cause of that problem?

For the iou report, the policy is the personal policy of the user so canAddOrDeleteTransactions always returns true without checking whether the user can access the parent report or not.

App/src/libs/ReportUtils.ts

Lines 1604 to 1608 in 5e65276

	function canAddOrDeleteTransactions(moneyRequestReport: OnyxEntry<Report>): boolean {
	if (!isMoneyRequestReport(moneyRequestReport)) {
	return false;
	}

When we submit an expense, we get the participants from the chat report and in this case, the invited user can't access this report so participants is an empty object, and then the confirm button is disabled on the confirmation page

App/src/libs/actions/IOU.ts

Line 7315 in 5e65276

const chatReportOtherParticipants = Object.keys(chatReport?.participants ?? {})

For the expense report, the invited user doesn't have the policy data of the expense report, and canAddTransactions also returns true in this case then the invited user can see the submit expense option in the expense report

App/src/libs/ReportUtils.ts

Line 6123 in 87c116b

return isReportInGroupPolicy(report) ? isOwnPolicyExpenseChat && canAddTransactions : canAddTransactions;

What changes do you think we should make in order to solve the problem?

We should check if the user can not access the parent report we will return false

if (!isMoneyRequestReport(moneyRequestReport) || !getParentReport(moneyRequestReport)?.reportID) {
    return false;
}

App/src/libs/ReportUtils.ts

Lines 1604 to 1608 in 5e65276

	function canAddOrDeleteTransactions(moneyRequestReport: OnyxEntry<Report>): boolean {
	if (!isMoneyRequestReport(moneyRequestReport)) {
	return false;
	}

What alternative solutions did you explore? (Optional)

Or we can check for iou report that will return false if the current user is not the manager and is not the owner of the iou report

if (isIOUReport(moneyRequestReport) && currentUserAccountID !== moneyRequestReport?.managerID && currentUserAccountID !== moneyRequestReport?.ownerAccountID) {
    return false;
}

App/src/libs/ReportUtils.ts

Lines 1604 to 1608 in 5e65276

	function canAddOrDeleteTransactions(moneyRequestReport: OnyxEntry<Report>): boolean {
	if (!isMoneyRequestReport(moneyRequestReport)) {
	return false;
	}

For the expense report, we can add the check isExpenseReport here

return (isReportInGroupPolicy(report) || isExpenseReport(report)) ? isOwnPolicyExpenseChat && canAddTransactions : canAddTransactions; 

App/src/libs/ReportUtils.ts

Line 6123 in 87c116b

return isReportInGroupPolicy(report) ? isOwnPolicyExpenseChat && canAddTransactions : canAddTransactions;

if (isExpenseReport(moneyRequestReport) && currentUserAccountID !== moneyRequestReport?.managerID) {
    return false;
}

or we can add a case in canAddOrDeleteTransactions for the expense report that will return false if the current user isn't the managerID (the submitter) of the expense report

[OfstadC]

Assigned to me while I was OoO - reassigning

[melvin-bot]

Triggered auto assignment to @zanyrenney (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.