[$250] Reports - Reports are submitted and approved without restricted action page

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.28-1
Reproducible in staging?: Yes
Reproducible in production?: Unable to validate in Prod - Provide reasoning.
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #83149
Email or phone of affected tester (no customers): applausetester+kdpdpdpd@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Pull Request QA execution
Device used: Mac 26.2 / Chrome
App Component: Search

Action Performed:

Precondition:

• Have separate reports pending submission, approval and payment.
• Run Onyx.merge('sharedNVP_private_billingGracePeriodEnd_[replaceWithYourACcountID]', {value: 1}); in console.

1. Go to staging.new.expensify.com
2. Go to Reports > Expenses.
3. Click Submit.
4. Click Approve.
5. Click Pay > Mark as paid.

Expected Result:

Restricted action page will open when submitting and approving reports from Reports.

Actual Result:

Reports are submitted and approved without restricted action page on Reports.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

1.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @dukenv0307

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022028820653587894438
• Upwork Job ID: 2028820653587894438
• Last Price Increase: 2026-03-03

[melvin-bot]

Triggered auto assignment to @jliexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[nyomanjyotisa]

🚨 Edited by proposal-police: This proposal was edited at 2026-03-03 13:18:41 UTC.

Proposal

Please re-state the problem that we are trying to solve in this issue.

Reports - Reports are submitted and approved without restricted action page

What is the root cause of that problem?

When submitting or approving reports from the Reports page, handleActionButtonPress calls submitMoneyRequestOnSearch and approveMoneyRequestOnSearch directly without checking for billing grace period restrictions. These functions call the API directly, bypassing the restriction checks in submitReport and approveMoneyRequest.

App/src/libs/actions/Search.ts

Line 148 in ccb3182

approveMoneyRequestOnSearch(hash, item.reportID ? [item.reportID] : [], currentSearchKey);

App/src/libs/actions/Search.ts

Line 155 in ccb3182

submitMoneyRequestOnSearch(hash, [item as Report], [snapshotPolicy], currentSearchKey);

The Pay action already has the restriction check in getPayActionCallback via handleBulkPayItemSelected, which is why only Pay shows the restricted action page.

App/src/libs/actions/Search.ts

Lines 1348 to 1350 in ccb3182

	if (policy && shouldRestrictUserBillableActions(policy?.id, userBillingGraceEndPeriods)) {
	Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(policy?.id));
	return;

What changes do you think we should make in order to solve the problem?

Add restriction checks in handleActionButtonPress before calling submitMoneyRequestOnSearch and approveMoneyRequestOnSearch:

        case CONST.SEARCH.ACTION_TYPES.APPROVE:
            if (isDelegateAccessRestricted) {
                onDelegateAccessRestricted?.();
                return;
            }
            if (hasDynamicExternalWorkflow(snapshotPolicy) && !isDEWBetaEnabled) {
                onDEWModalOpen?.();
                return;
            }
            if (snapshotReport.policyID && shouldRestrictUserBillableActions(snapshotReport.policyID)) {
                Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(snapshotReport.policyID));
                return;
            }
            approveMoneyRequestOnSearch(hash, item.reportID ? [item.reportID] : [], currentSearchKey);
            return;
        case CONST.SEARCH.ACTION_TYPES.SUBMIT: {
            if (hasDynamicExternalWorkflow(snapshotPolicy) && !isDEWBetaEnabled) {
                onDEWModalOpen?.();
                return;
            }
            if (snapshotReport.policyID && shouldRestrictUserBillableActions(snapshotReport.policyID)) {
                Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(snapshotReport.policyID));
                return;
            }
            submitMoneyRequestOnSearch(hash, [item as Report], [snapshotPolicy], currentSearchKey);
            return;
        }

App/src/libs/actions/Search.ts

Lines 139 to 157 in ccb3182

	case CONST.SEARCH.ACTION_TYPES.APPROVE:
	if (isDelegateAccessRestricted) {
	onDelegateAccessRestricted?.();
	return;
	}
	if (hasDynamicExternalWorkflow(snapshotPolicy) && !isDEWBetaEnabled) {
	onDEWModalOpen?.();
	return;
	}
	approveMoneyRequestOnSearch(hash, item.reportID ? [item.reportID] : [], currentSearchKey);
	return;
	case CONST.SEARCH.ACTION_TYPES.SUBMIT: {
	if (hasDynamicExternalWorkflow(snapshotPolicy) && !isDEWBetaEnabled) {
	onDEWModalOpen?.();
	return;
	}
	submitMoneyRequestOnSearch(hash, [item as Report], [snapshotPolicy], currentSearchKey);
	return;
	}

Note: We should handle the bulk action as well

        const restrictedPolicyID = selectedPolicyIDList.find((policyID) => policyID && shouldRestrictUserBillableActions(policyID));
        if (restrictedPolicyID) {
            Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(restrictedPolicyID));
            return;
        }

App/src/hooks/useSearchBulkActions.ts

Line 383 in ccb3182

                    const selectedPolicyIDList = itemList.map((item) => item.policyID).filter((policyID): policyID is string => !!policyID);
                    const restrictedPolicyID = selectedPolicyIDList.find((policyID) => shouldRestrictUserBillableActions(policyID));
                    if (restrictedPolicyID) {
                        Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(restrictedPolicyID));
                        return;
                    }

App/src/hooks/useSearchBulkActions.ts

Line 809 in ccb3182

            const selectedOptions = selectedReports.length ? selectedReports : Object.values(selectedTransactions);
            const selectedPolicyIDList = selectedOptions.map((item) => item.policyID).filter((policyID): policyID is string => !!policyID);
            const restrictedPolicyID = selectedPolicyIDList.find((policyID) => shouldRestrictUserBillableActions(policyID));
            if (restrictedPolicyID) {
                Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(restrictedPolicyID));
                return;
            }

App/src/hooks/useSearchBulkActions.ts

Lines 525 to 526 in ccb3182

	const selectedOptions = selectedReports.length ? selectedReports : Object.values(selectedTransactions);

What alternative solutions did you explore? (Optional)

None

[MelvinBot]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When a user has an active billing grace period (sharedNVP_private_billingGracePeriodEnd set), submitting and approving reports from the Reports > Expenses (Search) view proceeds normally instead of showing the Restricted Action page. The Restricted Action page correctly appears when submitting/approving from the direct report view (e.g., via the report header), but the Search bulk actions bypass this check entirely.

What is the root cause of that problem?

The Search bulk actions for Submit and Approve use completely separate code paths from the normal report view actions, and these paths never call shouldRestrictUserBillableActions to check the billing grace period:

• Submit (src/hooks/useSearchBulkActions.ts:796-818): The onSelected handler directly calls submitMoneyRequestOnSearch() (src/libs/actions/Search.ts:530) without any billing restriction check.
• Approve (src/hooks/useSearchBulkActions.ts:347-394): handleApproveWithDEWCheck() checks for delegate access and DEW policies, but never calls shouldRestrictUserBillableActions. It then calls approveMoneyRequestOnSearch() (src/libs/actions/Search.ts:585) which also has no check.

In contrast, the normal report view actions go through submitReport() (src/libs/actions/IOU/index.ts:11477) and approveMoneyRequest() (src/libs/actions/IOU/index.ts:10596), which both check shouldRestrictUserBillableActions and navigate to ROUTES.RESTRICTED_ACTION when the billing grace period is active.

Note: The Pay sub-item selection path (handleBulkPayItemSelected at src/libs/actions/Search.ts:1348) does have the billing check, but the onBulkPaySelected path (src/hooks/useSearchBulkActions.ts:509) does not.

What changes do you think we should make in order to solve the problem?

Add shouldRestrictUserBillableActions checks to the Search bulk actions flow in src/hooks/useSearchBulkActions.ts:

1. Pass userBillingGraceEndPeriods (already loaded via useOnyx in SearchBulkActionsButton.tsx:46) into the useSearchBulkActions hook as a parameter.
2. Add the billing restriction check in the Submit onSelected handler (around line 802) — before calling submitMoneyRequestOnSearch(), iterate through the selected items' policies and check shouldRestrictUserBillableActions. If any policy is restricted, navigate to ROUTES.RESTRICTED_ACTION and return early instead of submitting.
3. Add the same check in handleApproveWithDEWCheck (around line 347) — before calling approveMoneyRequestOnSearch().
4. Add the same check in onBulkPaySelected (around line 509) — before calling payMoneyRequestOnSearch().

This matches the pattern already used in handleBulkPayItemSelected at src/libs/actions/Search.ts:1348-1351.

---

Next Steps for Contributor+ team: Reply with @MelvinBot implement this to create a draft PR, or @MelvinBot <your feedback> to refine this analysis.

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @dukenv0307 (External)

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022028820653587894438

[shubham1206agra]

@bernhardoj Can you look into this?