Block report submission when strict policy rules are enabled with violations by abzokhattab · Pull Request #72663 · Expensify/App

abzokhattab · 2025-10-15T07:01:28Z

Explanation of Change

Fixed Issues

$ #70990
PROPOSAL: #70990 (comment)

Tests

Prerequisites:

Enable "Strictly Enforce Workspace Rules" in Domain Settings
Workspace must have at least one policy rule

Log in as a submitter in the domain with strict policy rules enabled
Submit a report that contains policy violations in NewDot
Go to Reports and open the created report
verify that the Submit button is disabled and next step message shows: "'Waiting for you to fix the issues. Your admins have restricted submission of expenses with violations."
Go back - verify Review button shows in report preview

Offline tests

Same as tests

QA Steps

same as tests

PR Author Checklist

Screenshots/Videos

Android: Native

Screen.Recording.2025-10-19.at.00.28.42.mov

Android: mWeb Chrome

Screen.Recording.2025-10-19.at.00.34.36.mov

iOS: Native

Screen.Recording.2025-10-19.at.00.28.42.mov

iOS: mWeb Safari

Screen.Recording.2025-10-19.at.00.34.36.mov

MacOS: Chrome / Safari

https://github.com/user-attachments/assets/fb9c340a-ff1f-46f0-9477-01c0b7b58b63

MacOS: Desktop

Screen.Recording.2025-10-19.at.00.35.18.mov

…lations

melvin-bot · 2025-10-15T07:01:49Z

@akinwale Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

…block

trjExpensify · 2025-10-16T23:06:58Z

        dates: 'Dates',
        rates: 'Rates',
        submitsTo: ({name}: SubmitsToParams) => `Submits to ${name}`,
+        waitingForSubmitterToFixViolations: 'Waiting for you to fix the issue(s). Your admins have restricted submission of expenses that have violations.',


@jamesdeanexpensify is asking for a small copy update here @abzokhattab.

'Waiting for you to fix the issue(s). Your admins have restricted submission of expenses with violations.',

I have a different question: should we translate this message into other languages, or keep it in English? In NextStepUtils.ts, all the text is hardcoded in English ... should we follow the same pattern? or translate it?

Good point, if this is a NextSteps text showing at the report header and that is all in english right now, I think we should not translate only this one now. The transactions for them all would possibly come later.

cc @trjExpensify

Okay, I kept it hardcoded and moved this logic to NextStepUtils.ts, similar to the buildOptimisticNextStepForPreventSelfApprovalsEnabled function to keep the optimistic values logic in one place and not scattered .. commit details: d48987b

…block

codecov · 2025-10-18T18:12:59Z

Codecov Report

❌ Patch coverage is 64.28571% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/components/MoneyReportHeader.tsx	0.00%	7 Missing ⚠️
src/components/MoneyReportHeaderStatusBar.tsx	0.00%	2 Missing ⚠️
src/components/AnimatedSubmitButton/index.tsx	0.00%	1 Missing ⚠️

Files with missing lines	Coverage Δ
...ReportPreview/MoneyRequestReportPreviewContent.tsx	`63.40% <100.00%> (+0.13%)`	⬆️
src/hooks/useStrictPolicyRules.ts	`100.00% <100.00%> (ø)`
src/libs/NextStepUtils.ts	`64.80% <100.00%> (+0.42%)`	⬆️
src/libs/ReportPreviewActionUtils.ts	`91.04% <100.00%> (+0.20%)`	⬆️
src/libs/ReportUtils.ts	`74.49% <100.00%> (+0.04%)`	⬆️
src/components/AnimatedSubmitButton/index.tsx	`2.00% <0.00%> (ø)`
src/components/MoneyReportHeaderStatusBar.tsx	`22.22% <0.00%> (ø)`
src/components/MoneyReportHeader.tsx	`0.18% <0.00%> (-0.01%)`	⬇️

... and 15 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

abzokhattab · 2025-10-18T23:36:21Z

The pr is now ready

trjExpensify · 2025-10-20T09:29:45Z

Wahooo! @akinwale can you prioritise the review today, please?

akinwale · 2025-10-20T10:08:34Z

Wahooo! @akinwale can you prioritise the review today, please?

Will do.

akinwale · 2025-10-20T17:26:51Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- MacOS: Desktop
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified there are no new alerts related to the canBeMissing param for useOnyx
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

72663-web.mp4

MacOS: Desktop

akinwale

LGTM.

NikkiWines

Looks good - a couple of NABs and questions

akinwale

Re-tested. LGTM.

…block

mountiny · 2025-10-23T08:14:54Z

@abzokhattab LEt me know in slack once you address these, thanks!

github-actions · 2025-10-23T08:16:03Z

Performance Violations Found

❌ PERF-6 - Use specific properties as hook dependencies

File: src/components/MoneyReportHeader.tsx
Line: 222

The dependencies violations and transactions are entire objects/arrays. This causes the hook to re-execute whenever any property changes, even unrelated ones.

Fix: Use specific properties instead:

transactions.length instead of transactions
Object.keys(violations).length instead of violations

❌ PERF-6 - Use specific properties as hook dependencies

File: src/components/ReportActionItem/MoneyRequestReportPreview/MoneyRequestReportPreviewContent.tsx
Line: 485-497

The dependencies include entire objects like violations, iouReport, policy, transactions, and invoiceReceiverPolicy. This causes unnecessary re-executions when unrelated properties change.

Fix: Use specific properties from these objects instead of passing the entire objects.

github-actions · 2025-10-23T08:17:26Z

HelpDot Documentation Review

Overall Assessment

This PR (#72663) focuses entirely on implementing functionality to block report submission when strict policy rules are enabled with violations. No documentation files were modified in this PR.

Analysis Summary

Files Changed: 13 files (all TypeScript code and test files)
Documentation Files: None
Scope: Pure backend/frontend functionality implementation
Feature: Strict policy rules enforcement for report submission

Documentation Impact Assessment

While this PR introduces new user-facing functionality (blocking report submission with policy violations), it does not include any accompanying documentation updates.

Key Findings

✅ Code Quality: Well-structured implementation with comprehensive test coverage
✅ Feature Completeness: Includes proper UI feedback and error messaging
⚠️ Documentation Gap: No help documentation was updated to reflect this new behavior

Recommendations

Since this PR introduces a significant change to user workflow (blocking report submission), consider:

User Documentation: Update relevant help articles in the docs/ or help/ directories to explain:
- How strict policy rules work
- What users see when submission is blocked
- How to resolve policy violations
Admin Documentation: Document the 'Strictly Enforce Workspace Rules' setting for workspace administrators
FAQ Updates: Add common questions about policy violation handling

Conclusion

No documentation review needed for this PR as it contains no documentation changes. However, this feature may warrant future documentation updates to help users understand the new strict policy enforcement behavior.

Note: This assessment focuses on documentation quality standards since no documentation files were present in this PR.

mountiny · 2025-10-23T09:30:20Z

@kacper-mikolajczak @adamgrzybowski this comment I think seems a bit off on this PR #72663 (comment) I dont think there is other way to implement this

mountiny · 2025-10-23T09:42:52Z

@abzokhattab There seems to be conflicts

…block

abzokhattab · 2025-10-23T09:45:16Z

fixed

…block

mountiny · 2025-10-23T12:07:28Z

+ */
+function useStrictPolicyRules(): UseStrictPolicyRulesResult {
+    const [myDomainSecurityGroups] = useOnyx(ONYXKEYS.MY_DOMAIN_SECURITY_GROUPS, {canBeMissing: true});
+    const [securityGroups] = useOnyx(ONYXKEYS.COLLECTION.SECURITY_GROUP, {canBeMissing: true});


I wonder how we could incorporate the selector for the groupID here already since it's dependent on the other useOnyx @TMisiukiewicz

OSBotify · 2025-10-23T12:21:03Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2025-10-23T13:10:05Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.2.37-1 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

izarutskaya · 2025-10-24T13:44:32Z

@abzokhattab PR is failing with original bug ID #70990

1761309673062.72663_desktop.mp4

1761310071470.72663_iOS.mp4

trjExpensify · 2025-10-24T13:54:22Z

@abzokhattab PR is failing with original bug ID #70990

@izarutskaya can you expand on that? How is it failing? Your video looks like it's behaving as expected. The user is prevented from submitting a report with this restriction.

OSBotify · 2025-10-24T17:52:16Z

🚀 Deployed to production by https://github.com/blimpich in version: 9.2.37-8 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

kacper-mikolajczak · 2025-10-27T08:10:58Z

this comment I think seems a bit off on this PR #72663 (comment) I dont think there is other way to implement this

You are clearly right @mountiny! These are not actual violations - I will take a look on how we could improve PERF-6 rule detection and get back to you.

hungvu193 · 2025-12-04T06:23:58Z

-    const optimisticNextStep = isSubmitterSameAsNextApprover && policy?.preventSelfApproval ? buildOptimisticNextStepForPreventSelfApprovalsEnabled() : nextStep;
+    let optimisticNextStep = isSubmitterSameAsNextApprover && policy?.preventSelfApproval ? buildOptimisticNextStepForPreventSelfApprovalsEnabled() : nextStep;
+
+    if (shouldBlockSubmit && isReportOwner(moneyRequestReport)) {


In #73426, we decided to only show the violation with open expense report.

More details in:
#73426 (comment)

Block report submission when strict policy rules are enabled with vio…

181f464

…lations

melvin-bot Bot assigned abzokhattab Oct 15, 2025

abzokhattab marked this pull request as ready for review October 15, 2025 07:01

abzokhattab requested a review from a team as a code owner October 15, 2025 07:01

melvin-bot Bot requested review from akinwale and removed request for a team October 15, 2025 07:01

abzokhattab marked this pull request as draft October 15, 2025 07:01

Merge remote-tracking branch 'origin/main' into strict-policy-submit-…

0c58450

…block

trjExpensify reviewed Oct 16, 2025

View reviewed changes

Merge remote-tracking branch 'origin/main' into strict-policy-submit-…

d96f09c

…block

abzokhattab added 6 commits October 18, 2025 22:34

Remove violation tooltip

590e322

minor edit

3a0dee3

fix ts

da37814

fixing eslint

7f8d6bd

fixing eslint errs

27f2d91

fixing ts err

3b56f69

abzokhattab marked this pull request as ready for review October 18, 2025 23:02

abzokhattab added 2 commits October 19, 2025 01:13

fix eslint

ceaa89d

fixing eslint

902ba2a

akinwale approved these changes Oct 20, 2025

View reviewed changes

melvin-bot Bot requested a review from NikkiWines October 20, 2025 17:32

abzokhattab requested a review from trjExpensify October 21, 2025 14:14

NikkiWines previously requested changes Oct 21, 2025

View reviewed changes

Comment thread src/libs/ReportUtils.ts Outdated

Comment thread src/languages/en.ts Outdated

Comment thread src/hooks/useStrictPolicyRules.ts

Comment thread src/components/MoneyReportHeaderStatusBar.tsx

Minor refactor

cad8617

abzokhattab added 2 commits October 22, 2025 16:11

minor edit with test title to follow existing pattern

43de8dd

chore: trigger pipeline

6d940f9

akinwale approved these changes Oct 22, 2025

View reviewed changes

abzokhattab and others added 4 commits October 23, 2025 07:59

Merge branch 'main' into strict-policy-submit-block

0a9ec6c

Merge remote-tracking branch 'origin/main' into strict-policy-submit-…

a3ea30f

…block

merge into main

77e0e14

fixing eslint

197d9c7

Merge remote-tracking branch 'origin/main' into strict-policy-submit-…

12fb7e4

…block

abzokhattab added 2 commits October 23, 2025 12:00

Merge remote-tracking branch 'origin/main' into strict-policy-submit-…

09efc42

…block

Merge remote-tracking branch 'origin/main' into strict-policy-submit-…

0ada7a8

…block

mountiny approved these changes Oct 23, 2025

View reviewed changes

mountiny merged commit 8504026 into Expensify:main Oct 23, 2025
23 checks passed

OSBotify mentioned this pull request Oct 23, 2025

Deploy Checklist: New Expensify 2025-10-23 #73307

Closed

88 tasks

nlemma mentioned this pull request Oct 24, 2025

[Due for payment 2025-12-03] [$250] Strict policy rules - "Waiting for you to fix the issues" is shown on paid report with violation #73426

Closed

8 tasks

clarajones-expensify mentioned this pull request Oct 28, 2025

[Due for payment 2025-10-31] [$250] [CMB] Strictly Enforce Workspace Rules - Report submission silently fails in NewDot #70990

Closed

16 tasks

kacper-mikolajczak mentioned this pull request Nov 4, 2025

[Due for payment 2025-12-07] [$250] [AI Reviewer] PERF-6 rule is not correctly understood by agent #74194

Closed

hungvu193 reviewed Dec 4, 2025

View reviewed changes

abzokhattab mentioned this pull request Dec 18, 2025

[DEW]: Update SubmitReport API command #75712

Merged

51 tasks

Conversation

abzokhattab commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

melvin-bot Bot commented Oct 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abzokhattab Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Oct 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

abzokhattab commented Oct 18, 2025

Uh oh!

trjExpensify commented Oct 20, 2025

Uh oh!

akinwale commented Oct 20, 2025

Uh oh!

akinwale commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

akinwale left a comment

Choose a reason for hiding this comment

Uh oh!

NikkiWines left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

akinwale left a comment

Choose a reason for hiding this comment

Uh oh!

mountiny commented Oct 23, 2025

Uh oh!

github-actions Bot commented Oct 23, 2025

Performance Violations Found

Uh oh!

github-actions Bot commented Oct 23, 2025

HelpDot Documentation Review

Overall Assessment

Analysis Summary

Documentation Impact Assessment

Key Findings

Recommendations

Conclusion

Uh oh!

mountiny commented Oct 23, 2025

Uh oh!

mountiny commented Oct 23, 2025

Uh oh!

abzokhattab commented Oct 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

abzokhattab commented Oct 15, 2025 •

edited

Loading

abzokhattab Oct 22, 2025 •

edited

Loading

codecov Bot commented Oct 18, 2025 •

edited

Loading

akinwale commented Oct 20, 2025 •

edited

Loading