Security - Copilot actions - The message "on behalf of..."on message and expense inconsitent

[IuliiaHerets]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.1.0-0
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught on HybridApp, is this reproducible on New Expensify Standalone?: Yes, reproducible on both
If this was caught during regression testing, add the test name, ID and link from TestRail: https://expensify.testrail.io/index.php?/tests/view/5614531&group_by=cases:section_id&group_order=asc&group_id=229064
Email or phone of affected tester (no customers): luongquocvu92@gmail.com / leungbratt@gmail.com
Issue reported by: Applause Internal Team
Device used: Windows 11 / Chrome
App Component: Chat Report View

Action Performed:

Precondition: Main account: luongquocvu92@gmail.com. Full Copilot access: leungbratt@gmail.com

1. Login as the account that has full copilot access
2. Verify the account loads and there's a "switch" to the account to copilot
3. Navigate to any DM conversation
4. Send a message
5. On a conversation with another 1:1 - Pay/send money to the other user

Expected Result:

Verify the message and expense are sent by the "Copilot" with a mention that was done on behalf of the main account.

Actual Result:

In the message on the Full Copilot, it displays "on behalf of " but on the expense, it displays "on behalf of " in the conversation

Workaround:

Unknown

Platforms:

• Android: Standalone
• Android: HybridApp
• Android: mWeb Chrome
• iOS: Standalone
• iOS: HybridApp
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug6747895_1739971466109.Inconsitent_Behalf.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @MitchExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[linhvovan29546]

🚨 Edited by proposal-police: This proposal was edited at 2025-02-19 14:29:45 UTC.

Proposal

Please re-state the problem that we are trying to solve in this issue.

Security - Copilot actions - The message "on behalf of..."on message and expense inconsitent

What is the root cause of that problem?

After the PR #55597 we started displaying the "on behalf of..." message in expense previews. This message is based on the actorAccountID returned by the getReportActionActorAccountID function. However, this function does not correctly return the actorAccountID for delegates, causing the message to be inconsistent.

What changes do you think we should make in order to solve the problem?

I suggest creating a new function (copied from getReportActionActorAccountID) to correctly retrieve the actorAccountID:

function getReportActionOnBehalfAccountID(reportAction,iouReport): number | undefined {
    // NOTE: We need to test the SUBMITTED case, as we may only need to return reportAction?.actorAccountID instead of adminAccountID 
    switch (reportAction?.actionName) {
        case CONST.REPORT.ACTIONS.TYPE.REPORT_PREVIEW: {
        const ownerAccountID = iouReport?.ownerAccountID ?? reportAction?.childOwnerAccountID;
        return ownerAccountID
        }
        case CONST.REPORT.ACTIONS.TYPE.SUBMITTED:
            return reportAction?.adminAccountID ?? reportAction?.actorAccountID;
        default:
            return reportAction?.actorAccountID;
    }
}

Then, update the logic to ensure the correct message is displayed:

App/src/pages/home/report/ReportActionItemSingle.tsx

Line 117 in 11302a9

const accountOwnerDetails = getPersonalDetailByEmail(login ?? '');

const onBehalfAccountID = getReportActionOnBehalfAccountID(action);
const { login: onBehalfLogin } = personalDetails?.[onBehalfAccountID ?? CONST.DEFAULT_NUMBER_ID] ?? {};
const accountOwnerDetails = getPersonalDetailByEmail(onBehalfLogin ?? '');

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

We should write a test to assert that the correct message is displayed on expense preview

What alternative solutions did you explore? (Optional)

N/A
Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[ijmalik]

🚨 Edited by proposal-police: This proposal was edited at 2025-02-22 05:16:50 UTC.

Proposal

Please re-state the problem that we are trying to solve in this issue.

Security - Copilot Actions - The "on behalf of..." message in chat and expense details is inconsistent.

What is the root cause of that problem?

App/src/pages/home/report/ReportActionItemSingle.tsx

Lines 110 to 118 in f060149

	const actorAccountID = getReportActionActorAccountID(action, iouReport, report);
	const [invoiceReceiverPolicy] = useOnyx(
	`${ONYXKEYS.COLLECTION.POLICY}${report?.invoiceReceiver && 'policyID' in report.invoiceReceiver ? report.invoiceReceiver.policyID : CONST.DEFAULT_NUMBER_ID}`,
	);
	let displayName = getDisplayNameForParticipant({accountID: actorAccountID});
	const {avatar, login, pendingFields, status, fallbackIcon} = personalDetails?.[actorAccountID ?? CONST.DEFAULT_NUMBER_ID] ?? {};
	const accountOwnerDetails = getPersonalDetailByEmail(login ?? '');
	// eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing

The issue stems from the getReportActionActorAccountID function in ReportUtils.ts. Specifically, the logic for determining the actorAccountID does not account for cases where a delegate account is involved. This results in incorrect accountOwnerDetails being used in the UI, as seen in

App/src/pages/home/report/ReportActionItemSingle.tsx

Lines 333 to 335 in f060149

	{!!action?.delegateAccountID && (
	<Text style={[styles.chatDelegateMessage]}>{translate('delegate.onBehalfOfMessage', {delegator: accountOwnerDetails?.displayName ?? ''})}</Text>
	)}

What changes do you think we should make in order to solve the problem?

Update the logic in getReportActionActorAccountID to handle delegate accounts correctly. Specifically, modify the condition to include cases where delegateAccountID is present:

App/src/libs/ReportUtils.ts

Lines 8753 to 8755 in f060149

	if (isPolicyExpenseChat(report)) {
	return ownerAccountID;
	}

Replace with

if (isPolicyExpenseChat(report) || (reportAction?.delegateAccountID != null && reportAction?.message[0]?.text.includes('owes'))) {
 
  return ownerAccountID;
}

Note:
The above is a pseudo "if condition" and will be optimized to ensure it covers all necessary scenarios, including any potential edge cases.

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

To ensure the correct "on behalf of" message is displayed consistently, we should add automated test covering the scenario:
The "on behalf of..." message appears correctly in both chat and expense details.

What alternative solutions did you explore? (Optional)

57103.mp4

[linhvovan29546]

Just noticed that this is a duplicate of #56477

[MitchExpensify]

Closing in favor of #56477