[Due for payment 2025-04-07] [$250] Reports - Expense can be submitted and approved when "Prevent self-approvals" is enabled

[IuliiaHerets]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.1.11-1
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from TestRail: Exp
Email or phone of affected tester (no customers): applausetester+110301kh@applause.expensifail.com
Issue reported by: Applause Internal Team
Device used: Mac 15.3 / Chrome
App Component: Search

Action Performed:

Precondition:

• Delayed submission is enabled.
• Admin is the approver.
• "Prevent self-approvals" is enabled.

1. Go to staging.new.expensify.com
2. Go to workspace chat.
3. Submit an expense.
4. Note that Submit button is disabled.
5. Go to Reports.
6. Click Submit button on the same expense in Step 3.
7. Click Approve button.

Expected Result:

Submit and Approve button should be disabled in Reports when "Prevent self-approvals" is enabled.

Actual Result:

Submit and Approve button are not disabled in Reports when "Prevent self-approvals" is enabled.

Workaround:

Unknown

Platforms:

• Android: Standalone
• Android: HybridApp
• Android: mWeb Chrome
• iOS: Standalone
• iOS: HybridApp
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug6767053_1741678201302.20250311_152510.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021899604361654368613
• Upwork Job ID: 1899604361654368613
• Last Price Increase: 2025-03-11
• Automatic offers:
• Tony-MK | Contributor | 106495059

Issue Owner

Current Issue Owner: @trjExpensify

[melvin-bot]

Triggered auto assignment to @trjExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[FitseTLT]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Open Reports - Expense can be submitted and approved when "Prevent self-approvals" is enabled

What is the root cause of that problem?

We call isAllowedToApproveExpenseReportUtils here

App/src/libs/SearchUIUtils.ts

Line 400 in 4c2b419

const isAllowedToApproveExpenseReport = isAllowedToApproveExpenseReportUtils(report, undefined, policy);

passing the policy from the search data but sometimes the data needed for the calculation might not be available like policy.areRulesEnabled so it will early return true here

App/src/libs/ReportUtils.ts

Lines 8647 to 8649 in 4c2b419

	if (!policy?.areRulesEnabled) {
	return true;
	}

What changes do you think we should make in order to solve the problem?

Reliable Solution can be given from BE by always populating all important props of the policy, for instance in this case we need preventSelfApproval and areRulesEnabled but otherwise from FE we can also rely on the onyx policy data and only fallback to the policy from search data if it doesn't exist.

App/src/libs/ReportUtils.ts

Line 8646 in 4c2b419

const policy = reportPolicy ?? getPolicy(report?.policyID);

    const policy = getPolicy(report?.policyID) ?? reportPolicy;

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

If needed we can add a test for getAction to assert it doesn't return submit action if self approval is prevented even if the policy data from search has missing information.

What alternative solutions did you explore? (Optional)

[Tony-MK]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Reports - Expense can be submitted and approved when "Prevent self-approvals" is enabled

What is the root cause of that problem?

This PR introduced the root cause, where the ReportUtils.isAllowedToApproveExpenseReport returns true early when the rules are not enabled.

Hence, the getAction function returns the CONST.SEARCH.ACTION_TYPES.SUBMIT because of this.

App/src/libs/SearchUIUtils.ts

Lines 400 to 408 in 05dd3dc

	const isAllowedToApproveExpenseReport = isAllowedToApproveExpenseReportUtils(report, undefined, policy);
	if (canApproveIOU(report, policy) && isAllowedToApproveExpenseReport && !hasOnlyPendingCardOrScanningTransactions) {
	return CONST.SEARCH.ACTION_TYPES.APPROVE;
	}
	// We check for isAllowedToApproveExpenseReport because if the policy has preventSelfApprovals enabled, we disable the Submit action and in that case we want to show the View action instead
	if (canSubmitReport(report, policy, allReportTransactions, allViolations) && isAllowedToApproveExpenseReport) {
	return CONST.SEARCH.ACTION_TYPES.SUBMIT;
	}

What changes do you think we should make in order to solve the problem?

Remove the condition below to stop returning true early in the ReportUtils.isAllowedToApproveExpenseReport, since it is necessary.

App/src/libs/ReportUtils.ts

Lines 8655 to 8657 in 05dd3dc

	if (!policy?.areRulesEnabled) {
	return true;
	}

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

Add tests to for ReportUtils.isAllowedToApproveExpenseReport function with different policies and reports which have randomized values for areRulesEnabled, preventSelfApproval and report?.ownerAccountID.

Also, add scenarios where the CONST.SEARCH.ACTION_TYPES needs to be the same as the report preview or money request page.

What alternative solutions did you explore? (Optional)

Improve the ReportUtils.isAllowedToApproveExpenseReport function by returning false if the policy rules are disabled.

return !(policy?.areRulesEnabled && policy?.preventSelfApproval && isOwner);

[trjExpensify]

CC: @mountiny for vis as you were involved in the PR.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~021899604361654368613

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @c3024 (External)