[HOLD ON #72715] IOU - Create report button appears for admin when admin cannot create report on behalf of member

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.2.32-1
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail: https://test-management.browserstack.com/projects/2219752/test-runs/TR-1307/folder/13176730/41237113/955760198
Email or phone of affected tester (no customers): jsdoijsdnoidnsjodj@gmail.com
Issue reported by: Applause - Internal Team

Action Performed:

Precondition:

• Admin invites member to workspace.

1. Go to staging.new.expensify.com
2. [Member] Go to workspace chat
3. [Member] Create an expense in the workspace chat
4. [Member] Create an empty report via + > Create report
5. [Admin] Open the report that has expense (from Step 3)
6. [Admin] Click Report field
7. [Admin] Click Create report

Expected Result:

Create report button should not appear for admin because admin cannot create report on behalf of the member

Actual Result:

Create report button appears for admin when admin cannot create report on behalf of the member
This causes the expense to disappear and reappear when admin clicks Create report button

Workaround:

Unknown

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Platforms Tested:

On which of our officially supported platforms was this issue tested:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6976575_1760618828684.Screen_Recording_2025-10-16_at_20.42.37.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @jliexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[lorretheboy]

Proposal

Please re-state the problem that we are trying to solve in this issue.

IOU - Create report button appears for admin when admin cannot create report on behalf of member

What is the root cause of that problem?

The IOURequestEditReport component was unconditionally passing the createReport function to IOURequestEditReportCommon, regardless of whether the current user was the owner of the report. This allowed admins to see and click the "Create report" button even when viewing a member's report, which they shouldn't be able to do.

App/src/pages/iou/request/step/IOURequestEditReport.tsx

Line 104 in 98b8288

createReport={createReport}

App/src/pages/iou/request/step/IOURequestEditReport.tsx

Lines 80 to 94 in 98b8288

	const createReport = () => {
	if (!policyForMovingExpensesID && !shouldSelectPolicy) {
	return;
	}
	if (shouldSelectPolicy) {
	Navigation.navigate(ROUTES.NEW_REPORT_WORKSPACE_SELECTION.getRoute(true, backTo));
	return;
	}
	if (policyForMovingExpensesID && shouldRestrictUserBillableActions(policyForMovingExpensesID)) {
	Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(policyForMovingExpensesID));
	return;
	}
	const createdReportID = createNewReport(currentUserPersonalDetails, hasViolations, isASAPSubmitBetaEnabled, policyForMovingExpensesID);
	selectReport({value: createdReportID});
	};

What changes do you think we should make in order to solve the problem?

Update to only pass the createReport function when the current user is the owner of the report

    const isReportOwner = selectedReport?.ownerAccountID === currentUserPersonalDetails.accountID;

    <IOURequestEditReportCommon
       createReport={isReportOwner ? createReport : undefined}
    ...
    />

What alternative solutions did you explore? (Optional)

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[daledah]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Create report button appears for admin when admin cannot create report on behalf of the member
This causes the expense to disappear and reappear when admin clicks Create report button

What is the root cause of that problem?

We always show the createReport when we have createReport props here

App/src/pages/iou/request/step/IOURequestEditReportCommon.tsx

Lines 165 to 178 in 69edde4

	const createReportOption = useMemo(() => {
	if (!createReport) {
	return undefined;
	}
	return (
	<MenuItem
	onPress={createReport}
	title={translate('report.newReport.createReport')}
	description={policyForMovingExpenses?.name}
	icon={Expensicons.Document}
	/>
	);
	}, [createReport, translate, policyForMovingExpenses?.name]);

What changes do you think we should make in order to solve the problem?

We should only show this if this is submitter

        const isSubmitter = isReportOwner(selectedReport);
        if (!createReport || !isSubmitter) {
            return undefined;
        }

Note: we should not pass createReport as undefined because it'll show the not found page here but admin can still move expenses like here

App/src/pages/iou/request/step/IOURequestEditReportCommon.tsx

Lines 181 to 184 in 69edde4

	const shouldShowNotFoundPage = useMemo(() => {
	if (createReport) {
	return false;
	}

App/src/pages/iou/request/step/IOURequestEditReportCommon.tsx

Lines 197 to 198 in 69edde4

	// If the report is Open, then only submitters, admins can move expenses
	return isOpen && !isAdmin && !isSubmitter;

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

None

What alternative solutions did you explore? (Optional)

If the admin can't move the expense, we can remove !isAdmin in this condition to disable the report field

App/src/libs/ReportUtils.ts

Lines 4503 to 4506 in 69edde4

	const isOpen = isOpenExpenseReport(moneyRequestReport);
	if (!isUnreportedExpense && isOpen && !isSubmitter && !isAdmin) {
	return false;
	}

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[ShridharGoel]

Should get fixed in #72715

[etCoderDysto]

Proposal

Please re-state the problem that we are trying to solve in this issue.

IOU - Create report button appears for admin when admin cannot create report on behalf of member

What is the root cause of that problem?

1. We show create report menu if createReport prop is not undefined
   

   App/src/pages/iou/request/step/IOURequestEditReportCommon.tsx

   Lines 165 to 174 in 69edde4

   	const createReportOption = useMemo(() => {
   	if (!createReport) {
   	return undefined;
   	}
   	return (
   	<MenuItem
   	onPress={createReport}
   	title={translate('report.newReport.createReport')}
   	description={policyForMovingExpenses?.name}

2. We are are passing moneyRequestReport?.ownerAccountID to reportOwnerAccountID param of getOutstandingReportsForUser function call. And the call will return 2 as the submitter ownerAccount id (moneyRequestReport?.ownerAccountID) matches with the two outstandigReport ID
   

   App/src/libs/ReportUtils.ts

   Lines 4508 to 4513 in 69edde4

   	return (
   	Object.values(allPolicies ?? {}).flatMap((currentPolicy) =>
   	getOutstandingReportsForUser(currentPolicy?.id, moneyRequestReport?.ownerAccountID, outstandingReportsByPolicyID?.[currentPolicy?.id ?? CONST.DEFAULT_NUMBER_ID] ?? {}),
   	).length > 1 ||
   	(isOwner && isReportOutstanding(moneyRequestReport, moneyRequestReport.policyID))
   	);

What changes do you think we should make in order to solve the problem?

1. We should check if the user the report owner before we display the create report button

if (!createReport || !isReportOwner(selectedReport)) {
            return undefined;
        }

2. We should pass currentUserAccountID instead of moneyRequestReport?.ownerAccountID so that we can get the right outstanding reports number for the current user. This will disable the report button

 Object.values(allPolicies ?? {}).flatMap((currentPolicy) =>
                getOutstandingReportsForUser(currentPolicy?.id, currentUserAccountID, outstandingReportsByPolicyID?.[currentPolicy?.id ?? CONST.DEFAULT_NUMBER_ID] ?? {}),
            ).length > 1;

What alternative solutions did you explore? (Optional)

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[jliexpensify]

Hi @ShridharGoel - I've assigned you to this one, can you test this when #72715 gets deployed?

[melvin-bot]

@jliexpensify, @ShridharGoel Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!