Card admin can click Learn more on Get the Expensify Card banner which enables Expensify Card

[applause-bot]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.4.7-0
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #92740
Email or phone of affected tester (no customers): jsodinjosdjsoinjsiojs@gmail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.5 / Chrome
App Component: Workspace Settings

Action Performed:

Precondition:

• User A invites User B to workspace as card admin.
• Perform steps below as card admin (User B).

1. Go to staging.new.expensify.com
2. Go to workspace settings > Company cards.
3. Click Learn more on Get the Expensify Card banner.
4. Go to Workspaces main page.
5. Open the workspace.

Expected Result:

Card admin should not be allowed to click Learn more on Get the Expensify Card banner because it will enable Expensify Card.

Actual Result:

Card admin can click Learn more on Get the Expensify Card banner. Expensify Card tab appears and disappears after navigating away.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome Safari

Screenshots/Videos

Bug7179424_1781304021445.17.mp4

View all open jobs on GitHub

Applause Internal Information
Exported by: Mita Rachim
Bug ID: 7179424

Issue Owner

Current Issue Owner: @ShridharGoel

[applause-bot]

While Applause doesn't embed attachments for this bug, here are the links for quick view:
https://platform.applause.com/services/links/v1/external/100c0fb5cc79a0e16df8fcbc00cb50516ec73ec52c128f842518a55f900f1aad

[melvin-bot]

@flodnv recently merged #92740, but they are OOO right now, so I'll auto-assign someone else.

[melvin-bot]

Triggered auto assignment to @rlinoz (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[MelvinBot]

Proposal

What is the root cause of that problem?

The "Get the Expensify Card" promotion banner on the Company Cards page gates its Learn more button on Company Cards write access, but the action it triggers actually enables the Expensify Card feature on the workspace — an admin-only operation.

In WorkspaceCompanyCardExpensifyCardPromotionBanner.tsx:33-44, when the cards aren't yet enabled the button calls enableExpensifyCard(policyID, true, true). The button is only disabled when canWriteCompanyCards is false (line 52).

The new CARD_ADMIN role has WRITE access to COMPANY_CARDS (PolicyUtils.ts:157-162), so canWriteCompanyCards is true for a Card Admin and the button stays active. Enabling a workspace feature should instead require workspace-admin level access (canEditWorkspaceSettings), which a Card Admin does not have. The "tab appears then disappears" symptom is the optimistic areExpensifyCardsEnabled: true update being shown and then reverted.

Why the empty-state page is unaffected

The Expensify Card empty-state page already separates the two concerns: it computes canStartBankAccountSetup = canEditWorkspaceSettings(policy, currentUserLogin) and shows the read-only modal when setup is required but the user can't edit workspace settings (WorkspaceExpensifyCardPageEmptyState.tsx:74-75). The promotion banner skipped that distinction.

What changes do you think we should make in order to solve the problem?

Split the banner's logic by what the button actually does:

• When the feature is already enabled (areExpensifyCardsEnabled === true) → the button just navigates to the Expensify Card page. This is fine for a Card Admin (they have card write access), so keep it gated on canWriteCompanyCards.
• When the feature is NOT yet enabled → clicking enables the feature, which is admin-only. Gate this branch on the user's ability to edit workspace settings (canEditWorkspaceSettings(policy, currentUserLogin)), and fall back to the read-only modal (onReadOnlyAction) for Card Admins.

Concretely, in WorkspaceCompanyCardExpensifyCardPromotionBanner.tsx, compute whether the current user may enable the feature and use that (not canWriteCompanyCards) to decide between handleLearnMore and onReadOnlyAction when the cards aren't enabled yet — so a Card Admin sees the read-only modal instead of silently enabling Expensify Card.

What alternative solutions did you explore? (Optional)

Removing EXPENSIFY_CARD: WRITE from the CARD_ADMIN role would also block enablement, but that's too broad — it would also break legitimate Expensify Card management the role is supposed to allow. The fix belongs at the enablement gate in the banner.

---

Next Steps for Contributor+ team:
To accept: @MelvinBot implement [this](https://github.com/Expensify/App/issues/93506) to create a draft PR.
To refine: @MelvinBot <your feedback>
To reject: Explain why you are rejecting Melvin's proposal.