Skip to content

Expense -"Approve Only" member can submit expense if role is changed after expense creation #104948

New issue
New issue
Open
Open
Expense -"Approve Only" member can submit expense if role is changed after expense creation#104948
Assignees
flodnvPujan92ShridharGoel
Labels
BugSomething is broken. Auto assigns a BugZero manager.DailyKSv2Overdue

Description

@applause-bot
applause-bot
bot
opened on Oct 26, 2026

If you haven’t already, check out our contributing guidelines for onboarding. To join our Slack channel, fill out this form.

Version Number: 9.5.20-0
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #102933
Email or phone of affected tester (no customers): ibellicotest+3295@gmail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Motorola MotoG60 / Android 12 (Hybrid app) - Windows 11 / Chrome
App Component: Money Requests

Action Performed:

Prerequisite: User A is owner of a "Control" workspace with delayed submissions and approvals enabled.
Prerequisite 2: User B already has a "Default" workspace.

  1. Open the staging.new.expensify.com website.
  2. Navigate to "Workspaces" > Workspace > "Members"
  3. Invite User B as "Member" of workspace.
  4. As User B, navigate to workspace chat.
  5. Create a manual expense.
  6. As User A, edit User B role to "Approve-Only"
  7. As User B, note that "Submit" is still available for the created expense.
  8. Click on "Submit"
  9. Note that expense can be submitted.

Expected Result:

"Approve-only" member shouldn´t be able to submit an expense in workspace chat.

Actual Result:

"Approve-Only" member is able to submit an expense, if role is changed from "Member" to "Approve-Only" after expense creation.

Workaround:

Unknown

Platforms:

  • Android: App
  • Android: mWeb Chrome
  • iOS: App
  • iOS: mWeb Safari
  • iOS: mWeb Chrome
  • Windows: Chrome
  • MacOS: Chrome Safari

Screenshots/Videos

Bug7294900_1792797446822.Approve_Only_1.mp4

View all open jobs on GitHub

Applause Internal Information
Exported by: Mita Rachim
Bug ID: 7294900

Issue OwnerCurrent Issue Owner: @ShridharGoel

Activity

  1. applause-bot
    added
    DeployBlockerCashThis issue or pull request should block deployment
    BugSomething is broken. Auto assigns a BugZero manager.
    on Oct 26, 2026
  2. gleitebr
    added this to #expensify-bugson Oct 26, 2026

  3. applause-bot commented on Oct 26, 2026

    @applause-bot
    applause-botBot
    on Oct 26, 2026
    Author

    While Applause doesn't embed attachments for this bug, here are the links for quick view:
    https://platform.applause.com/services/links/v1/external/35052ecbea68e617b2d4a85adf3271180d1402e8a8d73b29058714350b900a05

  4. melvin-bot commented on Oct 26, 2026

    @melvin-bot
    melvin-botBot
    on Oct 26, 2026 – with Melvin Bot

    @flodnv recently merged #102933, but they are OOO right now, so I'll auto-assign someone else.

  5. melvin-bot
    assigned
    NikkiWines
    on Oct 26, 2026

  6. melvin-bot commented on Oct 26, 2026

    @melvin-bot
    melvin-botBot
    on Oct 26, 2026 – with Melvin Bot

    Triggered auto assignment to @NikkiWines (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

  7. github-actions
    added
    Engineering
    HourlyKSv2
    on Oct 26, 2026
  8. melvin-bot
    assigned
    flodnv
    on Oct 26, 2026

  9. github-actions commented on Oct 26, 2026

    @github-actions
    github-actionsBot
    on Oct 26, 2026 – with GitHub Actions
    Contributor

    👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

    1. Identify the pull request that introduced this issue and revert it.
    2. Find someone who can quickly fix the issue.
    3. Fix the issue yourself.
  10. melvin-bot
    assigned
    Pujan92
    on Oct 26, 2026

  11. melvin-bot commented on Oct 26, 2026

    @melvin-bot
    melvin-botBot
    on Oct 26, 2026 – with Melvin Bot

    @flodnv @Pujan92 you have been assigned to this deploy blocker because you reviewed the offending PR: #102933

  12. melvin-bot
    assigned
    ShridharGoel
    on Oct 26, 2026

  13. melvin-bot commented on Oct 26, 2026

    @melvin-bot
    melvin-botBot
    on Oct 26, 2026 – with Melvin Bot

    @ShridharGoel you have been assigned to this deploy blocker because you authored the offending PR: #102933

  14. melvin-bot commented on Oct 26, 2026

    @melvin-bot
    melvin-botBot
    on Oct 26, 2026 – with Melvin Bot

    💬 A slack conversation has been started in #expensify-open-source

  15. MelvinBot commented on Oct 26, 2026

    @MelvinBot
    MelvinBot
    on Oct 26, 2026
    Contributor

    Deploy Blocker Analysis

    Causing PR: [Payment due @Pujan92] Add approve-only workspace role (high confidence). This is a gap in the new feature, not a regression in existing behavior.

    Root cause: The PR blocks approve-only members from creating expenses, but it doesn't change any of the checks that decide whether to show Submit. Those checks only ask whether the user owns the report, whether it's open, and whether it has expenses. They never check the user's current role. So after the role change, User B still owns the open draft and still sees Submit. Stale data isn't the cause: with an up-to-date role, the checks still return true.

    Recommendation: Fix forward or demote. Don't revert.

    • Revert is costly. The PR touches about 50 files, including translations in 11 languages.
    • The role isn't behind a beta, but it isn't in production yet. The bug only happens when an admin downgrades a member who has an open draft.
    • The fix is small. Add a canCreateExpensesOnPolicy check (or a dedicated "can submit" permission) for the submitter in the five submit checks listed below, and add unit tests for each.
    • Product needs to decide whether an approve-only member should be able to submit a draft they created before the role change. The server also accepted the submit. With delayed submissions on, scheduled auto-submit will likely submit the draft anyway, so hiding the button in App alone may not fully solve this.
    • Demote this if product decides that submitting existing drafts is acceptable for now.
    Investigation details

    What the PR added. The approve-only role has only Overview and Members read access, with no CREATE_EXPENSES permission:

    The PR uses this check only in create paths, such as canAddTransaction, canRequestMoney, canCreateReportOnPolicy, the workspace chat "+" menu, and the workspace pickers.

    The submit checks that ignore the role:

    Beta check. No approve-only beta exists in CONST.BETAS. Any admin of a Control workspace can assign the role (WorkspaceMemberRoleList.tsx).

    Next Steps: Reply with @MelvinBot implement this to create a draft PR, or @MelvinBot <your feedback> to refine this analysis.

  16. NikkiWines
    added
    ReviewingHas a PR in review
    on Oct 26, 2026

  17. NikkiWines commented on Oct 26, 2026

    @NikkiWines
    NikkiWines
    on Oct 26, 2026
    Contributor

    looks like this is being patched by #104952

  18. jasperhuangg
    added
    DailyKSv2
    and removed
    ReviewingHas a PR in review
    DeployBlockerCashThis issue or pull request should block deployment
    Engineering
    on Oct 26, 2026

  19. m-natarajan commented on Oct 26, 2026

    @m-natarajan
    m-natarajan
    on Oct 26, 2026

    Feature reverted, Not repro ("Approve-only" role option is no longer available in Workspace Settings > Members.)

    Mac 26.6/ Chrome, Version: 9.5.20-5

    Grabando.177.1.mp4
  20. flodnv
    unassigned
    NikkiWines
    on Oct 26, 2026
  21. Pujan92
    removed
    HourlyKSv2
    on Oct 28, 2026

  22. melvin-bot commented on Oct 29, 2026

    @melvin-bot
    melvin-botBot
    on Oct 29, 2026 – with Melvin Bot

    @ShridharGoel Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

  23. melvin-bot
    added
    Overdue
    on Oct 29, 2026

  24. melvin-bot commented on Nov 2, 2026

    @melvin-bot
    melvin-botBot
    on Nov 2, 2026 – with Melvin Bot

    @ShridharGoel Still overdue 6 days?! Let's take care of this!

  25. melvin-bot commented on Nov 3, 2026

    @melvin-bot
    melvin-botBot
    on Nov 3, 2026 – with Melvin Bot

    @ShridharGoel 6 days overdue. This is scarier than being forced to listen to Vogon poetry!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BugSomething is broken. Auto assigns a BugZero manager.DailyKSv2Overdue

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions