[Payment due @Pujan92] Add approve-only workspace role

src/CONST/index.ts

@@ -4949,6 +4949,12 @@ const CONST = {
             CARD_ADMIN: 'cardAdmin',
             PEOPLE_ADMIN: 'peopleAdmin',
             PAYMENTS_ADMIN: 'paymentsAdmin',
+            APPROVE_ONLY: 'approveOnly',
+        },
+        APPROVE_ONLY_BLOCKED_REASONS: {
+            HAS_CARD_ON_POLICY: 'hasCardOnPolicy',
+            IS_RESTRICTED_BY_DOMAIN_GROUP: 'isRestrictedByDomainGroup',
+            IS_DEFAULT_POLICY: 'isDefaultPolicy',
         },
         WORKSPACE_STATUS: {
             ACTIVE: 'active',
@@ -4981,6 +4987,7 @@ const CONST = {
             REPORT_FIELDS: 'reportFields',
             ACCOUNTING: 'accounting',
             MORE_FEATURES: 'moreFeatures',
+            CREATE_EXPENSES: 'createExpenses',
         },
         POLICY_FEATURE_ACCESS: {
             READ: 'read',

src/ONYXKEYS.ts

@@ -160,6 +160,9 @@ const ONYXKEYS = {
     /** Object containing contact method that's going to be added */
     PENDING_CONTACT_ACTION: 'pendingContactAction',
 
+    /** Reasons the backend refused an approve-only role change, shown to the requesting client in a modal */
+    BLOCKED_ROLE_CHANGE: 'blockedRoleChange',
+
     /** Store the information of validateCode */
     VALIDATE_ACTION_CODE: 'validateActionCode',
 
@@ -1944,6 +1947,7 @@ type OnyxValuesMapping = {
     [ONYXKEYS.RECENTLY_USED_REPORT_FIELDS]: OnyxTypes.RecentlyUsedReportFields;
     [ONYXKEYS.RAM_ONLY_UPDATE_REQUIRED]: boolean;
     [ONYXKEYS.SUPPORTAL_PERMISSION_DENIED]: OnyxTypes.SupportalPermissionDenied | null;
+    [ONYXKEYS.BLOCKED_ROLE_CHANGE]: OnyxTypes.BlockedRoleChange | null;
     [ONYXKEYS.RESET_REQUIRED]: boolean;
     [ONYXKEYS.PLAID_CURRENT_EVENT]: string;
     [ONYXKEYS.NVP_PRIVATE_TAX_EXEMPT]: boolean;

src/components/DeferredGlobalModals.tsx

@@ -1,3 +1,4 @@
+import useApproveOnlyRoleBlockedModal from '@hooks/useApproveOnlyRoleBlockedModal';
 import useScreenShareRequestPrompt from '@hooks/useScreenShareRequestPrompt';
 
 import React from 'react';
@@ -14,6 +15,7 @@ const LazyTrialPaymentReminderModalManager = React.lazy(() => import('./TrialPay
  */
 function DeferredGlobalModals() {
     useScreenShareRequestPrompt();
+    useApproveOnlyRoleBlockedModal();
 
     return (
         <>

src/components/Tables/WorkspaceListTable/WorkspaceRowThreeDotsMenu.tsx

@@ -12,7 +12,7 @@ import useThemeStyles from '@hooks/useThemeStyles';
 import {clearCopyPolicySettings} from '@libs/actions/Policy/CopyPolicySettings';
 import {callFunctionIfActionIsAllowed} from '@libs/actions/Session';
 import Navigation from '@libs/Navigation/Navigation';
-import {canUnarchivePolicy} from '@libs/PolicyUtils';
+import {canRoleCreateExpenses, canUnarchivePolicy} from '@libs/PolicyUtils';
 import shouldRenderTransferOwnerButton from '@libs/shouldRenderTransferOwnerButton';
 
 import UnarchiveWorkspaceFlow from '@pages/workspace/archiveWorkspace/UnarchiveWorkspaceFlow';
@@ -135,7 +135,8 @@ function WorkspaceRowThreeDotsMenu({item, onDeleteWorkspace, onArchiveWorkspace,
             }
         }
 
-        if (!isDefault && !item?.isJoinRequestPending && !isRestrictedToPreferredPolicy) {
+        // Making the workspace the default would break expense creation routing for members without create-expenses permission.
+        if (!isDefault && !item?.isJoinRequestPending && !isRestrictedToPreferredPolicy && canRoleCreateExpenses(item.role)) {
             menuItems.push({
                 icon: icons.Star,
                 text: translate('workspace.common.setAsDefault'),

src/components/Tables/WorkspaceMembersTable/index.tsx

@@ -69,6 +69,7 @@ type WorkspaceMembersTableProps = {
 
 const WORKSPACE_MEMBER_FILTER_VALUES = {
     ADMINS: 'admins',
+    APPROVE_ONLY: 'approveOnly',
     APPROVERS: 'approvers',
     AUDITORS: 'auditors',
     CARD_ADMINS: 'cardAdmins',
@@ -266,6 +267,11 @@ export default function WorkspaceMembersTable({
             return true;
         }
 
+        const isApproveOnly = item.role === CONST.POLICY.ROLE.APPROVE_ONLY;
+        if (filterValues.includes(WORKSPACE_MEMBER_FILTER_VALUES.APPROVE_ONLY) && isApproveOnly) {
+            return true;
+        }
+
         const isEditor = item.role === CONST.POLICY.ROLE.EDITOR;
         if (filterValues.includes(WORKSPACE_MEMBER_FILTER_VALUES.EDITORS) && isEditor) {
             return true;
@@ -321,6 +327,11 @@ export default function WorkspaceMembersTable({
             label: translate('workspace.people.guests'),
             value: WORKSPACE_MEMBER_FILTER_VALUES.GUESTS,
         });
+
+        filterConfig.role.options.push({
+            label: translate('workspace.people.approveOnly'),
+            value: WORKSPACE_MEMBER_FILTER_VALUES.APPROVE_ONLY,
+        });
     }
 
     if (isSubmitPolicy(policy)) {

src/components/WorkspaceMemberRoleList.tsx

@@ -111,6 +111,13 @@ function getAssignableWorkspaceMemberRoleItems(
             isSelected: currentRole === CONST.POLICY.ROLE.USER,
             keyForList: CONST.POLICY.ROLE.USER,
         },
+        {
+            value: CONST.POLICY.ROLE.APPROVE_ONLY,
+            text: translate('workspace.common.roleName', CONST.POLICY.ROLE.APPROVE_ONLY),
+            alternateText: translate('workspace.common.approveOnlyAlternateText'),
+            isSelected: currentRole === CONST.POLICY.ROLE.APPROVE_ONLY,
+            keyForList: CONST.POLICY.ROLE.APPROVE_ONLY,
+        },
     ];
 
     const selectableRoles = getSelectableRoles(policy, currentUserLogin, allowedRoles);
@@ -148,7 +155,7 @@ function WorkspaceMemberRoleList({
                         ListItem={SingleSelectListItem}
                         onSelectRow={onSelectRole}
                         confirmButtonOptions={confirmButtonOptions}
-                        shouldSingleExecuteRowSelect
+                        shouldSingleExecuteRowSelect={!confirmButtonOptions?.showButton}
                         initiallyFocusedItemKey={availableRoleItems.find((item) => item.isSelected)?.keyForList}
                         addBottomSafeAreaPadding
                     >

src/hooks/useApproveOnlyRoleBlockedModal.ts

@@ -0,0 +1,77 @@
+/**
+ * Subscribes to BLOCKED_ROLE_CHANGE in Onyx and shows the blocked-reasons modal on the global modal stack
+ * when the backend refuses an approve-only role change.
+ */
+import {clearBlockedRoleChange, clearUpdateMemberRoleError} from '@userActions/Policy/Member';
+
+import CONST from '@src/CONST';
+import type {TranslationPaths} from '@src/languages/types';
+import ONYXKEYS from '@src/ONYXKEYS';
+import type BlockedRoleChange from '@src/types/onyx/BlockedRoleChange';
+
+import type {OnyxEntry} from 'react-native-onyx';
+
+import {useEffect, useRef} from 'react';
+
+import useConfirmModal from './useConfirmModal';
+import useLocalize from './useLocalize';
+import useOnyx from './useOnyx';
+
+const APPROVE_ONLY_ROLE_BLOCKED_MODAL_ID = 'approveOnlyRoleBlocked';
+
+const REASON_TRANSLATION_KEYS: Record<string, TranslationPaths> = {
+    [CONST.POLICY.APPROVE_ONLY_BLOCKED_REASONS.HAS_CARD_ON_POLICY]: 'workspace.people.approveOnlyRoleBlockedReasons.hasCardOnPolicy',
+    [CONST.POLICY.APPROVE_ONLY_BLOCKED_REASONS.IS_RESTRICTED_BY_DOMAIN_GROUP]: 'workspace.people.approveOnlyRoleBlockedReasons.isRestrictedByDomainGroup',
+    [CONST.POLICY.APPROVE_ONLY_BLOCKED_REASONS.IS_DEFAULT_POLICY]: 'workspace.people.approveOnlyRoleBlockedReasons.isDefaultPolicy',
+};
+
+function useApproveOnlyRoleBlockedModal() {
+    const {translate} = useLocalize();
+    const {showConfirmModal, closeModalByID} = useConfirmModal();
+    const [blockedRoleChange] = useOnyx(ONYXKEYS.BLOCKED_ROLE_CHANGE);
+    const lastShownRef = useRef<OnyxEntry<BlockedRoleChange>>(undefined);
+    const isModalOpenRef = useRef(false);
+
+    useEffect(() => {
+        if (!blockedRoleChange) {
+            if (isModalOpenRef.current) {
+                isModalOpenRef.current = false;
+                closeModalByID(APPROVE_ONLY_ROLE_BLOCKED_MODAL_ID);
+            }
+            return;
+        }
+
+        if (lastShownRef.current === blockedRoleChange) {
+            return;
+        }
+        lastShownRef.current = blockedRoleChange;
+        isModalOpenRef.current = true;
+
+        const {policyID, email, blockedReasons = []} = blockedRoleChange;
+
+        // `OnyxUpdates.apply` runs `request.failureData` on the microtask after `response.onyxData`, which sets a
+        // generic inline error on the member row. Clear that row error once `failureData` has settled so the modal
+        // is the only feedback shown for a blocked role change.
+        if (policyID && email) {
+            Promise.resolve().then(() => {
+                clearUpdateMemberRoleError(policyID, email);
+            });
+        }
+
+        const reasonLines = blockedReasons.filter((reason) => reason in REASON_TRANSLATION_KEYS).map((reason) => `• ${translate(REASON_TRANSLATION_KEYS[reason])}`);
+        const hasReasonLines = reasonLines.length > 0;
+
+        showConfirmModal({
+            id: APPROVE_ONLY_ROLE_BLOCKED_MODAL_ID,
+            title: translate('workspace.people.approveOnlyRoleBlockedTitle'),
+            prompt: hasReasonLines ? [translate('workspace.people.approveOnlyRoleBlockedDescription'), '', ...reasonLines].join('\n') : translate('common.genericErrorMessage'),
+            confirmText: translate(hasReasonLines ? 'workspace.people.approveOnlyRoleBlockedConfirm' : 'common.buttonConfirm'),
+            shouldShowCancelButton: false,
+        }).then(() => {
+            isModalOpenRef.current = false;
+            clearBlockedRoleChange();
+        });
+    }, [blockedRoleChange, closeModalByID, showConfirmModal, translate]);
+}
+
+export default useApproveOnlyRoleBlockedModal;

src/hooks/useDefaultExpensePolicy.tsx

@@ -1,15 +1,19 @@
 import isTeachersUnitePolicyID from '@libs/isTeachersUnitePolicyID';
-import {isGroupPolicy, isPolicyAccessible} from '@libs/PolicyUtils';
+import {canCreateExpensesOnPolicy, isGroupPolicy, isPolicyAccessible} from '@libs/PolicyUtils';
 
 import ONYXKEYS from '@src/ONYXKEYS';
 import type {Policy} from '@src/types/onyx';
 
-import type {OnyxCollection} from 'react-native-onyx';
+import type {OnyxCollection, OnyxEntry} from 'react-native-onyx';
 
 import useCurrentUserPersonalDetails from './useCurrentUserPersonalDetails';
 import useOnyx from './useOnyx';
 import usePreferredPolicy from './usePreferredPolicy';
 
+function isEligibleDefaultExpensePolicy(policy: OnyxEntry<Policy>, login: string): policy is Policy {
+    return !!policy && isGroupPolicy(policy) && isPolicyAccessible(policy, login) && canCreateExpensesOnPolicy(policy, login) && !isTeachersUnitePolicyID(policy.id);
+}
+
 /**
  * Selector that finds the single qualifying group policy ID from the collection.
  * Returns only an ID (stable) — prevents re-renders when unrelated policies change.
@@ -21,7 +25,7 @@ function getSingleGroupPolicyID(policies: OnyxCollection<Policy>, login: string)
 
     let singlePolicyID: string | undefined;
     for (const policy of Object.values(policies)) {
-        if (!policy || !isGroupPolicy(policy) || !isPolicyAccessible(policy, login) || isTeachersUnitePolicyID(policy.id)) {
+        if (!isEligibleDefaultExpensePolicy(policy, login)) {
             continue;
         }
         if (!singlePolicyID) {
@@ -50,11 +54,11 @@ export default function useDefaultExpensePolicy() {
     const [singleGroupPolicy] = useOnyx(`${ONYXKEYS.COLLECTION.POLICY}${singleGroupPolicyID}`);
 
     // Teachers Unite only supports expenses via split expense , so it can never be the default destination for a new expense.
-    if (isRestrictedToPreferredPolicy && isGroupPolicy(preferredPolicy) && isPolicyAccessible(preferredPolicy, login) && !isTeachersUnitePolicyID(preferredPolicy?.id)) {
+    if (isRestrictedToPreferredPolicy && isEligibleDefaultExpensePolicy(preferredPolicy, login)) {
         return preferredPolicy;
     }
 
-    if (isGroupPolicy(activePolicy) && isPolicyAccessible(activePolicy, login) && !isTeachersUnitePolicyID(activePolicy?.id)) {
+    if (isEligibleDefaultExpensePolicy(activePolicy, login)) {
         return activePolicy;
     }
 

src/hooks/usePolicyForMovingExpenses.ts

@@ -2,7 +2,7 @@ import {useActivePolicyContext} from '@components/ActivePolicyProvider';
 import {useSession} from '@components/OnyxListItemProvider';
 
 import isTeachersUnitePolicyID from '@libs/isTeachersUnitePolicyID';
-import {canSubmitPerDiemExpenseFromWorkspace, getPolicyRole, isGroupPolicy, isPolicyMemberWithoutPendingDelete, isTimeTrackingEnabled} from '@libs/PolicyUtils';
+import {canCreateExpensesOnPolicy, canSubmitPerDiemExpenseFromWorkspace, isGroupPolicy, isPolicyMemberWithoutPendingDelete, isTimeTrackingEnabled} from '@libs/PolicyUtils';
 
 import CONST from '@src/CONST';
 import ONYXKEYS from '@src/ONYXKEYS';
@@ -22,15 +22,10 @@ function checkForUserPendingDelete(login: string, policy: OnyxEntry<Policy>) {
     return isPolicyMemberWithoutPendingDelete(login, policy);
 }
 
-function isPolicyMemberByRole(policy: OnyxEntry<Policy>, login: string) {
-    const role = getPolicyRole(policy, login);
-    return !!role && (Object.values(CONST.POLICY.ROLE) as string[]).includes(role);
-}
-
 function isPolicyValidForMovingExpenses(policy: OnyxEntry<Policy>, login: string, isPerDiemRequest?: boolean, isTimeRequest?: boolean) {
     return (
         checkForUserPendingDelete(login, policy) &&
-        isPolicyMemberByRole(policy, login) &&
+        canCreateExpensesOnPolicy(policy, login) &&
         isGroupPolicy(policy) &&
         policy?.pendingAction !== CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE &&
         // Teachers Unite doesn't support reimbursement, so it can never be a destination for moving/reporting an expense.

src/languages/de.ts

@@ -5013,6 +5013,8 @@ ${amount} für ${merchant} – ${date}`,
                         return 'Personenverwaltung';
                     case CONST.POLICY.ROLE.PAYMENTS_ADMIN:
                         return 'Zahlungsadministrator';
+                    case CONST.POLICY.ROLE.APPROVE_ONLY:
+                        return 'Nur Genehmigung';
                     case CONST.POLICY.ROLE.USER:
                         return 'Mitglied';
                     default:
@@ -5053,6 +5055,7 @@ ${amount} für ${merchant} – ${date}`,
             cardAdminAlternateText: 'Arbeitsbereichskarten verwalten.',
             peopleAdminAlternateText: 'Mitglieder und Genehmigungsabläufe verwalten.',
             paymentsAdminAlternateText: 'Workflow-Zahlungen verwalten.',
+            approveOnlyAlternateText: 'Nur Berichte genehmigen.',
             readOnlyActionTitle: 'Nicht so schnell …',
             readOnlyActionPrompt: 'Ihre Arbeitsbereichsrolle kann diese Einstellungen anzeigen, aber nicht bearbeiten.',
             noAccessActionPrompt: 'Ihre Arbeitsbereichsrolle hat keinen Zugriff auf diese Einstellungen. Bitten Sie eine/n Admin, falls Sie Zugriff benötigen.',
@@ -7298,6 +7301,15 @@ Der Control-Tarif beginnt bei 9 $ pro aktivem Mitglied und Monat.`,
         },
         people: {
             genericFailureMessage: 'Beim Entfernen eines Mitglieds aus dem Workspace ist ein Fehler aufgetreten, bitte versuche es erneut',
+            approveOnlyRoleBlockedTitle: 'Diese Rolle kann nicht geändert werden',
+            approveOnlyRoleBlockedConfirm: 'Verstanden',
+            approveOnlyRoleBlockedDescription: 'Mitglieder mit der Rolle „Nur Genehmigung“ können in diesem Arbeitsbereich keine Ausgaben erstellen. Diese müssen zuerst behoben werden:',
+            approveOnlyRoleBlockedReasons: {
+                hasCardOnPolicy: 'Ihnen ist in diesem Arbeitsbereich eine Karte zugewiesen. Ein Arbeitsbereichs- oder Kartenadministrator muss sie zuerst entziehen.',
+                isRestrictedByDomainGroup:
+                    'Dieser Arbeitsbereich ist der bevorzugte Arbeitsbereich für eine Domänengruppe, in der sie sich befinden. Ein Domänenadministrator muss dies zuerst ändern.',
+                isDefaultPolicy: 'Dies ist ihr Standard-Arbeitsbereich. Sie müssen einen anderen festlegen, bevor Sie ihre Rolle aktualisieren können.',
+            },
             removeMembersPrompt: ({memberName}: {memberName: string}) => ({
                 one: `Möchtest du ${memberName} wirklich entfernen?`,
                 other: 'Sind Sie sicher, dass Sie diese Mitglieder entfernen möchten?',
@@ -7349,6 +7361,10 @@ Der Control-Tarif beginnt bei 9 $ pro aktivem Mitglied und Monat.`,
                 cannotRemove: 'Du kannst dich selbst oder den/die Workspace-Inhaber:in nicht entfernen',
                 genericRemove: 'Beim Entfernen dieses Workspace-Mitglieds ist ein Problem aufgetreten',
             },
+            makeApproveOnly: () => ({
+                one: 'Auf „Nur Genehmigung“ setzen',
+                other: 'Als „Nur Genehmigung“ festlegen',
+            }),
             addedWithPrimary: 'Einige Mitglieder wurden mit ihren primären Anmeldungen hinzugefügt.',
             invitedBySecondaryLogin: (secondaryLogin: string) => `Hinzugefügt durch sekundären Login ${secondaryLogin}.`,
             workspaceMembersCount: (count: number) => `Gesamtzahl der Workspace-Mitglieder: ${count}`,
@@ -7371,6 +7387,7 @@ Der Control-Tarif beginnt bei 9 $ pro aktivem Mitglied und Monat.`,
             admins: 'Workspace-Administratoren',
             approvers: 'Genehmigende',
             auditors: 'Prüfer',
+            approveOnly: 'Nur Genehmigung',
             guests: 'Gäste',
             editors: 'Bearbeiter',
             emptyRoleFilter: {title: 'Keine Mitglieder entsprechen diesem Filter', subtitle: 'Laden Sie ein Mitglied ein oder ändern Sie den Filter oben.'},
@@ -9675,8 +9692,8 @@ Fügen Sie weitere Ausgabelimits hinzu, um den Cashflow Ihres Unternehmens zu sc
                 other: `hat Sie aus den Genehmigungs-Workflows und Spesen-Chats von ${joinedNames} entfernt. Zuvor eingereichte Berichte bleiben in Ihrem Posteingang zur Genehmigung verfügbar.`,
             };
         },
-        demotedFromWorkspace: (policyName: string, oldRole: string) =>
-            `hat Ihre Rolle in ${policyName} von ${oldRole} zu Nutzer geändert. Sie wurden aus allen Einreicher-Spesen-Chats entfernt, außer aus Ihrem eigenen.`,
+        demotedFromWorkspace: (policyName: string, oldRole: string, newRole: string) =>
+            `hat Ihre Rolle in ${policyName} von ${oldRole} zu ${newRole} geändert. Sie wurden aus allen Einreicher-Spesen-Chats entfernt, außer aus Ihrem eigenen.`,
         updatedWorkspaceCurrencyAction: (oldCurrency: string, newCurrency: string) => `Standardwährung auf ${newCurrency} aktualisiert (zuvor ${oldCurrency})`,
         updatedWorkspaceFrequencyAction: (oldFrequency: string, newFrequency: string) => `die automatische Berichtshäufigkeit auf „${newFrequency}“ aktualisiert (zuvor „${oldFrequency}“)`,
         updateApprovalMode: (newValue: string, oldValue?: string) => `hat den Genehmigungsmodus auf „${newValue}“ aktualisiert (zuvor „${oldValue}“)`,