Skip to content

[NoQA][Insights] Add Compliance dashboard navigation and access rules - #104590

Open
OlGierd03 wants to merge 8 commits into
Expensify:mainfrom
software-mansion-labs:@OlGierd03/Insights-Compliance-Dashboard-Nav-Access-Rules
Open

OlGierd03 wants to merge 8 commits into
Expensify:mainfrom
software-mansion-labs:@OlGierd03/Insights-Compliance-Dashboard-Nav-Access-Rules

Conversation

@OlGierd03

@OlGierd03 OlGierd03 commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor

Explanation of Change

Adds a Spend / Compliance segmented control to the Insights page. Compliance is gated behind the new insightsCompliance beta and shown only to workspace admins and auditors (canViewAllPolicyData). Each tab navigates to /insights/<dashboardID>, so the route decides which dashboard is shown. Compliance has no charts yet, they come in a follow-up.

For readability, the workspace scoping in getVisibleCharts is moved into a separate getPoliciesInScope helper, with no change in behavior.

Fixed Issues

$ #102807

Tests

Precondition: account with the insightsPage beta, admin of a workspace.

  1. Open Insights and verify there are no tabs.
  2. Open /insights/compliance and verify the not found page shows.
  3. Enable the insightsCompliance beta and open Insights.
  4. Verify the Spend and Compliance tabs show, with Spend selected.
  5. Press Compliance and verify the URL is /insights/compliance.
  6. Go back and verify Spend is selected.
  7. Press Compliance, refresh and verify Compliance is selected.
  8. Open /insights/compliance in a new tab and verify Compliance is selected.
  9. Log out, open /insights/compliance, log in and verify Compliance is selected.
  10. Open /insights/unknown and verify the not found page shows.
  11. On Spend, change the date filter and press Compliance. Verify Compliance shows the default date filter.
  12. Press Spend and verify the changed date filter is kept.
  13. In the workspace filter, select only a workspace where you're a member and verify the Compliance tab still shows.
  14. Switch to narrow layout and verify the tabs show above the filters.
  15. Log in as an auditor of a workspace with both betas and verify the Compliance tab shows.
  16. Log in as a member (not admin or auditor) with both betas and verify there are no tabs.
  17. As the member, open /insights/compliance and verify the not found page shows.
  18. Log in as a user with only a personal workspace and both betas and verify there are no tabs.

Offline tests

  1. Open Insights with the insightsCompliance beta and go offline.
  2. Press Compliance and verify the tab switches.

QA Steps

NoQA

PR Author Checklist

  • I linked the correct issue in the ### Fixed Issues section above
  • I wrote clear testing steps that cover the changes made in this PR
    • I added steps for local testing in the Tests section
    • I added steps for the expected offline behavior in the Offline steps section
    • I added steps for Staging and/or Production testing in the QA steps section
    • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
    • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
    • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
  • I included screenshots or videos for tests on all platforms
  • I ran the tests on all platforms & verified they passed on:
    • Android: Native
    • Android: mWeb Chrome
    • iOS: Native
    • iOS: mWeb Safari
    • MacOS: Chrome / Safari
  • I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
  • I verified any copy / text that was added to the app is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
  • If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
  • I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
  • If new assets were added or existing ones were modified, I verified that:
    • The assets are optimized and compressed (for SVG files, run npm run compress-svg)
    • The assets load correctly across all supported platforms.
  • If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
  • If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
  • If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
  • If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
  • If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
    • I verified that all the inputs inside a form are aligned with each other.
    • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
  • If the PR adds or modifies the UI:
    • I asked an AI agent to review the changes for accessibility issues and addressed its findings.
    • I tested with a screen reader (VoiceOver on macOS) and verified all new/changed elements are reachable with a logical focus order.
    • I verified all new/changed elements have meaningful accessible names and roles.
    • I verified state changes are announced (e.g. checked/unchecked, expanded/collapsed, selected).
  • I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
  • If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

MacOS: Chrome / Safari Screenshot 2026-10-22 at 21 07 54
Screen.Recording.2026-10-22.at.21.09.58.mov

@melvin-bot

melvin-bot Bot commented Oct 21, 2026

Copy link
Copy Markdown

Hey, I noticed you changed src/languages/en.ts in a PR from a fork. For security reasons, translations are not generated automatically for PRs from forks.

If you want to automatically generate translations for other locales, an Expensify employee will have to:

  1. Look at the code and make sure there are no malicious changes.
  2. Run the Generate static translations GitHub workflow. If you have write access and the K2 extension, you can simply click: [this button]

Alternatively, if you are an external contributor, you can run the translation script locally with your own OpenAI API key. To learn more, try running:

npx bun ./scripts/generateTranslations.ts --help

Typically, you'd want to translate only what you changed by running npx bun ./scripts/generateTranslations.ts --compare-ref main

Comment thread src/pages/Insights/dashboardSpecs.ts Outdated
Comment thread src/pages/Insights/InsightsDashboard.tsx Outdated
Comment thread tests/unit/insightsQueriesTest.ts Outdated
Comment thread src/components/Navigation/NavigationTabBar/InsightsTabButton.tsx Outdated
@OlGierd03
OlGierd03 marked this pull request as ready for review October 23, 2026 14:43
@OlGierd03
OlGierd03 requested review from a team as code owners October 23, 2026 14:43
@melvin-bot
melvin-bot Bot requested review from Pujan92 and removed request for a team October 23, 2026 14:43
@melvin-bot

melvin-bot Bot commented Oct 23, 2026

Copy link
Copy Markdown

@Pujan92 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

@melvin-bot
melvin-bot Bot requested review from dylanexpensify and removed request for a team October 23, 2026 14:43
@OlGierd03

Copy link
Copy Markdown
Contributor Author

@MelvinBot Cancel the request for a review from @Pujan92 and instead request a review from @daledah, since he's assigned to the Insights project

@MelvinBot
MelvinBot requested review from daledah and removed request for Pujan92 October 23, 2026 14:49
@MelvinBot

Copy link
Copy Markdown
Contributor

Done. I removed the review request for Pujan92 and requested a review from daledah. Current requested reviewers: dylanexpensify, daledah.


view run

@OlGierd03

Copy link
Copy Markdown
Contributor Author

@Pujan92 sorry for unassigning you right after Melvin's ping. I assigned @daledah because he's one of the reviewers selected to review the Insights project PRs. Sorry for the confusion 🙇

@daledah

daledah commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

I can review this PR in a couple of hours

@OlGierd03

Copy link
Copy Markdown
Contributor Author

#104590 (comment)

@dylanexpensify could you please run parrot translations here? 🦜

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1dc9d4bdd6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +99 to +101
graphKey: CONST.INSIGHTS.GRAPH.SPEND_OVER_TIME,
titleKey: 'search.spendOverTime',
view: CONST.SEARCH.VIEW.LINE,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Do not render the Spend chart on Compliance

When an eligible admin or auditor opens Compliance after Spend has loaded for the same default filters, this placeholder is treated as a real chart: buildInsightsJsonQuery produces the same chart hash as Spend and useMultipleSnapshots reads the globally keyed snapshot_<hash>. Consequently getDashboardState sees the cached Spend snapshot as loaded and the Compliance page immediately renders “Spend over time” and its data instead of a chartless Compliance page; later responses can also overwrite the snapshot used by Spend. Represent the empty dashboard without a queryable Spend spec, or namespace its snapshots by dashboard/search key.

Useful? React with 👍 / 👎.

Comment on lines +74 to 75
// The tab opens on Spend dashboard once, then keeps the last dashboard in navigation state until the app restarts.
initialParams={{dashboardID: CONST.INSIGHTS.DASHBOARD.SPEND}}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Validate retained Compliance before native tab restore

When a narrow native user selects Compliance, leaves the tab, and then loses the compliance beta or their last admin/auditor workspace, the retained dashboardID: compliance here is still restored on the next Insights tab press. I checked NativeTabNavigator/tabScreenListeners.ts: the Insights handler only performs anonymous interception and never runs getInsightsTabRoute, so InsightsPage renders NotFound and the user cannot recover via the native tab even though Spend remains accessible. Validate the retained dashboard on native tab presses and fall back to Spend when access was revoked.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-23T15:06:08.581767Z 1dc9d4b Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@luacmartins
luacmartins self-requested a review October 23, 2026 15:49
Comment on lines +99 to +101
graphKey: CONST.INSIGHTS.GRAPH.SPEND_OVER_TIME,
titleKey: 'search.spendOverTime',
view: CONST.SEARCH.VIEW.LINE,

@luacmartins luacmartins Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Compliance still sends the Spend payload (date:year-to-date and spendOverTime), so GetInsights returns 400. Could we use anySubmission OR anyApproval with the same bounded range and request violationsOverTime instead? The chart and comparison queries need matching filters and regenerated hashes too.

You can apply this patch to fix the issue

insights-compliance-local-fix.patch

@daledah

daledah commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bug: I can’t click the back button in the header of the Not Found page when I access nsights/compliance without the insightsCompliance beta enabled

bug.1.mov

@JmillsExpensify
JmillsExpensify requested review from JmillsExpensify and removed request for dylanexpensify October 23, 2026 18:36

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants