Apply approve-only permission checks to missed expense creation paths by ShridharGoel · Pull Request #104929 · Expensify/App

ShridharGoel · 2026-10-24T13:16:52Z

Explanation of Change

The approve-only workspace role lets a member approve reports but not create expenses (#102933). The permission check canCreateExpensesOnPolicy was applied to the main expense creation flows, but a few older paths still only checked that the member has any role on the workspace. This PR applies the check to those paths:

Per diem and time workspace pickers: getActivePoliciesWithExpenseChat now excludes workspaces without the create-expense permission. This also fixes the start page counts that show the Per diem tab and auto-select a single workspace.
"Submit to my employer": the workspace count selector now excludes workspaces the member cannot create expenses on, so the flow no longer opens the confirm page of an approve-only workspace.
Report field: useOutstandingReports now applies the same permission filter as the report list, so the field is disabled when the list would be empty.
Next step: an open, empty report now shows "No further action" instead of "Waiting for you to add expenses" when the report owner cannot create expenses on the workspace.
Green brick road: the outstanding-child flag of the member's own empty report no longer shows the GBR when the member cannot create expenses on the workspace. Approve and pay badges still show.
Duplicate report: the copy now targets the default workspace when the source workspace is approve-only, and the button hides when there is no eligible default.
Default workspace after deletion: the optimistic fallback no longer picks an approve-only workspace as the new default, so the "Default" label no longer flashes on it.

Fixed Issues

$ #104917
$ #104914
$ #104907
$ #104903
$ #104902
$ #104945

Tests

Setup:

User A creates a Control workspace and imports per diem rates to it.
User A invites User B to the workspace.
As User B, create a workspace of your own and set it as the default workspace.
As User B, create two empty reports and one report with an expense in User A's workspace chat.
User A changes User B's role on their workspace to Approve-only (workspace settings > Members).

Verify the fixes as User B:

Per diem workspace picker: open FAB > Create expense > Per diem. Verify User A's workspace does not appear in the workspace list.
Duplicate report: open the report with the expense in User A's workspace, then open More > Duplicate report. Verify the copy is created in your default workspace, with the expense and no error. Use a report with an expense, as in the issue's steps: an empty report has no expenses to copy, so it produces no visible copy. Do this step before step 10 deletes your default workspace. After that deletion, verify the Duplicate report option is hidden.
Next step and GBR: open one of the empty reports created in step 4. Verify the next step shows "No further action" instead of "Waiting for you to add expenses", and the LHN shows no GBR on User A's workspace chat. Then have another member submit a report to you for approval and verify the Approve badge still shows in the LHN.
Report field: create an expense in the self DM and tap Submit to my employer. Verify the flow does not open the confirm page of User A's workspace. Since no countable workspace remains, the flow creates a new Submit workspace, the same as for a user without a workspace. Then open a confirm page of an expense in the self DM and tap the Report field. Verify the Report field is disabled when the only outstanding reports are in User A's workspace, and enabled with a non-empty list otherwise. Also edit an expense that already sits in a report in User A's workspace: with exactly one outstanding report in another workspace, the Report field is enabled and that report can be picked.
Default label: delete your own workspace. Verify User A's workspace never shows the Default label, not even briefly. The new default is an eligible workspace or the personal workspace.

Regression checks:

As a regular member (no approve-only role), repeat steps 6, 7, 8, 9 and 10. Verify the behavior is unchanged: the workspace shows in the per diem picker, "Submit to my employer" routes to the only workspace, Duplicate report copies into the source workspace, deleting the default workspace picks the newest remaining group workspace, and "Waiting for you to add expenses" still shows on an open, empty report.

Verify that no errors appear in the JS console

Offline tests

Turn off the network as the approve-only member and repeat the verify steps above. The permission checks read local data, so the results are the same.
While offline, delete the default workspace. Verify the optimistic fallback still skips the approve-only workspace, with the same result after the request syncs.

QA Steps

Same as tests.

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

MacOS: Chrome / Safari

Screen.Recording.2026-10-24.at.7.16.30.PM.mov

Screen.Recording.2026-10-24.at.7.36.32.PM.mov

Screen.Recording.2026-10-24.at.7.46.23.PM.mov

codecov · 2026-10-24T13:19:51Z

Codecov Report

✅ Changes either increased or maintained existing code coverage, great job!

Files with missing lines	Coverage Δ
...eyRequestConfirmationList/sections/ReportField.tsx	`77.77% <100.00%> (+0.41%)`	⬆️
...MoneyRequestConfirmationList/sections/selectors.ts	`85.71% <100.00%> (+0.27%)`	⬆️
src/libs/NextStepUtils.ts	`91.00% <100.00%> (+0.09%)`	⬆️
src/libs/PolicyUtils/permissions.ts	`100.00% <ø> (ø)`
src/libs/PolicyUtils/policy.ts	`84.81% <100.00%> (+0.29%)`	⬆️
src/libs/ReportUtils.ts	`90.25% <100.00%> (+0.02%)`	⬆️
src/libs/actions/IOU/Duplicate.ts	`93.26% <100.00%> (ø)`
src/libs/actions/Policy/Policy.ts	`73.43% <100.00%> (+0.15%)`	⬆️
...es/iou/request/step/IOURequestEditReportCommon.tsx	`87.15% <100.00%> (+0.33%)`	⬆️
src/selectors/Policy.ts	`88.55% <ø> (+0.66%)`	⬆️
... and 2 more
... and 513 files with indirect coverage changes

melvin-bot · 2026-10-24T14:17:20Z

@Pujan92 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

chatgpt-codex-connector · 2026-10-24T14:17:25Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T14:34:01.842733Z	`618e3ac`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 618e3ac982

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…oy-blockers

ShridharGoel · 2026-11-01T12:10:11Z

@Pujan92 Did you get the chance to review this?

…oy-blockers # Conflicts: # src/components/MoneyRequestConfirmationList/sections/ReportField.tsx # src/hooks/useOutstandingReports.ts # src/pages/iou/request/step/IOURequestEditReportCommon.tsx

Pujan92 · 2026-11-02T14:35:12Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified any copy / text that was added to the app is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If the PR adds or modifies the UI:
- I asked an AI agent to review the changes for accessibility issues and addressed its findings.
- I tested with a screen reader (VoiceOver on macOS) and verified all new/changed elements are reachable with a logical focus order.
- I verified all new/changed elements have meaningful accessible names and roles.
- I verified state changes are announced (e.g. checked/unchecked, expanded/collapsed, selected).
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

Pujan92 · 2026-11-03T12:46:01Z

@ShridharGoel we need to remove the temp block condition

Pujan92 · 2026-11-03T12:53:51Z

~~#104917 isn't solved yet as able to see that approve only workspace in the per diem flow~~ My bad, I didn't reload the app

Apply approve-only permission checks to missed expense creation paths

618e3ac

melvin-bot Bot assigned ShridharGoel Oct 24, 2026

ShridharGoel marked this pull request as ready for review October 24, 2026 14:17

ShridharGoel requested review from a team as code owners October 24, 2026 14:17

melvin-bot Bot requested review from Pujan92 and flaviadefaria and removed request for a team October 24, 2026 14:17

melvin-bot Bot removed the request for review from a team October 24, 2026 14:17

chatgpt-codex-connector Bot reviewed Oct 24, 2026

View reviewed changes

Comment thread tests/actions/PolicyTest.ts Resolved

Comment thread src/components/MoneyRequestConfirmationList/sections/ReportField.tsx Resolved

ShridharGoel added 3 commits October 24, 2026 20:13

Document new tests with Given When Then comments

18cba54

Enable the report field when a different eligible report remains

17aaa48

Merge remote-tracking branch 'origin/main' into fix/approve-only-depl…

0501fb8

…oy-blockers

ShridharGoel requested a review from flodnv November 1, 2026 12:10

ShridharGoel added 2 commits November 1, 2026 18:22

Merge remote-tracking branch 'origin/main' into fix/approve-only-depl…

2aded82

…oy-blockers # Conflicts: # src/components/MoneyRequestConfirmationList/sections/ReportField.tsx # src/hooks/useOutstandingReports.ts # src/pages/iou/request/step/IOURequestEditReportCommon.tsx

fmt fixes

866f27d

ShridharGoel added 2 commits November 3, 2026 18:38

Revert "Block approve-only role assignment"

26061e3

Remove unnecessary type assertion in NextStepUtilsTest

b4e3514

Navigation Menu

Repository navigation

Apply approve-only permission checks to missed expense creation paths - #104929

Apply approve-only permission checks to missed expense creation paths#104929
ShridharGoel wants to merge 8 commits into
Expensify:mainfrom
ShridharGoel:fix/approve-only-deploy-blockers

ShridharGoel commented Oct 24, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 24, 2026 •

edited by github-actions Bot

Loading

Uh oh!

melvin-bot Bot commented Oct 24, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

ShridharGoel commented Nov 1, 2026

Uh oh!

Pujan92 commented Nov 2, 2026

Uh oh!

Pujan92 commented Nov 3, 2026

Uh oh!

Pujan92 commented Nov 3, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ShridharGoel commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

codecov Bot commented Oct 24, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

melvin-bot Bot commented Oct 24, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ShridharGoel commented Nov 1, 2026

Uh oh!

Pujan92 commented Nov 2, 2026

Reviewer Checklist

Screenshots/Videos

Uh oh!

Pujan92 commented Nov 3, 2026

Uh oh!

Pujan92 commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ShridharGoel commented Oct 24, 2026 •

edited

Loading

codecov Bot commented Oct 24, 2026 •

edited by github-actions Bot

Loading

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

Pujan92 commented Nov 3, 2026 •

edited

Loading