[Due for payment 2025-03-11] [$250] Expense - An expense can be send to an expired WS via FAB

[IuliiaHerets]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.0.98-0
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught on HybridApp, is this reproducible on New Expensify Standalone?: Yes, reproducible on both
If this was caught during regression testing, add the test name, ID and link from TestRail: https://expensify.testrail.io/index.php?/tests/view/5592352
Email or phone of affected tester (no customers): gatantm@gmail.com
Issue reported by: Applause Internal Team
Device used: iPhone 16 Pro Max, iOS 18.1.1
App Component: Money Requests

Action Performed:

1. Login with an account without a subscription with Workspaces and an expired trial
2. Tap on Fab > Create expense
3. Enter amount or scan a receipt and confirm to send

Expected Result:

User can not submit an expense to a workspace without payment details after the trial has expired

Actual Result:

User can submit an expense to a workspace without payment details after the trial has expired through FAB

Workaround:

Unknown

Platforms:

• Android: Standalone
• Android: HybridApp
• Android: mWeb Chrome
• iOS: Standalone
• iOS: HybridApp
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug6741397_1739411112767.video_2025-02-13_03-44-28.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021890411613023898571
• Upwork Job ID: 1890411613023898571
• Last Price Increase: 2025-02-14
• Automatic offers:
• FitseTLT | Contributor | 106223557

Issue Owner

Current Issue Owner: @bfitzexpensify

[melvin-bot]

Triggered auto assignment to @bfitzexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[FitseTLT]

🚨 Edited by proposal-police: This proposal was edited at 2025-02-13 12:31:55 UTC.

Proposal

Please re-state the problem that we are trying to solve in this issue.

Expense - An expense can be send to an expired WS via FAB

What is the root cause of that problem?

As you can see on the OP the user is directly navigated from amount page to confirmation page on confirming amount this is because the active policy/default policy of the user was a group policy but in those cases we are directly navigating to the confirmation page without checking if billable action is restricted here

App/src/pages/iou/request/step/IOURequestStepAmount.tsx

Lines 255 to 259 in 5ddef34

	if (iouType === CONST.IOU.TYPE.CREATE && isPaidGroupPolicy(activePolicy) && activePolicy?.isPolicyExpenseChatEnabled) {
	const activePolicyExpenseChat = getPolicyExpenseChat(currentUserPersonalDetails.accountID, activePolicy?.id);
	setMoneyRequestParticipantsFromReport(transactionID, activePolicyExpenseChat);
	Navigation.navigate(
	ROUTES.MONEY_REQUEST_STEP_CONFIRMATION.getRoute(

What changes do you think we should make in order to solve the problem?

We will need to check the billable action is not restricted before navigating to confirmation page here

App/src/pages/iou/request/step/IOURequestStepAmount.tsx

Lines 255 to 259 in 5ddef34

	if (iouType === CONST.IOU.TYPE.CREATE && isPaidGroupPolicy(activePolicy) && activePolicy?.isPolicyExpenseChatEnabled) {
	const activePolicyExpenseChat = getPolicyExpenseChat(currentUserPersonalDetails.accountID, activePolicy?.id);
	setMoneyRequestParticipantsFromReport(transactionID, activePolicyExpenseChat);
	Navigation.navigate(
	ROUTES.MONEY_REQUEST_STEP_CONFIRMATION.getRoute(

        if (iouType === CONST.IOU.TYPE.CREATE && isPaidGroupPolicy(activePolicy) && activePolicy?.isPolicyExpenseChatEnabled && !shouldRestrictUserBillableActions(activePolicy.id)) {

We should do the checks in other places before navigating to confirmation page like here here here and others like navigateToConfirmationPage functions of all amount, distance and receipt pages and also here here here

On categorize a tracked expense we have the same problem so we should also add the same check here

We will add the same checks in all other places needed too where we navigate to MONEY_REQUEST_STEP_CONFIRMATION.

Note For C+: As you can see from the OP the user is directly navigated to confirmation page from Amount page so the missing check directly linked to the issue is inside IOURequestStepAmount but as I mentioned above there are a lot of other places where we are missing these checks so we will need to cover all cases in PR phase where we are starting a money request with a known report(not generated report id) and also where we are navigating to a confirmation page 👍

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

N / A

What alternative solutions did you explore? (Optional)

We can centralize the navigation via a util function use it everywhere and only navigate to confirmation page if it passes the restricted action check and otherwise navigate to restricted page. We can also additionally centralize the checking in startMoneyRequest where if the report we are starting the money request is a workspace chat and the billing is expired we can navigate to restricted page instead of starting the money request.

[etCoderDysto]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Expense - An expense can be send to an expired WS via FAB

What is the root cause of that problem?

n FloatingActionButtonAndPopover.tsx, we call selectOption when QAB is clicked

App/src/pages/home/sidebar/FloatingActionButtonAndPopover.tsx

Lines 255 to 259 in 5ddef34

	const selectOption = useCallback(
	(onSelected: () => void, shouldRestrictAction: boolean) => {
	if (shouldRestrictAction && quickActionReport?.policyID && shouldRestrictUserBillableActions(quickActionReport.policyID)) {
	Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(quickActionReport.policyID));
	return;

In selectOption, we check if the user is restricted from billable action by calling

shouldRestrictUserBillableActions(quickActionReport.policyID))

If the user is restricted we will navigate to restricted page. If not the onSelected navigation callback will be called.

When a user has created a workspace but hasn't created an expense yet, we will display scan qab by building a qab data from the created workspace (policyChatForActivePolicy)

App/src/pages/home/sidebar/FloatingActionButtonAndPopover.tsx

Lines 402 to 407 in 4f3a2ee

	if (!isEmptyObject(policyChatForActivePolicy)) {
	const onSelected = () => {
	interceptAnonymousUser(() => {
	selectOption(() => {
	hideProductTrainingTooltip();
	const quickActionReportID = policyChatForActivePolicy?.reportID || generateReportID();

In this scenario, quickActionReport will be undefined since there is no quick action yet. And when call selectOption the navigation callback will be called

What changes do you think we should make in order to solve the problem?

In selectOption when quckActionReport is undefined, we should use policyChatForActivePolicy.policyID to check if the user is restricted from performing billable action when the qab is only a result of creating a workspace but not performing other action that creates qab.

 if (shouldRestrictAction && policyChatForActivePolicy?.policyID && shouldRestrictUserBillableActions(policyChatForActivePolicy?.policyID)) {
                Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(policyChatForActivePolicy?.policyID));
                return;
            }

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

N/A

What alternative solutions did you explore? (Optional)

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~021890411613023898571

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @shubham1206agra (External)

[thelullabyy]

Proposal

Please re-state the problem that we are trying to solve in this issue.

User can submit an expense to a workspace without payment details after the trial has expired through FAB

What is the root cause of that problem?

Let's see this code

App/src/pages/iou/request/step/IOURequestStepAmount.tsx

Lines 255 to 259 in 5ddef34

	if (iouType === CONST.IOU.TYPE.CREATE && isPaidGroupPolicy(activePolicy) && activePolicy?.isPolicyExpenseChatEnabled) {
	const activePolicyExpenseChat = getPolicyExpenseChat(currentUserPersonalDetails.accountID, activePolicy?.id);
	setMoneyRequestParticipantsFromReport(transactionID, activePolicyExpenseChat);
	Navigation.navigate(
	ROUTES.MONEY_REQUEST_STEP_CONFIRMATION.getRoute(

Users with a group policy are being directly routed from the amount page to the confirmation page without proper validation. Specifically, we're not checking if the billable action is restricted before allowing this navigation

What changes do you think we should make in order to solve the problem?

1. To solve this bug completely, on confirmation page, let's add a useEffect to check if we should restrict the action or not and navigate to the restricted page if the check is true

    useEffect(() => {
        if (isPolicyExpenseChat && policyExpenseChat?.policyID && shouldRestrictUserBillableActions(policyExpenseChat?.policyID)) {
            Navigation.navigate(ROUTES.RESTRICTED_ACTION.getRoute(policyExpenseChat?.policyID), {forceReplace: true});
            return;
        }
    }, [isPolicyExpenseChat, policyExpenseChat?.policyID]);

2. With this approach, the App still navigates to the Confirmation page first before navigating to the restricted page. To improve and make a better UX, we can create a wrapped component

<WorkspaceRestrictedActionPageWrapper>
   <IOUConfirmationPage>
</WorkspaceRestrictedActionPageWrapper>

The useEffect in step 1 will be handled in WorkspaceRestrictedActionPageWrapper. With this improvement, the navigation will have happened before IOUConfirmationPage is rendered and It will create a better UX to users

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

NA

What alternative solutions did you explore? (Optional)

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[github-actions]

⚠️ @thelullabyy Thanks for your proposal. Please update it to follow the proposal template, as proposals are only reviewed if they follow that format (note the mandatory sections).

[melvin-bot]

@bfitzexpensify, @shubham1206agra Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!