Copilot is able to upgrade / downgrade workspace plan from collect to control and vice versa of another user

[izarutskaya]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.1.69-0
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: @allgandalf
Slack conversation (hyperlinked to channel name): #expensify_bugs

Action Performed:

Prerequisites: User A should have a workspace

1. Go to https://staging.expensify.com/
2. Log in with User A > Settings > Account > Add a copilot User B
3. Go to https://staging.new.expensify.com/
4. Log with User B
5. Click account > Switch accounts > Subscription > scroll down to reach Your Plans > Explore All plans
6. Click on Upgrade to Control / Downgrade to collect

Expected Result:

We shown a blocking modal if a co-pilot tries to add payment card / switch between pay-per-use and annual subscription, so blocking modal should be seen while upgrading / downgrading a subscription plan of another user

Actual Result:

The copilot is able to downgrade / upgrade subscription plan of another user

Workaround:

Unknown

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Platforms Tested:

On which of our officially supported platforms was this issue tested:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Recording.3224.mp4

Screen.Recording.2025-06-19.at.10.13.16.AM.mov

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @adelekennedy (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[izarutskaya]

From @allgandalf

Proposal

Please re-state the problem that we are trying to solve in this issue.

Copilot is able to upgrade / downgrade workspace plan from collect to control and vice versa

What is the root cause of that problem?

We do not block the upgrade / downgrade button if the user is acting as a co-pilot so the action doesn't get blocked

App/src/pages/settings/Subscription/SubscriptionPlan/SubscriptionPlanCardActionButton.tsx

Lines 47 to 50 in 3d818ef

	const handlePlanPress = (planType: PersonalPolicyTypeExcludedProps) => {
	closeComparisonModal?.();
	// If user has no policies, return.

What changes do you think we should make in order to solve the problem?

To fix this issue, we need to add a blocking modal to the page whenever the user is acting as a delegate and pressed the upgrade / downgrade button:

const [isActingAsDelegate] = useOnyx(ONYXKEYS.ACCOUNT, {selector: (account) => account?.delegatedAccess?.delegate});

const [isNoDelegateAccessMenuVisible, setIsNoDelegateAccessMenuVisible] = useState(false);


...

const handlePlanPress = (planType: PersonalPolicyTypeExcludedProps) => {


if (isActingAsDelegate) {
            setIsNoDelegateAccessMenuVisible(true);
            return;
        }
        closeComparisonModal?.();



.....

<DelegateNoAccessModal
                isNoDelegateAccessMenuVisible={isNoDelegateAccessMenuVisible}
                onClose={() => setIsNoDelegateAccessMenuVisible(false)}
            />

Note

After #64020, we will be using context provider here instead of the above, so during PR, we will use context similarly like we have used in #64020

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

N/A, this is a UI bug but we can always have UI test to see if the values are shown correctly, but this is not required for this case

What alternative solutions did you explore? (Optional)

N/A

[rushatgabhane]

i don't see why this is a bug. it's also allowed by backend

please create a feature request instead of a bug.
this change should require a problem solution statement

and ideally we list down all actions we wanna block

cc @dangrous @joekaufmanexpensify

[allgandalf]

i don't see why this is a bug

You are on collect plan , you’ll be billed $5, your copilot upgrades your plan to control, now you’re billed $18 per month, so yeah most probably a bug

Also, we block the copilot from updating the contract from pay per use -> annual, so it makes sense to block this action as well

[rushatgabhane]

a copilot has full access to your account so they should be able to do these actions

which is why a problem solution statement should be posted on slack for this. this is not a bug

[joekaufmanexpensify]

Hm, yeah I thought we really only limited adding or removing copilots for full access copilots.

It's interesting though that we show that blocking modal if you try to change from PPU > annual as a copilot or add a billing card. I don't see those mentioned in the design doc, though I did not work on this project. I am curious what @dylanexpensify and @dangrous think about the expected behavior here.

[dangrous]

Okay so it looks like we added copilot restrictions to a bunch of flows last December - #50796 - maybe due to some fraud stuff? My guess is then that we'd also want to restrict this flow. But cc @Julesssss since seems like you were in charge of those updates?

[allgandalf]

@Julesssss I already have a proposal here, can you please check, else i can be the C+ as well