Report - "Not here" page displayed when trying to add expense to report after categorizing

[mitarachim]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.2.48-0
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: https://test-management.browserstack.com/projects/2219752/test-runs/TR-1894/folder/13176730/41237111/1005354563
Email or phone of affected tester (no customers): ibellicotest+2040@gmail.com
Issue reported by: Applause Internal Team
Device used: Motorola MotoG60 / Android 12 / Chrome ( mWeb / Hybrid app) - Windows 11 / Chrome
App Component: Money Requests

Action Performed:

Prerequisite: Account has at least one workspace.

1. Open the Expensify app.
2. Open any workspace chat.
3. Create a manual expense without category.
4. Open the report of the just created expense.
5. Wait until whisper to categorize expense appears.
6. Send a comment with any category to add to report.
7. Wait until category field updates. (Close and reopen report if necessary)
8. Tap on "Submit"
9. Tap on "More" and select "Add Expense"
10. Tap on "Create Expense"
11. Note that you land on a "It´s not here" page.

Expected Result:

User should be able to add a new expense to a report after adding a category via comment.

Actual Result:

User lands on a "It´s not here" page when trying to add an expense to an "Outstanding" report after setting a category via comment.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug7000043_1762818549848.Not.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @trjExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[TaduJR]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When a user creates an expense report and categorizes it via a comment (whisper), then submits the report, they are unable to add a new expense to the same report. Clicking "More" > "Add Expense" > "Create Expense" results in a "It's not here" (NotFound) page being displayed instead of the expense creation flow.

This issue occurs specifically with test accounts that use the + postfix format (e.g., user+test@expensify.com), where Concierge is automatically added as a participant to provide guidance.

What is the root cause of that problem?

The root cause is an overly restrictive security check in the getMoneyRequestOptions function that blocks ALL IOU actions when an Expensify system account (like Concierge, accountID: 8392101) is a participant in a report.

Location of the issue:

App/src/libs/ReportUtils.ts

Lines 9489 to 9501 in 5dc4f0c

	// We don't allow IOU actions if an Expensify account is a participant of the report, unless the policy that the report is on is owned by an Expensify account
	const doParticipantsIncludeExpensifyAccounts = lodashIntersection(reportParticipants, CONST.EXPENSIFY_ACCOUNT_IDS).length > 0;
	// This will be fixed as part of https://github.com/Expensify/Expensify/issues/507850
	// eslint-disable-next-line @typescript-eslint/no-deprecated
	const policyOwnerAccountID = getPolicy(report?.policyID)?.ownerAccountID;
	const isPolicyOwnedByExpensifyAccounts = policyOwnerAccountID ? CONST.EXPENSIFY_ACCOUNT_IDS.includes(policyOwnerAccountID) : false;
	if (doParticipantsIncludeExpensifyAccounts && !isPolicyOwnedByExpensifyAccounts) {
	// Allow create expense option for Manager McTest report
	if (reportParticipants.some((accountID) => accountID === CONST.ACCOUNT_ID.MANAGER_MCTEST) && Permissions.isBetaEnabled(CONST.BETAS.NEWDOT_MANAGER_MCTEST, allBetas)) {
	return [CONST.IOU.TYPE.SUBMIT];
	}
	return [];
	}

The problematic logic:

if (doParticipantsIncludeExpensifyAccounts && !isPolicyOwnedByExpensifyAccounts) {
    // Allow create expense option for Manager McTest report
    if (reportParticipants.some((accountID) => accountID === CONST.ACCOUNT_ID.MANAGER_MCTEST) && Permissions.isBetaEnabled(CONST.BETAS.NEWDOT_MANAGER_MCTEST, allBetas)) {
        return [CONST.IOU.TYPE.SUBMIT];
    }
    return [];  // ← This blocks adding expenses to existing expense reports
}

The flow:

1. User with test account creates an expense report → Concierge is automatically added as participant
2. User submits the report → Works fine (report already exists)
3. User clicks "Add Expense" via MoneyReportHeader dropdown → Calls getMoneyRequestOptions(reportID, ...)
4. getMoneyRequestOptions detects Concierge in participants → Returns [] (empty allowed IOU types)
5. canCreateRequest validation fails because SUBMIT is not in the allowed options
6. AccessOrNotFoundWrapper shows NotFound page

Why the check exists:

This security check was originally added in PR #4821 (issue #4486) to prevent users from creating NEW reports or sending money requests TO system accounts like Concierge/Chronos. It was later refined in PR #30019 to allow IOU actions when the workspace is owned by an Expensify account.

Why it's too restrictive:

The check doesn't distinguish between:

• ❌ Creating NEW reports WITH Expensify accounts (should be blocked)
• ✅ Adding expenses to EXISTING reports THAT HAVE Expensify accounts (should be allowed)

For test accounts, Concierge is intentionally added as a participant. The expense report already exists with Concierge, so blocking additional expense additions prevents legitimate business operations.

What changes do you think we should make in order to solve the problem?

Add an exception to the Expensify account security check for expense reports, since adding expenses to an existing expense report is safe even when Expensify accounts are participants.

Change location:

App/src/libs/ReportUtils.ts

Lines 9495 to 9501 in 5dc4f0c

	if (doParticipantsIncludeExpensifyAccounts && !isPolicyOwnedByExpensifyAccounts) {
	// Allow create expense option for Manager McTest report
	if (reportParticipants.some((accountID) => accountID === CONST.ACCOUNT_ID.MANAGER_MCTEST) && Permissions.isBetaEnabled(CONST.BETAS.NEWDOT_MANAGER_MCTEST, allBetas)) {
	return [CONST.IOU.TYPE.SUBMIT];
	}
	return [];
	}

Proposed fix:

// We don't allow IOU actions if an Expensify account is a participant of the report, unless:
// 1. The policy is owned by an Expensify account, OR
// 2. It's an expense report (adding to existing report is safe)
// This commonly occurs with test accounts where Concierge is automatically added as a participant.
const doParticipantsIncludeExpensifyAccounts = lodashIntersection(reportParticipants, CONST.EXPENSIFY_ACCOUNT_IDS).length > 0;
// This will be fixed as part of https://github.com/Expensify/Expensify/issues/507850
// eslint-disable-next-line @typescript-eslint/no-deprecated
const policyOwnerAccountID = getPolicy(report?.policyID)?.ownerAccountID;
const isPolicyOwnedByExpensifyAccounts = policyOwnerAccountID ? CONST.EXPENSIFY_ACCOUNT_IDS.includes(policyOwnerAccountID) : false;
if (doParticipantsIncludeExpensifyAccounts && !isPolicyOwnedByExpensifyAccounts && !isExpenseReport(report)) {
    // Allow create expense option for Manager McTest report
    if (reportParticipants.some((accountID) => accountID === CONST.ACCOUNT_ID.MANAGER_MCTEST) && Permissions.isBetaEnabled(CONST.BETAS.NEWDOT_MANAGER_MCTEST, allBetas)) {
        return [CONST.IOU.TYPE.SUBMIT];
    }
    return [];
}

Key change: Add && !isExpenseReport(report) to the condition on line 9498.

This ensures the early return (blocking IOU actions) only happens when:

• Expensify accounts are participants, AND
• The policy is NOT owned by Expensify accounts, AND
• It is NOT an expense report

[gijoe0295]

I think this and #74818 have the same root cause. See #74818 (comment)

[trjExpensify]

Yeah, likely. @marcochavezf @marcaaron @jasperhuangg @thienlnam - these look like Concierge AI bugs. 👍

[trjExpensify]

Flagged this in #concierge-ai https://expensify.slack.com/archives/C090U774ZH7/p1763136980164569

[trjExpensify]

No change, Melv. Posted in channel for the team.

[trjExpensify]

Same here, @thienlnam. This is quite a bad bug I think.