Fix/28925: Anonymous user can edit profile by DylanDylann · Pull Request #29248 · Expensify/App

DylanDylann · 2023-10-11T02:08:02Z

Details

Public room as anonymous user can able to edit profile

Fixed Issues

$ #28925
PROPOSAL: #28925 (comment)

Tests

Go to a public room as an anonymous user like https://staging.new.expensify.com/r/207591744844000
Click on the search icon.
Close the login menu.
Enter url in chrome /settings/profile, /settings/profile/display-name
Verify that the login modal is displayed

Verify that no errors appear in the JS console

Offline tests

QA Steps

Go to a public room as an anonymous user like https://staging.new.expensify.com/r/207591744844000
Click on the search icon.
Close the login menu.
Enter url in chrome /settings/profile, /settings/profile/display-name
Verify that the login modal is displayed

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

Android: Native

There is a problem when testing with mobile native platform: Go to the public room with an anonymous user encountered the bellow error: (Which existed in the latest staging as well)

Android: mWeb Chrome

Screencast.from.11-10-2023.09.21.00.webm

iOS: Native

There is a problem when testing with mobile native platform: Go to the public room with an anonymous user encountered the bellow error: (Which existed in the latest staging as well)

iOS: mWeb Safari

Safari-room-output.mp4

MacOS: Chrome / Safari

MacOS-room-output.mp4

MacOS: Desktop

Cannot go to the public room with an anonymous user on desktop

DylanDylann · 2023-10-11T09:52:03Z

There is a problem when testing with mobile native platform: Go to the public room with an anonymous user encountered the bellow error: (Which existed in the latest staging as well)

Also I cannot go to the public room with an anonymous user on desktop.

So currently, I am missing the mobile native and desktop screenshots

melvin-bot · 2023-10-11T09:53:00Z

@burczu Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

DylanDylann · 2023-10-12T13:41:32Z

@burczu please help review this PR when you have a chance. Thanks

burczu · 2023-10-13T05:37:14Z

@DylanDylann In terms native and desktop, I think we can skip testing them here, so please check all the checkboxes and leave a suitable comments in screenshots/videos section of native environments.

burczu · 2023-10-13T05:38:14Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified tests pass on all platforms & I tested again on:
- Android: Native
- Android: mWeb Chrome
- iOS: Native
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- MacOS: Desktop
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is approved by marketing by adding the Waiting for Copy label for a copy review on the original GH to get the correct copy.
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(themeColors.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Web

Screen.Recording.2023-10-26.at.10.41.05.mov

Mobile Web - Chrome

Mobile Web - Safari

Desktop

iOS

Android

burczu · 2023-10-13T05:45:48Z

@DylanDylann I've encountered strange behaviour while testing this PR. Please take a look at the video below:

Screen.Recording.2023-10-13.at.07.42.57.mov

I think this should be handled here too, because it may case a regression.

DylanDylann · 2023-10-13T06:29:26Z

@DylanDylann I've encountered strange behaviour while testing this PR. Please take a look at the video below:

Screen.Recording.2023-10-13.at.07.42.57.mov
I think this should be handled here too, because it may case a regression.

Do you have any suggestions about the expected behavior?

burczu · 2023-10-13T06:31:17Z

@DylanDylann Two options: clicking back should do nothing or removing this back button.

burczu · 2023-10-13T06:36:53Z

@DylanDylann Actually - wait :) I think this back button should actually just close the sidebar. What do you think?

DylanDylann · 2023-10-13T06:38:06Z

@burczu yeah. So i think we just need to close the side bar when clicking on back button

DylanDylann · 2023-10-13T06:43:33Z

@burczu just updated the PR and here is the result:

Screencast.from.13-10-2023.13.40.40.webm

DylanDylann · 2023-10-16T01:07:06Z

@burczu please help review this PR when you have a chance. Thanks

burczu · 2023-10-16T12:27:08Z

@DylanDylann Thanks for addressing the issue with back button. Unfortunately I've encountered the same issue (second sidebar shows up for a second) event when I try to open /settings/profile or /settings/profile/display-name...

Screen.Recording.2023-10-16.at.14.21.26.mov

DylanDylann · 2023-10-16T16:07:28Z

@burczu I think it is an edge case because I can just handle the onStateChange event. Any suggestion for this case?

…-edit

DylanDylann · 2023-10-17T12:36:54Z

@burczu Friendly BUMP - Do you have any suggestion for this one or we will consider it as an edge case ?#29248 (comment)

DylanDylann · 2023-10-18T07:47:37Z

@DylanDylann Thanks for addressing the issue with back button. Unfortunately I've encountered the same issue (second sidebar shows up for a second) event when I try to open /settings/profile or /settings/profile/display-name...

Screen.Recording.2023-10-16.at.14.21.26.mov

@stitesExpensify should we consider it as an edge case?

burczu · 2023-10-18T07:51:00Z

@DylanDylann I don't think we should consider it as an edge case - there is a glitch and I bet it will be raised as a bug in the future, so I think we should try to find a solution for this. Sorry for the delayed answer, I had a lot other thinks to work on. I'll think about the possible solution here later today.

burczu · 2023-10-25T10:39:45Z

Hey @DylanDylann I've checked the new solution and I think it's the step in a good direction - I still can see the /settings/profile modal but for a really short amount of time which is better than before. I think the problem here is with this navigation - it looks like it starts before the redirection to the login modal page is made. Maybe we could somehow postpone it a little bit?

I tend to think I could approve it and see what the Expensify engineer thinks about it.

DylanDylann · 2023-10-25T12:50:47Z

@burczu I`ve fixed the conflict but the latest change in the main branch makes the app crash so I cannot test. Will ping you when it is fixed #30228 (comment)

…er-able-to-edit

DylanDylann · 2023-10-26T03:13:11Z

@burczu the main is fixed, just tested and it works well. Here is the result:

Screencast.from.26-10-2023.10.11.23.webm

burczu

Code LGTM

burczu · 2023-10-26T08:45:42Z

@stitesExpensify I've approved this PR, but there is one thing that concerns me. Please see the below video:

Screen.Recording.2023-10-26.at.10.41.05.mov

When we type /settings/profile or /settings/profile/display-name the page is correctly redirected to the sign in sidebar page, bot for milliseconds we see the settings page, until the sliding animation of the sign in sidebar ends - I'm not sure if this acceptable, so please decide about it.

…-edit

DylanDylann · 2023-10-30T04:11:53Z

@stitesExpensify please help review this PR when you have a chance

DylanDylann · 2023-11-01T23:38:22Z

@stitesExpensify friendly bump in case you miss this one

OSBotify · 2023-11-02T22:33:47Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2023-11-06T22:32:58Z

🚀 Deployed to staging by https://github.com/stitesExpensify in version: 1.3.96-0 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

OSBotify · 2023-11-09T22:50:31Z

🚀 Deployed to production by https://github.com/puneetlath in version: 1.3.96-15 🚀

platform	result
🤖 android 🤖	failure ❌
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

OSBotify · 2023-11-10T15:47:27Z

🚀 Deployed to production by https://github.com/puneetlath in version: 1.3.97-7 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

s77rt · 2024-02-05T02:51:45Z

src/pages/signin/SignInModal.js

            testID={SignInModal.displayName}
        >
-            <HeaderWithBackButton />
+            <HeaderWithBackButton onBackButtonPress={Navigation.dismissModal} />


This caused inconsistency between browser back button and modal back button. (Coming from #33417)

flodnv · 2024-03-07T16:07:29Z

src/libs/actions/Session/index.ts

+ * @param {string} route
+ */
+
+const canAccessRouteByAnonymousUser = (route: string) => {


canAnonymousUserAccessRoute would sound better

flodnv · 2024-03-07T16:07:52Z

src/libs/actions/Session/index.ts

+    if (route.startsWith('/')) {
+        routeRemovedReportId = routeRemovedReportId.slice(1);
+    }
+    const routesCanAccessByAnonymousUser = [ROUTES.SIGN_IN_MODAL, ROUTES.REPORT_WITH_ID_DETAILS.route, ROUTES.REPORT_WITH_ID_DETAILS_SHARE_CODE.route];


routesAccessibleByAnonymousUser would sound better

Fixed here: #37952

flodnv · 2024-03-07T16:09:11Z

src/libs/actions/Session/index.ts

 }

+/**
+ * check if the route can be accessed by anonymous user


Updating this comment (or adding a comment in the function) to say why an anonymous user can only access different routes would be helpful for future programmers like me who don't have context on why this exists (in general, comments should be used to explain why the code is like that, not what the code is obviously doing)

DylanDylann added 3 commits October 11, 2023 09:01

fix anonymous user can edit profile

c92ab2e

fix update util function

fa0fc43

fix lint issue

78ba2a4

DylanDylann marked this pull request as ready for review October 11, 2023 09:52

DylanDylann requested a review from a team as a code owner October 11, 2023 09:52

melvin-bot bot requested review from burczu and removed request for a team October 11, 2023 09:52

DylanDylann mentioned this pull request Oct 11, 2023

[HOLD for payment 2023-11-16] [$500] public room as anonymous user can able to edit profile #28925

Closed

6 tasks

fix dissmiss modal login when clicking on back button

709d48f

fix refactor code

0d08b32

Merge branch 'main' into fix/28925-public-room-anonymous-user-able-to…

51cd993

…-edit

DylanDylann added 2 commits October 19, 2023 00:56

fix sign in modal appear for a second

03af648

fix revert unrelated change

0ac3e98

DylanDylann force-pushed the fix/28925-public-room-anonymous-user-able-to-edit branch 2 times, most recently from cd4148c to a14e7ff Compare October 25, 2023 11:34

DylanDylann added 2 commits October 25, 2023 18:45

fix merge main

d0983f9

fix type error

70e068d

Merge branch 'Expensify:main' into fix/28925-public-room-anonymous-us…

bcfdc7e

…er-able-to-edit

burczu approved these changes Oct 26, 2023

View reviewed changes

melvin-bot bot requested a review from stitesExpensify October 26, 2023 08:42

DylanDylann and others added 3 commits October 30, 2023 10:32

Merge branch 'main' into fix/28925-public-room-anonymous-user-able-to…

bf8bec8

…-edit

fix: lint

1cb4cc1

fix lint prettier

3ff9451

stitesExpensify approved these changes Nov 2, 2023

View reviewed changes

stitesExpensify merged commit 5ae80bd into Expensify:main Nov 2, 2023

OSBotify mentioned this pull request Nov 6, 2023

Deploy Checklist: New Expensify 2023-11-06 #30929

Closed

OSBotify mentioned this pull request Nov 8, 2023

Deploy Checklist: New Expensify 2023-11-08 #31077

Closed

bernhardoj mentioned this pull request Dec 21, 2023

[PAID] [$500] Web - Sign in modal - Browser back button takes to previous modal while modal back button closes it #33417

Closed

6 tasks

DylanDylann mentioned this pull request Jan 13, 2024

[$1000] Annonymous User can open title/description edit task modal but not able to edit it #25482

Closed

6 tasks

jjcoffee mentioned this pull request Jan 30, 2024

[HOLD for payment 2024-02-14] [$500] Login - After opening public room and killing app user stuck on login page & back icon shown #35121

Closed

6 tasks

s77rt reviewed Feb 5, 2024

View reviewed changes

flodnv reviewed Mar 7, 2024

View reviewed changes

flodnv mentioned this pull request Mar 7, 2024

[HOLD for payment 2024-03-19] HIGH: [$500] Magic link - Can't sign in using magic link after going to public room via deeplink #36812

Closed

6 tasks

Conversation

DylanDylann commented Oct 11, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

DylanDylann commented Oct 11, 2023

Uh oh!

melvin-bot bot commented Oct 11, 2023

Uh oh!

DylanDylann commented Oct 12, 2023

Uh oh!

burczu commented Oct 13, 2023

Uh oh!

burczu commented Oct 13, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

burczu commented Oct 13, 2023

Uh oh!

DylanDylann commented Oct 13, 2023

Uh oh!

burczu commented Oct 13, 2023

Uh oh!

burczu commented Oct 13, 2023

Uh oh!

DylanDylann commented Oct 13, 2023

Uh oh!

DylanDylann commented Oct 13, 2023

Uh oh!

DylanDylann commented Oct 16, 2023

Uh oh!

burczu commented Oct 16, 2023

Uh oh!

DylanDylann commented Oct 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DylanDylann commented Oct 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DylanDylann commented Oct 18, 2023

Uh oh!

burczu commented Oct 18, 2023

Uh oh!

burczu commented Oct 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DylanDylann commented Oct 25, 2023

Uh oh!

DylanDylann commented Oct 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

burczu left a comment

Choose a reason for hiding this comment

Uh oh!

burczu commented Oct 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DylanDylann commented Oct 30, 2023

Uh oh!

DylanDylann commented Nov 1, 2023

Uh oh!

OSBotify commented Nov 2, 2023

Uh oh!

OSBotify commented Nov 6, 2023

Uh oh!

OSBotify commented Nov 9, 2023

Uh oh!

OSBotify commented Nov 10, 2023

Uh oh!

s77rt Feb 5, 2024

Choose a reason for hiding this comment

Uh oh!

flodnv Mar 7, 2024

DylanDylann commented Oct 11, 2023 •

edited

Loading

burczu commented Oct 13, 2023 •

edited

Loading

DylanDylann commented Oct 16, 2023 •

edited

Loading

DylanDylann commented Oct 17, 2023 •

edited

Loading

burczu commented Oct 25, 2023 •

edited

Loading

DylanDylann commented Oct 26, 2023 •

edited

Loading

burczu commented Oct 26, 2023 •

edited

Loading