Skip to content

Fix canEditMoneyRequest for policies with Dynamic External Workflow #85495

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yuwenmemon merged 2 commits into from
Mar 18, 2026
+118 −0
Merged

Fix canEditMoneyRequest for policies with Dynamic External Workflow #85495

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b66405b
Disable editing requests for processing reports on DEW policies for n…
francoisl Mar 17, 2026
afde664
Add test
francoisl Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/libs/ReportUtils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,7 @@
getRuleApprovers,
getSubmitToAccountID,
hasDependentTags as hasDependentTagsPolicyUtils,
hasDynamicExternalWorkflow,
isExpensifyTeam,
isInstantSubmitEnabled,
isPaidGroupPolicy as isPaidGroupPolicyPolicyUtils,
Expand Down Expand Up @@ -1049,7 +1050,7 @@
};

let conciergeReportIDOnyxConnect: OnyxEntry<string>;
Onyx.connect({

Check warning on line 1053 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.CONCIERGE_REPORT_ID,
callback: (value) => {
conciergeReportIDOnyxConnect = value;
Expand All @@ -1057,7 +1058,7 @@
});

const defaultAvatarBuildingIconTestID = 'SvgDefaultAvatarBuilding Icon';
Onyx.connect({

Check warning on line 1061 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.SESSION,
callback: (value) => {
// When signed out, val is undefined
Expand All @@ -1075,7 +1076,7 @@
let allPersonalDetails: OnyxEntry<PersonalDetailsList>;
let allPersonalDetailLogins: string[];
let currentUserPersonalDetails: OnyxEntry<PersonalDetails>;
Onyx.connect({

Check warning on line 1079 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.PERSONAL_DETAILS_LIST,
callback: (value) => {
if (currentUserAccountID) {
Expand All @@ -1087,7 +1088,7 @@
});

let allReportsDraft: OnyxCollection<Report>;
Onyx.connect({

Check warning on line 1091 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.COLLECTION.REPORT_DRAFT,
waitForCollectionCallback: true,
callback: (value) => (allReportsDraft = value),
Expand All @@ -1095,7 +1096,7 @@

let allPolicies: OnyxCollection<Policy>;
let policiesArray: Policy[] = [];
Onyx.connect({

Check warning on line 1099 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.COLLECTION.POLICY,
waitForCollectionCallback: true,
callback: (value) => {
Expand All @@ -1105,7 +1106,7 @@
});

let allPolicyDrafts: OnyxCollection<Policy>;
Onyx.connect({

Check warning on line 1109 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.COLLECTION.POLICY_DRAFTS,
waitForCollectionCallback: true,
callback: (value) => (allPolicyDrafts = value),
Expand All @@ -1113,7 +1114,7 @@

let allReports: OnyxCollection<Report>;
let reportsByPolicyID: ReportByPolicyMap;
Onyx.connect({

Check warning on line 1117 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.COLLECTION.REPORT,
waitForCollectionCallback: true,
callback: (value) => {
Expand Down Expand Up @@ -1149,14 +1150,14 @@
});

let betaConfiguration: OnyxEntry<BetaConfiguration> = {};
Onyx.connect({

Check warning on line 1153 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.BETA_CONFIGURATION,
callback: (value) => (betaConfiguration = value ?? {}),
});

let deprecatedAllTransactions: OnyxCollection<Transaction> = {};
let deprecatedReportsTransactions: Record<string, Transaction[]> = {};
Onyx.connect({

Check warning on line 1160 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.COLLECTION.TRANSACTION,
waitForCollectionCallback: true,
callback: (value) => {
Expand All @@ -1182,7 +1183,7 @@
});

let allReportActions: OnyxCollection<ReportActions>;
Onyx.connect({

Check warning on line 1186 in src/libs/ReportUtils.ts

View workflow job for this annotation

GitHub Actions / Changed files ESLint check 

Onyx.connect() is deprecated. Use useOnyx() hook instead and pass the data as parameters to a pure function
key: ONYXKEYS.COLLECTION.REPORT_ACTIONS,
waitForCollectionCallback: true,
callback: (actions) => {
Expand Down Expand Up @@ -4780,6 +4781,11 @@
return true;
}

// On policies with Dynamic External Workflow, non-admin/managers should only be able to submit their expenses on open reports
if (!isOpenReport(moneyRequestReport) && hasDynamicExternalWorkflow(reportPolicy)) {
return false;
}

if (reportPolicy?.type === CONST.POLICY.TYPE.CORPORATE && moneyRequestReport && isSubmitted && isCurrentUserSubmitter(moneyRequestReport)) {
const isForwarded = getSubmitToAccountID(reportPolicy, moneyRequestReport) !== moneyRequestReport.managerID;
return !isForwarded;
Expand Down
112 changes: 112 additions & 0 deletions tests/unit/canEditFieldOfMoneyRequestTest.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,118 @@ describe('canEditFieldOfMoneyRequest', () => {
});
});

describe('Policy has Dynamic External Workflow', () => {
const DEW_POLICY_ID = '77';
const IOU_REPORT_ID = '88';
const IOU_TRANSACTION_ID = '99';
const EXPENSE_AMOUNT = 345;

const dewReportAction = {
...createRandomReportAction(7),
actionName: CONST.REPORT.ACTIONS.TYPE.IOU,
actorAccountID: currentUserAccountID,
originalMessage: {
IOUReportID: IOU_REPORT_ID,
IOUTransactionID: IOU_TRANSACTION_ID,
type: CONST.IOU.ACTION.CREATE,
amount: EXPENSE_AMOUNT,
currency: CONST.CURRENCY.USD,
},
};

const dewTransaction = {
...createRandomTransaction(Number(IOU_TRANSACTION_ID)),
transactionID: IOU_TRANSACTION_ID,
reportID: IOU_REPORT_ID,
amount: EXPENSE_AMOUNT,
};

const dewPolicy: Policy = {
...createRandomPolicy(Number(DEW_POLICY_ID), CONST.POLICY.TYPE.CORPORATE),
id: DEW_POLICY_ID,
role: CONST.POLICY.ROLE.USER,
approvalMode: CONST.POLICY.APPROVAL_MODE.DYNAMICEXTERNAL,
};

afterEach(() => {
Onyx.clear();
return waitForBatchedUpdates();
});

it('should return false for non-admin requestor editing receipt on a processing report', async () => {
const processingReport = {
...createExpenseReport(Number(IOU_REPORT_ID)),
policyID: DEW_POLICY_ID,
ownerAccountID: currentUserAccountID,
stateNum: CONST.REPORT.STATE_NUM.SUBMITTED,
statusNum: CONST.REPORT.STATUS_NUM.SUBMITTED,
};

const policyCollectionDataSet = toCollectionDataSet(ONYXKEYS.COLLECTION.POLICY, [dewPolicy], (p) => p.id);
await Onyx.multiSet({
[ONYXKEYS.SESSION]: {email: currentUserEmail, accountID: currentUserAccountID},
[`${ONYXKEYS.COLLECTION.TRANSACTION}${IOU_TRANSACTION_ID}`]: dewTransaction,
[`${ONYXKEYS.COLLECTION.REPORT}${IOU_REPORT_ID}`]: processingReport,
...policyCollectionDataSet,
});
await waitForBatchedUpdates();

const canEditReceipt = canEditFieldOfMoneyRequest(dewReportAction, CONST.EDIT_REQUEST_FIELD.RECEIPT);

expect(canEditReceipt).toBe(false);
});

it('should return true for non-admin requestor editing receipt on an open report', async () => {
const openReport = {
...createExpenseReport(Number(IOU_REPORT_ID)),
policyID: DEW_POLICY_ID,
ownerAccountID: currentUserAccountID,
stateNum: CONST.REPORT.STATE_NUM.OPEN,
statusNum: CONST.REPORT.STATUS_NUM.OPEN,
};

const policyCollectionDataSet = toCollectionDataSet(ONYXKEYS.COLLECTION.POLICY, [dewPolicy], (p) => p.id);
await Onyx.multiSet({
[ONYXKEYS.SESSION]: {email: currentUserEmail, accountID: currentUserAccountID},
[`${ONYXKEYS.COLLECTION.TRANSACTION}${IOU_TRANSACTION_ID}`]: dewTransaction,
[`${ONYXKEYS.COLLECTION.REPORT}${IOU_REPORT_ID}`]: openReport,
...policyCollectionDataSet,
});
await waitForBatchedUpdates();

const canEditReceipt = canEditFieldOfMoneyRequest(dewReportAction, CONST.EDIT_REQUEST_FIELD.RECEIPT);

expect(canEditReceipt).toBe(true);
});

it('should return true for admin editing receipt on a processing report', async () => {
const adminPolicy: Policy = {
...dewPolicy,
role: CONST.POLICY.ROLE.ADMIN,
};
const processingReport = {
...createExpenseReport(Number(IOU_REPORT_ID)),
policyID: DEW_POLICY_ID,
ownerAccountID: currentUserAccountID,
stateNum: CONST.REPORT.STATE_NUM.SUBMITTED,
statusNum: CONST.REPORT.STATUS_NUM.SUBMITTED,
};

const policyCollectionDataSet = toCollectionDataSet(ONYXKEYS.COLLECTION.POLICY, [adminPolicy], (p) => p.id);
await Onyx.multiSet({
[ONYXKEYS.SESSION]: {email: currentUserEmail, accountID: currentUserAccountID},
[`${ONYXKEYS.COLLECTION.TRANSACTION}${IOU_TRANSACTION_ID}`]: dewTransaction,
[`${ONYXKEYS.COLLECTION.REPORT}${IOU_REPORT_ID}`]: processingReport,
...policyCollectionDataSet,
});
await waitForBatchedUpdates();

const canEditReceipt = canEditFieldOfMoneyRequest(dewReportAction, CONST.EDIT_REQUEST_FIELD.RECEIPT);

expect(canEditReceipt).toBe(true);
});
});

describe('unreported per diem expense', () => {
const PER_DIEM_IOU_TRANSACTION_ID = '99';
const PER_DIEM_CUSTOM_UNIT_ID = 'perDiemUnit1';
Expand Down
Loading