Skip to content

Restrict report state transitions to archived policies only - #98948

Merged
rlinoz merged 16 commits into
Expensify:mainfrom
c3024:chaitanya/98868-restrict-more-menu-archived-policies
Aug 28, 2026
Merged

Restrict report state transitions to archived policies only#98948
rlinoz merged 16 commits into
Expensify:mainfrom
c3024:chaitanya/98868-restrict-more-menu-archived-policies

Conversation

@c3024

@c3024 c3024 commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Explanation of Change

Report state transitions (Submit, Approve, Pay, Unapprove, Cancel payment, Retract, Reopen) are now hidden only when the report's policy is archived, keyed on isArchivedPolicy. Reports archived for other reasons, such as the submitter being removed from the workspace, keep these actions so their outstanding reports can still be approved and paid. IOU and invoice reports keep the existing archived report checks because they have no policy archived state. The same keying is applied to canIOUBePaid, canApproveIOU and the report preview actions, which drive the preview button and the settlement button payment options.

Fixed Issues

$ #98868

PROPOSAL:

Tests

Removed member flow:

  1. As an admin, create a Control workspace with approvals enabled (Submit and Approve) and invite a member.
  2. As the member, create an expense on the workspace and submit the report.
  3. As the admin, remove the member from the workspace.
  4. As the admin, open the workspace chat and verify the report preview shows the Approve button.
  5. As the admin, open the removed member's submitted expense report.
  6. Verify the Approve action is available (header button or More menu) and approve the report.
  7. Verify the report preview and the report header show a Pay button with payment options and pay the report.

Archived policy flow:

  1. Create a workspace and add a member.
  2. As the member, submit an expense.
  3. As admin, run Onyx.merge('policy_<policyID>', {archivedDate: '2026-01-01'}) with the policyID created in step 1.
  4. Open the report and verify Approve, Pay, Unapprove, Cancel payment, Retract, and Reopen do not appear in the header, the More menu, or the report preview.
Screen.Recording.2026-08-20.at.2.28.58.PM.mov
Screen.Recording.2026-08-19.at.8.32.06.PM.mov
  • Verify that no errors appear in the JS console

Offline tests

Same as Tests.

QA Steps

Same as above.

  • Verify that no errors appear in the JS console

PR Author Checklist

  • I linked the correct issue in the ### Fixed Issues section above
  • I wrote clear testing steps that cover the changes made in this PR
    • I added steps for local testing in the Tests section
    • I added steps for the expected offline behavior in the Offline steps section
    • I added steps for Staging and/or Production testing in the QA steps section
    • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
    • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
    • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
  • I included screenshots or videos for tests on all platforms
  • I ran the tests on all platforms & verified they passed on:
    • Android: Native
    • Android: mWeb Chrome
    • iOS: Native
    • iOS: mWeb Safari
    • MacOS: Chrome / Safari
  • I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
  • I followed proper code patterns (see Reviewing the code)
    • I verified that comments were added to code that is not self explanatory
    • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
    • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
  • If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
  • I followed the guidelines as stated in the Review Guidelines
  • I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
  • If a new CSS style is added I verified that:
    • A similar style doesn't already exist
    • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))
  • If new assets were added or existing ones were modified, I verified that:
    • The assets are optimized and compressed (for SVG files, run npm run compress-svg)
    • The assets load correctly across all supported platforms.
  • If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
  • If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
  • If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
  • If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
  • If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
    • I verified that all the inputs inside a form are aligned with each other.
    • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
  • I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
  • If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari
Screen.Recording.2026-08-19.at.8.35.22.PM.mov
Screen.Recording.2026-08-19.at.8.32.06.PM.mov

@codecov

codecov Bot commented Aug 19, 2026

Copy link
Copy Markdown

Codecov Report

❌ Looks like you've decreased code coverage for some files. Please write tests to increase, or at least maintain, the existing level of code coverage. See our documentation here for how to interpret this table.

Files with missing lines Coverage Δ
src/components/Search/selectionBuilders.ts 79.45% <100.00%> (ø)
src/hooks/useSelectedTransactionsActions.ts 78.03% <100.00%> (ø)
src/libs/PolicyUtils.ts 79.46% <100.00%> (+0.03%) ⬆️
src/libs/ReportPrimaryActionUtils.ts 94.23% <100.00%> (+0.46%) ⬆️
src/libs/ReportSecondaryActionUtils.ts 96.27% <100.00%> (+0.46%) ⬆️
src/libs/SearchUIUtils.ts 68.02% <100.00%> (-0.03%) ⬇️
src/libs/TodosUtils.ts 95.71% <100.00%> (ø)
...c/components/Search/SearchWriteActionsProvider.tsx 66.83% <50.00%> (ø)
src/libs/ReportPreviewActionUtils.ts 91.66% <83.33%> (-1.56%) ⬇️
src/libs/actions/IOU/ReportWorkflow.ts 82.42% <75.00%> (-0.28%) ⬇️
... and 1 more
... and 36 files with indirect coverage changes

c3024 added 4 commits August 19, 2026 16:17
…ict-more-menu-archived-policies

# Conflicts:
#	tests/unit/ReportPrimaryActionUtilsTest.ts
#	tests/unit/ReportSecondaryActionUtilsTest.ts
…ict-more-menu-archived-policies

# Conflicts:
#	src/libs/ReportPreviewActionUtils.ts
#	src/libs/actions/IOU/ReportWorkflow.ts
@c3024
c3024 marked this pull request as ready for review August 19, 2026 15:19
@c3024
c3024 requested review from a team as code owners August 19, 2026 15:19
@melvin-bot
melvin-bot Bot requested review from daledah and removed request for a team August 19, 2026 15:19
@melvin-bot

melvin-bot Bot commented Aug 19, 2026

Copy link
Copy Markdown

@daledah Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

@melvin-bot
melvin-bot Bot requested review from dylanexpensify and removed request for a team August 19, 2026 15:19

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f32667f64

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/libs/ReportPrimaryActionUtils.ts Outdated
@c3024

c3024 commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

@codex review.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9a7700cc17

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/libs/actions/IOU/ReportWorkflow.ts
Comment thread src/libs/actions/IOU/ReportWorkflow.ts Outdated
// Expense reports cannot be paid when their policy is archived or pending delete. Reports archived for other reasons
// (e.g. the submitter was unshared from the policy) can still be paid. IOU reports have no policy
// archived state, so an archived chat blocks payment instead.
const isBlockedByArchivedState = isExpenseReport(iouReport) ? isArchivedOrPendingDeletePolicy(policy) : isChatReportArchived;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This logic is now duplicated in three places. Could we extract a single shared helper so the rule lives in one place?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extracted isPayBlockedByArchivedState in ReportUtils and used it in all three places. Thanks!

@dylanexpensify dylanexpensify left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@c3024 have we applied the Reject facet of this yet? Based on this comment.

@c3024

c3024 commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

@dylanexpensify, that is implemented now.

dylanexpensify
dylanexpensify previously approved these changes Aug 20, 2026

@dylanexpensify dylanexpensify left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍

@daledah

daledah commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ea3059179

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/libs/SearchUIUtils.ts
// the manager, so don't block Submit when the default submit-to route is the owner.
if (
canSubmitReport(report, ownerLogin, policy, allReportTransactions, allViolations, isIOUReportArchived || isChatReportArchived, currentUserLogin, currentUserAccountID) &&
canSubmitReport(report, ownerLogin, policy, allReportTransactions, allViolations, isArchivedOrPendingDeletePolicy(policy), currentUserLogin, currentUserAccountID) &&

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Read live policies before exposing Search transitions

When a workspace is deleted while offline and the user returns to a cached Search, this still exposes Submit because policy comes from the nested Search snapshot (getPolicyFromKey(data, report)), whereas deleteWorkspace() only sets pendingAction: DELETE on the live policy_<id> Onyx key; the Search screen does not subscribe to the live policy collection, so this helper never observes the optimistic deletion. The same stale policy also reaches the newly changed Approve, Pay, and Reject predicates. The fresh evidence beyond the earlier review thread is that these are separate Onyx keys and cached Search data is only reconciled with live transactions/reports, not policies, so evaluate these gates using the live policy collection or update the snapshot optimistically.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@c3024 could you please check this comment?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Subscribing to the policy key is not necessary to observe optimistic deletion. Policy data is also reconciled through updateSnapshots inside Onyx.update in OnyxUtils.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daledah addressed! thanks!

@daledah

daledah commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Reviewer Checklist

  • I have verified the author checklist is complete (all boxes are checked off).
  • I verified the correct issue is linked in the ### Fixed Issues section above
  • I verified testing steps are clear and they cover the changes made in this PR
    • I verified the steps for local testing are in the Tests section
    • I verified the steps for Staging and/or Production testing are in the QA steps section
    • I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
    • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
  • I checked that screenshots or videos are included for tests on all platforms
  • I included screenshots or videos for tests on all platforms
  • I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
  • I verified tests pass on all platforms & I tested again on:
    • Android: HybridApp
    • Android: mWeb Chrome
    • iOS: HybridApp
    • iOS: mWeb Safari
    • MacOS: Chrome / Safari
  • If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
  • I verified proper code patterns were followed (see Reviewing the code)
    • I verified that comments were added to code that is not self explanatory
    • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
    • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
  • If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
  • I verified that this PR follows the guidelines as stated in the Review Guidelines
  • I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
  • If a new component is created I verified that:
    • A similar component doesn't exist in the codebase
    • All props are defined accurately
    • The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
    • The only data being stored in the state is data necessary for rendering and nothing else
    • The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
  • If a new CSS style is added I verified that:
    • A similar style doesn't already exist
    • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
  • If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
  • If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
  • If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
  • If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
  • If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
    • I verified that all the inputs inside a form are aligned with each other.
    • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
  • For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
  • If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
  • I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

MacOS: Chrome / Safari
web.mov
web-2.mov

@daledah

daledah commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

@c3024 could you please merge main again?

@daledah daledah left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes LGTM

@melvin-bot
melvin-bot Bot requested a review from rlinoz August 27, 2026 14:34

@rlinoz rlinoz left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, one minor request.

Comment thread tests/unit/ReportSecondaryActionUtilsTest.ts Outdated
@rlinoz
rlinoz merged commit 687e9e0 into Expensify:main Aug 28, 2026
35 of 37 checks passed
@github-actions

Copy link
Copy Markdown
Contributor

🚧 rlinoz has triggered a test Expensify/App build. You can view the workflow run here.

@OSBotify

Copy link
Copy Markdown
Contributor

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

@OSBotify

Copy link
Copy Markdown
Contributor

🚀 Deployed to staging by https://github.com/rlinoz in version: 9.4.64-0 🚀

platform result
🕸 web 🕸 success ✅
🤖 android 🤖 success ✅
🍎 iOS 🍎 success ✅

@MelvinBot

Copy link
Copy Markdown
Contributor

Yes — help site changes are required. Draft PR: #99803

Two published articles described the old behavior:

Article What's now wrong Fix
Delete-a-Workspace.md "Outstanding expenses and reports can be retracted by the submitter and assigned to another workspace." isRetractAction now returns false for an archived or pending-delete policy, so Retract is gone after deletion. Dropped the retract claim, listed every action that disappears, and documented Change workspace as the way to restore them. Added a matching FAQ.
Managing-Workspace-Members.md Nothing said what happens to a removed member's Outstanding reports — the exact confusion #98868 was filed about. Added a note that admins can still Approve and Pay them, and that only workspace deletion removes report actions. Also corrected Remove from WorkspaceRemove from workspace to match the live UI.
How I confirmed the retract regression

Before this PR, isRetractAction had no archived guard, and getSecondaryReportActions has no outer archived guard around its call site either — so Retract was previously shown on a deleted workspace's reports, exactly as the article said. This PR added the guard at ReportSecondaryActionUtils.ts:738, which is intentional per your archived-policy test steps, but it makes that documented bullet false.

isChangeWorkspaceAction has no archived guard, so Change workspace is still available — that's the workaround I documented.

UI labels verified in the live app (not inferred)

Confirmed on dev NewDot web: Remove from workspace, Delete workspace, Retract, Unapprove, Cancel payment, Change workspace, Approve, Pay.

Member profile panel showing 'Remove from workspace' button

Member profile panel showing 'Remove from workspace' button

Workspace list three-dot menu showing 'Delete workspace'

Workspace list three-dot menu showing 'Delete workspace'

Report More menu (Outstanding) showing 'Retract'

Report More menu (Outstanding) showing 'Retract'

Report More menu (Approved) showing 'Unapprove'

Report More menu (Approved) showing 'Unapprove'

Report More menu (Paid) showing 'Cancel payment'

Report More menu (Paid) showing 'Cancel payment'

Report More menu showing 'Change workspace'

Report More menu showing 'Change workspace'

Reopen could not be surfaced in any state I could reach without a real bank payment or an accounting export integration, so its label is taken from your PR description rather than from the live UI. Worth a second look when you review.

The draft PR is labelled HelpDot and assigned to you.

@c3024, please review the linked help site PR and confirm it reflects the current behavior. Then mark the linked help site PR Ready for review


view run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants