[HOLD for payment 2024-11-29] [Held] [$250] Invoices - Workspace settings can be opened from "workspace" link when workspace is deleted

[IuliiaHerets]

If you haven’t already, check out our contributing guidelines for onboarding and email [email protected] to request to join our Slack channel!

---

Version Number: 9.0.33-1
Reproducible in staging?: Y
Reproducible in production?: N/A - new feature, doesn't exist in prod
Issue was found when executing this PR: #48275
Email or phone of affected tester (no customers): [email protected]
Issue reported by: Applause Internal Team

Action Performed:

Precondition:

• User B has no workspace.

1. Go to staging.new.expensify.com
2. {User A] Send an invoice to User B.
3. [User B] Pay the invoice using Pay as a business option.
4. [User B] Delete the workspace.
5. {User B] Go to invoice chat.
6. [User B] Click on the "workspace" link in Expensify message.

Expected Result:

The link should lead to not here page because workspace is deleted.

Actual Result:

The link can open workspace settings page and Members tab leads to not here page.

Workaround:

Unknown

Platforms:

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug6601039_1726148441534.20240912_213050.1.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021834598579747458653
• Upwork Job ID: 1834598579747458653
• Last Price Increase: 2024-09-13
• Automatic offers:
• ishpaul777 | Contributor | 104008088
• gijoe0295 | Contributor | 104027162

Issue Owner

Current Issue Owner: @joekaufmanexpensify

[melvin-bot]

Triggered auto assignment to @joekaufmanexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[IuliiaHerets]

We think that this bug might be related to #vip-bills

[iwiznia]

Removed blocker, see https://expensify.slack.com/archives/C9YU7BX5M/p1726158576447559

[melvin-bot]

Triggered auto assignment to @srikarparsi (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[luacmartins]

@IuliiaHerets I think the uploaded video is incorrect. Can you please check?

[IuliiaHerets]

@luacmartins fixed, sorry for this

[luacmartins]

No problem. Thank you!

[luacmartins]

This is also reproducible in prod if we just copy/paste the workspace link

[rlinoz]

Just by having the workspace link in any chat the problem also happens in prod:

Screen.Recording.2024-09-12.at.14.46.18.mov

[IuliiaHerets]

We can't pay the invoice using Pay as a business in prod, so I marked it as N/A - can't check on prod

[gijoe0295]

Edited by proposal-police: This proposal was edited at 2023-10-06T15:00:00Z.

Proposal

Please re-state the problem that we are trying to solve in this issue.

The link can open workspace settings page and Members tab leads to not here page.

What is the root cause of that problem?

After deleting the workspace, we still retain some workspace information to show the invoice report's avatars and name:

These information is returned by OpenReport:

The not found page condition here simply checks for empty/delete-pending policy:

App/src/pages/workspace/WorkspacePageWithSections.tsx

Lines 171 to 174 in c6ce0f8

	return (
	(!isEmptyObject(policy) && !PolicyUtils.isPolicyAdmin(policy) && !shouldShowNonAdmin) ||
	(PolicyUtils.isPendingDeletePolicy(policy) && PolicyUtils.isPendingDeletePolicy(prevPolicy))
	);

What changes do you think we should make in order to solve the problem?

1. We can add shouldShowPolicy to the shouldShowNotFoundPage above to filter these workspaces and prevent them from being accessed by URL:

App/src/libs/PolicyUtils.ts

Lines 180 to 187 in 7748eff

	function shouldShowPolicy(policy: OnyxEntry<Policy>, isOffline: boolean, currentUserLogin: string | undefined): boolean {
	return (
	!!policy &&
	(policy?.type !== CONST.POLICY.TYPE.PERSONAL || !!policy?.isJoinRequestPending) &&
	(isOffline || policy?.pendingAction !== CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE || Object.keys(policy.errors ?? {}).length > 0) &&
	!!getPolicyRole(policy, currentUserLogin)
	);
	}

This condition is also used in WorkspacesListPage to filter viewable workspace. This solution ensures if a workspace did not appear in the workspaces list, it should not be accessible via direct URL.

App/src/pages/workspace/WorkspacesListPage.tsx

Line 315 in 0c37d5b

.filter((policy): policy is PolicyType => PolicyUtils.shouldShowPolicy(policy, !!isOffline))

2. We also need to add the above filter to WorkspaceInitialPage and WorkspaceProfilePage:

App/src/pages/workspace/WorkspaceInitialPage.tsx

Line 310 in c225771

const shouldShowNotFoundPage =

App/src/pages/workspace/WorkspaceProfilePage.tsx

Line 155 in 1eecd00

shouldShowNotFoundPage={policy === undefined}

3. And modify the not found subtitle in those pages as well since they are assuming that only empty policies are deleted:

App/src/pages/workspace/WorkspacePageWithSections.tsx

Line 190 in c6ce0f8

subtitleKey={isEmptyObject(policy) ? undefined : 'workspace.common.notAuthorized'}

App/src/pages/workspace/WorkspaceInitialPage.tsx

Line 363 in c225771

subtitleKey={isEmptyObject(policy) ? undefined : 'workspace.common.notAuthorized'}

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~021834598579747458653

[gijoe0295]

Will retest today.

[joekaufmanexpensify]

@gijoe0295 Did you have a chance to do this?

[ishpaul777]

@gijoe0295 has asked some help from @fabioh8010, the investigation in ongoing #49509

[joekaufmanexpensify]

Sounds good. TY!

[melvin-bot]

Reviewing label has been removed, please complete the "BugZero Checklist".

[melvin-bot]

The solution for this issue has been 🚀 deployed to production 🚀 in version 9.0.65-5 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

• fix: deleted workspace with invoices is accessible by url #49509

If no regressions arise, payment will be issued on 2024-11-29. 🎊

For reference, here are some details about the assignees on this issue:

• @ishpaul777 requires payment automatic offer (Contributor)
• @gijoe0295 requires payment automatic offer (Contributor)

[melvin-bot]

@ishpaul777 @joekaufmanexpensify @ishpaul777 The PR fixing this issue has been merged! The following checklist (instructions) will need to be completed before the issue can be closed. Please copy/paste the BugZero Checklist from here into a new comment on this GH and complete it. If you have the K2 extension, you can simply click: [this button]

[joekaufmanexpensify]

@ishpaul777 could you handle the checklist here?

[joekaufmanexpensify]

As an fyi, I am OOO the rest of the week after today. Assuming the checklist is done by then, I will handle payment on Monday!

[ishpaul777]

BugZero Checklist:

• [Contributor] Classify the bug:

Bug classification

Source of bug:

• 1a. Result of the original design (eg. a case wasn't considered)
• 1b. Mistake during implementation
• 1c. Backend bug
• 1z. Other:

Where bug was reported:

• 2a. Reported on production
• 2b. Reported on staging (deploy blocker)
• 2c. Reported on both staging and production
• 2d. Reported on a PR
• 2z. Other:

Who reported the bug:

• 3a. Expensify user
• 3b. Expensify employee
• 3c. Contributor
• 3d. QA
• 3z. Other:

• [Contributor] The offending PR has been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake.

  Link to comment: https://github.com/Expensify/App/pull/38488/files#r1864457951

• [Contributor] If the regression was CRITICAL (e.g. interrupts a core flow) A discussion in #expensify-open-source has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner.

  Link to discussion: not required

• [Contributor] If it was decided to create a regression test for the bug, please propose the regression test steps using the template below to ensure the same bug will not reach production again. - Not required because reproduction steps are far fetched, not a core or even usual flow, Real user rarely could have encountered it, One time issue Now its fixed

[melvin-bot]

@srikarparsi, @joekaufmanexpensify, @ishpaul777, @gijoe0295 Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[joekaufmanexpensify]

Just back from OOO. Will handle remaining steps today!

[joekaufmanexpensify]

Checklist is all set. We're good to pay.

[joekaufmanexpensify]

We need to pay:

• @gijoe0295 $250 for PR via Upwork.
• @ishpaul777 $250 for C+ via Upwork.

[joekaufmanexpensify]

@gijoe0295 $250 sent and contract ended!

[joekaufmanexpensify]

@ishpaul777 $250 sent and contract ended!

[joekaufmanexpensify]

Upwork job closed

[joekaufmanexpensify]

All set, thanks everyone!