[Due for payment 2026-11-16] Expense - Error shows up when approve-only member duplicates report

@Pujan92

If you haven’t already, check out our contributing guidelines for onboarding. To join our Slack channel, fill out this form.

Version Number: 9.5.20-0
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #102933
Email or phone of affected tester (no customers): osdjnoidosjio@gmail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.5 / Chrome
App Component: Money Requests

Action Performed:

Precondition:

User A creates a Control workspace.
User A invites User B to workspace.
User B creates a workspace and make it default workspace.

Go to staging.new.expensify.com
[User B] Create an expense in the invited workspace chat.
[User A] Change User B's role to Approve-only in workspace settings > Members.
[User B] Open the report.
[User B] Click More > Duplicate report.
[User B] Open the duplicated report.
[User B] Dismiss the error.

Expected Result:

Duplicate report button should be hidden or the report should be duplicated in another workspace.

Actual Result:

Duplicate report button is shown. Error shows up when approve-only member duplicates the report.

Workaround:

Unknown

Platforms:

Screenshots/Videos

Bug7294628_1792776896240.10.1.mp4

View all open jobs on GitHub

Applause Internal Information
Exported by: Julia Ponikarchuk
Bug ID: 7294628

Issue Owner

Current Issue Owner: @Pujan92

While Applause doesn't embed attachments for this bug, here are the links for quick view:
https://platform.applause.com/services/links/v1/external/25516f3b1e7ca8ebdd172d9a07b7f7e428f59aae7fe781bd681ab53d84fafe4e

You have been assigned to this deploy blocker because you recently merged this PR: #102933

@flodnv

@flodnv @Pujan92 you have been assigned to this deploy blocker because you reviewed the offending PR: #102933

@ShridharGoel

@ShridharGoel you have been assigned to this deploy blocker because you authored the offending PR: #102933

💬 A slack conversation has been started in #expensify-open-source

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

Identify the pull request that introduced this issue and revert it.
Find someone who can quickly fix the issue.
Fix the issue yourself.

Deploy Blocker Analysis

Causing PR: [Payment due @Pujan92] Add approve-only workspace role (high confidence).

Root cause: Duplicate report picks its target workspace with isPolicyAccessible, which passes for any role, including approveOnly. So the copy is created in a workspace where the member cannot create expenses, and the backend rejects it. The PR added canCreateExpensesOnPolicy checks to many expense-creation paths but missed this one:

src/hooks/useExpenseActions.ts:450-451 (More > Duplicate report)
src/libs/actions/IOU/Duplicate.ts:1586-1594 (Search bulk duplicate, same bug)

Recommended fix (fix forward): Add the permission check to both isSourcePolicyValid lines:

isPolicyAccessible(policy, login) && canCreateExpensesOnPolicy(policy, login)

Approve-only members then get the copy in their default workspace, which the issue lists as an expected result. If they have no eligible default workspace, shouldShow: !!defaultExpensePolicy already hides the button. Reverting is the fallback only. The PR touches 49 files, so a revert would pull the whole feature.

Investigation details

The PR is on the current staging checklist. The bug requires the approve-only role, which this PR introduced.
The PR defined canCreateExpensesOnPolicy and left CREATE_EXPENSES out of the APPROVE_ONLY role bundle.
isPolicyAccessible only checks that the user has some role on the workspace.
Duplicate expense already handles this. It goes through canAddTransaction, which the PR updated with canCreateExpensesOnPolicy (src/libs/ReportUtils.ts:3183-3185). Duplicate report should match it.
Button visibility (src/libs/ReportSecondaryActionUtils.ts:965-975) only checks submitter and report type. With the fix, keeping the button visible is correct because the copy goes to the default workspace.
Consider a shared helper for both target-selection paths, plus unit tests for the approve-only role.

Next Steps: Reply with @MelvinBot implement this to create a draft PR, or @MelvinBot <your feedback> to refine this analysis.

view run

@ShridharGoel

@ShridharGoel Now this issue is 8 days overdue. Are you sure this should be a Daily? Feel free to change it!

@ShridharGoel

@ShridharGoel Now this issue is 8 days overdue. Are you sure this should be a Daily? Feel free to change it!

@ShridharGoel

@ShridharGoel 8 days overdue is a lot. Should this be a Weekly issue? If so, feel free to change it!

This will be ready for re-testing after we enable the Approve-only role

@flodnv

@flodnv @Pujan92 @ShridharGoel this issue was created 2 weeks ago. Are we close to a solution? Let's make sure we're treating this as a top priority. Don't hesitate to create a thread in #expensify-open-source to align faster in real time. Thanks!

@ShridharGoel

@ShridharGoel Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

@Pujan92

@Pujan92

The solution for this issue has been 🚀 deployed to production 🚀 in version 9.5.34-1 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

[NoQA] Apply approve-only permission checks to missed expense creation paths #104929

If no regressions arise, payment will be issued on 2026-11-16. 🎊

The following checklist (instructions) will need to be completed before the issue can be closed. Please copy/paste the Contributor+ Checklist from here into a new comment on this GH and complete it. If you have the K2 extension, you can simply click: [this button]. If no checklist is needed for this issue, you can click: [no checklist button]

@Pujan92

@Pujan92 Eep! 4 days overdue now. Issues have feelings too...

Chrome / v9.5.39-0
Passed

bandicam.2026-11-13.11-22-56-651.mp4

Navigation Menu

Repository navigation

[Due for payment 2026-11-16] Expense - Error shows up when approve-only member duplicates report #104903

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Deploy Blocker Analysis

14 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Due for payment 2026-11-16] Expense - Error shows up when approve-only member duplicates report #104903

Description

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Activity

applause-bot commented on Oct 23, 2026

melvin-bot commented on Oct 23, 2026

melvin-bot commented on Oct 23, 2026

melvin-bot commented on Oct 23, 2026

melvin-bot commented on Oct 23, 2026

github-actions commented on Oct 23, 2026

MelvinBot commented on Oct 23, 2026

Deploy Blocker Analysis

14 remaining items

melvin-bot commented on Nov 5, 2026

melvin-bot commented on Nov 5, 2026

melvin-bot commented on Nov 5, 2026

ShridharGoel commented on Nov 6, 2026

melvin-bot commented on Nov 6, 2026

melvin-bot commented on Nov 9, 2026

melvin-bot commented on Nov 9, 2026

melvin-bot commented on Nov 11, 2026

IuliiaHerets commented on Nov 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions