[hungvu193]

Explanation of Change

Allow current non-admin approvers to reassign Outstanding reports when workspace enforcement is disabled. Apply the permission rule to the report menu, Search bulk-action menu, and approver-selection pages, while preserving existing admin access.

Fixed Issues

$ #105895
PROPOSAL: N/A

Tests

Same as QA steps

• Verify that no errors appear in the JS console

Offline tests

N/A

QA Steps

Prerequisite: Workflow enforcement is disabled.

1. Submit an expense to an approver who is not the admin.
2. Sign in as that approver and verify Change approver is available from the report menu and the Search bulk-action menu.
3. Select Reassign approver and assign the report to another workspace member.
4. Verify the report history identifies the replacement and skipped approver, and verify the replacement can approve the report.
5. Enable workspace enforcement for the current non-admin approver and verify Reassign approver is unavailable.
6. Select a report assigned to someone else as a non-admin and verify reassignment is unavailable.
7. Select multiple reports, including one the non-admin cannot reassign, and verify the bulk Change approver action is unavailable.

• Verify that no errors appear in the JS console

PR Author Checklist

• I linked the correct issue in the ### Fixed Issues section above
• I wrote clear testing steps that cover the changes made in this PR
  • I added steps for local testing in the Tests section
  • I added steps for the expected offline behavior in the Offline steps section
  • I added steps for Staging and/or Production testing in the QA steps section
  • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
  • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
  • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
• I included screenshots or videos for tests on all platforms
• I ran the tests on all platforms & verified they passed on:
  • Android: Native
  • Android: mWeb Chrome
  • iOS: Native
  • iOS: mWeb Safari
  • MacOS: Chrome / Safari
• I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
• I verified any copy / text that was added to the app is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
• If new assets were added or existing ones were modified, I verified that:
  • The assets are optimized and compressed (for SVG files, run npm run compress-svg)
  • The assets load correctly across all supported platforms.
• If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
• If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
• If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
  • I verified that all the inputs inside a form are aligned with each other.
  • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
• If the PR adds or modifies the UI:
  • I asked an AI agent to review the changes for accessibility issues and addressed its findings.
  • I tested with a screen reader (VoiceOver on macOS) and verified all new/changed elements are reachable with a logical focus order.
  • I verified all new/changed elements have meaningful accessible names and roles.
  • I verified state changes are announced (e.g. checked/unchecked, expanded/collapsed, selected).
• I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

Screen.Recording.2026-11-12.at.18.18.17.mov

iOS: mWeb Safari

Screen.Recording.2026-11-12.at.18.14.57.mov

MacOS: Chrome / Safari

Screen.Recording.2026-11-12.at.18.02.13.mov

[hungvu193]

Note

Update action visibility at getSecondaryReportActions and useSearchBulkActions

[codecov]

Codecov Report

❌ Looks like you've decreased code coverage for some files. Please write tests to increase, or at least maintain, the existing level of code coverage. See our documentation here for how to interpret this table.

Files with missing lines	Coverage Δ
src/hooks/useExpenseActions.ts	74.35% <100.00%> (+0.75%)	⬆️
src/hooks/useSearchBulkActions.ts	82.64% <100.00%> (+0.23%)	⬆️
src/hooks/useSelectionModeReportActions.ts	93.10% <100.00%> (+0.05%)	⬆️
src/hooks/useStrictPolicyRules.ts	100.00% <100.00%> (ø)
src/libs/ReportSecondaryActionUtils.ts	96.43% <100.00%> (+0.02%)	⬆️
src/pages/DynamicReportChangeApproverPage.tsx	89.47% <100.00%> (+88.04%)	⬆️
src/pages/ReportReassignApproverPage.tsx	93.54% <100.00%> (+2.74%)	⬆️
src/pages/Search/SearchApproverPage.tsx	87.28% <100.00%> (+1.20%)	⬆️
src/pages/Search/SearchChangeApproverPage.tsx	86.85% <100.00%> (+71.66%)	⬆️
...eaderActions/MoneyReportHeaderSecondaryActions.tsx	0.38% <0.00%> (-0.01%)	⬇️
... and 1 more
... and 12 files with indirect coverage changes

[hungvu193]

@MelvinBot verify this

[MelvinBot]

🤖 Web test steps verification results: ⚠️ partial

Completed onboarding on dev NewDot web, but the account shows “No workspaces yet.” The genuine non-admin additional-approver fixture is unavailable; no admin substitute was created.

Step	Status
Workflow enforcement is disabled. Blocked: Workspaces snapshot shows “No workspaces yet,” so workflow settings could not be verified.	⚠️
Current user is a workspace member (not admin) and additional approver. Blocked: no workspace fixture is available to verify membership or approver role.	⚠️
An Outstanding report is waiting for the current user's approval. Blocked: the required workspace and report fixture are unavailable.	⚠️
Current approver can access Reassign approver from report secondary actions and complete reassignment. Not tested: the genuine non-admin approver and pending report fixture are unavailable.	⚠️
Current approver can access Reassign approver through Search bulk actions for eligible selected reports. Not tested: no eligible report fixture is available.	⚠️
No JS console errors during the tested flow. Not verified: browser console inspection is unavailable in the supported web command surface.	⚠️

---

view run · view recording

[hungvu193]

@codex review

[hungvu193]

@MelvinBot review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T11:36:31.734817Z	253965c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[MelvinBot]

🤖 Web test steps verification results: ⚠️ partial

Required fixtures were unavailable: the account had no workspaces or reports, so browser verification was blocked. Static review found two P1 blockers below; all 299 tests across the three modified suites passed.

Step	Status
Enforcement disabled; user is a non-admin additional approver. Blocked: no workspace was available to verify these prerequisites.	⚠️
An Outstanding report awaits the user's approval. Blocked: Reports displayed “No reports yet”.	⚠️
Change approver is available from report and Search menus. Browser verification blocked. P1 — Single-report flow still rejects eligible non-admins: the newly exposed action reaches DynamicReportChangeApproverPage:123–143, whose unchanged admin-only guard renders NotFoundPage. The destination ReportReassignApproverPage:64–72 independently requires admin status. Update both guards and the shared picker authorization to allow eligible current approvers.	⚠️
Reassign the report to another member. Browser verification blocked. P1 — Search reassignment still opens an unauthorized picker: the updated options page permits non-admin reassignment, but SearchApproverPage:204–237 still requires admin status for every selected workspace and passes that restriction to the picker. Apply the same current-approver/enforcement eligibility throughout the destination flow, including the shared picker's default admin requirement.	⚠️
History identifies replacement/skipped approvers; replacement can approve. Blocked: no reassignment fixture; no user switching attempted.	⚠️
Enforcement enabled prevents non-admin reassignment. Blocked: required workspace and approver fixtures unavailable.	⚠️
Non-admin cannot reassign another approver's report. Blocked: required membership and report unavailable.	⚠️
Mixed eligible/ineligible selection hides bulk Change approver. Blocked: no reports available for selection.	⚠️
Admin reassignment remains available with enforcement enabled. Blocked: required fixture unavailable; admin coverage was not substituted for non-admin coverage.	⚠️
No JavaScript console errors. Unverified: supported browser tooling does not expose console inspection.	⚠️

---

view run · view recording

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aa2517cc49

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[hungvu193]

@garrettmknight I assume that the current assign approver (member) is only able to reassign approver? They won't be allow to add approver or bypass it, right?

[hungvu193]

@codex review

[melvin-bot]

@ZhenjaHorbach Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

[MelvinBot]

Yes—Garrett was already assigned to the linked issue on November 4, so this wasn’t an assignment timing race.

The PR timeline shows:

• 11:17:48 UTC: GitHub requested the product-pr team after you marked the PR ready.
• 11:17:56: melvin-bot[bot] requested joekaufmanexpensify.
• 11:17:58: The bot removed the team request.

The initial team request comes from .github/CODEOWNERS:4–5. The unexpected part is the bot’s individual-reviewer selection, not CODEOWNERS.

I couldn’t access the reviewer-selection implementation or its runtime logs, so I can’t confirm why Garrett wasn’t reused or identify the earlier fix you remember. I haven’t changed any reviewers.

---

view run

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 253965ce72

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[joekaufmanexpensify]

Reassigning product review to Garrett, as he is working on the project.

[hungvu193]

@MelvinBot Merge main

[MelvinBot]

Merged main into this PR and pushed 3678891, resolving one import conflict.

✅ 365 targeted tests, lint, typecheck, spelling, and Storybook smoke test passed.

Full-suite testing wasn’t run; the legacy Prettier script is unavailable.

---

view run