[HOLD for payment 2024-01-17] [$500] Tasks - User is unable to complete task without opening task first

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Issue found when executing PR #23971

Action Performed:

1. As User A, create a group including User B &C
2. As User A, assign task to group with no assignees
3. Log out of User A and Log in to User B or C
4. Open newly created group and click box of new task to complete task(do not open task)

Expected Result:

User is able to complete task without opening task in group

Actual Result:

User is unable to click and complete task. The selected box is unselected automatically
"You do not have permission to do requested action" is shown after opening task.

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android / native
• Android / Chrome
• iOS / native
• iOS / Safari
• Windows / Chrome
• MacOS / Desktop

Version Number: 1.3.50.0

Reproducible in staging?: Yes

Reproducible in production?: Yes

If this was caught during regression testing, add the test name, ID and link from TestRail:

Email or phone of affected tester (no customers):

Logs: https://stackoverflow.com/c/expensify/questions/4856

Notes/Photos/Videos: Any additional supporting documentation

Bug6153172__PR23971_Web_.mp4

Bug6153172_23971_mWeb_.mp4

Bug6153172_23971_iOS_.mp4

Expensify/Expensify Issue URL:

Issue reported by: Applause - Internal Team

Slack conversation:

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01f28e9843a6957b04
• Upwork Job ID: 1697329510087221248
• Last Price Increase: 2023-09-07

Issue Owner

Current Issue Owner: @thienlnam

[melvin-bot]

Triggered auto assignment to @bfitzexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[Nodebrute]

Why should user B or user C be allowed to edit the task?

[Nodebrute]

Proposal

This issue existed way before the mentioned PR, where we are not disabling the checkbox for users who are not allowed to edit the task.

Please re-state the problem that we are trying to solve in this issue.

Tasks - User is unable to complete task without opening task first

What is the root cause of that problem?

We are not disabling the checkbox here for unauthorized users here

App/src/components/ReportActionItem/TaskPreview.js

Line 88 in bba0eb2

disabled={ReportUtils.isCanceledTaskReport(props.taskReport)}

What changes do you think we should make in order to solve the problem?

Add withCurrentUserPersonalDetails in TaskPreview

export default compose(
    withLocalize,
    withOnyx({
        taskReport: {
            key: ({taskReportID}) => `${ONYXKEYS.COLLECTION.REPORT}${taskReportID}`,
        },
        personalDetailsList: {
            key: ONYXKEYS.PERSONAL_DETAILS_LIST,
        },
    }),
    withCurrentUserPersonalDetails
)(TaskPreview);

then change disable to

disabled={ReportUtils.isCanceledTaskReport(props.taskReport) || !Task.canModifyTask(props.taskReport,props.currentUserPersonalDetails.accountID)}

We can also disable it for anonymous users using Session.isAnonymousUser()

Also, here we are allowing anyone with write capabilities to edit the task, but we haven't fixed it from the backend yet.

App/src/libs/actions/Task.js

Lines 755 to 759 in bba0eb2

	// If you don't have access to the task report (maybe haven't opened it yet), check if you can access the parent report
	// - If the parent report is an #admins only room
	// - If you are a policy admin
	const parentReport = ReportUtils.getParentReport(taskReport);
	return ReportUtils.isAllowedToComment(parentReport);

What alternative solutions did you explore? (Optional)

[thienlnam]

Why should user B or user C be allowed to edit the task?

We updated this recently, anyone that can view the task should be able to modify the task

[thienlnam]

This might be a BE issue

[melvin-bot]

@thienlnam, @bfitzexpensify Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[melvin-bot]

@thienlnam, @bfitzexpensify Huh... This is 4 days overdue. Who can take care of this?

[thienlnam]

Haven't looked into this yet - been focused on wave5

[melvin-bot]

@thienlnam, @bfitzexpensify 10 days overdue. Is anyone even seeing these? Hello?

[melvin-bot]

@thienlnam, @bfitzexpensify 12 days overdue. Walking. Toward. The. Light...

[thienlnam]

Same as above, focused on wave 5 so no updates here

[melvin-bot]

@thienlnam @bfitzexpensify this issue is now 3 weeks old. There is one more week left before this issue breaks WAQ. What needs to happen to get a PR in review this week? Please create a thread in #expensify-open-source to discuss. Thanks!

[melvin-bot]

@thienlnam, @bfitzexpensify Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[thienlnam]

Same as above, focused on wave 5 so no updates here - should be more free by the end of the week

[melvin-bot]

Reviewing label has been removed, please complete the "BugZero Checklist".

[melvin-bot]

The solution for this issue has been 🚀 deployed to production 🚀 in version 1.4.23-4 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

• Disable checkbox of task preview if not visit the task report #33857

If no regressions arise, payment will be issued on 2024-01-17. 🎊

For reference, here are some details about the assignees on this issue:

• @thesahindia requires payment through NewDot Manual Requests
• @dukenv0307 requires payment (Needs manual offer from BZ)

[melvin-bot]

BugZero Checklist: The PR fixing this issue has been merged! The following checklist (instructions) will need to be completed before the issue can be closed:

• [@thesahindia] The PR that introduced the bug has been identified. Link to the PR:
• [@thesahindia] The offending PR has been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake. Link to comment:
• [@thesahindia] A discussion in #expensify-bugs has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner. Link to discussion:
• [@thesahindia] Determine if we should create a regression test for this bug.
• [@thesahindia] If we decide to create a regression test for the bug, please propose the regression test steps to ensure the same bug will not reach production again.
• [@bfitzexpensify] Link the GH issue for creating/updating the regression test once above steps have been agreed upon:

[bfitzexpensify]

I'm going to be mostly ooo until Jan 29, assigning a second BZ team member to keep an eye on this.

• ready for payment on 01/17
• BZ checklist needs completing (bump on that @thesahindia)

[melvin-bot]

Triggered auto assignment to @isabelastisser (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

@thienlnam, @isabelastisser, @bfitzexpensify, @thesahindia, @dukenv0307 Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[thienlnam]

On hold for payment

[thesahindia]

Regression test steps -

Pre-requisite steps: Create a group with User B and User C, then create a task report in the group without assignee

1. As user B, go to the group and click on the checkbox of the task report without opening the task report
2. Verify that the checkbox is disabled.
3. Open the task report and go back
4. Click on the checkbox of the task report to complete the task
5. Verify that the task is completed

[melvin-bot]

Payment Summary

Upwork Job

• Reviewer: @thesahindia owed $500 via NewDot
• ROLE: @dukenv0307 paid $500 via Upwork (LINK)

BugZero Checklist (@isabelastisser)

• I have verified the correct assignees and roles are listed above and updated the neccesary manual offers
• I have verified that there are no duplicate or incorrect contracts on Upwork for this job (https://www.upwork.com/ab/applicants/1697329510087221248/hired)
• I have paid out the Upwork contracts or cancelled the ones that are incorrect
• I have verified the payment summary above is correct

[isabelastisser]

Upwork offer expired, creating new one.

[isabelastisser]

@dukenv0307 offer sent in Upwork, please accept it and I will process the payment. Thanks!

[isabelastisser]

All set!

[dukenv0307]

@dukenv0307 offer sent in Upwork, please accept it and I will process the payment. Thanks!

@isabelastisser I've accepted, thank you!

[JmillsExpensify]

$500 payment approved for @thesahindia based on this comment.