Upgrade workspace - Workspace upgrade whisper can be deleted

[IuliiaHerets]

If you haven’t already, check out our contributing guidelines for onboarding and email [email protected] to request to join our Slack channel!

---

Version Number: 9.0.45-2
Reproducible in staging?: Y
Reproducible in production?: Y
Email or phone of affected tester (no customers): [email protected]
Issue reported by: Applause Internal Team

Action Performed:

1. Go to staging.new.expensify.com
2. Create a new workspace.
3. Go to workspace settings > More features.
4. Enable Report fields.
5. Click Upgrade.
6. Go to #admins.
7. Right click on the workspace upgrade whisper > Delete comment.

Expected Result:

Whisper should not be deletable.

Actual Result:

Workspace upgrade whisper can be deleted.

Workaround:

Unknown

Platforms:

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug6626309_1728235940839.20241007_012754.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @joekaufmanexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[IuliiaHerets]

We think that this bug might be related to #wave-control

[IuliiaHerets]

@joekaufmanexpensify FYI I haven't added the External label as I wasn't 100% sure about this issue. Please take a look and add the label if you agree it's a bug and can be handled by external contributors

[Nodebrute]

Edited by proposal-police: This proposal was edited at 2024-10-07 02:44:04 UTC.

Proposal

Please re-state the problem that we are trying to solve in this issue.

Workspace upgrade whisper can be deleted

What is the root cause of that problem?

We are allowing user to delete messages from ExpensifyAccount but we don't show delete button for messages sent from concierge

App/src/libs/ReportUtils.ts

Line 1806 in 99f280b

reportAction?.actorAccountID === CONST.ACCOUNT_ID.CONCIERGE

What changes do you think we should make in order to solve the problem?

We can add another check here

       reportAction?.actionName !== CONST.REPORT.ACTIONS.TYPE.ADD_COMMENT ||
        reportAction?.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE ||
        ReportActionsUtils.isCreatedTaskReportAction(reportAction) ||
        reportAction?.actorAccountID === CONST.ACCOUNT_ID.CONCIERGE ||
        reportAction?.actorAccountID === CONST.ACCOUNT_ID.NOTIFICATIONS

We can also hide other options too using the same check that we want to hide from context menu

Optional: We can also hide flag as offensive by changing this check here

  if (!isCurrentUserAction && reportAction?.actorAccountID !== CONST.ACCOUNT_ID.CONCIERGE && reportAction?.actorAccountID !== CONST.ACCOUNT_ID.NOTIFICATIONS) {
            return true;
        }

Optional: we can also add the reportAction?.actorAccountID !== CONST.ACCOUNT_ID.NOTIFICATIONS check here

App/src/libs/ReportUtils.ts

Line 6440 in 6d8e739

reportAction?.actorAccountID !== CONST.ACCOUNT_ID.CONCIERGE

What alternative solutions did you explore? (Optional)

[Nodebrute]

Proposal Updated
Added optional change

[truph01]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Workspace upgrade whisper can be deleted.

What is the root cause of that problem?

• The current user is not the action owner of the workspace upgrade whisper, but they still can delete that message because they are policy's admin:

App/src/libs/ReportUtils.ts

Line 1813 in 99f280b

return isActionOwner || isAdmin;

What changes do you think we should make in order to solve the problem?

• In this add addtitional condition:

       || ReportActionsUtils.isWhisperAction(reportAction)

What alternative solutions did you explore? (Optional)

[Nodebrute]

Proposal Updated
Added optional

[joekaufmanexpensify]

I don't think it really matters that this message can be deleted. Maybe I could see an argument because it's recording
history you can't delete it. But my understanding is this is purely for informational purposes. If someone deletes it, we know they engaged with it, so that seems fine to me.

Going to close for now as I don't really think this is a bug, but please let me know if you disagree, or think that being able to delete this causes a problem.

[Nodebrute]

@joekaufmanexpensify user can flag it as offensive i think atleast we should fix that.

[joekaufmanexpensify]

🤷 I'd rather see if it causes a problem before doing anything. Not convinced this will be an issue.