[HOLD for payment 2023-07-24] [$1000] Web- Flagged as a violation message from the concierge can be deleted in room

[kbecciv]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Action Performed:

1. Go to any Public room that User A has created and User B is a member of that group
2. Send a message from User A
3. Go to User B and Flag it as Violation (Spam).
4. Now go to User A and notice that a message from the concierge appears.
5. As User A, delete the message from the concierge.

Expected Result:

Flagged as a violation message from the concierge can't be deleted

Actual Result:

Flagged as a violation

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android / native
• Android / Chrome
• iOS / native
• iOS / Safari
• MacOS / Chrome / Safari
• MacOS / Desktop

Version Number: 1.3.33-4
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation

Flagged.Delete-1.mp4

Recording.3302.mp4

Expensify/Expensify Issue URL:
Issue reported by: @daveSeife
Slack conversation: https://expensify.slack.com/archives/C049HHMV9SM/p1687896716749819

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~012848636c2b7e6eeb
• Upwork Job ID: 1676954069734211584
• Last Price Increase: 2023-07-06

[melvin-bot]

Triggered auto assignment to @johncschuster (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[Nodebrute]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Web- Flagged as a violation message from the concierge can be deleted in room

What is the root cause of that problem?

We are not hiding the delete icon from both context menus.

What changes do you think we should make in order to solve the problem?

Add a check in delete action of context menu to don't show the delete icon if it's a concierge text.
add !ReportActionUtils.isWhisperAction(reportAction),
here

The result here will look like this. This will hide the delete icon from all concierge whispered messages

What alternative solutions did you explore? (Optional)

[melvin-bot]

@johncschuster Eep! 4 days overdue now. Issues have feelings too...

[dukenv0307]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Web- Flagged as a violation message from the concierge can be deleted in room

What is the root cause of that problem?

canDeleteReportAction function doesn't return false if the actor of the message is concierge. And then if the user is the admin of the room, canDeleteReportAction function return true. Thus this issue occurs.

App/src/libs/ReportUtils.js

Lines 232 to 247 in 15e547e

	function canDeleteReportAction(reportAction, reportID) {
	if (
	reportAction.actionName !== CONST.REPORT.ACTIONS.TYPE.ADDCOMMENT ||
	reportAction.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE ||
	ReportActionsUtils.isCreatedTaskReportAction(reportAction) ||
	(ReportActionsUtils.isMoneyRequestAction(reportAction) && isSettled(reportAction.originalMessage.IOUReportID))
	) {
	return false;
	}
	if (reportAction.actorAccountID === currentUserAccountID) {
	return true;
	}
	const report = lodashGet(allReports, `${ONYXKEYS.COLLECTION.REPORT}${reportID}`, {});
	const policy = lodashGet(allPolicies, `${ONYXKEYS.COLLECTION.POLICY}${report.policyID}`) || {};
	return policy.role === CONST.POLICY.ROLE.ADMIN;
	}

What changes do you think we should make in order to solve the problem?

We should add a check here to return false if the actor of action is concierge

App/src/libs/ReportUtils.js

Line 233 in 15e547e

if (

if (
    reportAction.actionName !== CONST.REPORT.ACTIONS.TYPE.ADDCOMMENT ||
    reportAction.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE ||
    ReportActionsUtils.isCreatedTaskReportAction(reportAction) ||
    (ReportActionsUtils.isMoneyRequestAction(reportAction) && isSettled(reportAction.originalMessage.IOUReportID)) ||
    reportAction.actorEmail === CONST.EMAIL.CONCIERGE
) {
    return false;
}

What alternative solutions did you explore? (Optional)

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~012848636c2b7e6eeb

[melvin-bot]

Current assignee @johncschuster is eligible for the External assigner, not assigning anyone new.

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @eVoloshchak (External)