[HOLD - #21977] Web - Users can download attachments when viewing attachment previews as anonymous users

[kbecciv]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Action Performed:

1. Logout current user or open web app in private mode
2. Open any room as an anonymous user. SNH room for example: https://staging.new.expensify.com/r/5303403427249671
3. HOVER on any attached image in the chat room and click Download option on the context menu
   Observer: User is UNABLE to download the image and re-directed to Login page
4. Open that room at step 2 again and CLICK on any attached image
5. Click download button on the Attachment preview
   Observer: User is now ABLE to download the image - this is opposite to the behavior at step 3

Expected Result:

The behavior of the download attachment function should be consistent between the context menu and attachment preview.

Actual Result:

Users are unable to download attachments from the context menu, but they are able to download them from the attachment preview.

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android / native
• Android / Chrome
• iOS / native
• iOS / Safari
• MacOS / Chrome / Safari
• MacOS / Desktop

Version Number: 1.3.39-5
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation

Download-function.mp4

Recording.3548.mp4

Expensify/Expensify Issue URL:
Issue reported by: @tranvantoan-qn
Slack conversation: https://expensify.slack.com/archives/C049HHMV9SM/p1689053816447709

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @alexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[kbecciv]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Users can download attachments when viewing attachment previews as anonymous users.

What is the root cause of that problem?

We always allow the user to download the attachment without checking whether or not the user is anonymous.
https://github.com/Expensify/App/blob/staging/src/components/AttachmentModal.js#L305

What changes do you think we should make in order to solve the problem?

Add a function to check whether or not the user is anonymous:

• If the user is anonymous: Re-direct user to Signin page
• If the user is already logged in: Trigger desired action - which is to download the attachment

/**
     * Checks if user is anonymous. If true, hides the context menu and
     * shows the sign in modal. Else, executes the callback.
     *
     * @param {Function} callback
    */
    const interceptAnonymousUser = (callback) => {
        if (Session.isAnonymousUser()) {
            InteractionManager.runAfterInteractions(() => {
                Session.signOutAndRedirectToSignIn();
            });
        } else {
            callback();
        }
    };

Then use that function in onDownloadButtonPress event:

onDownloadButtonPress={() => interceptAnonymousUser(() => downloadAttachment(source))}

What alternative solutions did you explore? (Optional)

N/A

[namhihi237]

Proposal

Please re-state the problem that we are trying to solve in this issue.

The behavior of the download attachment function should be consistent between context menu and attachment preview, allow anonymous users to view the chat and attached file.

What is the root cause of that problem?

The difference here is because at BaseReportActionContextMenu we check anonymous and logout here.

App/src/pages/home/report/ContextMenu/BaseReportActionContextMenu.js

Lines 74 to 85 in 900b328

	const interceptAnonymousUser = (callback) => {
	if (Session.isAnonymousUser()) {
	hideContextMenu(false);
	InteractionManager.runAfterInteractions(() => {
	Session.signOutAndRedirectToSignIn();
	});
	} else {
	callback();
	}
	};

What changes do you think we should make in order to solve the problem?

Here we will add a key to determine whether to allow anonymous users or not:
isAllowAnonymous: true

In the interceptAnonymousUser we should add isAllowAnonymous param to check:

        const interceptAnonymousUser = (callback, isAllowAnonymous) => {
            if (Session.isAnonymousUser() && !isAllowAnonymous) {
                hideContextMenu(false);

What alternative solutions did you explore? (Optional)

N/A

[PauloGasparSv]

Hey @alexpensify we are coming up with a fix for this in #21977 so I think we can put this on HOLD for #21977.

[alexpensify]

Thank you @PauloGasparSv for that update! I've placed this one on hold.

[alexpensify]

Looks like the other PR is being reviewed, still on hold here.