[$500] Distance - Request with empty distance can be created by changing the link to participant link

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 1.4.14-1
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: Applause - Internal Team
Slack conversation:

Action Performed:

1. Go to workspace chat > + > Request money.
2. Go to Distance.
3. Change the link to https://staging.new.expensify.com/create/request/participants/1/<workspacechat_ID>.
4. Proceed with distance request creation

Expected Result:

In Step 3, user will be redirected to Request money page
In Step 4, distance request cannot be created as the waypoints are empty

Actual Result:

In Step 3, user lands on workspace selection page
In Step 4, distance request with empty waypoints can be created, but an error shows up after creating it

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6320250_1703017386013.20231220_002020.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01af0bd38709b573a6
• Upwork Job ID: 1737229471030083584
• Last Price Increase: 2024-01-02

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~01af0bd38709b573a6

[melvin-bot]

Triggered auto assignment to @NicMendonca (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @c3024 (External)

[unidev727]

Proposal

from: @unicorndev-727

Please re-state the problem that we are trying to solve in this issue.

Request with empty distance can be created by changing the link to participant link.

What is the root cause of that problem?

The root cause is that the draftTransaction is created when we select the request tab in MONEY_REQUEST_CREATE page and we don't check if the transaction is drafted transaction in IOURequestStepParticipants.js depending on iouRequestType in transaction object. We only check the transaction if iouRequestType is 'scan' here.

App/src/pages/iou/request/step/IOURequestStepParticipants.js

Lines 50 to 53 in bb6bc9c

	useEffect(() => {
	IOUUtils.navigateToStartStepIfScanFileCannotBeRead(receiptFilename, receiptPath, () => {}, iouRequestType, iouType, transactionID, reportID);
	}, [receiptPath, receiptFilename, iouRequestType, iouType, transactionID, reportID]);

What changes do you think we should make in order to solve the problem?

We need to check if the transaction is eligible to create MoneyRequest and if it is not eligible, we need to go back to MONEY_REQUEST_CREATE page.
If the iouRequestType in transaction object is distance, we need to check if all waypoints are valid and has over two waypoints connected each other and amount is not zero.
And if it is manual, we only need to check if the amount is not zero. If amount is zero, we should return back to MONEY_REQUEST_CREATE page.

We need to update transaction checking part here in participants page and here in confirmation page to stop an ineligible money request.

useEffect(() => {
        if (iouRequestType === CONST.IOU.REQUEST_TYPE.MANUAL &&  _.get(transaction, 'amount', 0) === 0) {
            navigateBack() 
            return;
        }

        if (iouRequestType === CONST.IOU.REQUEST_TYPE.DISTANCE) {

            const waypoints = _.get(transaction, 'comment.waypoints', {waypoint0: {}, waypoint1: {}});
            const validatedWaypoints = TransactionUtils.getValidWaypoints(waypoints);
            
            if (_.size(validatedWaypoints) < 2) {
                navigateBack();
                return
            }
        }
        
        IOUUtils.navigateToStartStepIfScanFileCannotBeRead(receiptFilename, receiptPath, () => {}, iouRequestType, iouType, transactionID, reportID);
    }, [receiptPath, receiptFilename, iouRequestType, iouType, transactionID, reportID]);

screen-capture.webm

What alternative solutions did you explore? (Optional)

N/A

[cooldev900]

Proposal

from: @cooldev900

Please re-state the problem that we are trying to solve in this issue.

Request with empty distance can be created by changing the link to participant link

What is the root cause of that problem?

The root cause is that transaction is already created when we click distance tab in MONEY_REQUEST_CREATE page and we didn't consider visiting participant page by deeplink.

What changes do you think we should make in order to solve the problem?

In my opinion, we need to check if the amount in transaction is zero and if it is, we should let the user return back to the MONEY_REQUEST_CREATE because we don't need to create MoneyRequest with zero amount.

What alternative solutions did you explore?

N/A

[DylanDylann]

Proposal

Please re-state the problem that we are trying to solve in this issue.

In Step 3, user lands on workspace selection page
In Step 4, distance request with empty waypoints can be created, but an error shows up after creating it

What is the root cause of that problem?

Note that: We had a PR to fix this issue but while refactoring we miss it

In here, MoneyRequestParticipantsPage we don't have logic to go back to previous page if the waypoint is invalid

What changes do you think we should make in order to solve the problem?

App/src/pages/iou/request/step/IOURequestStepParticipants.js

Line 50 in 52ecad4

useEffect(() => {

In here we should add logic to navigate back on the distance request and manual request:

• Distance request: navigate back if there is invalid waypoints
• Manual request: navigate back if amount is 0

useEffect(() => {
        if (iouRequestType === CONST.IOU.REQUEST_TYPE.DISTANCE) {

            const waypoints = lodashGet(transaction, 'comment.waypoints', {});
            const validatedWaypoints = TransactionUtils.getValidWaypoints(waypoints);
            const isInvalidWaypoint = lodashSize(validatedWaypoints) < 2;
            
            if (isInvalidWaypoint) {
                navigateBack();
            }
            return
        }

        if (iouRequestType === CONST.IOU.REQUEST_TYPE.MANUAL &&  lodashGet(transaction, 'amount', 0) === 0) {
            navigateBack() 
            return;
        }
        // Note that we can upload receipt on both manual request and scan request
        IOUUtils.navigateToStartStepIfScanFileCannotBeRead(receiptFilename, receiptPath, () => {}, iouRequestType, iouType, transactionID, reportID);
    }, [receiptPath, receiptFilename, iouRequestType, iouType, transactionID, reportID, transaction, navigateBack]);

What alternative solutions did you explore? (Optional)

NA

[bernhardoj]

Proposal

Please re-state the problem that we are trying to solve in this issue.

A user can create a distance request with empty waypoints by directly opening the confirmation URL.

What is the root cause of that problem?

We don't have any logic to prevent the user from creating a distance request while having empty waypoints. It's also possible for a user to create a money request with an empty amount. Before, we had a logic to prevent the user from accessing the page if some of the required data was empty. (distance not included)

App/src/pages/iou/steps/MoneyRequestConfirmPage.js

Lines 126 to 128 in c09a3fe

	if (_.isEmpty(props.iou.participants) || (props.iou.amount === 0 && !props.iou.receiptPath && !isDistanceRequest) || shouldReset || ReportUtils.isArchivedRoom(props.report)) {
	Navigation.goBack(ROUTES.MONEY_REQUEST.getRoute(iouType, reportID), true);
	}

But that logic was completely removed when doing the refactor.

What changes do you think we should make in order to solve the problem?

If that was intentional, then I think we can either disable or show an error when the user presses the confirm button.

Currently, we already disable the button if the participant is empty.

App/src/components/MoneyTemporaryForRefactorRequestConfirmationList.js

Line 518 in c09a3fe

const shouldDisableButton = selectedParticipants.length === 0;

We just need to add the required data-checking logic.

disable = participant empty || (not distance && amount empty && no receipt) || (is distance && empty valid waypoints) || is archived report;