[Due for payment 2025-08-20] [$250] User can delete MC Tests automated message

[izarutskaya]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.1.87-1
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: @hungvu193
Slack conversation (hyperlinked to channel name): #expensify_bugs

Action Performed:

1. Go to https://staging.new.expensify.com/ and log in
2. Create expense with MC Tests.
3. Go to the report
4. Type somethings.
5. Right click on MC Tests reponse message.
6. Notice that you can delete it.

Expected Result:

User shouldn't be able to delete MC Test message.

Actual Result:

User can delete MC Tests automated message

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Platforms Tested:

On which of our officially supported platforms was this issue tested:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Screen.Recording.2025-07-29.at.16.30.56.mov

Recording.3345.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021952874124131341557
• Upwork Job ID: 1952874124131341557
• Last Price Increase: 2025-08-05
• Automatic offers:
• FitseTLT | Contributor | 108316890

Issue Owner

Current Issue Owner: @greg-schroeder

[melvin-bot]

Triggered auto assignment to @greg-schroeder (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[izarutskaya]

From @hungvu193

Proposal

Please re-state the problem that we are trying to solve in this issue.

Users are allowed to delete the MC Tests automated message.

What is the root cause of that problem?

We have the logic to check if we can delete a report action here:

App/src/libs/ReportUtils.ts

Lines 2529 to 2533 in 69d27c0

	if (
	reportAction?.actionName !== CONST.REPORT.ACTIONS.TYPE.ADD_COMMENT ||
	reportAction?.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE ||
	isCreatedTaskReportAction(reportAction) ||
	reportAction?.actorAccountID === CONST.ACCOUNT_ID.CONCIERGE

But we forgot to check if that's the report action (comment) from MC Tests.

What changes do you think we should make in order to solve the problem?

We should add an extra condition to check if that's the report action from MC Tests here:

    if (
        reportAction?.actionName !== CONST.REPORT.ACTIONS.TYPE.ADD_COMMENT ||
        reportAction?.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE ||
        isCreatedTaskReportAction(reportAction) ||
        reportAction?.actorAccountID === CONST.ACCOUNT_ID.CONCIERGE || 
+       reportAction?.actorAccountID === CONST.ACCOUNT_ID.MANAGER_MCTEST
    ) {
        return false;
    }

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

Add an extra test case for canDeleteReportAction with the reportAction that comes from MC Tests, it should return false.
We can also add a few extra tests for the rest of the condition here

What alternative solutions did you explore? (Optional)

N/A

[FitseTLT]

Proposal

Please re-state the problem that we are trying to solve in this issue.

User can delete MC Tests automated message

What is the root cause of that problem?

We allow the admins of a policy to delete report actions here

App/src/libs/ReportUtils.ts

Lines 2538 to 2540 in 1a1d5f5

	const isAdmin = policy?.role === CONST.POLICY.ROLE.ADMIN && !isEmptyObject(report) && !isDM(report);
	return isActionOwner || isAdmin;

but in this case the policy linked to the report is the personal policy and the user is admin of their personal policy.

What changes do you think we should make in order to solve the problem?

To solve this problem future proof we should check that the policy is not personal policy

    const isAdmin = policy?.type !== CONST.POLICY.TYPE.PERSONAL && policy?.role === CONST.POLICY.ROLE.ADMIN && !isEmptyObject(report) && !isDM(report);

isDM check might not be needed anymore.

Note: that the problem is not only related to mc test manager if you create an iou report on a DM with a user and we are allowing deleting comment of the other user for personal policy admin user but the BE returns error because it is not allowed.

Demo

2025-07-29.23-32-08.mp4

### What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future? We will test canDeleteReportAction that it doesn't allow deletion for admin if the policy is personal policy

What alternative solutions did you explore? (Optional)

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~021952874124131341557

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @rushatgabhane (External)