[Due for payment 2026-10-20] [$175] Workspace - Auditor reappears after removing from workspace chat and refreshing member page

@mallenexpensify

If you haven’t already, check out our contributing guidelines for onboarding. To join our Slack channel, fill out this form.

Version Number: 9.4.99-0
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #101643
Email or phone of affected tester (no customers): sjdoisjndoinjsonj@gmail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.5 / Chrome
App Component: Money Requests

Action Performed:

Precondition:

Create a Control workspace.
Invite User B as auditor.
Perform steps below as workspace owner.

Go to staging.new.expensify.com
Go to workspace chat > Members.
Remove User B from workspace chat.
Refresh the page.

Expected Result:

Auditor will be permanently removed and will not reappear after refreshing member page.

Actual Result:

Auditor reappears after removing from workspace chat and refreshing member page.

Workaround:

Unknown

Platforms:

Screenshots/Videos

Bug7273640_1790782479736.5.mp4

View all open jobs on GitHub

Applause Internal Information
Exported by: Julia Ponikarchuk
Bug ID: 7273640

Upwork Automation - Do Not Edit

Upwork Job URL: https://www.upwork.com/jobs/~022107964951852389213
Upwork Job ID: 2107964951852389213
Last Price Increase: 2026-10-07

Issue Owner

Current Issue Owner: @mallenexpensify

While Applause doesn't embed attachments for this bug, here are the links for quick view:
https://platform.applause.com/services/links/v1/external/7c1b82f58dac4d318af863d41e94bac42158e4b0c22852452b7aeeebb078022a

You have been assigned to this deploy blocker because you recently merged this PR: #101643

@marcaaron

@marcaaron @ikevin127 you have been assigned to this deploy blocker because you reviewed the offending PR: #101643

💬 A slack conversation has been started in #expensify-open-source

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

Identify the pull request that introduced this issue and revert it.
Find someone who can quickly fix the issue.
Fix the issue yourself.

Deploy Blocker Analysis

Causing PR: Resolve the member's own policy role when checking room member removal (merged 2026-09-29, on today's checklist).

Root cause: The PR added isRoomMemberProtectedByPolicyRole. It protects the owner, admins, and approvers, but not auditors. So the App now lets you remove an auditor from the workspace chat. Auditors are default members of that chat, so the server still lists them and they come back after a refresh.

Recommendation: Roll forward (revert only if the fix can't land before the deploy). Reverting brings back [Exploratory] Room - Admin cannot remove an invited member from the workspace chat. The fix is one missing role check.

Investigation details

Why production isn't affected: Before the PR, the check used isPolicyAdmin(policy, details.login), which answered for the viewer, not the listed member. Only admins can open this page, so every member looked protected and nobody could be removed.

Where the helper is used:

Members list row selection: DynamicRoomMembersPage.tsx:218-223
"Remove from chat" on member details: DynamicRoomMemberDetailsPage.tsx:64-65

Expected rule: SECURITY.md:88-89 says default (automatically invited) members can't be removed from the expense chat.

Suggested fix in src/libs/PolicyUtils.ts:

const isRoomMemberProtectedByPolicyRole = (policy, login, accountID) => {
    if (isPolicyOwner(policy, accountID) || !login) {
        return true;
    }
    const role = getPolicyRole(policy, login, false);
    return role === CONST.POLICY.ROLE.ADMIN || role === CONST.POLICY.ROLE.AUDITOR || isPolicyApprover(policy, login);
};

Don't use isPolicyAuditor(policy, login) here. It answers for the viewer, the same flaw the PR fixed for isPolicyAdmin. Add a unit test in tests/unit/PolicyUtilsTest.ts for a protected auditor.

Confidence: High that the PR exposes the Remove option for auditors. Medium on why the auditor returns. The behavior fits auditors being re-added as default chat members, but I didn't confirm that with server logs.

Next Steps: Reply with @MelvinBot implement this to create a draft PR, or @MelvinBot <your feedback> to refine this analysis.

view run

⚠️ Looks like this issue was linked to a Deploy Blocker here

If you are the assigned CME please investigate whether the linked PR caused a regression and leave a comment with the results.

If a regression has occurred and you are the assigned CM follow the instructions here.

If this regression could have been avoided please consider also proposing a recommendation to the PR checklist so that we can avoid it in the future.

@ikevin127

@ikevin127

The solution for this issue has been 🚀 deployed to production 🚀 in version 9.5.7-3 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

Protect workspace auditors from removal in workspace chats #102722

If no regressions arise, payment will be issued on 2026-10-20. 🎊

The following checklist (instructions) will need to be completed before the issue can be closed. Please copy/paste the Contributor+ Checklist from here into a new comment on this GH and complete it. If you have the K2 extension, you can simply click: [this button]. If no checklist is needed for this issue, you can click: [no checklist button]

This is a follow-up issue / PR coming from main issue - no separate payment due here.

@mallenexpensify

Triggered auto assignment to @mallenexpensify (Awaiting Payment)

@ikevin127

Payment Summary

Resolving PRs:

Protect workspace auditors from removal in workspace chats #102722
Reviewer: @ikevin127 owed $175 via NewDot

BugZero Checklist (@mallenexpensify)

I have confirmed assignees, roles, and Upwork contracts look correct
I have paid out Upwork contracts / manual NewDot requests
[BugZero Assignee] I have created a GH issue for creating/updating the regression test once above steps have been agreed upon

@mallenexpensify

@mallenexpensify Thanks for the tag, I wanna note that the payment summary should be posted on the main issue - see my comment here - already posted the BZ Checklist on that issue, and bounty should be $100 since there was a regression (this issue) - therefore this issue can be closed as fixed 🙌

@ikevin127

Thx @ikevin127 , removed payment summary and closing

Navigation Menu

Repository navigation

[Due for payment 2026-10-20] [$175] Workspace - Auditor reappears after removing from workspace chat and refreshing member page #102680

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Deploy Blocker Analysis

21 remaining items

Payment Summary

BugZero Checklist (@mallenexpensify)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Due for payment 2026-10-20] [$175] Workspace - Auditor reappears after removing from workspace chat and refreshing member page #102680

Description

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Activity

applause-bot commented on Sep 30, 2026

melvin-bot commented on Sep 30, 2026

melvin-bot commented on Sep 30, 2026

melvin-bot commented on Sep 30, 2026

github-actions commented on Sep 30, 2026

MelvinBot commented on Sep 30, 2026

Deploy Blocker Analysis

melvin-bot commented on Sep 30, 2026

ikevin127 commented on Sep 30, 2026

21 remaining items

melvin-bot commented on Oct 13, 2026

ikevin127 commented on Oct 13, 2026

melvin-bot commented on Oct 19, 2026

melvin-bot commented on Oct 19, 2026

Payment Summary

BugZero Checklist (@mallenexpensify)

ikevin127 commented on Oct 20, 2026

mallenexpensify commented on Oct 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions