[HOLD 296932][$1000] Web - Member from `Share Somewhere` in assign task (creating from group) can choose assignee, results in error

[kbecciv]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Action Performed:

1. Create a group
2. Using User A create a task, don't assign it to anybody and leave the default options as it's
3. Log in using User B (member of same group in which task was created)
4. Navigate to task page.
5. Try assigning the user to task ( as User B )
6. Note that a selected user is assigned to task ( but in the network tab shows error error [shown in the recording])
7. Note the assignee is there even we are getting error
8. If we check from User A, assignee is not there

Expected Result:

User B should not be able to assign the task to someone, if they are not a policy admin, the task creator, or a current task assignee.

User B should be able to assign the task to someone if they are a policy admin, the task creator, or the current assignee.

Actual Result:

User B can assign the task to someone when they are not a policy admin, the task creator or current task assignee. However, the assignee only appears in their account and does not appear in user A's (who is the task creator).

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android / native
• Android / Chrome
• iOS / native
• iOS / Safari
• MacOS / Chrome / Safari
• MacOS / Desktop

Version Number: 1.3.30-5
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation

Assignee.bug.in.grp.task.-.Made.with.Clipchamp.1.mp4

Recording.896.mp4

Expensify/Expensify Issue URL:
Issue reported by: @BhuvaneshPatil
Slack conversation: https://expensify.slack.com/archives/C049HHMV9SM/p1687434560850899

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01e2d2c3fd882a94d6
• Upwork Job ID: 1674164051273023488
• Last Price Increase: 2023-06-28

[melvin-bot]

Triggered auto assignment to @joekaufmanexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[BhuvaneshPatil]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Web - Member from Share Somewhere in assign task (creating from group) can choose assignee, results in error

What is the root cause of that problem?

The root cause for this problem is that we are not checking if current user has permission to assign this task to someone.

App/src/components/TaskHeader.js

Lines 66 to 117 in c261901

	<PressableWithFeedback
	onPress={() => Navigation.navigate(ROUTES.getTaskReportAssigneeRoute(props.report.reportID))}
	disabled={!isOpen}
	accessibilityRole="button"
	accessibilityLabel={props.translate('newTaskPage.assignee')}
	hoverDimmingValue={1}
	pressDimmingValue={0.2}
	>
	<View style={[styles.flexRow, styles.alignItemsCenter, styles.justifyContentBetween, styles.pv3]}>
	<View style={[styles.flexRow, styles.alignItemsCenter, styles.justifyContentBetween]}>
	{assigneeAccountID && assigneeAccountID > 0 && (
	<>
	<Avatar
	source={assigneeAvatar}
	type={CONST.ICON_TYPE_AVATAR}
	name={assigneeName}
	size={CONST.AVATAR_SIZE.HEADER}
	/>
	<View style={[styles.flexColumn, styles.ml3]}>
	<Text
	style={[styles.headerText, styles.pre]}
	numberOfLines={1}
	>
	{assigneeName}
	</Text>
	</View>
	</>
	)}
	</View>
	<View style={[styles.flexRow]}>
	{isCompleted ? (
	<>
	<Text>{props.translate('task.completed')}</Text>
	<View style={styles.defaultCheckmarkWrapper}>
	<Icon
	src={Expensicons.Checkmark}
	fill={themeColors.iconSuccessFill}
	/>
	</View>
	</>
	) : (
	<Button
	success
	isDisabled={TaskUtils.isTaskCanceled(props.report) || !TaskUtils.isTaskAssigneeOrTaskOwner(props.report, props.session.accountID)}
	medium
	text={props.translate('newTaskPage.markAsDone')}
	onPress={() => TaskUtils.completeTask(props.report.reportID, title)}
	/>
	)}
	</View>
	</View>
	</PressableWithFeedback>

Currently we are only checking if the task is open or not.

What changes do you think we should make in order to solve the problem?

• We shall add a condition if the user who is viewing the task page has permission to add the assignee. My guess is that only the creator can assign the task to someone. And disable the PressableFeedback in TaskHeader component.
• We shall add appropriate successData, optimisticData and failureData in setAssigneeValue()
• While disabling the PressableFeedback will do most of work, there may be a case when user directly pastes the url - http://localhost:8080/r/7730858533875691/assignee - This will open TaskAssigneeSelectorModal. To handle this case we shall add condition to the TaskAssigneeSelectorModal to only display if current user has enough permissions.
  i.e wrap with FullPageNotFoundView.
  checks for shouldShow will be -
  !Task.isTaskAssigneeOrTaskOwner - if current user is not assignee or owner.
  !PolicyUtils.isPolicyAdmin - Tif current user is not a policy admin
  ReportUtils.isCompletedTaskReport - If task is completed or not. This will cover - [HOLD for payment 2023-09-21] [$1000] App allows task title update for completed task using deep link and throws error on update #22451
• This is happening in case of accessing task fields like (description, title and assignee) using deep link in case of archived room

Further updates discussed in this comment - #21580 (comment)

What alternative solutions did you explore? (Optional)

None

[joekaufmanexpensify]

I can reproduce this. Based on the design doc, it's not clear to me whether it's expected that anyone in the parent chat can edit a task's assignee.

cc @thienlnam curious if you could share the expected behavior here? Should anyone in the chat be able to edit a task's assignee, or just the task creator/assignee (if there is one).

[thienlnam]

Yes, only the creator, assignee, and policy admins are able to edit a task assignee

[joekaufmanexpensify]

Got it, ty!

[joekaufmanexpensify]

Updated OP to clarify expected behavior.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~01e2d2c3fd882a94d6

[melvin-bot]

Current assignee @joekaufmanexpensify is eligible for the External assigner, not assigning anyone new.