Copilot with limited access can reject expense via the dropdown from Reports>Expenses

[nlemma]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.2.78-0
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod (Different behavior is seen on prod - no reject button from the dropdown menu)
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #75821
Email or phone of affected tester (no customers): kiatest.78+ck1212251@gmail.com
Issue reported by: Applause Internal Team
Bug source: Pull Request QA execution
Device used: Windows 11/Chrome, iPhone 16/18.7.1
App Component: Other

Action Performed:

Precondition:
User A has added User B as copilot with Limited access level.

1. Navigate to staging.new.expensify.com
   2.[User A] Go to workspace chat.
2. [User A] Create an expense and click Submit button.
3. [User A] Create another expense, click Submit and Approve button.
4. [User B] Go to Account.
5. [User B] Open account switcher and switch to User A account.
6. [User B] Go to Inbox and open User A's workspace chat.
7. [User B] Open the expense report
8. Click More >> Reject
9. Observe modal "Not so fast" is displayed & copilot with limited access cannot reject expense
10. [User B] Go to Reports >> Expenses
11. Select the submitted report via checkbox
12. Click dropdown menu >> select Reject option
13. Enter reason & reject expense
14. Observe expense can be rejected from reports >> Expenses page

Expected Result:

On step 13 - When Copilot with limited access select submitted report via the checkbox from reports page, "Not so fast"modal should appear as it appears in Expense details page and copilot should not be allowed to reject expense

Actual Result:

Copilot with limited access can reject expense via the dropdown menu from Reports >> Expenses page

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Bug7028423_1765594829967.12.12.2025_21.57.39_REC80.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @trjExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Triggered auto assignment to @yuwenmemon (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[ChavdaSachin]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Copilot with limited access can reject expense via the dropdown from Reports>Expenses

What is the root cause of that problem?

We do not restrict the limited access delegate from rejecting the expense from bulk action menu here

App/src/pages/Search/SearchPage.tsx

Lines 525 to 544 in e0923e0

	if (shouldShowRejectOption) {
	options.push({
	icon: expensifyIcons.ThumbsDown,
	text: translate('search.bulkActions.reject'),
	value: CONST.SEARCH.BULK_ACTION_TYPES.REJECT,
	shouldCloseModalOnSelect: true,
	onSelected: () => {
	if (isOffline) {
	setIsOfflineModalVisible(true);
	return;
	}
	if (dismissedRejectUseExplanation) {
	Navigation.navigate(ROUTES.SEARCH_REJECT_REASON_RHP);
	} else {
	setRejectModalAction(CONST.REPORT.TRANSACTION_SECONDARY_ACTIONS.REJECT);
	}
	},
	});
	}

What changes do you think we should make in order to solve the problem?

Add following code block to restrict limited access delegate from rejecting the expenses.

    if (isDelegateAccessRestricted) {
        showDelegateNoAccessModal();
        return;
    }

App/src/pages/Search/SearchPage.tsx

Line 531 in e0923e0

onSelected: () => {

Also look for any other bulk actions which should be restricted for full/limited access delegate and fix them as well.

What alternative solutions did you explore? (Optional)

Alternatively we could hide the reject button for delegates.

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[trjExpensify]

@mukhrr how is this failing when your PR has reject in the test steps OP? #75821

[mukhrr]

Sorry. I am a bit sick these days... will update as possible as I can