Skip to content

[CORRUPTED] Synthetic Benchmark PR #70349 - Add delete report option - #36

Open
tomerqodo wants to merge 18 commits into
base_pr_70349_20251204_1329from
corrupted_pr_70349_20251204_1329
Open

tomerqodo wants to merge 18 commits into
base_pr_70349_20251204_1329from
corrupted_pr_70349_20251204_1329

Conversation

@tomerqodo

@tomerqodo tomerqodo commented Dec 4, 2025 •

Copy link
Copy Markdown

User description

Benchmark PR Expensify#70349

Type: Corrupted (contains bugs)

Original PR Title: Add delete report option
Original PR Description:

Explanation of Change

Fixed Issues

$ Expensify#69546
PROPOSAL: Expensify#69546 (comment)

Tests

Same as QA Steps

  • Verify that no errors appear in the JS console

Offline tests

Same as QA Steps

QA Steps

  1. Open a workspace chat
  2. Create an empty report
  3. Create a new report with at least 2 expenses
  4. Right click on each report preview
  5. Verify there is a delete option
  6. Delete the report preview
  7. Verify the report preview is deleted

NOTE for QA:
If the report preview only has 1 expense and has never been opened before, the confirmation modal will say delete report instead of delete expense. It's technically an existing issue.

  • Verify that no errors appear in the JS console

PR Author Checklist

  • I linked the correct issue in the ### Fixed Issues section above
  • I wrote clear testing steps that cover the changes made in this PR
    • I added steps for local testing in the Tests section
    • I added steps for the expected offline behavior in the Offline steps section
    • I added steps for Staging and/or Production testing in the QA steps section
    • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
    • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
    • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
  • I included screenshots or videos for tests on all platforms
  • I ran the tests on all platforms & verified they passed on:
    • Android: Native
    • Android: mWeb Chrome
    • iOS: Native
    • iOS: mWeb Safari
    • MacOS: Chrome / Safari
    • MacOS: Desktop
  • I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
  • I verified there are no new alerts related to the canBeMissing param for useOnyx
  • I followed proper code patterns (see Reviewing the code)
    • I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick)
    • I verified that comments were added to code that is not self explanatory
    • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
    • I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
      • If any non-english text was added/modified, I used JaimeGPT to get English > Spanish translation. I then posted it in #expensify-open-source and it was approved by an internal Expensify engineer. Link to Slack message:
    • I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
    • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
    • I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
    • I verified the JSDocs style guidelines (in STYLE.md) were followed
  • If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
  • I followed the guidelines as stated in the Review Guidelines
  • I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
  • I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
  • I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
  • I verified that if a function's arguments changed that all usages have also been updated correctly
  • If any new file was added I verified that:
    • The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
  • If a new CSS style is added I verified that:
    • A similar style doesn't already exist
    • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))
  • If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
  • If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
  • If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
  • If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
  • If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
    • I verified that all the inputs inside a form are aligned with each other.
    • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
  • If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
  • I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
  • If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

Android: Native
android.mp4
Android: mWeb Chrome
android.mweb.mp4
iOS: Native
iOS: mWeb Safari
ios.mweb.mp4
MacOS: Chrome / Safari
web.mp4
MacOS: Desktop
desktop.mp4

Original PR URL: Expensify#70349


PR Type

Enhancement


Description

  • Add delete report option for report preview actions across all supported languages

  • Refactor delete action logic into canDeleteMoneyRequestReport utility function

  • Update translation strings to support report deletion with conditional type handling

  • Integrate report deletion capability into context menu with proper permission checks


Diagram Walkthrough

flowchart LR
  A["Report Preview Action"] -->|"Check Delete Permission"| B["canDeleteMoneyRequestReport"]
  B -->|"Validate User & Report State"| C["Permission Granted"]
  C -->|"Show Delete Option"| D["Context Menu"]
  D -->|"User Confirms"| E["deleteAppReport"]
  E -->|"Remove Report"| F["Report Deleted"]
Loading

File Walkthrough

Relevant files
Enhancement
14 files
en.ts
Add report type to delete action translations                       
+18/-2   
de.ts
Add report type to German delete translations                       
+18/-2   
es.ts
Add report type to Spanish delete translations                     
+18/-3   
fr.ts
Add report type to French delete translations                       
+18/-3   
it.ts
Add report type to Italian delete translations                     
+18/-2   
ja.ts
Add report type to Japanese delete translations                   
+18/-2   
nl.ts
Add report type to Dutch delete translations                         
+18/-3   
pl.ts
Add report type to Polish delete translations                       
+18/-2   
pt-BR.ts
Add report type to Portuguese delete translations               
+18/-3   
zh-hans.ts
Add report type to Chinese delete translations                     
+18/-2   
ReportUtils.ts
Extract and enhance delete permission logic for reports   
+62/-1   
BaseReportActionContextMenu.tsx
Integrate transactions data for delete action validation 
+5/-4     
ContextMenuActions.tsx
Add report preview action delete support to context menu 
+22/-19 
PopoverReportActionContextMenu.tsx
Implement report deletion handler for preview actions       
+4/-2     
Refactoring
1 files
ReportSecondaryActionUtils.ts
Simplify delete action logic by delegating to utility       
+2/-47   
Tests
2 files
ReportUtils.perf-test.ts
Update test to pass new function parameters                           
+1/-1     
ReportUtilsTest.ts
Update unit tests with new function signature                       
+3/-3     

@qodo-code-review

Copy link
Copy Markdown

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
⚪
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

⚪
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Missing audit log: Deleting reports or money requests is triggered (including new report preview deletion)
without any added logging of user, timestamp, action, or outcome in the new code.

Referred Code
const reportAction = reportActionRef.current;
if (isMoneyRequestAction(reportAction)) {
    const originalMessage = getOriginalMessage(reportAction);
    if (isTrackExpenseAction(reportAction)) {
        deleteTrackExpense(reportIDRef.current, originalMessage?.IOUTransactionID, reportAction, duplicateTransactions, duplicateTransactionViolations, isReportArchived);
    } else {
        deleteMoneyRequest(originalMessage?.IOUTransactionID, reportAction, duplicateTransactions, duplicateTransactionViolations);
    }
} else if (isReportPreviewAction(reportAction)) {
    deleteAppReport(reportAction.childReportID);
} else if (reportAction) {
    InteractionManager.runAfterInteractions(() => {
        deleteReportComment(reportIDRef.current, reportAction, isReportArchived, isOriginalReportArchived);
    });

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status:
Misleading naming: The conditional in deleteAction checks IOU in both branches which likely intended
REPORT_PREVIEW, making the resulting 'informe' type selection misleading.

Referred Code
deleteAction: ({action}: DeleteActionParams) => {
    let type = 'comentario';
    if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.IOU) {
        type = 'gasto';
    } else if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.IOU) {
        type = 'informe';
    }
    return `Eliminar ${type}`;
},
deleteConfirmation: ({action}: DeleteConfirmationParams) => {
    let type = 'comentario';
    if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.IOU) {
        type = 'gasto';
    } else if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.REPORT_PREVIEW) {
        type = 'informe';
    }
    return `¿Estás seguro de que quieres eliminar este ${type}?`;
},

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
No error handling: New delete flows (money requests and report preview deletion) call delete functions
without local try/catch or fallback UI handling in case of failures.

Referred Code
const reportAction = reportActionRef.current;
if (isMoneyRequestAction(reportAction)) {
    const originalMessage = getOriginalMessage(reportAction);
    if (isTrackExpenseAction(reportAction)) {
        deleteTrackExpense(reportIDRef.current, originalMessage?.IOUTransactionID, reportAction, duplicateTransactions, duplicateTransactionViolations, isReportArchived);
    } else {
        deleteMoneyRequest(originalMessage?.IOUTransactionID, reportAction, duplicateTransactions, duplicateTransactionViolations);
    }
} else if (isReportPreviewAction(reportAction)) {
    deleteAppReport(reportAction.childReportID);
} else if (reportAction) {
    InteractionManager.runAfterInteractions(() => {
        deleteReportComment(reportIDRef.current, reportAction, isReportArchived, isOriginalReportArchived);
    });

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Authorization path: The new generalized delete action relies on canDeleteReportAction with broader inputs
(transactions/child actions) but adds report preview deletion without visible explicit
authorization checks in this diff.

Referred Code
            Navigation.navigate(ROUTES.DEBUG_REPORT.getRoute(reportID));
        }
        hideContextMenu(false, ReportActionComposeFocusManager.focus);
    },
    getDescription: () => {},
},
{
    isAnonymousAction: false,
    textTranslateKey: 'common.delete',
    icon: Expensicons.Trashcan,
    shouldShow: ({type, reportAction, isArchivedRoom, isChronosReport, reportID: reportIDParam, moneyRequestAction, iouTransaction, transactions, childReportActions}) => {
        // Until deleting parent threads is supported in FE, we will prevent the user from deleting a thread parent
        let reportID = reportIDParam;

        if (isMoneyRequestAction(moneyRequestAction)) {
            reportID = getOriginalMessage(moneyRequestAction)?.IOUReportID;
        } else if (isReportPreviewActionReportActionsUtils(reportAction)) {
            reportID = reportIDParam;
        }
        return (
            !!reportIDParam &&


 ... (clipped 8 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

@qodo-code-review

Copy link
Copy Markdown

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
The PR introduces a copy-paste bug

A copy-paste error exists in the Spanish translation file es.ts. The condition
for a REPORT_PREVIEW action incorrectly checks for IOU again, causing incorrect
text to be displayed.

Examples:

src/languages/es.ts [839-847]
        deleteAction: ({action}: DeleteActionParams) => {
            let type = 'comentario';
            if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.IOU) {
                type = 'gasto';
            } else if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.IOU) {
                type = 'informe';
            }
            return `Eliminar ${type}`;
        },

Solution Walkthrough:

Before:

// src/languages/es.ts
deleteAction: ({action}) => {
    let type = 'comentario';
    if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.IOU) {
        type = 'gasto';
    } else if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.IOU) { // Bug: should be REPORT_PREVIEW
        type = 'informe';
    }
    return `Eliminar ${type}`;
},

After:

// src/languages/es.ts
deleteAction: ({action}) => {
    let type = 'comentario';
    if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.IOU) {
        type = 'gasto';
    } else if (action?.actionName === CONST.REPORT.ACTIONS.TYPE.REPORT_PREVIEW) {
        type = 'informe';
    }
    return `Eliminar ${type}`;
},
Suggestion importance[1-10]: 6

__

Why: The suggestion correctly identifies a copy-paste bug in the es.ts translation file, which would lead to incorrect UI text for Spanish-speaking users when deleting a report.

Low
  • More

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants