[HOLD for payment 2024-07-22] [HOLD for payment 2024-07-17] [$250] Prevent requesting money from domain emails

@isabelastisser

Domain emails are in format +@<domain> like +@expensify.com.

Problem

We allow users to request money from domains in newDot. Update the code so we don't allow this action.

Steps to reproduce:

From the global create button, select Split expense.
In the search field enter +@applause.expensifail.com' and confirm you are able to select that email as an option.

Solution

Update the code to prevent users from requesting money from domain emails.

Solution

Update the code to prevent users from requesting money from domain emails.

Upwork Automation - Do Not Edit

Upwork Job URL: https://www.upwork.com/jobs/~014e28879d82637e16
Upwork Job ID: 1805872485147678962
Last Price Increase: 2024-06-26
Automatic offers:

rayane-djouah | Reviewer | 102895687
nkdengineer | Contributor | 102895688

Issue Owner

Current Issue Owner: @isabelastisser

Job added to Upwork: https://www.upwork.com/jobs/~014e28879d82637e16

@isabelastisser

Triggered auto assignment to @isabelastisser (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

@rayane-djouah

Triggered auto assignment to Contributor-plus team member for initial proposal review - @rayane-djouah (External)

Proposal

Please re-state the problem that we are trying to solve in this issue.

We'd like to prevent requesting money from domain emails

What is the root cause of that problem?

There's no logic to exclude domain emails when getOptions

What changes do you think we should make in order to solve the problem?

Add a param includeDomainEmail to getOptions

App/src/libs/OptionsListUtils.ts

Line 1769 in 57e5d0e

includeCategories = false,

, default to true

In

App/src/libs/OptionsListUtils.ts

Line 1941 in 57e5d0e

    
           const havingLoginPersonalDetails = includeP2P ? options.personalDetails.filter((detail) => !!detail?.login && !!detail.accountID && !detail?.isOptimisticPersonalDetail) : [];

, add

&& (includeDomainEmail || !Str.isDomainEmail(detail.login))

[Optional] In

App/src/libs/OptionsListUtils.ts

Line 1915 in 57e5d0e

}

add

if (Str.isDomainEmail(login) && !includeDomainEmail) {
    return;
}

In the money request participants page, pass includeDomainEmail as false

Can include the same check in other places in getOptions if needed

What alternative solutions did you explore? (Optional)

includeDomainEmail=false can be used for other use cases that should not include the domain email. We can also default includeDomainEmail to false if we don't want to show this when getting options by default.

We can optionally update the message when not found to "You cannot submit expense to a domain email". It's clearer than "No results found" that's being shown to the user.

@nkdengineer

@nkdengineer's proposal looks good to me.

🎀👀🎀 C+ reviewed

@techievivek

Current assignee @techievivek is eligible for the choreEngineerContributorManagement assigner, not assigning anyone new.

@techievivek

@techievivek - To confirm, Do we need to exclude domain email options in all IOU flows: Submit Expense, Split Expense, Pay Someone, Send Invoice? Do we also need to exclude them in the Start chat and assign task flows?

Edit: based on this issue #44485, we need to exclude the domain email option for the Start chat flow. So, I think all flows should be considered.

@adelekennedy

Triggered auto assignment to @adelekennedy (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

@adelekennedy

I will be OOO tomorrow and next week, so I am reassigning this until I return on July 29. Thanks, @adelekennedy!

Status:

@rayane-djouah needs to complete the BZ list.

The PR that introduced the bug has been identified. Link to the PR: No PR caused this, as this introduces a new feature. Previously, there was no logic to exclude domain emails.
The offending PR has been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake. Link to comment: N/A
A discussion in #expensify-bugs has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner. Link to discussion: N/A
Determine if we should create a regression test for this bug. Yes
If we decide to create a regression test for the bug, please propose the regression test steps to ensure the same bug will not reach production again.

Regression Test Proposal

From the global create button, select one of the flows: Submit Expense, Split Expense, Pay Someone, Send Invoice, Start chat, or assign task...
In the "Name, email, or phone number" field enter a domain email in this format: +@<domain>, like +@applause.expensifail.com.
Verify that you aren't able to select the domain email as an option.

Do we agree 👍 or 👎

@adelekennedy

The regression test looks good to me; @adelekennedy, can we please get that added? Thanks.

Not overdue, completing the BZ list.

@isabelastisser

@isabelastisser, @techievivek, @adelekennedy, @rayane-djouah, @nkdengineer Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

https://github.com/Expensify/Expensify/issues/414452

@adelekennedy

Thanks, @adelekennedy !

Navigation Menu

Repository navigation

[HOLD for payment 2024-07-22] [HOLD for payment 2024-07-17] [$250] Prevent requesting money from domain emails #44429

Problem

Steps to reproduce:

Solution

Solution

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order to solve the problem?

What alternative solutions did you explore? (Optional)

34 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[HOLD for payment 2024-07-22] [HOLD for payment 2024-07-17] [$250] Prevent requesting money from domain emails #44429

Description

Problem

Steps to reproduce:

Solution

Solution

Activity

melvin-bot commented on Jun 26, 2024

melvin-bot commented on Jun 26, 2024

melvin-bot commented on Jun 26, 2024

nkdengineer commented on Jun 26, 2024

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order to solve the problem?

What alternative solutions did you explore? (Optional)

rayane-d commented on Jun 26, 2024

melvin-bot commented on Jun 26, 2024

rayane-d commented on Jun 26, 2024

34 remaining items

melvin-bot commented on Jul 18, 2024

isabelastisser commented on Jul 18, 2024

rayane-d commented on Jul 20, 2024

techievivek commented on Jul 22, 2024

techievivek commented on Jul 22, 2024

melvin-bot commented on Jul 22, 2024

adelekennedy commented on Jul 22, 2024

isabelastisser commented on Jul 29, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions