[Due for payment 2025-04-23] [$250] Co-pilot is able to delete a contact method

@allgandalf

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

Version Number: 9.1.18-0
Reproducible in staging?: y
Reproducible in production?: y
If this was caught on HybridApp, is this reproducible on New Expensify Standalone?:
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: @allgandalf
Slack conversation (hyperlinked to channel name): #Expensify-bugs

Action Performed:

Precondition

Have a account atleast one extra contact method added and verified

Co-pilot login into that account
Go to profile > Contacts > The extra added contact
Click on delete contact

Expected Result:

We should see a modal explainig that these actions cannot be performed by a delegate like we do when adding a contact method

Actual Result:

Co-pilot is able to delete the contact method of another users account

Workaround:

unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

Screenshots/Videos

Add any screenshot/video evidence

Recording.1083.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

Upwork Job URL: https://www.upwork.com/jobs/~021904822580033366895
Upwork Job ID: 1904822580033366895
Last Price Increase: 2025-04-09
Automatic offers:

allgandalf | Contributor | 106854149

Issue Owner

Current Issue Owner: @bfitzexpensify

@bfitzexpensify

Triggered auto assignment to @bfitzexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

@allgandalf

Proposal by @allgandalf

Proposal

Please re-state the problem that we are trying to solve in this issue.

Co-pilot is able to delete a contact method

What is the root cause of that problem?

We block the co-pilot from adding a new contact method, but we don't block them deleting an added contact method:

App/src/pages/settings/Profile/Contacts/ContactMethodsPage.tsx

Lines 92 to 95 in dc8eb79

    
           if (isActingAsDelegate) { 
        
               setIsNoDelegateAccessMenuVisible(true); 
        
               return; 
        
           }

App/src/pages/settings/Profile/Contacts/ContactMethodDetailsPage.tsx

Lines 148 to 153 in dc8eb79

    
                */ 
        
               const confirmDeleteAndHideModal = useCallback(() => { 
        
                   toggleDeleteModal(false); 
        
                   deleteContactMethod(contactMethod, loginList ?? {}, backTo); 
        
               }, [contactMethod, loginList, toggleDeleteModal, backTo]);

What changes do you think we should make in order to solve the problem?

We should check if isActingAsDelegate is true and show the noAccess delegate modal to the user. same as we did in ContactMethodsPage.

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

N/A but if we want then, we can render the contacts detail page have the account logged in as delegate then press the delete button and verify that we see no access modal

What alternative solutions did you explore? (Optional)

We can hide the delete button altogether
In ContactMethodsPage, we will not show the right icon and not navigate when clicked

But i guess the main solution is the best as we follow the same approach throughout the application

Job added to Upwork: https://www.upwork.com/jobs/~021904822580033366895

@rojiphil

Triggered auto assignment to Contributor-plus team member for initial proposal review - @rojiphil (External)

@rojiphil

@rojiphil Eep! 4 days overdue now. Issues have feelings too...

@rojiphil

@rojiphil can you complete the checklist please?

@allgandalf payment sent and contract ended - thank you! 🎉

BugZero Checklist:

[Contributor] Classify the bug:

Bug classification

Source of bug:

1a. Result of the original design (eg. a case wasn't considered)
1b. Mistake during implementation
1c. Backend bug
1z. Other:

Where bug was reported:

2a. Reported on production
2b. Reported on staging (deploy blocker)
2c. Reported on a PR
2z. Other:

Who reported the bug:

[Contributor] The offending PR has been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake.

Link to comment:
[Contributor] If the regression was CRITICAL (e.g. interrupts a core flow) A discussion in #expensify-open-source has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner.

Link to discussion: Not Required. The existing checklist is good enough to capture such issues.
[Contributor] If it was decided to create a regression test for the bug, please propose the regression test steps using the template below to ensure the same bug will not reach production again.

Regression Test Proposal

Precondition:

Have an account atleast one extra contact method added and verified

Test:

Co-pilot login into that account
Go to profile > Contacts > The extra added contact
Click on delete contact
Verify that we see a modal explaining that these actions cannot be performed by a delegate like we do when adding a contact method

Do we agree 👍 or 👎

@abekkala

@abekkala BZ Checklist done. Thanks.

lets close this

@bfitzexpensify

@bfitzexpensify Huh... This is 4 days overdue. Who can take care of this?

@rojiphil

$250 approved for @rojiphil

@bfitzexpensify

Reopening for @bfitzexpensify to finish the QA test.

QA test GH created https://github.com/Expensify/Expensify/issues/497011
I didn't realize it was posted above and then missed that this was closed while Ben was ooo

Navigation Menu

Repository navigation

[Due for payment 2025-04-23] [$250] Co-pilot is able to delete a contact method #59093

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order to solve the problem?

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

What alternative solutions did you explore? (Optional)

48 remaining items

BugZero Checklist:

Regression Test Proposal

Precondition:

Test:

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	if (isActingAsDelegate) {
	setIsNoDelegateAccessMenuVisible(true);
	return;
	}

	*/
	const confirmDeleteAndHideModal = useCallback(() => {
	toggleDeleteModal(false);
	deleteContactMethod(contactMethod, loginList ?? {}, backTo);
	}, [contactMethod, loginList, toggleDeleteModal, backTo]);

[Due for payment 2025-04-23] [$250] Co-pilot is able to delete a contact method #59093

Description

Action Performed:

Expected Result:

Actual Result:

Workaround:

Platforms:

Screenshots/Videos

Activity

melvin-bot commented on Mar 25, 2025

m-natarajan commented on Mar 25, 2025

Proposal

Please re-state the problem that we are trying to solve in this issue.

What is the root cause of that problem?

What changes do you think we should make in order to solve the problem?

What specific scenarios should we cover in automated tests to prevent reintroducing this issue in the future?

What alternative solutions did you explore? (Optional)

melvin-bot commented on Mar 26, 2025

melvin-bot commented on Mar 26, 2025

melvin-bot commented on Mar 31, 2025

48 remaining items

abekkala commented on Apr 23, 2025

rojiphil commented on Apr 25, 2025

BugZero Checklist:

Regression Test Proposal

Precondition:

Test:

rojiphil commented on Apr 25, 2025

allgandalf commented on Apr 28, 2025

melvin-bot commented on Apr 28, 2025

garrettmknight commented on May 2, 2025

garrettmknight commented on May 2, 2025

abekkala commented on May 2, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions