[Internal QA] Fix From filter showing Account Managers on customer accounts by allgandalf · Pull Request #88921 · Expensify/App

allgandalf · 2026-04-27T11:30:12Z

Explanation of Change

the From filter on Reports was leaking current and former AMs because hidden AMs are written into customer policy.employeeList with role: admin, and the filter pulled options from hydrated personal details with no Expensify-team filtering. added getExpensifyTeamExclusions in PolicyUtils that soft-excludes @expensify.com / @team.expensify.com logins from search filter suggestions, mirroring the rule WorkspaceMembersPage already uses: skip the filter when the current user is themselves Expensify staff, and preserve Expensify-team members of any Expensify-owned policy the current user belongs to. applied to all user filters (TO, FROM, ASSIGNEE, ATTENDEE) plus inline from: autocomplete.

Fixed Issues

$ #83879
PROPOSAL:

Tests

Precondition:

Assign AM & Guide to the domain using this SO: https://stackoverflowteams.com/c/expensify/questions/17036/17052

Or run the following CLI command in local VM:

❯ ./script/clitools.sh generator:account-manager
Setting up Account Manager test environment...

Account email? [whogandalf@gmail.com] testaccountdomain@domainctest.com
Let's authenticate you
success
Account Manager email?[am-1779049352@team.expensify.com] 
Creating Account Manager account: am-1779049352@team.expensify.com
Guides policy setup complete
Granting FR+ access to Account Manager...
Domain name for user?[guidetest-1779049352.com] 
User email?[admin@guidetest-1779049352.com] 
Creating user account: admin@guidetest-1779049352.com
Creating domain: guidetest-1779049352.com
Domain token created: 3AA26A386CD958C1762A...
Creating policy...
Setting Account Manager as user's assigned guide...
Adding Account Manager to user's #admins room...
Assigning Account Manager to user's domain...

Setup Complete!

📧 User Email: admin@guidetest-1779049352.com
👤 Account Manager Email: am-1779049352@team.expensify.com
🏢 Domain: guidetest-1779049352.com (validated)
📋 Policy ID: 26A331B96CCB81D1
💬 Admins Room ID: 7067458307355860

🔗 Admins Room Link: https://www.expensify.com/r/7067458307355860

Add to your _config.local.php:

define('CONCIERGE_VENDORS', [
    [
        'vendor' => 'Expensify Vendor',
        'FRPolicyId' => '6EACA522BA47989E',
        'FRPlusPolicyId' => 'E168A2786CC67EB3',
    ],
]);

✅ AM setup complete. Send a message in the #admins room as the user and pick it up as the AM in FR+ to validate.

Go to https://staging.new.expensify.com/
Navigate to the Spend page > click filter From

Verify that you don't see any AM or guides in the filter list

Verify that no errors appear in the JS console

Before the fix:

After the Fix:

Offline tests

N/A

QA Steps

// TODO: These must be filled out, or the issue title must include "[No QA]."

Same as Tests.

Verify that no errors appear in the JS console

PR Author Checklist

…tsSelector

melvin-bot · 2026-04-27T11:30:19Z

@Krishna2323 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

codecov · 2026-04-27T11:37:42Z

Codecov Report

✅ Changes either increased or maintained existing code coverage, great job!

Files with missing lines	Coverage Δ
src/hooks/useAutocompleteSuggestions.ts	`75.14% <100.00%> (+0.14%)`	⬆️
src/libs/OptionsListUtils/index.ts	`84.52% <100.00%> (+0.01%)`	⬆️
src/libs/PolicyUtils.ts	`71.65% <100.00%> (+0.69%)`	⬆️
...nents/Search/SearchFiltersParticipantsSelector.tsx	`0.00% <0.00%> (ø)`
...omponents/Search/FilterComponents/UserSelector.tsx	`0.00% <0.00%> (ø)`
... and 10 files with indirect coverage changes

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 25f62cef64

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-04-27T11:38:22Z

            searchContext: CONST.SEARCH_SELECTOR.SEARCH_CONTEXT_GENERAL,
            initialSelected: initialSelectedOptions,
            excludeLogins: CONST.EXPENSIFY_EMAILS_OBJECT,
+            excludeFromSuggestionsOnly: expensifyTeamExclusions,


Restrict Expensify-team exclusions to From popup

excludeFromSuggestionsOnly is now always applied in UserSelectPopup, but this popup is shared by ASSIGNEE, ATTENDEE, TO, and FROM in useSearchFiltersBar.tsx (cases around lines 354-357). On wide-screen Reports filters, this change hides @expensify.com/@team.expensify.com people from all those dropdowns instead of only From, which is a regression from the intended behavior. Because includeUserToInvite is false here, users also lose the manual fallback path in these popups.

Useful? React with 👍 / 👎.

good catch, gated this behind a shouldExcludeExpensifyTeamMembers prop in bc3e895 and only enabled it for the From case in useSearchFiltersBar in 8a59c2b. assignee/attendee/to are unchanged now.

…ount-managers # Conflicts: # src/components/Search/FilterDropdowns/UserSelectPopup.tsx # src/components/Search/SearchFiltersParticipantsSelector.tsx

…e From filter

…ount-managers # Conflicts: # android/app/build.gradle # docs/redirects.csv # ios/NewExpensify/Info.plist # ios/NotificationServiceExtension/Info.plist # ios/ShareViewController/Info.plist # package-lock.json # package.json # patches/@shopify/flash-list/details.md # src/components/ReportActionItem/MoneyReportView.tsx # src/components/ReportActionItem/MoneyRequestView.tsx # src/components/Search/FilterComponents/UserSelector.tsx # src/components/Search/index.tsx # src/hooks/useSearchSections.ts # src/libs/Navigation/linkingConfig/RELATIONS/WORKSPACE_TO_RHP.ts # src/libs/Navigation/types.ts # src/libs/actions/IOU/index.ts # src/pages/inbox/report/ContextMenu/BaseReportActionContextMenu.tsx # src/pages/iou/request/step/IOURequestStepConfirmation.tsx # src/pages/workspace/AccessOrNotFoundWrapper.tsx # src/pages/workspace/WorkspaceInitialPage.tsx # src/pages/workspace/WorkspacePageWithSections.tsx # src/pages/workspace/expensifyCard/WorkspaceExpensifyCardDetailsPage.tsx # src/types/onyx/Policy.ts # tests/ui/MoneyReportViewTest.tsx # tests/ui/MoneyRequestViewTest.tsx # tests/unit/PolicyUtilsTest.ts

github-actions · 2026-05-20T08:17:42Z

⚠️ This PR is possibly changing native code and/or updating libraries, it may cause problems with HybridApp. Please check if any patch updates are required in the HybridApp repo and run an AdHoc build to verify that HybridApp will not break. Ask Contributor Plus for help if you are not sure how to handle this. ⚠️

neil-marcellini

Thanks for the updates. This is looking much more simple now, and I think it's pretty close. I have reviewed all of it now.

While reviewing the tests, I started wondering if this would break suggestions for filtering on expenses from individuals that were sent outside of a workspace, such as in the P2P path. I believe those users will no longer show up as suggestions, so the approach that was recommended to limit only to workspace members was not a great idea after all.

Also, I see that you've explained how account managers are added to the workspace with their role set to admin. I didn't know that. Filtering them out based on workspace membership does not really work at all, so what we're relying on is basically the existing filtering idea from the policy members page, where we filter out Expensify team users. I do think that's the best approach for now and it's good to be consistent with that page.

One more edge case based on the members page logic. What if the user is a not on the expensify team but they are a member of an expensify team owned policy? Right now for search filter suggestions we would not show any of the expensify policy members even though we should, but we would show all members on the policy page. Let's fix that too.

App/src/pages/workspace/WorkspaceMembersPage.tsx

Lines 432 to 439 in 13b81ae

    
           // If this policy is owned by Expensify then show all support (expensify.com or team.expensify.com) emails 
        
           // We don't want to show guides as policy members unless the user is a guide. Some customers get confused when they 
        
           // see random people added to their policy, but guides having access to the policies help set them up. 
        
           if (isExpensifyTeam(details?.login ?? details?.displayName)) { 
        
               if (policyOwner && currentUserLogin && !isExpensifyTeam(policyOwner) && !isExpensifyTeam(currentUserLogin)) { 
        
                   continue; 
        
               } 
        
           }

…ns per policy

allgandalf · 2026-05-23T07:30:06Z

@neil-marcellini thanks, addressed all three:

P2P suggestions are back. dropped the workspace-member scoping, candidate pool is the full personalDetails again so users you've sent expenses to outside any workspace still show as suggestions. helper rewritten in 88d9754, call sites switched in bcc27c6, bc07bcd, and 8282c3a.
Expensify-team filter restored as the primary mechanism, named getExpensifyTeamExclusions for consistency with the WorkspaceMembersPage idea you pointed at.
edge case handled. when the current user is non-Expensify but is a member of an Expensify-owned policy, Expensify-team members of THAT policy are kept in the suggestion list. matches the WorkspaceMembersPage exception (skip the filter when policy owner OR current user is Expensify team). new test cases for this in be1691c.

allgandalf · 2026-05-23T09:38:11Z

@codex review

chatgpt-codex-connector · 2026-05-23T09:46:01Z

Codex Review: Didn't find any major issues. Another round soon, please!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…ount-managers # Conflicts: # android/app/build.gradle # ios/NewExpensify/Info.plist # ios/NotificationServiceExtension/Info.plist # ios/ShareViewController/Info.plist # package-lock.json # package.json # src/components/Search/FilterComponents/UserSelector.tsx # src/components/Search/index.tsx # src/pages/workspace/WorkspacesListPage.tsx

neil-marcellini

Great work, I'm happy with it!

neil-marcellini · 2026-05-26T17:53:53Z

@allgandalf we need to fix merge conflicts. I will also work on getting a contributor plus to review it.

Krishna2323 · 2026-05-28T02:09:03Z

Will review today.

Krishna2323 · 2026-05-29T06:32:23Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- MacOS: Desktop
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified there are no new alerts related to the canBeMissing param for useOnyx
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

android_hybrid.mp4

Android: mWeb Chrome

android_mWeb.mp4

iOS: HybridApp

ios_hybrid.mp4

iOS: mWeb Safari

ios_safari.mp4

MacOS: Chrome / Safari

web_chrome.mp4

Krishna2323

LGTM and works well!

@allgandalf please resolve the conflicts when you get a chance. Thanks!

allgandalf added 10 commits April 27, 2026 16:50

Add getExpensifyTeamExclusions helper to PolicyUtils

74070db

Add unit tests for getExpensifyTeamExclusions

1b86f0a

Wire excludeFromSuggestionsOnly into UserSelectPopup

54657cc

Add shouldExcludeExpensifyTeamMembers prop to SearchFiltersParticipan…

5a1df3e

…tsSelector

Enable Expensify team exclusion on advanced From filter page

7e29b29

Forward excludeFromSuggestionsOnly through getSearchOptions

e54b1d2

Apply Expensify team exclusion to inline from: autocomplete

168f6aa

Add unit test for from: autocomplete excluding Expensify team

1a0f4ab

Replace forEach with for…of in PolicyUtils test fixture builder

4e79f64

Type and scope-disable lint rules in autocomplete from: tests

25f62ce

allgandalf requested review from a team as code owners April 27, 2026 11:30

melvin-bot Bot assigned allgandalf Apr 27, 2026

melvin-bot Bot requested review from Krishna2323 and joekaufmanexpensify and removed request for a team April 27, 2026 11:30

allgandalf removed the request for review from Krishna2323 April 27, 2026 11:38

allgandalf marked this pull request as draft April 27, 2026 11:38

chatgpt-codex-connector Bot reviewed Apr 27, 2026

View reviewed changes

allgandalf changed the title ~~Fix From filter showing Account Managers on customer accounts~~ [WIP] Fix From filter showing Account Managers on customer accounts Apr 27, 2026

allgandalf added Internal Requires API changes or must be handled by Expensify staff InternalQA This pull request required internal QA and removed Internal Requires API changes or must be handled by Expensify staff labels May 4, 2026

allgandalf changed the title ~~[WIP] Fix From filter showing Account Managers on customer accounts~~ [Internal QA] Fix From filter showing Account Managers on customer accounts May 4, 2026

allgandalf added 3 commits May 4, 2026 21:02

Merge remote-tracking branch 'upstream/main' into fix-from-filter-acc…

8613527

…ount-managers # Conflicts: # src/components/Search/FilterDropdowns/UserSelectPopup.tsx # src/components/Search/SearchFiltersParticipantsSelector.tsx

Gate Expensify team exclusion in UserSelectPopup behind a prop

bc3e895

Pass shouldExcludeExpensifyTeamMembers to UserSelectPopup only for th…

8a59c2b

…e From filter

allgandalf added 3 commits May 20, 2026 13:33

Fix lint in getNonWorkspaceMemberExclusions test helper

abc64f3

Align FlashList consumer files to upstream/main after merge

8471067

allgandalf added 4 commits May 20, 2026 13:50

Reset unrelated upstream files to upstream/main

4da9ef0

Hide Expensify team accounts from workspace member scoping

d5ed0ad

Add tests for Expensify team exclusion in workspace member scoping

e05d614

Merge branch 'main' into fix-from-filter-account-managers

6f10a4c

allgandalf requested a review from neil-marcellini May 22, 2026 06:59

Fix cspell unknown-word in getNonWorkspaceMemberExclusions docstring

037d169

neil-marcellini requested changes May 22, 2026

View reviewed changes

allgandalf added 6 commits May 23, 2026 12:16

Replace getNonWorkspaceMemberExclusions with getExpensifyTeamExclusio…

88d9754

…ns per policy

Switch UserSelector to getExpensifyTeamExclusions

bcc27c6

Switch SearchFiltersParticipantsSelector to getExpensifyTeamExclusions

bc07bcd

Switch user-filter autocomplete to getExpensifyTeamExclusions

8282c3a

Update getExpensifyTeamExclusions tests for per-policy filter

be1691c

Update autocomplete tests for getExpensifyTeamExclusions

62b8518

Merge branch 'Expensify:main' into fix-from-filter-account-managers

d195a24

allgandalf requested a review from neil-marcellini May 25, 2026 15:32

neil-marcellini approved these changes May 26, 2026

View reviewed changes

neil-marcellini requested a review from Krishna2323 May 26, 2026 17:54

Krishna2323 approved these changes May 29, 2026

View reviewed changes

melvin-bot Bot requested a review from neil-marcellini May 29, 2026 06:45

	// If this policy is owned by Expensify then show all support (expensify.com or team.expensify.com) emails
	// We don't want to show guides as policy members unless the user is a guide. Some customers get confused when they
	// see random people added to their policy, but guides having access to the policies help set them up.
	if (isExpensifyTeam(details?.login ?? details?.displayName)) {
	if (policyOwner && currentUserLogin && !isExpensifyTeam(policyOwner) && !isExpensifyTeam(currentUserLogin)) {
	continue;
	}
	}

Conversation

allgandalf commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Uh oh!

melvin-bot Bot commented Apr 27, 2026

Uh oh!

codecov Bot commented Apr 27, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

allgandalf May 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

neil-marcellini left a comment

Choose a reason for hiding this comment

Uh oh!

allgandalf commented May 23, 2026

Uh oh!

allgandalf commented May 23, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 23, 2026

Uh oh!

neil-marcellini left a comment

Choose a reason for hiding this comment

Uh oh!

neil-marcellini commented May 26, 2026

Uh oh!

Krishna2323 commented May 28, 2026

Uh oh!

Krishna2323 commented May 29, 2026

Reviewer Checklist

Screenshots/Videos

Uh oh!

Krishna2323 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

allgandalf commented Apr 27, 2026 •

edited

Loading

codecov Bot commented Apr 27, 2026 •

edited by github-actions Bot

Loading