Hide receipt attachment actions when the parent conversation is read-only

[wildan-m]

Explanation of Change

In a read-only conversation, someone who cannot post there can still add an attachment to an expense — opening the expense and using the receipt's add-additional-receipt control attaches an image that lands in the conversation. The restriction that makes a conversation read-only is carried on the report the user was given limited access to, which here is the expense's own report. The receipt view is handed the transaction thread below it and decides editability from that alone; the thread carries no restriction, so the control stays visible and the attachment goes through.

Editability now also requires write permission on the reports above the expense — its own report and the conversation above it — using the same permission check that hides the conversation composer. Only the add control is gated: the expand control still renders, so someone who cannot post can still open the receipt to read it, exactly as they can today.

Root cause corrected since the approved proposal. The proposal placed the restriction on the conversation above the expense. Testing on an Android emulator against a genuinely read-only conversation showed it sits one level below, on the expense's own report, so the proposal's fix left the control on screen. Asking the C+ reviewer to confirm the corrected root cause before internal review.

Fixed Issues

$ #92679
PROPOSAL: #92679 (comment)

Tests

1. Sign in and open a 1:1 chat.
2. Create a manual expense with a receipt in that chat.
3. Open the expense so the receipt is displayed.
4. Invite another user by sending their email in the chat, then choose "invite to chat" from the whisper.
5. Sign in as the invited user, open the same expense, and hover (or tap) the receipt.
6. Verify the add-additional-receipt (+) control is not offered on the receipt, so no attachment can be added to the read-only conversation from there.
7. Back as the original user, who can post in the conversation, open the same expense and verify the add-additional-receipt (+) control is still offered and still adds an attachment.

• Verify that no errors appear in the JS console

Offline tests

This is a visibility check computed from conversation data that is already cached locally, and it adds no network request. Offline, the add-additional-receipt control is hidden or shown from that cached data exactly as it is online: hidden in a read-only conversation, offered in one the user can post in.

QA Steps

Same as tests.

• Verify that no errors appear in the JS console

PR Author Checklist

• I linked the correct issue in the ### Fixed Issues section above
• I wrote clear testing steps that cover the changes made in this PR
  • I added steps for local testing in the Tests section
  • I added steps for the expected offline behavior in the Offline steps section
  • I added steps for Staging and/or Production testing in the QA steps section
  • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
  • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
  • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
• I included screenshots or videos for tests on all platforms
• I ran the tests on all platforms & verified they passed on:
  • Android: Native
  • Android: mWeb Chrome
  • iOS: Native
  • iOS: mWeb Safari
  • MacOS: Chrome / Safari
• I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
• I followed proper code patterns (see Reviewing the code)
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I followed the guidelines as stated in the Review Guidelines
• I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
• If a new CSS style is added I verified that:
  • A similar style doesn't already exist
  • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))
• If new assets were added or existing ones were modified, I verified that:
  • The assets are optimized and compressed (for SVG files, run npm run compress-svg)
  • The assets load correctly across all supported platforms.
• If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
• If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
• If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
  • I verified that all the inputs inside a form are aligned with each other.
  • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
• I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

Android: Native

Kapture.2026-07-31.at.10.43.04.mp4

Android: mWeb Chrome

Kapture.2026-07-31.at.10.46.06.mp4

iOS: Native

Kapture.2026-07-31.at.10.53.10.mp4

iOS: mWeb Safari

Kapture.2026-07-31.at.10.54.48.mp4

MacOS: Chrome / Safari

Kapture.2026-07-31.at.10.47.15.mp4

[melvin-bot]

@Krishna2323 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cbc493be1c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Require the parent chat to load before enabling uploads

When parentReport?.parentReportID is already known but that chat report has not hydrated yet (for example after opening the transaction from search/deep link or after clearing Onyx), !chatReport makes this guard treat the parent conversation as writable. That leaves the receipt actions enabled for a read-only parent chat until the chat report arrives, so a user with only READ permission can still press Add additional receipt and send addAttachmentWithComment before the guard flips. Please only skip this check when there is truly no parent conversation, not when the expected parent chat is missing from Onyx.

Useful? React with 👍 / 👎.

[wildan-m]

Good catch — fixed in b25e1ea: a report above the expense that is expected but not yet in Onyx now blocks the add button until it loads, instead of reading as writable.

[codecov]

Codecov Report

✅ Changes either increased or maintained existing code coverage, great job!

Files with missing lines	Coverage Δ
...nents/ReportActionItem/MoneyRequestReceiptView.tsx	71.65% <80.00%> (+0.56%)	⬆️
... and 73 files with indirect coverage changes