Fix false missingAttendees violation in Search rows by VickyStash · Pull Request #104540 · Expensify/App

VickyStash · 2026-10-21T09:23:08Z

Explanation of Change

Bug:
In Spend -> Reports, a report row shows "Report contains expenses with violations.", but opening the report shows no errors.
In Spend → Expenses, its expenses show "Multiple attendees required for this category." until the expense or report is opened.

Root cause: Both Search rows re-check the missing-attendees violation on the client. For snapshot data they read the top-level attendees field, which is never set. The attendees are actually in comment.attendees, so with snapshot data the client saw no attendees and added the violation.

Expense row: it used transaction?.comment?.attendees ?? transactionItem.attendees.
- transaction is the live transaction from Onyx (transactions_<id>). It only exists after the expense or its report has been opened, because opening it loads the transaction into Onyx. Search results live in a separate snapshot key.
- transactionItem is the snapshot row, and its top-level attendees is always undefined.
- So before the expense is opened, the live value is missing and the row falls back to undefined, which shows the error. After it's opened, the live comment.attendees is used and the error disappears.
Report row: it used transaction.attendees, where transaction comes from reportItem.transactions, the snapshot rows. It never looks at the live transaction, so it got undefined even after the report was opened, and the error never went away.

Fix: Both rows (ExpenseReportListItem, TransactionListItem) now read attendees with getAttendees(), which returns modifiedAttendees ?? comment.attendees. That is the same source the Search attendees column already uses.

Fixed Issues

$ #104546
PROPOSAL: N/A

Tests

Verify that no errors appear in the JS console

Precondition: Create a WS setup-requires-attendees rule for a category. Invite a member. As a member, create an expense with the category with the rule and add two attendees.

Log in as the admin/owner/approver, or reset the cache if already logged in
Go Spend > Expense
Verify that the member's expense doesn't show the attendees violation.

Offline tests

N/A

QA Steps

// TODO: These must be filled out, or the issue title must include "[No QA]."

Verify that no errors appear in the JS console

Same, as in Tests section

PR Author Checklist

Screenshots/Videos

MacOS: Chrome / Safari

Shared in Slack: https://expensify.slack.com/archives/C05LX9D6E07/p1792579446644099?thread_ts=1792563208.522159&cid=C05LX9D6E07

codecov · 2026-10-21T09:29:31Z

Codecov Report

✅ Changes either increased or maintained existing code coverage, great job!

Files with missing lines	Coverage Δ
...arch/SearchList/ListItem/ExpenseReportListItem.tsx	`0.00% <ø> (ø)`
src/components/Search/SearchList/ListItem/types.ts	`100.00% <ø> (ø)`
.../SearchList/ListItem/TransactionListItem/index.tsx	`0.00% <0.00%> (ø)`
... and 17 files with indirect coverage changes

VickyStash · 2026-10-21T09:38:59Z

@MelvinBot review

MelvinBot · 2026-10-21T09:43:38Z

Review

The fix looks correct. Search rows now read attendees from the same place as the attendees column and the expense view: modifiedAttendees ?? comment.attendees. Returning [] instead of undefined doesn't change anything, because syncMissingAttendeesViolation already treats undefined as []. Reading modifiedAttendees is also an improvement.

I found no blocking problems. I have three optional suggestions:

Remove the unused attendees field from the Search row type. types.ts:177 declares a top-level attendees on TransactionListItemType, but nothing sets it. That field let the old transactionItem.attendees read pass type checks, which is how this bug got in. Removing it stops the same mistake from coming back.
The report-owner fallback still differs in one edge case. It only matters when the viewer is not the report owner (for example, an approver) and the expense has no attendees at all.
- The Expenses snapshot row adds the report owner as an attendee (SearchUIUtils.ts:1927-1943). So does the expense view, through useAttendees.
- The live-transaction path in TransactionListItem/index.tsx:216 and the report row in ExpenseReportListItem.tsx:208 don't add it.
- Result: for that approver, the Expenses row shows no violation before the expense is opened, then shows one after. The report row always shows one, while the expense view never does.
This existed before your PR and is rare, so a follow-up is fine. To make it consistent, pass the report owner to getAttendees in both rows.
Consider a regression test. Render a row from snapshot data where attendees exist only in comment.attendees, and check that no missingAttendees violation appears. The current tests don't cover this.

I didn't run the App: reproducing this needs a Control workspace with a category that requires attendees and existing snapshot data.

VickyStash · 2026-10-21T10:30:08Z

@MelvinBot

I've updatedTransactionListItemType.

Regarding:

The report-owner fallback still differs in one edge case.

Good catch, but I think the root cause is different. The spec in #76155 says to flag the violation when the attendees list is empty or has no one besides the expense creator. getIsMissingAttendeesViolation removes the current viewer instead of the creator, so when an approver views someone else's expense, [creator] counts as a valid attendee and the violation is hidden. getViolationsOnyxData already removes the report owner (ViolationsUtils.ts:1013-1034), so the two checks disagree.

Passing the report owner to getAttendees in the rows would make Search consistent with the expense view, but both would then hide the violation for approvers. Maybe the better fix is to have getIsMissingAttendeesViolation take the report owner's login instead of the current user?

App/src/libs/AttendeeUtils.ts

Lines 71 to 72 in 5bd9516

    
           const creatorLogin = userPersonalDetails.login ?? ''; 
        
           const creatorEmail = userPersonalDetails.email ?? '';

The same issue was already flagged in the #79721 (comment)

@MelvinBot, considering this, do you think it makes sense to do any adjustments in this PR? Or should it be solved separately?

MelvinBot · 2026-10-21T10:32:59Z

I agree with your diagnosis. I'd fix it in a separate PR and merge this one as is.

You're right that the root cause is the viewer-vs-creator check. AttendeeUtils.ts:71-72 removes the current viewer, but ViolationsUtils.ts:1013-1034 removes the report owner. Passing the owner's login to getIsMissingAttendeesViolation is the better fix. It also makes my second point unnecessary. Once the check removes the owner, adding the owner as a fallback attendee can't hide the violation, so the rows don't need to change.

Why I'd keep it separate:

It's a different bug. This PR fixes a false positive caused by a wrong data field. The owner fix changes the rules for approvers and admins: they'd start seeing violations that are hidden today.
It's wider. Every caller would need the owner's login:
- MoneyRequestView.tsx:820
- ViolationsUtils.ts:595
- useConfirmationValidation.ts:276. The current user is the creator here, so this one can keep its current value.
- Both Search rows, through syncMissingAttendeesViolation.
It needs its own QA. Testers should cover owner, approver, and admin views of the same expense. That doesn't fit this PR's test steps.

Attendee - Multiple attendee violation only applicable for the owner of the WS was closed after a CP hid the feature, with a note to fix this in a follow-up. That follow-up doesn't seem to exist, so a new issue linking that comment would track it. In that thread, ikevin127 marked a different case as not a bug: the only attendee is someone other than the creator. The owner-based check keeps that behavior.

melvin-bot · 2026-10-21T10:45:12Z

@nkdengineer Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

chatgpt-codex-connector · 2026-10-21T10:45:16Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T10:59:18.907276Z	`fb778b3`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

nkdengineer · 2026-10-21T10:50:49Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If the PR adds or modifies the UI:
- I asked an AI agent to review the changes for accessibility issues and addressed its findings.
- I tested with a screen reader (VoiceOver on macOS) and verified all new/changed elements are reachable with a logical focus order.
- I verified all new/changed elements have meaningful accessible names and roles.
- I verified state changes are announced (e.g. checked/unchecked, expanded/collapsed, selected).
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Screen.Recording.2026-10-21.at.18.21.14.mov

Android: mWeb Chrome

Screen.Recording.2026-10-21.at.18.22.10.mov

iOS: HybridApp

Screen.Recording.2026-10-21.at.18.20.30.mov

iOS: mWeb Safari

Screen.Recording.2026-10-21.at.18.19.26.mov

MacOS: Chrome / Safari

Screen.Recording.2026-10-21.at.18.18.05.mov

mountiny

LGTM

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fb778b36f1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-10-21T10:59:15Z

Sign in to view

        policyCategories,
        transaction?.category ?? transactionItem.category ?? '',
-        transaction?.comment?.attendees ?? transactionItem.attendees,
+        getAttendees(transaction ?? transactionItem),


Compare required attendees with the report owner

When a manager or approver views a Control-workspace expense in a category that requires attendees but has no non-owner attendee, getTransactionsSections inserts the report owner as the default snapshot attendee, and this new fallback passes that owner into syncMissingAttendeesViolation while the next argument remains the viewer's currentUserDetails. The helper therefore counts the submitter as a valid non-owner attendee and fails to add the real violation; the new getAttendees(transaction) call in ExpenseReportListItem.tsx:208 has the same owner/viewer mismatch and can remove the snapshot violation. Use the report owner/submitterLogin for the owner exclusion in both rows.

Useful? React with 👍 / 👎.

@VickyStash I think the owner vs viewer check needs fixing in this PR.

Say Alice submits an expense and is the only attendee. The backend flags it, because it leaves out the owner when it counts attendees. But syncMissingAttendeesViolation leaves out the viewer. So when Bob, the approver, looks at the row in Search, the check leaves out Bob instead of Alice, Alice counts as the extra attendee, and the violation is hidden.

Can we leave out the report owner's login instead, like the backend does, in both Search rows, with the current user as the fallback for unreported expenses?

Ah, I misunderstood the codex comment. @lakchote is right.

The backend flags it, because it leaves out the owner when it counts attendees. But syncMissingAttendeesViolation leaves out the viewer.

Yeah, and other places in the app pass the current user instead of the owner in other places too:

MoneyRequestView.tsx:820

ViolationsUtils.ts:595

useConfirmationValidation.ts:276. The current user is the creator here, so this one can keep its current value.

I've mentioned it here: #104540 (comment)

So if we do this:

Can we leave out the report owner's login instead, like the backend does, in both Search rows, with the current user as the fallback for unreported expenses?

we should change it everywhere, right?

Here is the result from creator

Here is the result from approver

@nkdengineer I guess it's the same on staging?

Approving see https://expensify.slack.com/archives/C05LX9D6E07/p1792592889779979?thread_ts=1792563208.522159&cid=C05LX9D6E07

nkdengineer · 2026-10-21T11:13:56Z

Reproducible on staging.

@VickyStash We can update the test step

Precondition: Create a WS setup-requires-attendees rule for a category. Invite a member. As a member, create an expense with the category with the rule and add two attendees.

Log in as the admin/owner/approver, or reset the cache if already logged in
Go Spend > Expense
Verify that the member's expense doesn't show the attendees violation.

nkdengineer

LGTM!

JmillsExpensify

LGTM

lakchote

Commented

lakchote · 2026-10-21T12:56:48Z

        policyCategories,
        transaction?.category ?? transactionItem.category ?? '',
-        transaction?.comment?.attendees ?? transactionItem.attendees,
+        getAttendees(transaction ?? transactionItem),


@VickyStash I think the owner vs viewer check needs fixing in this PR.

Say Alice submits an expense and is the only attendee. The backend flags it, because it leaves out the owner when it counts attendees. But syncMissingAttendeesViolation leaves out the viewer. So when Bob, the approver, looks at the row in Search, the check leaves out Bob instead of Alice, Alice counts as the extra attendee, and the violation is hidden.

Can we leave out the report owner's login instead, like the backend does, in both Search rows, with the current user as the fallback for unreported expenses?

mountiny

@nkdengineer can you create the new issues using melvin please?

nkdengineer · 2026-10-21T17:00:41Z

@MelvinBot Create a new issue based on this analysis and the image for the bug is here.

MelvinBot · 2026-10-21T17:07:04Z

I created Missing attendees violation is hidden when an approver views another member's expense.

It covers the owner-vs-viewer mismatch from the review analysis and includes the creator and approver screenshots. It also lists every caller that passes the current user, and notes that the confirmation page can keep its current value.

I found no open duplicate. Two issues are related:

Attendee - Multiple attendee violation only applicable for the owner of the WS reported the same problem. It was closed in January 2026.
Fix false missingAttendees violation in Search rows tracks this PR's fix. That fix is for the opposite symptom: a violation that shows when it shouldn't.

I didn't add labels.

nkdengineer · 2026-10-21T17:09:12Z

@MelvinBot Let assign me, @mountiny and @VickyStash to this issue.

nkdengineer · 2026-10-21T17:09:51Z

@nkdengineer can you create the new issues using melvin please?

@mountiny The new issue is here.

MelvinBot · 2026-10-21T17:12:18Z

I assigned nkdengineer, mountiny, and VickyStash to Missing attendees violation is hidden when an approver views another member's expense.

OSBotify · 2026-10-21T20:09:27Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.5.16-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

MelvinBot · 2026-10-21T20:12:05Z

No help site update needed. This PR fixes a bug: Search showed a false "Multiple attendees required for this category" violation, and it no longer does. That doesn't make any sentence in an existing article wrong.

OSBotify · 2026-10-22T19:23:35Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.5.18-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	cancelled 🔪

MelvinBot · 2026-10-22T19:26:24Z

No help site update needed. This bug fix stops a false "Multiple attendees required" violation from showing in Search rows, and the help site doesn't document the absence of an error.

view run

OSBotify · 2026-10-23T16:54:43Z

🚀 Deployed to production by https://github.com/grgia in version: 9.5.18-1 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

Bundle Size Analysis (Sentry):

Android
iOS

Fix false missingAttendees violation in Search rows

bc24df7

melvin-bot Bot assigned VickyStash Oct 21, 2026

Correct the type

fb778b3

mountiny mentioned this pull request Oct 21, 2026

[Due for payment 2026-10-30] Fix false missingAttendees violation in Search rows #104546

Open

VickyStash marked this pull request as ready for review October 21, 2026 10:45

VickyStash requested review from a team as code owners October 21, 2026 10:45

melvin-bot Bot requested review from nkdengineer and removed request for a team October 21, 2026 10:45

melvin-bot Bot requested review from JmillsExpensify and removed request for a team October 21, 2026 10:45

mountiny requested a review from lakchote October 21, 2026 10:52

mountiny approved these changes Oct 21, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Oct 21, 2026

View reviewed changes

nkdengineer approved these changes Oct 21, 2026

View reviewed changes

melvin-bot Bot requested a review from mountiny October 21, 2026 11:24

JmillsExpensify approved these changes Oct 21, 2026

View reviewed changes

lakchote reviewed Oct 21, 2026

View reviewed changes

mountiny approved these changes Oct 21, 2026

View reviewed changes

mountiny merged commit 6b711f6 into Expensify:main Oct 21, 2026
49 of 56 checks passed

MelvinBot mentioned this pull request Oct 21, 2026

[$175] Missing attendees violation is hidden when an approver views another member's expense #104596

Open

OSBotify mentioned this pull request Oct 21, 2026

Deploy Checklist: New Expensify 2026-10-21 #104620

Closed

83 tasks done

MelvinBot mentioned this pull request Oct 21, 2026

Investigate workflow job failing on main: typecheck / typecheck #104664

Closed

c3024 mentioned this pull request Oct 22, 2026

[No QA] Fix typecheck on main #104672

Merged

38 tasks done

Conversation

VickyStash commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

codecov Bot commented Oct 21, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

VickyStash commented Oct 21, 2026

Uh oh!

MelvinBot commented Oct 21, 2026

Review

Uh oh!

VickyStash commented Oct 21, 2026

Uh oh!

MelvinBot commented Oct 21, 2026

Uh oh!

melvin-bot Bot commented Oct 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

nkdengineer commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

mountiny left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

lakchote Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

nkdengineer Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

VickyStash Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

nkdengineer Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

VickyStash Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

lakchote Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nkdengineer commented Oct 21, 2026

Uh oh!

nkdengineer left a comment

Choose a reason for hiding this comment

Uh oh!

JmillsExpensify left a comment

Choose a reason for hiding this comment

Uh oh!

lakchote left a comment

Choose a reason for hiding this comment

Uh oh!

lakchote Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

VickyStash commented Oct 21, 2026 •

edited

Loading

codecov Bot commented Oct 21, 2026 •

edited by github-actions Bot

Loading

chatgpt-codex-connector Bot commented Oct 21, 2026 •

edited

Loading

nkdengineer commented Oct 21, 2026 •

edited

Loading

lakchote Oct 21, 2026 •

edited

Loading