Merge branch 'main' into fix/34755-concierge-navigation

.github/workflows/deployExpensifyHelp.yml

@@ -53,10 +53,10 @@ jobs:
           directory: ./docs/_site
 
       - name: Setup Cloudflare CLI
-        run: pip3 install cloudflare
+        run: pip3 install cloudflare==2.17.0
 
       - name: Purge Cloudflare cache
-        run: /home/runner/.local/bin/cli4 --delete hosts=["help.expensify.com"] /zones/:9ee042e6cfc7fd45e74aa7d2f78d617b/purge_cache
+        run: /home/runner/.local/bin/cli4 --verbose --delete hosts=["help.expensify.com"] /zones/:9ee042e6cfc7fd45e74aa7d2f78d617b/purge_cache
         env:
           CF_API_KEY: ${{ secrets.CLOUDFLARE_TOKEN }}
 
@@ -66,7 +66,7 @@ jobs:
         with:
           token: ${{ secrets.OS_BOTIFY_TOKEN }}
           body: ${{ format('A preview of your ExpensifyHelp changes have been deployed to {0} ⚡️', steps.deploy.outputs.alias) }}
-      
+
       - name: Reindex google search
         if: ${{ github.event_name == 'push' }}
         run : |

.github/workflows/platformDeploy.yml

@@ -301,7 +301,7 @@ jobs:
         uses: ./.github/actions/composite/setupNode
 
       - name: Setup Cloudflare CLI
-        run: pip3 install cloudflare
+        run: pip3 install cloudflare==2.17.0
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -338,13 +338,13 @@ jobs:
 
       - name: Purge production Cloudflare cache
         if: ${{ fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
-        run: /home/runner/.local/bin/cli4 --delete hosts=["new.expensify.com"] /zones/:9ee042e6cfc7fd45e74aa7d2f78d617b/purge_cache
+        run: /home/runner/.local/bin/cli4 --verbose --delete hosts=["new.expensify.com"] /zones/:9ee042e6cfc7fd45e74aa7d2f78d617b/purge_cache
         env:
           CF_API_KEY: ${{ secrets.CLOUDFLARE_TOKEN }}
 
       - name: Purge staging Cloudflare cache
         if: ${{ !fromJSON(env.SHOULD_DEPLOY_PRODUCTION) }}
-        run: /home/runner/.local/bin/cli4 --delete hosts=["staging.new.expensify.com"] /zones/:9ee042e6cfc7fd45e74aa7d2f78d617b/purge_cache
+        run: /home/runner/.local/bin/cli4 --verbose --delete hosts=["staging.new.expensify.com"] /zones/:9ee042e6cfc7fd45e74aa7d2f78d617b/purge_cache
         env:
           CF_API_KEY: ${{ secrets.CLOUDFLARE_TOKEN }}
 

.storybook/webpack.config.js

@@ -25,7 +25,7 @@ module.exports = ({config}) => {
     config.resolve.alias = {
         'react-native-config': 'react-web-config',
         'react-native$': 'react-native-web',
-        '@react-native-community/netinfo': path.resolve(__dirname, '../__mocks__/@react-native-community/netinfo.js'),
+        '@react-native-community/netinfo': path.resolve(__dirname, '../__mocks__/@react-native-community/netinfo.ts'),
         '@react-navigation/native': path.resolve(__dirname, '../__mocks__/@react-navigation/native'),
 
         // Module alias support for storybook files, coping from `webpack.common.js`

README.md

@@ -16,6 +16,7 @@
 * [Debugging](#debugging)
 * [App Structure and Conventions](#app-structure-and-conventions)
 * [Philosophy](#Philosophy)
+* [Security](#Security)
 * [Internationalization](#Internationalization)
 * [Deploying](#deploying)
 
@@ -395,6 +396,117 @@ This application is built with the following principles.
 
 ----
 
+# Security
+Updated rules for managing members across all types of chats in New Expensify.
+
+- **Nobody can leave or be removed from something they were automatically added to. For example:**
+
+    - DM members can't leave or be removed from their DMs
+    - Members can't leave or be removed from their own workspace chats
+    - Admins can't leave or be removed from workspace chats
+    - Members can't leave or be removed from the #announce room
+    - Admins can't leave or be removed from #admins
+    - Domain members can't leave or be removed from their domain chat
+    - Report submitters can't leave or be removed from their reports 
+    - Report managers can't leave or be removed from their reports 
+    - Group owners cannot be removed from their groups - they need to transfer ownership first
+- **Excepting the above, admins can remove anyone. For example:**
+    - Group admins can remove other group admins, as well as group members
+    - Workspace admins can remove other workspace admins, as well as workspace members, and invited guests
+- **Excepting the above, members can remove guests. For example:**
+    - Workspace members can remove non-workspace guests.
+- **Excepting the above, anybody can remove themselves from any object**
+
+1. ### DM
+    |  | Member
+    | :---: | :---: 
+    | **Invite** | ❌ 
+    | **Remove** | ❌ 
+    | **Leave**  | ❌ 
+    | **Can be removed**  | ❌
+- DM always has two participants. None of the participant can leave or be removed from the DM. Also no additional member can be invited to the chat.
+
+2. ### Workspace
+    1. #### Workspace
+        |   |  Creator  |  Member(Employee/User) | Admin |  Auditor?
+        | :---: | :---:  |  :---: | :---: | :---: 
+        | **Invite** | ✅ |  ❌ |  ✅ | ❌
+        | **Remove** | ✅ |  ❌ |  ✅ | ❌
+        | **Leave**  | ❌ |  ✅ |  ❌ | ✅
+        | **Can be removed**  | ❌ |  ✅ | ✅ | ✅
+
+        - Creator can't leave or be removed from their own workspace
+        - Admins can't leave from the workspace
+        - Admins can remove other workspace admins, as well as workspace members, and invited guests
+        - Creator can remove other workspace admins, as well as workspace members, and invited guests
+        - Members and Auditors cannot invite or remove anyone from the workspace
+
+    2. #### Workspace #announce room
+        |   |  Member(Employee/User) | Admin |  Auditor?
+        | :---: | :---:  |  :---: | :---: 
+        | **Invite** | ❌ |  ❌ |  ❌
+        | **Remove** | ❌ |  ❌ |  ❌
+        | **Leave**  | ❌ |  ❌ |  ❌
+        | **Can be removed**  | ❌ |  ❌ |  ❌ |
+
+       - No one can leave or be removed from the #announce room
+
+    3. #### Workspace #admin room
+        |   |  Admin |
+        | :---: | :---: 
+        | **Invite** | ❌  
+        | **Remove** | ❌   
+        | **Leave**  | ❌ 
+        | **Can be removed**  | ❌
+
+        - Admins can't leave or be removed from #admins
+
+    4. #### Workspace rooms
+        |   |  Creator | Member | Guest(outside of the workspace)
+        | :---: | :---:  |  :---: | :---:
+        | **Invite** | ✅ | ✅ | ✅
+        | **Remove** | ✅ | ✅ | ❌
+        | **Leave**  | ✅ | ✅ | ✅
+        | **Can be removed**  | ✅ | ✅ | ✅
+
+        - Everyone can be removed/can leave from the room including creator
+        - Guests are not able to remove anyone from the room
+
+    4. #### Workspace chats
+        |   |  Admin | Member(default) | Member(invited)  
+        | :---: | :---:  |  :---:  |  :---:
+        | **Invite** | ✅ |  ✅ | ❌
+        | **Remove** | ✅ |  ✅ | ❌  
+        | **Leave**  | ❌ |  ❌  | ✅
+        | **Can be removed**  | ❌ | ❌ | ✅
+
+        - Admins are not able to leave/be removed from the workspace chat
+        - Default members(automatically invited) are not able to leave/be removed from the workspace chat
+        - Invited members(invited by members) are not able to invite or remove from the workspace chat
+        - Invited members(invited by members) are able to leave the workspace chat
+        - Default members and admins are able to remove invited members
+
+3. ### Domain chat
+    |   |  Member
+    | :---: | :---:  
+    | **Remove** | ❌ 
+    | **Leave**  | ❌ 
+    | **Can be removed**  | ❌ 
+
+- Domain members can't leave or be removed from their domain chat
+
+4. ### Reports
+    |   |  Submitter | Manager
+    | :---: | :---:  | :---:  
+    | **Remove** | ❌ | ❌
+    | **Leave**  | ❌ | ❌
+    | **Can be removed**  | ❌ | ❌
+
+- Report submitters can't leave or be removed from their reports (eg, if they are the report.accountID)
+- Report managers can't leave or be removed from their reports (eg, if they are the report.managerID)
+
+----
+
 # Internationalization
 This application is built with Internationalization (I18n) / Localization (L10n) support, so it's important to always
 localize the following types of data when presented to the user (even accessibility texts that are not rendered):

__mocks__/@react-native-camera-roll/camera-roll.ts

@@ -0,0 +1,15 @@
+import type {CameraRoll} from '@react-native-camera-roll/camera-roll';
+
+type CameraRollMock = {
+    CameraRoll: {
+        save: typeof CameraRoll.save;
+    };
+};
+
+const cameraRollMock: CameraRollMock = {
+    CameraRoll: {
+        save: jest.fn(),
+    },
+};
+
+export default cameraRollMock;

__mocks__/@react-native-clipboard/clipboard.js

@@ -0,0 +1,3 @@
+import MockClipboard from '@react-native-clipboard/clipboard/jest/clipboard-mock';
+
+export default MockClipboard;

__mocks__/@react-native-community/netinfo.ts

@@ -0,0 +1,31 @@
+import {NetInfoCellularGeneration, NetInfoStateType} from '@react-native-community/netinfo';
+import type {addEventListener, configure, fetch, NetInfoState, refresh, useNetInfo} from '@react-native-community/netinfo';
+
+const defaultState: NetInfoState = {
+    type: NetInfoStateType.cellular,
+    isConnected: true,
+    isInternetReachable: true,
+    details: {
+        isConnectionExpensive: true,
+        cellularGeneration: NetInfoCellularGeneration['3g'],
+        carrier: 'T-Mobile',
+    },
+};
+
+type NetInfoMock = {
+    configure: typeof configure;
+    fetch: typeof fetch;
+    refresh: typeof refresh;
+    addEventListener: typeof addEventListener;
+    useNetInfo: typeof useNetInfo;
+};
+
+const netInfoMock: NetInfoMock = {
+    configure: () => {},
+    fetch: () => Promise.resolve(defaultState),
+    refresh: () => Promise.resolve(defaultState),
+    addEventListener: () => () => {},
+    useNetInfo: () => defaultState,
+};
+
+export default netInfoMock;

__mocks__/fileMock.ts

@@ -0,0 +1,3 @@
+const fileMock = 'test-file-stub';
+
+export default fileMock;

__mocks__/fs/promises.ts

@@ -0,0 +1,8 @@
+import {fs} from 'memfs';
+import type {FsPromisesApi} from 'memfs/lib/node/types';
+
+type PromisesMock = FsPromisesApi;
+
+const promisesMock: PromisesMock = fs.promises;
+
+export default promisesMock;

__mocks__/react-native-blob-util.ts

@@ -0,0 +1,5 @@
+import type RNFetchBlob from 'react-native-blob-util';
+
+const ReactNativeBlobUtilMock: Partial<typeof RNFetchBlob> = {};
+
+export default ReactNativeBlobUtilMock;

__mocks__/react-native-config.ts

@@ -0,0 +1,8 @@
+import dotenv from 'dotenv';
+import path from 'path';
+
+type ReactNativeConfigMock = dotenv.DotenvParseOutput | undefined;
+
+const reactNativeConfigMock: ReactNativeConfigMock = dotenv.config({path: path.resolve('./.env.example')}).parsed;
+
+export default reactNativeConfigMock;

__mocks__/react-native-device-info.ts

@@ -0,0 +1,6 @@
+import type DeviceInfoModule from 'react-native-device-info';
+import MockDeviceInfo from 'react-native-device-info/jest/react-native-device-info-mock';
+
+const DeviceInfo: typeof DeviceInfoModule = MockDeviceInfo;
+
+export default DeviceInfo;

__mocks__/react-native-document-picker.js

@@ -0,0 +1,23 @@
+export default {
+    getConstants: jest.fn(),
+    pick: jest.fn(),
+    releaseSecureAccess: jest.fn(),
+    pickDirectory: jest.fn(),
+
+    types: Object.freeze({
+        allFiles: 'public.item',
+        audio: 'public.audio',
+        csv: 'public.comma-separated-values-text',
+        doc: 'com.microsoft.word.doc',
+        docx: 'org.openxmlformats.wordprocessingml.document',
+        images: 'public.image',
+        pdf: 'com.adobe.pdf',
+        plainText: 'public.plain-text',
+        ppt: 'com.microsoft.powerpoint.ppt',
+        pptx: 'org.openxmlformats.presentationml.presentation',
+        video: 'public.movie',
+        xls: 'com.microsoft.excel.xls',
+        xlsx: 'org.openxmlformats.spreadsheetml.sheet',
+        zip: 'public.zip-archive',
+    }),
+};

__mocks__/react-native-key-command.ts

@@ -0,0 +1,9 @@
+import type {addListener as _addListener, constants as _constants} from 'react-native-key-command';
+
+const registerKeyCommands = () => {};
+const unregisterKeyCommands = () => {};
+const constants: Partial<typeof _constants> = {};
+const eventEmitter = () => {};
+const addListener: typeof _addListener = () => () => {};
+
+export {addListener, constants, eventEmitter, registerKeyCommands, unregisterKeyCommands};

__mocks__/react-native-localize.ts

@@ -0,0 +1,3 @@
+import mockRNLocalize from 'react-native-localize/mock';
+
+module.exports = mockRNLocalize;