[$250] Expense - Time expense can be submitted to workspace with disabled Time tracking

[jponikarchuk]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.11-53
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #78137
Email or phone of affected tester (no customers): applausetester+s2d22d@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.1 / Chrome
App Component: Money Requests

Action Performed:

Scenario 1:

Precondition:

• Log in with Expensifail account.
• Create two workspaces - A and B.
• Time tracking is enabled in workspace A and disabled in workspace B.

1. Go to staging.new.expensify.com
2. Create an empty report in workspace A and B.
3. Open FAB > Create expense > Time.
4. Enter amount > Next.
5. On confirm page, click Report.
6. Select report from workspace B and click Create expense.

Scenario 2:

Precondition:

• Log in with Expensifail account.
• Create two workspaces - A and B.
• Time tracking is enabled in workspace A and disabled in workspace B.

1. Go to staging.new.expensify.com
2. Go to workspace chat A.
3. Create a time expense.
4. Open the time expense.
5. Click Report > Remove from report.
6. Go to self DM.
7. Open the time expense.
8. Click on the report header.
9. Click Submit it to someone.
10. Select workspace B.
11. Click Create expense.

Expected Result:

Scenario 1: Report from workspace B should be filtered out from report list because Time tracking is disabled in workspace B.
Scenario 2: Workspace B (and also contacts) should not appear in recipient list because Time tracking is disabled in workspace B.

Actual Result:

Scenario 1: Report from workspace B is shown in report list when Time tracking is disabled in workspace B.
Scenario 2: Workspace B (and also contacts) appear in recipient list when Time tracking is disabled in workspace B and p2p expense.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Bug_1.mp4

Bug_2.mp4

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @Krishna2323

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022029611357441470478
• Upwork Job ID: 2029611357441470478
• Last Price Increase: 2026-03-05

[nyomanjyotisa]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Expense - Time expense can be submitted to workspace with disabled Time tracking

What is the root cause of that problem?

When filtering reports for time expenses in IOURequestEditReportCommon, we don't check if the policy has time tracking enabled.

App/src/pages/iou/request/step/IOURequestEditReportCommon.tsx

Lines 133 to 147 in 148e390

	.filter((report) => {
	const policy = allPolicies?.[`${ONYXKEYS.COLLECTION.POLICY}${report.policyID}`];
	if (isReportIneligibleForMoveExpenses(report, policy)) {
	return false;
	}
	if (canAddTransaction(report, undefined, true)) {
	return true;
	}
	const isReportPolicyAdmin = isPolicyAdmin(policy);
	const isReportManager = report.managerID === currentUserPersonalDetails.accountID;
	return isReportPolicyAdmin || isReportManager;
	})

When filtering recipients in isValidReport, we don't check if the policy has time tracking enabled for time expenses.

App/src/libs/OptionsListUtils/index.ts

Lines 2039 to 2044 in 148e390

	if (action === CONST.IOU.ACTION.CATEGORIZE) {
	if (!policy?.areCategoriesEnabled) {
	return false;
	}
	}
	return true;

What changes do you think we should make in order to solve the problem?

Test Branch

Add isTimeRequest prop to IOURequestEditReportCommon and filter reports based on time tracking enabled when it's a time expense.

    isPerDiemRequest: boolean;
    isTimeRequest?: boolean;

App/src/pages/iou/request/step/IOURequestEditReportCommon.tsx

Line 57 in 148e390

isPerDiemRequest: boolean;

Add time tracking check in the report filtering logic:

            .filter((report) => {
                const policy = allPolicies?.[`${ONYXKEYS.COLLECTION.POLICY}${report.policyID}`];

                if (isReportIneligibleForMoveExpenses(report, policy)) {
                    return false;
                }

                if (isTimeRequest && !isTimeTrackingEnabled(policy)) {
                    return false;
                }

                if (canAddTransaction(report, undefined, true)) {
                    return true;
                }

                const isReportPolicyAdmin = isPolicyAdmin(policy);
                const isReportManager = report.managerID === currentUserPersonalDetails.accountID;
                return isReportPolicyAdmin || isReportManager;
            })

App/src/pages/iou/request/step/IOURequestEditReportCommon.tsx

Lines 133 to 147 in 148e390

	.filter((report) => {
	const policy = allPolicies?.[`${ONYXKEYS.COLLECTION.POLICY}${report.policyID}`];
	if (isReportIneligibleForMoveExpenses(report, policy)) {
	return false;
	}
	if (canAddTransaction(report, undefined, true)) {
	return true;
	}
	const isReportPolicyAdmin = isPolicyAdmin(policy);
	const isReportManager = report.managerID === currentUserPersonalDetails.accountID;
	return isReportPolicyAdmin || isReportManager;
	})

Pass isTimeRequest from IOURequestStepReport:

                isPerDiemRequest={transaction ? isPerDiemRequest(transaction) : false}
                isTimeRequest={transaction ? isTimeRequest(transaction) : false}

App/src/pages/iou/request/step/IOURequestStepReport.tsx

Line 278 in 148e390

isPerDiemRequest={transaction ? isPerDiemRequest(transaction) : false}

Add isTimeRequest to GetValidReportsConfig type:

    isPerDiemRequest?: boolean;
    isTimeRequest?: boolean;

App/src/libs/OptionsListUtils/types.ts

Line 153 in 148e390

isPerDiemRequest?: boolean;

Add isTimeRequest to IsValidReportsConfig type:

    | 'isRestrictedToPreferredPolicy'
    | 'preferredPolicyID'
    | 'shouldAlwaysIncludeDM'
    | 'isTimeRequest'

App/src/libs/OptionsListUtils/types.ts

Lines 163 to 185 in 148e390

	type IsValidReportsConfig = Pick<
	GetValidReportsConfig,
	| 'betas'
	| 'includeMultipleParticipantReports'
	| 'includeOwnedWorkspaceChats'
	| 'includeThreads'
	| 'includeTasks'
	| 'includeMoneyRequests'
	| 'includeReadOnly'
	| 'transactionViolations'
	| 'includeSelfDM'
	| 'includeInvoiceRooms'
	| 'action'
	| 'includeP2P'
	| 'includeDomainEmail'
	| 'loginsToExclude'
	| 'excludeNonAdminWorkspaces'
	| 'isRestrictedToPreferredPolicy'
	| 'preferredPolicyID'
	| 'shouldAlwaysIncludeDM'
	> & {
	currentUserAccountID: number;
	};

Add time tracking check in isValidReport:

    if (action === CONST.IOU.ACTION.CATEGORIZE) {
        if (!policy?.areCategoriesEnabled) {
            return false;
        }
    }

    if (config.isTimeRequest && isPolicyExpenseChat && !isTimeTrackingEnabled(policy)) {
        return false;
    }

    return true;

App/src/libs/OptionsListUtils/index.ts

Lines 2039 to 2044 in 148e390

	if (action === CONST.IOU.ACTION.CATEGORIZE) {
	if (!policy?.areCategoriesEnabled) {
	return false;
	}
	}
	return true;

Pass isTimeRequest in MoneyRequestParticipantsSelector config. Determine if it's a time expense from the transaction and add it to the config:

    const getValidOptionsConfig = useMemo(
        () => ({
            selectedOptions: participants as Participant[],
            excludeLogins: CONST.EXPENSIFY_EMAILS_OBJECT,
            includeOwnedWorkspaceChats: iouType === CONST.IOU.TYPE.SUBMIT || iouType === CONST.IOU.TYPE.CREATE || iouType === CONST.IOU.TYPE.SPLIT || iouType === CONST.IOU.TYPE.TRACK,
            excludeNonAdminWorkspaces: action === CONST.IOU.ACTION.SHARE,
            includeP2P: !isCategorizeOrShareAction && !isPerDiemRequest && !isCorporateCardTransaction && !isTimeRequest,
            includeInvoiceRooms: iouType === CONST.IOU.TYPE.INVOICE,
            action,
            shouldSeparateSelfDMChat: iouType !== CONST.IOU.TYPE.INVOICE,
            shouldSeparateWorkspaceChat: true,
            includeSelfDM: !isMovingTransactionFromTrackExpense(action) && iouType !== CONST.IOU.TYPE.INVOICE,
            canShowManagerMcTest,
            isPerDiemRequest,
            isTimeRequest,
            showRBR: false,
            preferPolicyExpenseChat: isPaidGroupPolicy,
            preferRecentExpenseReports: action === CONST.IOU.ACTION.CREATE,
            isRestrictedToPreferredPolicy,
            preferredPolicyID,
        }),
        [
            participants,
            iouType,
            action,
            isCategorizeOrShareAction,
            isPerDiemRequest,
            isCorporateCardTransaction,
            canShowManagerMcTest,
            isPaidGroupPolicy,
            isRestrictedToPreferredPolicy,
            preferredPolicyID,
            isTimeRequest,
        ],
    );

App/src/pages/iou/request/MoneyRequestParticipantsSelector.tsx

Lines 176 to 208 in 148e390

	const getValidOptionsConfig = useMemo(
	() => ({
	selectedOptions: participants as Participant[],
	excludeLogins: CONST.EXPENSIFY_EMAILS_OBJECT,
	includeOwnedWorkspaceChats: iouType === CONST.IOU.TYPE.SUBMIT || iouType === CONST.IOU.TYPE.CREATE || iouType === CONST.IOU.TYPE.SPLIT || iouType === CONST.IOU.TYPE.TRACK,
	excludeNonAdminWorkspaces: action === CONST.IOU.ACTION.SHARE,
	includeP2P: !isCategorizeOrShareAction && !isPerDiemRequest && !isCorporateCardTransaction,
	includeInvoiceRooms: iouType === CONST.IOU.TYPE.INVOICE,
	action,
	shouldSeparateSelfDMChat: iouType !== CONST.IOU.TYPE.INVOICE,
	shouldSeparateWorkspaceChat: true,
	includeSelfDM: !isMovingTransactionFromTrackExpense(action) && iouType !== CONST.IOU.TYPE.INVOICE,
	canShowManagerMcTest,
	isPerDiemRequest,
	showRBR: false,
	preferPolicyExpenseChat: isPaidGroupPolicy,
	preferRecentExpenseReports: action === CONST.IOU.ACTION.CREATE,
	isRestrictedToPreferredPolicy,
	preferredPolicyID,
	}),
	[
	participants,
	iouType,
	action,
	isCategorizeOrShareAction,
	isPerDiemRequest,
	isCorporateCardTransaction,
	canShowManagerMcTest,
	isPaidGroupPolicy,
	isRestrictedToPreferredPolicy,
	preferredPolicyID,
	],
	);

What alternative solutions did you explore? (Optional)

None

[melvin-bot]

Triggered auto assignment to @joekaufmanexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[MelvinBot]

🔍 Issue Analysis

Please re-state the problem that we are trying to solve in this issue.

Time expenses can be submitted to workspaces that have time tracking disabled. This occurs in two flows: (1) when selecting a report for a time expense, reports from workspaces with disabled time tracking are not filtered out, and (2) when selecting a recipient/workspace for a time expense, workspaces with disabled time tracking still appear in the list.

What is the root cause of that problem?

The per diem expense flow has comprehensive filtering at every layer to prevent submission to workspaces with per diem disabled, but the time expense flow has no equivalent filtering at any layer. Specifically:

Gap 1 – Report Selection (IOURequestEditReportCommon): The component accepts isPerDiemRequest as a prop and validates per diem moves via checkIfPerDiemTransactionsCanBeMoved / validatePerDiemMove, but has no isTimeRequest prop and no time tracking check. IOURequestStepReport passes isPerDiemRequest but not any time request flag.

• IOURequestEditReportCommon.tsx Props (line 36-50) – isPerDiemRequest exists, isTimeRequest is absent
• IOURequestEditReportCommon.tsx filter logic (line 128-138) – no time tracking check
• IOURequestStepReport.tsx (line 279-293) – passes isPerDiemRequest but not isTimeRequest

Gap 2 – Recipient/Participant Selection (OptionsListUtils + MoneyRequestParticipantsSelector): The prepareReportOptionsForDisplay function filters workspaces for per diem via canSubmitPerDiemExpenseFromWorkspace, but has no equivalent check for isTimeTrackingEnabled. MoneyRequestParticipantsSelector passes isPerDiemRequest in the config and uses it to exclude P2P recipients, but does not handle isTimeRequest at all.

• OptionsListUtils/index.ts (line 2301-2304) – per diem filtering exists, time filtering absent
• MoneyRequestParticipantsSelector.tsx (line 175-207) – isPerDiemRequest used, isTimeRequest missing
• OptionsListUtils/types.ts (line 168) – isPerDiemRequest in type, no isTimeRequest

What changes do you think we should make in order to solve the problem?

Mirror the per diem filtering pattern for time requests at both layers:

Scenario 1 fix (Report Selection):

1. Add isTimeRequest prop to IOURequestEditReportCommon alongside isPerDiemRequest
2. In the report filter logic, check if (isTimeRequest && !isTimeTrackingEnabled(policy)) return false
3. Pass isTimeRequest from IOURequestStepReport using the existing TransactionUtils.isTimeRequest(transaction) utility

Scenario 2 fix (Recipient/Participant Selection):

1. Add isTimeRequest to GetValidReportsConfig and IsValidReportsConfig types in OptionsListUtils/types.ts
2. In prepareReportOptionsForDisplay (OptionsListUtils), add: if (!isTimeTrackingEnabled(policy) && isTimeRequest) { continue; } alongside the existing per diem check
3. In MoneyRequestParticipantsSelector, pass isTimeRequest in the config and also set includeP2P: false for time requests (time tracking is a workspace-only feature, same as per diem)
4. Pass isTimeRequest from IOURequestStepParticipants to MoneyRequestParticipantsSelector

The existing utility functions PolicyUtils.isTimeTrackingEnabled(policy) and TransactionUtils.isTimeRequest(transaction) already exist and can be reused directly.

What alternative solutions did you explore? (Optional)

N/A — the pattern is well-established by the per diem flow. The fix follows the same approach to maintain consistency.

---

Note: The existing proposal from nyomanjyotisa correctly identifies the root cause and proposes a valid solution. One consideration their proposal should address: whether includeP2P should also be set to false for time requests in MoneyRequestParticipantsSelector (matching the per diem behavior), since time tracking is a workspace-level feature and P2P recipients should likely be excluded.

---

Next Steps for Contributor+ team: Reply with @MelvinBot implement this to create a draft PR, or @MelvinBot <your feedback> to refine this analysis.