Merge latest upstream/main into KJ21-ENG/98233-august-product-marketing-window

Author: KJ21-ENG

src/hooks/useParticipantSubmission.ts

@@ -113,7 +113,6 @@ function useParticipantSubmission({
     const isActivePolicyRequest =
         iouType === CONST.IOU.TYPE.CREATE &&
         isGroupPolicy(activePolicy) &&
-        activePolicy?.isPolicyExpenseChatEnabled &&
         !shouldRestrictUserBillableActions(activePolicy, ownerBillingGracePeriodEnd, userBillingGracePeriodEnds, amountOwed, currentUserPersonalDetails.accountID);
 
     const dataRef = useRef({

src/hooks/useReceiptScanDrop.tsx

@@ -86,7 +86,6 @@ function useReceiptScanDrop() {
 
         if (
             isGroupPolicy(activePolicy) &&
-            activePolicy?.isPolicyExpenseChatEnabled &&
             !shouldRestrictUserBillableActions(activePolicy, ownerBillingGracePeriodEnd, userBillingGracePeriodEnds, amountOwed, currentUserPersonalDetails.accountID)
         ) {
             const shouldAutoReport = !!activePolicy?.autoReporting || !!personalPolicy?.autoReporting;

src/libs/ExportOnyxState/common.ts

@@ -57,6 +57,26 @@ const ONYX_KEY_EXPORT_RULES: Record<string, ExportRule> = {
         allowList: ['email', 'accountID', 'loading', 'creationDate', 'errors'],
         maskList: [],
     },
+    // delegateAccessData holds live OldDot credentials (auth tokens, an auto-generated login and its
+    // password). A rule masks them in both toggle states; maskFragileData only runs when masking is on and
+    // would let a credential field pass through unless its exact name is in keysToMask.
+    [ONYXKEYS.HYBRID_APP]: {
+        allowList: [
+            'useNewDotSignInPage',
+            'readyToShowAuthScreens',
+            'isSingleNewDotEntry',
+            'loggedOutFromOldDot',
+            'shouldRemoveDelegatedAccess',
+            'closingReactNativeApp',
+            'shouldUseNewPartnerName',
+            'signingInWithSAML',
+            'pressedTryNewExpensify',
+            'transitionStartTimestamp',
+            'isDelegateAccess',
+            'oldDotCurrentAccountID',
+        ],
+        maskList: ['oldDotCurrentUserEmail', 'oldDotCurrentAuthToken', 'oldDotCurrentEncryptedAuthToken', 'oldDotAutoGeneratedLogin', 'oldDotAutoGeneratedPassword'],
+    },
     [ONYXKEYS.CREDENTIALS]: {
         allowList: ['login', 'accountID'],
         maskList: [],
@@ -388,7 +408,6 @@ const onyxKeysToMaskFragileData = new Set<string>([
     ONYXKEYS.FREQUENTLY_USED_EMOJIS,
     ONYXKEYS.FUND_LIST,
     ONYXKEYS.GPS_DRAFT_DETAILS,
-    ONYXKEYS.HYBRID_APP,
     ONYXKEYS.IMPORTED_SPREADSHEET,
     ONYXKEYS.IMPORTED_SPREADSHEET_MEMBER_DATA,
     ONYXKEYS.INITIATING_BANK_ACCOUNT_UNLOCK,
@@ -490,6 +509,7 @@ const keysToMask = new Set([
     'addressName',
     'addressStreet',
     'addressZipCode',
+    'authToken',
     'avatar',
     'avatarURL',
     'bank',
@@ -501,6 +521,7 @@ const keysToMask = new Set([
     'description',
     'displayName',
     'edits',
+    'encryptedAuthToken',
     'firstName',
     'lastMessageHtml',
     'lastMessageText',
@@ -524,6 +545,7 @@ const keysToMask = new Set([
     'source',
     'state',
     'street',
+    'supportAuthToken',
     'title',
     'validateCode',
     'zip',

src/libs/shouldUseDefaultExpensePolicy.ts

@@ -1,6 +1,6 @@
 import type {IOUType} from '@src/CONST';
 import CONST from '@src/CONST';
-import type {BillingGraceEndPeriod, OnyxInputOrEntry, Policy} from '@src/types/onyx';
+import type {BillingGraceEndPeriod, Policy} from '@src/types/onyx';
 
 import type {OnyxCollection, OnyxEntry} from 'react-native-onyx';
 
@@ -9,18 +9,17 @@ import {shouldRestrictUserBillableActions} from './SubscriptionUtils';
 
 function shouldUseDefaultExpensePolicy(
     iouType: IOUType,
-    defaultExpensePolicy: OnyxInputOrEntry<Policy>,
+    defaultExpensePolicy: OnyxEntry<Policy> | null,
     amountOwed: OnyxEntry<number>,
     userBillingGracePeriodEnds: OnyxCollection<BillingGraceEndPeriod>,
     ownerBillingGracePeriodEnd: OnyxEntry<number>,
     currentUserAccountID: number,
 ) {
-    return (
-        iouType === CONST.IOU.TYPE.CREATE &&
-        isGroupPolicy(defaultExpensePolicy) &&
-        defaultExpensePolicy?.isPolicyExpenseChatEnabled &&
-        !shouldRestrictUserBillableActions(defaultExpensePolicy, ownerBillingGracePeriodEnd, userBillingGracePeriodEnds, amountOwed, currentUserAccountID)
-    );
+    if (iouType !== CONST.IOU.TYPE.CREATE || !defaultExpensePolicy || !isGroupPolicy(defaultExpensePolicy)) {
+        return false;
+    }
+
+    return !shouldRestrictUserBillableActions(defaultExpensePolicy, ownerBillingGracePeriodEnd, userBillingGracePeriodEnds, amountOwed, currentUserAccountID);
 }
 
 export default shouldUseDefaultExpensePolicy;

tests/actions/IOU/MoneyRequestTest.ts

@@ -1790,10 +1790,10 @@ describe('MoneyRequest', () => {
             expect(shouldUseDefaultExpensePolicy(CONST.IOU.TYPE.CREATE, policy, 0, undefined, undefined, currentUserAccountID)).toBe(false);
         });
 
-        it('should return false when isPolicyExpenseChatEnabled is false', () => {
+        it('should return false when policy is not a group policy', () => {
             const policy = {
                 ...fakePolicy,
-                type: CONST.POLICY.TYPE.TEAM,
+                type: CONST.POLICY.TYPE.PERSONAL,
                 isPolicyExpenseChatEnabled: false,
             };
 

tests/unit/ExportOnyxStateTest.ts

@@ -399,6 +399,36 @@ describe('maskOnyxState', () => {
             expect(result.lastMessageHtml).not.toBe(input.lastMessageHtml);
         }
     });
+
+    it.each([
+        ['masking enabled', true],
+        ['masking disabled', false],
+    ])('should mask delegate credentials held under hybridApp with %s', (_label, isMaskingEnabled) => {
+        // Given a hybridApp key holding live OldDot delegate credentials in delegateAccessData
+        const credentialValues = ['live-olddot-auth-token', 'live-olddot-encrypted-token', 'auto-generated-login', 'auto-generated-password', 'delegate@example.com'];
+        const input = {
+            session: mockSession,
+            [ONYXKEYS.HYBRID_APP]: {
+                isSingleNewDotEntry: true,
+                delegateAccessData: {
+                    isDelegateAccess: true,
+                    oldDotCurrentAuthToken: 'live-olddot-auth-token',
+                    oldDotCurrentEncryptedAuthToken: 'live-olddot-encrypted-token',
+                    oldDotAutoGeneratedLogin: 'auto-generated-login',
+                    oldDotAutoGeneratedPassword: 'auto-generated-password',
+                    oldDotCurrentUserEmail: 'delegate@example.com',
+                },
+            },
+        };
+
+        // When the state is exported (the export rule applies regardless of the masking toggle)
+        const serialized = JSON.stringify(maskOnyxState(input, isMaskingEnabled));
+
+        // Then none of the credential values may appear verbatim anywhere in the export
+        for (const credentialValue of credentialValues) {
+            expect(serialized).not.toContain(credentialValue);
+        }
+    });
 });
 
 // These tests check that every Onyx key is sorted into a bucket and that no key lands in two of them.
@@ -457,6 +487,7 @@ describe('Onyx key export coverage', () => {
             ONYXKEYS.ACCOUNT,
             ONYXKEYS.PRESERVED_USER_SESSION,
             ONYXKEYS.PRESERVED_ACCOUNT,
+            ONYXKEYS.HYBRID_APP,
             ONYXKEYS.PERSONAL_DETAILS_LIST,
             ONYXKEYS.PRIVATE_PERSONAL_DETAILS,
             ONYXKEYS.LOGINS,
@@ -488,6 +519,17 @@ describe('Onyx key export coverage', () => {
         }
     });
 
+    it('session token field names must be in keysToMask so the maskFragileData fallback can never pass them through', () => {
+        // maskFragileData exports any field name it does not recognize verbatim. Keys that reach it and hold a
+        // session-token field rely on keysToMask to catch the secret, so these generic field names must stay
+        // listed as a backstop even though the keys that carry them today have their own export rules.
+        const credentialFieldNames = ['authToken', 'encryptedAuthToken', 'supportAuthToken'];
+
+        for (const fieldName of credentialFieldNames) {
+            expect(keysToMask.has(fieldName)).toBe(true);
+        }
+    });
+
     it('no key should appear in multiple buckets', () => {
         const rulesKeys = Object.keys(ONYX_KEY_EXPORT_RULES);
         const removeKeys = new Set<string>(Array.from(onyxKeysToRemove).filter((key): key is Extract<typeof key, string> => typeof key === 'string'));

tests/unit/shouldUseDefaultExpensePolicyTest.ts

@@ -49,8 +49,8 @@ describe('shouldUseDefaultExpensePolicy', () => {
         expect(shouldUseDefaultExpensePolicy(CONST.IOU.TYPE.CREATE, policy, undefined, undefined, undefined, CONST.DEFAULT_NUMBER_ID)).toBeFalsy();
     });
 
-    it('returns false when isPolicyExpenseChatEnabled is false', () => {
-        const policy = makePaidGroupPolicy({isPolicyExpenseChatEnabled: false});
+    it('returns false when defaultExpensePolicy is not a group policy', () => {
+        const policy = makePaidGroupPolicy({type: CONST.POLICY.TYPE.PERSONAL, isPolicyExpenseChatEnabled: false});
         expect(shouldUseDefaultExpensePolicy(CONST.IOU.TYPE.CREATE, policy, undefined, undefined, undefined, CONST.DEFAULT_NUMBER_ID)).toBeFalsy();
     });