Merge pull request Expensify#73120 from bernhardoj/fix/72465-only-allow-reject-for-report-manager

Only allow report manager to reject expense

Author: lakchote

src/libs/ReportUtils.ts

@@ -242,7 +242,6 @@ import {
     wasActionTakenByCurrentUser,
 } from './ReportActionsUtils';
 import type {LastVisibleMessage} from './ReportActionsUtils';
-import {getSession} from './SessionUtils';
 import {shouldRestrictUserBillableActions} from './SubscriptionUtils';
 import {
     getAttendees,
@@ -11837,12 +11836,11 @@ function canRejectReportAction(currentUserLogin: string, report: Report, policy?
 
     const isReportApprover = isApproverUtils(policy, currentUserLogin);
     const isReportBeingProcessed = isProcessingReport(report);
-    const isReportPayer = isPayer(getSession(), report, false, policy);
     const isIOU = isIOUReport(report);
     const isInvoice = isInvoiceReport(report);
     const isCurrentUserManager = report?.managerID === currentUserAccountID;
 
-    const userCanReject = (isReportApprover && isCurrentUserManager) || isReportPayer;
+    const userCanReject = isReportApprover && isCurrentUserManager;
 
     if (!userCanReject) {
         return false; // must be approver or payer

tests/unit/ReportUtilsTest.ts

@@ -35,6 +35,7 @@ import {
     canHoldUnholdReportAction,
     canJoinChat,
     canLeaveChat,
+    canRejectReportAction,
     canSeeDefaultRoom,
     canUserPerformWriteAction,
     excludeParticipantsForDisplay,
@@ -8264,4 +8265,24 @@ describe('ReportUtils', () => {
             expect(actorAccountID).toEqual(123);
         });
     });
+
+    describe('canRejectReportAction', () => {
+        it('should return false if the user is not the report manager', async () => {
+            const approver = 'approver@gmail.com';
+            const expenseReport: Report = {
+                ...createRandomReport(0),
+                type: CONST.REPORT.TYPE.EXPENSE,
+                managerID: 1,
+            };
+            const reportPolicy: Policy = {
+                ...createRandomPolicy(0),
+                approver,
+            };
+            await Onyx.merge(ONYXKEYS.SESSION, {
+                accountID: 2,
+            });
+            await Onyx.merge(ONYXKEYS.BETAS, [CONST.BETAS.NEWDOT_REJECT]);
+            expect(canRejectReportAction(approver, expenseReport, reportPolicy)).toBe(false);
+        });
+    });
 });