Whisper to admin and auditor when their role is changed to user

[garrettmknight]

If you haven’t already, check out our contributing guidelines for onboarding and email [email protected] to request to join our Slack channel!

---

Version Number: N/A
Reproducible in staging?: N
Reproducible in production?: N
Expensify/Expensify Issue URL:
Issue reported by: @JmillsExpensify
Slack conversation: https://expensify.slack.com/archives/C06ML6X0W9L/p1727169064223989?thread_ts=1726494273.889699&cid=C06ML6X0W9L

Problem

When we change a user's role from Admin or Auditor to user we remove them from all workspace chats they had access to, except for their own. Since they've been removed from the #admins room for the workspace, they won't have any context on their role change or why they no longer have access to the chats they once did.

Solution

Similar to how we handle approvers who are removed from workspace chats (PR for that here), we'll send a whisper to admins and auditors in their workspace chat when their role is updated and access to other workspace chats is removed.

Admin copy for the whisper:

[Admin] updated your role in [Workspace Name] from admin to user. You have been removed from all submitter workspace chats except for your own.

Auditor copy for the whisper:

[Admin] updated your role in [Workspace Name] from auditor to user. You have been removed from all submitter workspace chats except for your own.

Platforms:

All

Screenshots/Videos

Add any screenshot/video evidence

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @bfitzexpensify (NewFeature), see https://stackoverflowteams.com/c/expensify/questions/14418#:~:text=BugZero%20process%20steps%20for%20feature%20requests for more details. Please add this Feature request to a GH project, as outlined in the SO.

[bfitzexpensify]

Remains a hot pick, waiting to be picked up

[bfitzexpensify]

Remains a hot pick, waiting to be picked up

[bfitzexpensify]

Same update - remains a hot pick, waiting to be picked up. Weekly still seems right to me

[bfitzexpensify]

Remains a hot pick, waiting to be picked up.

[blimpich]

Picking up. Initial investigation shows this is where we update a modified user's role in Web. Command is UpdateWorkspaceMembersRole. Will continue looking into this tomorrow. Questions I need to answer:

• do we have the ability to add whisper messages from web? From auth?
• would it violate 1:1:1 to add code in Web that created these whispers?

[blimpich]

To answer my own questions, we have the ability to add whisper messages both from Auth and Web. But, since UpdateWorkspaceMembersRole is not 1:1:1 (more so than most commands) its not possible to do this in Auth right now. And while its feasible to do this from Web it would require loading the downgraded User's entire list of chat reports, which makes this flow even more in violation of our 1:1:1 principle.

Maybe there is another engineer who can see something that I can't, but might need to take a raincheck for this issue. Going to unassign this from myself for now since I can't prioritize it given how much work it would be to make it comply with 1:1:1.

[bfitzexpensify]

Remains a hot pick and available for the taking

[bfitzexpensify]

Still waiting on a volunteer, remains low priority

[bfitzexpensify]

Same update, waiting on a volunteer

[tgolen]

The UpdateWorkspaceMembersRole command uses PolicyAPI::mergeEmployees() under the hood. I think it would be very simple to make UpdateWorkspaceMembersRole call straight to Auth (adding a new UpdateWorkspaceMembersRole command to Auth), and having it use the policy merge stuff in Auth that has already been written and in use for quite some time. This would refactor the command to be 1:1:1.

@flodnv @iwiznia do you agree? If so, I can get it moved and implement this whisper I don't think it should take too much work.

[iwiznia]

Don't know the full details, but I think as long as we are only changing the role it should be fine. If we are inviting/uninviting then there's probably more to it.

[flodnv]

+1, though it would be good to double check. For example, it seems like this logic would apply if changing the role to admin. Perhaps there's more.

[bfitzexpensify]

Remains a hot pick - sounds like perhaps we have an idea of a solution @tgolen?

[tgolen]

Yeah, I can take this and begin working on it.