Expense policy - Protected pdf file is allowed and password modal appears repeatedly

[mitarachim]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.65-0
Reproducible in staging?: Yes
Reproducible in production?: N/A - new feature, doesn't exist in prod
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #87684
Email or phone of affected tester (no customers): applausetester+sjdiosndjsois2jd@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.2 / Chrome
App Component: Workspace Settings

Action Performed:

Precondition:

• Log in with Expensifail account.

1. Go to staging.new.expensify.com
2. Go to workspace settings > Overview.
3. Scroll down to Expense policy.
4. Click Choose file.
5. Upload protected pdf file (attached below).
6. Enter password [Test12345].
7. Go to Members tab.
8. Go back to Overview tab.
9. Click Cancel on password modal.

Expected Result:

Protected pdf file should not be allowed.

Actual Result:

Protected pdf file is allowed.
Password modal appears after changing tab and back to Overview. It appears repeatedly after tapping Cancel.

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Bug7142472_1777600040918!Password_protected_Test12345.pdf

Bug7142472_1777600040908.8.mp4

View all open jobs on GitHub

[melvin-bot]

You have been assigned to this deploy blocker because you recently merged this PR: #87684

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[OSBotify]

Investigation Summary

Classification: Frontend bug
Causing PR: #87684 - "Add workspace rules PDF document upload, view, and management UI" by @ishpaul777 (High confidence)
Related Issues: None

Recommendation: REVERT

PR #87684 introduced the entire "Expense policy PDF document" feature in WorkspaceOverviewPage.tsx. The bug reproduces only on staging (it's a new feature not in production), and the fix requires changes to this App PR. Reverting it cleanly removes the broken functionality.

Assigned: @ishpaul777 (PR author), @abzokhattab (approving reviewer), @lakchote (approving reviewer)
Labels: DeployBlockerCash kept (frontend/App PR is the cause). DeployBlocker removed — no backend changes are required to fix this issue; the root cause is entirely in the App PR.

Detailed Analysis

Evidence

• The issue is "Reproducible in staging, N/A in production — new feature, doesn't exist in prod", which aligns perfectly with PR [Payment due @abzokhattab] Add workspace rules PDF document upload, view, and management UI #87684 being a new feature merged into staging on 2026-04-28.
• PR [Payment due @abzokhattab] Add workspace rules PDF document upload, view, and management UI #87684 is explicitly listed in the StagingDeployCash checklist (issue Deploy Checklist: New Expensify 2026-04-30 #89315) for release 9.3.65-0, which matches the version number in the bug report.
• The melvin-bot already identified PR [Payment due @abzokhattab] Add workspace rules PDF document upload, view, and management UI #87684 as the cause.
• The bug occurs in the "Workspace Settings > Overview > Expense policy" section — exactly the area that PR [Payment due @abzokhattab] Add workspace rules PDF document upload, view, and management UI #87684 added.
• Two specific bugs are reported:
  1. Protected PDFs are accepted (not blocked) — updatePolicyRulesDocument in src/libs/actions/Policy/Policy.ts only validates that the uploaded file is a PDF (by type/extension) but performs no check for password protection. There is no pre-upload validation that rejects encrypted/password-protected PDFs.
  2. After navigating away and back, a password modal appears repeatedly even after Cancel — the PDFThumbnail component in WorkspaceOverviewPage.tsx (line 865) is rendered with no onPassword callback, but the component supports an onPassword prop to handle password-protected PDFs. Without handling this callback, there is no mechanism to reject the upload or clear the stored rulesDocumentURL when the PDF requires a password, causing the password prompt to be triggered again every time the thumbnail renders.

Verification

• Affected files: src/pages/workspace/WorkspaceOverviewPage.tsx, src/libs/actions/Policy/Policy.ts
• PR [Payment due @abzokhattab] Add workspace rules PDF document upload, view, and management UI #87684 directly adds and modifies both of these files:
  • src/pages/workspace/WorkspaceOverviewPage.tsx (+154/-17 lines)
  • src/libs/actions/Policy/Policy.ts (+102/-1 lines)

Root Cause

updatePolicyRulesDocument accepts any valid PDF without checking for password protection. Once a password-protected PDF is stored as policy.rulesDocumentURL, the PDFThumbnail component rendered on the Overview page encounters the password requirement but has no onPassword handler registered — causing it to re-trigger the password prompt every time the component mounts (e.g., after switching tabs). Clicking Cancel does not clear the stored URL, so the modal reappears in a loop.