Betree
commented
1 year ago I agree with this one, I would however relax the rule to allow host admins to invite people to submit expenses for the collectives they're hosting.
Open alanna opened 2 years ago
Betree
commented
1 year ago I agree with this one, I would however relax the rule to allow host admins to invite people to submit expenses for the collectives they're hosting.
Betree
commented
1 year ago I've looked into this, but it looks like there are many legit cases of non-admins inviting people to submit expenses. I've used this query which only looks at paid expenses:
select uc.slug as inviter, 'https://opencollective.com/' || c.slug || '/expenses/' || e.id as expense
from "Expenses" e
INNER JOIN "Collectives" c ON c.id = e."CollectiveId"
LEFT JOIN "Collectives" parent ON c."ParentCollectiveId" = parent.id
INNER JOIN "Collectives" uc ON uc.id = (e.data #>> '{invitedByCollectiveId}')::integer
LEFT JOIN "Members" m
ON m."MemberCollectiveId" = uc.id
AND (m.role = 'ADMIN' OR m.role = 'MEMBER')
AND (m."CollectiveId" = c.id OR m."CollectiveId" = c."HostCollectiveId" OR m."CollectiveId" = parent.id)
WHERE e.data #>> '{invitedByCollectiveId}' IS NOT NULL
AND c."isActive" IS TRUE
AND e.status = 'PAID'
AND m.id IS NULLWhich gives these 232 rows:
I'm not sure yet how to best approach this.
alanna
commented
1 year ago Maybe the invitation notification could be "from" the individual inviter instead of emphsising that it's the Collective inviting you to submit an expense? However, this conflicts with the simplicity of "[Collective] wants to pay you" which helps get the message across. Maybe it could say "Request payment from [Collective]"?
It seems anyone can invite an expense from any Collective by default. This is a way for a random person to trigger an email that looks like it's been officially approved by the Collective. I think it makes more sense for only admins to be able to invite expenses for that Collective.
See https://opencollective.slack.com/archives/G46PNRCGP/p1650062399578029?thread_ts=1650062399.578029&cid=G46PNRCGP