Merge pull request #88701 from software-mansion-labs/jakubstec/domains/security-group-details-page-group-permissions2

mountiny · web-flow · commit 0a6ddcd1f567 · 2026-05-05T17:43:07.000+02:00
diff --git a/src/languages/de.ts b/src/languages/de.ts
@@ -9212,6 +9212,9 @@ Hier ist ein *Testbeleg*, um dir zu zeigen, wie es funktioniert:`,
             preferredWorkspaceDescription: (enabled: boolean) => `Alle neuen Berichte und Ausgaben werden im ${enabled ? 'ausgewählten bevorzugten' : 'diesem'} Arbeitsbereich erstellt.`,
             preferredWorkspaceSelectDescription: 'Alle neuen Ausgaben und Berichte werden in diesem Arbeitsbereich erstellt.',
             noWorkspacesMessage: 'Es gibt keine Arbeitsbereiche in dieser Domain. Ein Arbeitsbereich ist erforderlich, um diese Einschränkung zu aktivieren.',
+            restrictDefaultLoginSelection: 'Standard-Login-Auswahl einschränken',
+            restrictDefaultLoginSelectionDescription:
+                'Verhindert, dass Mitglieder ihre Login-E-Mail-Adresse außerhalb der Unternehmensdomäne ändern, um Richtlinienbeschränkungen zu umgehen.',
         },
     },
     proactiveAppReview: {
diff --git a/src/languages/en.ts b/src/languages/en.ts
@@ -9206,6 +9206,8 @@ const translations = {
             preferredWorkspaceDescription: (enabled: boolean) => `All new reports and expenses will be created on ${enabled ? 'selected preferred' : 'this'} workspace.`,
             preferredWorkspaceSelectDescription: 'All new expenses and reports will be created on this workspace.',
             noWorkspacesMessage: 'There are no workspaces on this domain. A workspace is required to enable this restriction.',
+            restrictDefaultLoginSelection: 'Restrict default login selection',
+            restrictDefaultLoginSelectionDescription: 'Prevent members from changing their login email away from their company domain to avoid policy restrictions.',
         },
     },
 };
diff --git a/src/languages/es.ts b/src/languages/es.ts
@@ -9443,6 +9443,8 @@ ${amount} para ${merchant} - ${date}`,
                 `Todos los nuevos informes y gastos se crearán en ${enabled ? 'el espacio de trabajo preferido seleccionado' : 'este espacio de trabajo'}.`,
             preferredWorkspaceSelectDescription: 'Todos los nuevos gastos e informes se crearán en este espacio de trabajo.',
             noWorkspacesMessage: 'No hay espacios de trabajo en este dominio. Se requiere un espacio de trabajo para habilitar esta restricción.',
+            restrictDefaultLoginSelection: 'Restringir el inicio de sesión predeterminado',
+            restrictDefaultLoginSelectionDescription: 'Evita que los miembros cambien su correo de inicio de sesión fuera del dominio de la empresa para eludir restricciones de políticas.',
         },
     },
     gps: {
diff --git a/src/languages/fr.ts b/src/languages/fr.ts
@@ -9237,6 +9237,9 @@ Voici un *reçu test* pour vous montrer comment ça fonctionne :`,
                 `Tous les nouveaux rapports et dépenses seront créés dans ${enabled ? "l'espace de travail préféré sélectionné" : 'cet espace de travail'}.`,
             preferredWorkspaceSelectDescription: 'Toutes les nouvelles dépenses et tous les nouveaux rapports seront créés dans cet espace de travail.',
             noWorkspacesMessage: "Il n'y a aucun espace de travail sur ce domaine. Un espace de travail est requis pour activer cette restriction.",
+            restrictDefaultLoginSelection: 'Restreindre la sélection de connexion par défaut',
+            restrictDefaultLoginSelectionDescription:
+                'Empêche les membres de modifier leur e-mail de connexion en dehors du domaine de leur entreprise afin d’éviter les restrictions de politique.',
         },
     },
     proactiveAppReview: {
diff --git a/src/languages/it.ts b/src/languages/it.ts
@@ -9204,6 +9204,8 @@ Ecco una *ricevuta di prova* per mostrarti come funziona:`,
                 `Tutti i nuovi report e le spese verranno creati ${enabled ? 'nello spazio di lavoro preferito selezionato' : 'in questo spazio di lavoro'}.`,
             preferredWorkspaceSelectDescription: 'Tutte le nuove spese e i report verranno creati in questo spazio di lavoro.',
             noWorkspacesMessage: 'Non ci sono spazi di lavoro su questo dominio. È necessario uno spazio di lavoro per abilitare questa restrizione.',
+            restrictDefaultLoginSelection: 'Limita la selezione di accesso predefinita',
+            restrictDefaultLoginSelectionDescription: 'Impedisce ai membri di modificare l’email di accesso al di fuori del dominio aziendale per eludere le restrizioni delle policy.',
         },
     },
     proactiveAppReview: {
diff --git a/src/languages/ja.ts b/src/languages/ja.ts
@@ -9088,6 +9088,8 @@ ${reportName}
             preferredWorkspaceDescription: (enabled: boolean) => `すべての新しいレポートと経費は${enabled ? '選択された優先' : 'この'}ワークスペースに作成されます。`,
             preferredWorkspaceSelectDescription: 'すべての新しい経費とレポートはこのワークスペースに作成されます。',
             noWorkspacesMessage: 'このドメインにワークスペースがありません。この制限を有効にするにはワークスペースが必要です。',
+            restrictDefaultLoginSelection: 'デフォルトのログイン選択を制限する',
+            restrictDefaultLoginSelectionDescription: 'メンバーがポリシー制限を回避するために、ログイン用のメールアドレスを会社のドメイン以外に変更することを防ぎます。',
         },
     },
     proactiveAppReview: {
diff --git a/src/languages/nl.ts b/src/languages/nl.ts
@@ -9176,6 +9176,8 @@ Hier is een *proefbon* om je te laten zien hoe het werkt:`,
             preferredWorkspaceDescription: (enabled: boolean) => `Alle nieuwe rapporten en uitgaven worden aangemaakt in ${enabled ? 'de geselecteerde voorkeurs' : 'deze'} werkruimte.`,
             preferredWorkspaceSelectDescription: 'Alle nieuwe uitgaven en rapporten worden aangemaakt in deze werkruimte.',
             noWorkspacesMessage: 'Er zijn geen werkruimtes op dit domein. Een werkruimte is vereist om deze beperking in te schakelen.',
+            restrictDefaultLoginSelection: 'Standaard login-selectie beperken',
+            restrictDefaultLoginSelectionDescription: 'Voorkomt dat leden hun login-e-mail wijzigen naar een adres buiten het bedrijfsdomein om beleidsbeperkingen te omzeilen.',
         },
     },
     proactiveAppReview: {
diff --git a/src/languages/pl.ts b/src/languages/pl.ts
@@ -9156,6 +9156,8 @@ Oto *paragon testowy*, żeby pokazać Ci, jak to działa:`,
             preferredWorkspaceDescription: (enabled: boolean) => `Wszystkie nowe raporty i wydatki będą tworzone w ${enabled ? 'wybranym preferowanym' : 'tym'} obszarze roboczym.`,
             preferredWorkspaceSelectDescription: 'Wszystkie nowe wydatki i raporty będą tworzone w tym obszarze roboczym.',
             noWorkspacesMessage: 'W tej domenie nie ma żadnych obszarów roboczych. Obszar roboczy jest wymagany, aby włączyć to ograniczenie.',
+            restrictDefaultLoginSelection: 'Ogranicz wybór domyślnego logowania',
+            restrictDefaultLoginSelectionDescription: 'Zapobiega zmianie adresu e-mail do logowania przez członków na adres spoza domeny firmowej, aby obejść ograniczenia zasad.',
         },
     },
     proactiveAppReview: {
diff --git a/src/languages/pt-BR.ts b/src/languages/pt-BR.ts
@@ -9165,6 +9165,9 @@ Aqui está um *comprovante de teste* para mostrar como funciona:`,
                 `Todos os novos relatórios e despesas serão criados ${enabled ? 'no espaço de trabalho preferido selecionado' : 'neste espaço de trabalho'}.`,
             preferredWorkspaceSelectDescription: 'Todas as novas despesas e relatórios serão criados neste espaço de trabalho.',
             noWorkspacesMessage: 'Não há espaços de trabalho neste domínio. Um espaço de trabalho é necessário para ativar esta restrição.',
+            restrictDefaultLoginSelection: 'Restringir seleção de login padrão',
+            restrictDefaultLoginSelectionDescription:
+                'Impede que os membros alterem o e-mail de login para um endereço fora do domínio da empresa, evitando que burlem restrições de políticas.',
         },
     },
     proactiveAppReview: {
diff --git a/src/languages/zh-hans.ts b/src/languages/zh-hans.ts
@@ -8928,6 +8928,8 @@ ${reportName}
             preferredWorkspaceDescription: (enabled: boolean) => `所有新报告和费用将在${enabled ? '选定的首选' : '此'}工作区中创建。`,
             preferredWorkspaceSelectDescription: '所有新费用和报告将在此工作区中创建。',
             noWorkspacesMessage: '此域上没有工作区。启用此限制需要一个工作区。',
+            restrictDefaultLoginSelection: '限制默认登录选择',
+            restrictDefaultLoginSelectionDescription: '防止成员将登录邮箱更改为公司域名以外的地址，以规避政策限制。',
         },
     },
     proactiveAppReview: {title: '喜欢全新的 Expensify 吗？', description: '请告诉我们，这样我们就能帮助您让报销体验变得更好。', positiveButton: '太棒了！', negativeButton: '不太是'},
diff --git a/src/libs/actions/Domain.ts b/src/libs/actions/Domain.ts
@@ -1855,7 +1855,10 @@ function updateDomainSecurityGroup(
     groupID: string,
     currentSecurityGroup: DomainSecurityGroup,
     newSettingValue: Partial<DomainSecurityGroup>,
-    settingsName: keyof Pick<DomainSecurityGroup, 'name' | 'enableStrictPolicyRules' | 'enableRestrictedPolicyCreation' | 'enableRestrictedPrimaryPolicy' | 'restrictedPrimaryPolicyID'>,
+    settingsName: keyof Pick<
+        DomainSecurityGroup,
+        'name' | 'enableStrictPolicyRules' | 'enableRestrictedPolicyCreation' | 'enableRestrictedPrimaryPolicy' | 'restrictedPrimaryPolicyID' | 'enableRestrictedPrimaryLogin'
+    >,
 ) {
     const SECURITY_GROUP_KEY = `${CONST.DOMAIN.DOMAIN_SECURITY_GROUP_PREFIX}${groupID}`;
     const newSecurityGroup = {...currentSecurityGroup, ...newSettingValue};
diff --git a/src/pages/domain/Groups/DomainGroupDetailsPage.tsx b/src/pages/domain/Groups/DomainGroupDetailsPage.tsx
@@ -21,6 +21,7 @@ import type SCREENS from '@src/SCREENS';
 import DefaultGroupToggle from './DefaultGroupToggle';
 import DeleteGroupRow from './DeleteGroupRow';
 import PreferredWorkspaceToggle from './PreferredWorkspaceToggle';
+import RestrictDefaultLoginSelectionToggle from './RestrictDefaultLoginSelectionToggle';
 import RestrictExpenseWorkspaceCreationToggle from './RestrictExpenseWorkspaceCreationToggle';
 import StrictlyEnforceWorkspaceRulesToggle from './StrictlyEnforceWorkspaceRulesToggle';
 
@@ -74,6 +75,10 @@ function DomainGroupDetailsPage({route}: DomainGroupDetailsPageProps) {
                         domainAccountID={domainAccountID}
                         groupID={groupID}
                     />
+                    <RestrictDefaultLoginSelectionToggle
+                        domainAccountID={domainAccountID}
+                        groupID={groupID}
+                    />
                     <RestrictExpenseWorkspaceCreationToggle
                         domainAccountID={domainAccountID}
                         groupID={groupID}
diff --git a/src/pages/domain/Groups/RestrictDefaultLoginSelectionToggle.tsx b/src/pages/domain/Groups/RestrictDefaultLoginSelectionToggle.tsx
@@ -0,0 +1,59 @@
+import {domainSecurityGroupSettingErrorsSelector, domainSecurityGroupSettingPendingActionSelector, selectGroupByID} from '@selectors/Domain';
+import React from 'react';
+import {View} from 'react-native';
+import useLocalize from '@hooks/useLocalize';
+import useOnyx from '@hooks/useOnyx';
+import useThemeStyles from '@hooks/useThemeStyles';
+import ToggleSettingOptionRow from '@pages/workspace/workflows/ToggleSettingsOptionRow';
+import {clearDomainSecurityGroupSettingError, updateDomainSecurityGroup} from '@userActions/Domain';
+import ONYXKEYS from '@src/ONYXKEYS';
+
+type RestrictDefaultLoginSelectionToggleProps = {
+    /** The account ID of the domain */
+    domainAccountID: number;
+
+    /** The ID of the security group */
+    groupID: string;
+};
+
+function RestrictDefaultLoginSelectionToggle({domainAccountID, groupID}: RestrictDefaultLoginSelectionToggleProps) {
+    const styles = useThemeStyles();
+    const {translate} = useLocalize();
+
+    const [group] = useOnyx(`${ONYXKEYS.COLLECTION.DOMAIN}${domainAccountID}`, {
+        selector: selectGroupByID(groupID),
+    });
+
+    const [enableRestrictedPrimaryLoginPendingAction] = useOnyx(`${ONYXKEYS.COLLECTION.DOMAIN_PENDING_ACTIONS}${domainAccountID}`, {
+        selector: domainSecurityGroupSettingPendingActionSelector('enableRestrictedPrimaryLogin', groupID),
+    });
+    const [enableRestrictedPrimaryLoginErrors] = useOnyx(`${ONYXKEYS.COLLECTION.DOMAIN_ERRORS}${domainAccountID}`, {
+        selector: domainSecurityGroupSettingErrorsSelector('enableRestrictedPrimaryLoginErrors', groupID),
+    });
+
+    const isEnabled = !!group?.enableRestrictedPrimaryLogin;
+
+    return (
+        <View style={styles.mv3}>
+            <ToggleSettingOptionRow
+                title={translate('domain.groups.restrictDefaultLoginSelection')}
+                subtitle={translate('domain.groups.restrictDefaultLoginSelectionDescription')}
+                switchAccessibilityLabel={translate('domain.groups.restrictDefaultLoginSelection')}
+                shouldPlaceSubtitleBelowSwitch
+                isActive={isEnabled}
+                onToggle={(enabled) => {
+                    if (!group) {
+                        return;
+                    }
+                    updateDomainSecurityGroup(domainAccountID, groupID, group, {enableRestrictedPrimaryLogin: enabled}, 'enableRestrictedPrimaryLogin');
+                }}
+                wrapperStyle={[styles.ph5]}
+                pendingAction={enableRestrictedPrimaryLoginPendingAction}
+                errors={enableRestrictedPrimaryLoginErrors}
+                onCloseError={() => clearDomainSecurityGroupSettingError(domainAccountID, groupID, 'enableRestrictedPrimaryLoginErrors')}
+            />
+        </View>
+    );
+}
+
+export default RestrictDefaultLoginSelectionToggle;
diff --git a/src/types/onyx/DomainErrors.ts b/src/types/onyx/DomainErrors.ts
@@ -74,6 +74,11 @@ type DomainSecurityGroupErrors = {
      * Errors related to changing the preferred workspace ID
      */
     restrictedPrimaryPolicyIDErrors?: OnyxCommon.Errors;
+
+    /**
+     * Errors related to the restricted default login selection
+     */
+    enableRestrictedPrimaryLoginErrors?: OnyxCommon.Errors;
 };
 
 /**
diff --git a/src/types/onyx/DomainPendingActions.ts b/src/types/onyx/DomainPendingActions.ts
@@ -74,6 +74,11 @@ type DomainSecurityGroupPendingActions = {
      * Pending action for changing the preferred workspace ID
      */
     restrictedPrimaryPolicyID?: OnyxCommon.PendingAction;
+
+    /**
+     * Pending action for the restricted default login selection
+     */
+    enableRestrictedPrimaryLogin?: OnyxCommon.PendingAction;
 };
 
 /**
