[Domain Control] add validation in MoveUsersBetweenGroupsPage for Preferred Policy admin restriction#89979
Merged
mountiny merged 8 commits intoMay 13, 2026
Conversation
|
Hey, I noticed you changed If you want to automatically generate translations for other locales, an Expensify employee will have to:
Alternatively, if you are an external contributor, you can run the translation script locally with your own OpenAI API key. To learn more, try running: npx ts-node ./scripts/generateTranslations.ts --helpTypically, you'd want to translate only what you changed by running |
Codecov Report✅ Changes either increased or maintained existing code coverage, great job!
|
Contributor
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1b2d958ad4
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
jmusial
approved these changes
May 11, 2026
melvin-bot
Bot
requested review from
a team,
ZhenjaHorbach and
joekaufmanexpensify
and removed request for
a team
|
@ZhenjaHorbach Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
melvin-bot
Bot
requested review from
flaviadefaria
and removed request for
a team
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
…idate-moving-users-between-groups
Contributor
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
Contributor
Author
|
@ZhenjaHorbach made the changes! |
Contributor
Reviewer Checklist
Screenshots/VideosAndroid: HybridApp2026-05-12.19.46.53.movAndroid: mWeb Chrome2026-05-12.19.45.28.moviOS: HybridApp2026-05-12.19.46.53.moviOS: mWeb Safari2026-05-12.19.45.28.movMacOS: Chrome / Safari2026-05-12.19.44.49.mov |
ZhenjaHorbach
approved these changes
May 12, 2026
mountiny
requested changes
May 12, 2026
mountiny
requested changes
May 12, 2026
Contributor
🦜 Polyglot Parrot! 🦜Squawk! Looks like you added some shiny new English strings. Allow me to parrot them back to you in other tongues: View the translation diffdiff --git a/src/languages/de.ts b/src/languages/de.ts
index c269afc9..55a03d34 100644
--- a/src/languages/de.ts
+++ b/src/languages/de.ts
@@ -9207,7 +9207,7 @@ Hier ist ein *Testbeleg*, um dir zu zeigen, wie es funktioniert:`,
vacationDelegate: 'Dieser Benutzer kann nicht als Urlaubsvertretung festgelegt werden. Bitte versuche es erneut.',
moveMember: 'Dieses Mitglied kann nicht verschoben werden. Bitte versuchen Sie es erneut.',
moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ 'Mitglied kann nicht in die Domänengruppe verschoben werden. Sie müssen ein Richtlinien-Admin für die Bevorzugte Richtlinie sein, die für die Domänengruppe festgelegt ist, in die Sie diesen Benutzer verschieben möchten.',
},
reportSuspiciousActivityPrompt: (email: string) =>
`Bist du sicher? Dadurch wird das Konto von <strong>${email}</strong> gesperrt. <br /><br /> Unser Team wird das Konto anschließend überprüfen und unbefugten Zugriff entfernen. Um den Zugriff wiederherzustellen, muss die Person mit Concierge zusammenarbeiten.`,
diff --git a/src/languages/es.ts b/src/languages/es.ts
index fe8e20fd..21c03479 100644
--- a/src/languages/es.ts
+++ b/src/languages/es.ts
@@ -1687,10 +1687,8 @@ const translations: TranslationDeepObject<typeof en> = {
backdropLabel: 'Fondo del Modal',
},
nextStep: {
- /* eslint-disable @typescript-eslint/no-unused-vars */
message: {
[CONST.NEXT_STEP.MESSAGE_KEY.WAITING_TO_ADD_TRANSACTIONS]: (actor, actorType, _eta, _etaType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que <strong>tú</strong> añadas gastos.`;
@@ -1701,7 +1699,6 @@ const translations: TranslationDeepObject<typeof en> = {
}
},
[CONST.NEXT_STEP.MESSAGE_KEY.WAITING_TO_SUBMIT]: (actor, actorType, _eta, _etaType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que <strong>tú</strong> envíes los gastos.`;
@@ -1713,7 +1710,6 @@ const translations: TranslationDeepObject<typeof en> = {
},
[CONST.NEXT_STEP.MESSAGE_KEY.NO_FURTHER_ACTION]: (_actor, _actorType, _eta, _etaType) => `¡No se requiere ninguna acción adicional!`,
[CONST.NEXT_STEP.MESSAGE_KEY.WAITING_FOR_SUBMITTER_ACCOUNT]: (actor, actorType, _eta, _etaType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que <strong>tú</strong> añadas una cuenta bancaria.`;
@@ -1728,7 +1724,6 @@ const translations: TranslationDeepObject<typeof en> = {
if (eta) {
formattedETA = etaType === CONST.NEXT_STEP.ETA_TYPE.DATE_TIME ? ` el ${eta} de cada mes` : ` ${eta}`;
}
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que tus gastos se envíen automáticamente${formattedETA}.`;
@@ -1739,7 +1734,6 @@ const translations: TranslationDeepObject<typeof en> = {
}
},
[CONST.NEXT_STEP.MESSAGE_KEY.WAITING_TO_FIX_ISSUES]: (actor, actorType, _eta, _etaType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que <strong>tú</strong> soluciones ellos problemas.`;
@@ -1750,7 +1744,6 @@ const translations: TranslationDeepObject<typeof en> = {
}
},
[CONST.NEXT_STEP.MESSAGE_KEY.WAITING_TO_APPROVE]: (actor, actorType, _eta, _etaType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que <strong>tú</strong> apruebes los gastos.`;
@@ -1761,7 +1754,6 @@ const translations: TranslationDeepObject<typeof en> = {
}
},
[CONST.NEXT_STEP.MESSAGE_KEY.WAITING_TO_EXPORT]: (actor, actorType, _eta, _etaType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que <strong>tú</strong> exportes este informe.`;
@@ -1772,7 +1764,6 @@ const translations: TranslationDeepObject<typeof en> = {
}
},
[CONST.NEXT_STEP.MESSAGE_KEY.WAITING_TO_PAY]: (actor, actorType, _eta, _etaType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que <strong>tú</strong> pagues los gastos.`;
@@ -1783,7 +1774,6 @@ const translations: TranslationDeepObject<typeof en> = {
}
},
[CONST.NEXT_STEP.MESSAGE_KEY.WAITING_FOR_POLICY_BANK_ACCOUNT]: (actor, actorType, _eta, _etaType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Esperando a que <strong>tú</strong> termines de configurar una cuenta bancaria de empresa.`;
@@ -1803,7 +1793,6 @@ const translations: TranslationDeepObject<typeof en> = {
[CONST.NEXT_STEP.MESSAGE_KEY.SUBMITTING_TO_SELF]: (_actor, _actorType, _eta, _etaType) =>
`¡Ups! Parece que estás enviando el informe a <strong>ti mismo</strong>. Aprobar tus propios informes está <strong>prohibido</strong> por tu espacio de trabajo. Por favor, envía este informe a otra persona o contacta a tu administrador para cambiar la persona a la que lo envías.`,
[CONST.NEXT_STEP.MESSAGE_KEY.REJECTED_REPORT]: (actor, actorType) => {
- // eslint-disable-next-line default-case
switch (actorType) {
case CONST.NEXT_STEP.ACTOR_TYPE.CURRENT_USER:
return `Este informe fue rechazado. Esperando a que <strong>tú</strong> corrijas los problemas y lo vuelvas a enviar manualmente.`;
@@ -2458,7 +2447,6 @@ ${amount} para ${merchant} - ${date}`,
two: 'º',
few: 'º',
other: 'º',
- /* eslint-disable @typescript-eslint/naming-convention */
'1': 'Primero',
'2': 'Segundo',
'3': 'Tercero',
@@ -2469,7 +2457,6 @@ ${amount} para ${merchant} - ${date}`,
'8': 'Octavo',
'9': 'Noveno',
'10': 'Décimo',
- /* eslint-enable @typescript-eslint/naming-convention */
},
},
approverInMultipleWorkflows: 'Este miembro ya pertenece a otro flujo de aprobación. Cualquier actualización aquí se reflejará allí también.',
@@ -6925,7 +6912,6 @@ ${amount} para ${merchant} - ${date}`,
restrictedDescription: 'Sólo las personas en tu espacio de trabajo pueden encontrar esta sala',
privateDescription: 'Sólo las personas que están invitadas a esta sala pueden encontrarla',
publicDescription: 'Cualquier persona puede unirse a esta sala',
- // eslint-disable-next-line @typescript-eslint/naming-convention
public_announceDescription: 'Cualquier persona puede unirse a esta sala',
createRoom: 'Crea una sala de chat',
roomAlreadyExistsError: 'Ya existe una sala con este nombre',
@@ -6945,7 +6931,6 @@ ${amount} para ${merchant} - ${date}`,
restricted: 'Espacio de trabajo',
private: 'Privada',
public: 'Público',
- // eslint-disable-next-line @typescript-eslint/naming-convention
public_announce: 'Anuncio Público',
},
},
@@ -7260,7 +7245,6 @@ ${amount} para ${merchant} - ${date}`,
updatedDefaultTitle: (newDefaultTitle, oldDefaultTitle) => `cambió la fórmula personalizada del nombre del informe a "${newDefaultTitle}" (previamente "${oldDefaultTitle}")`,
updatedOwnership: (oldOwnerEmail, oldOwnerName, policyName) => `asumió la propiedad del espacio de trabajo ${policyName} de ${oldOwnerName} (${oldOwnerEmail})`,
updatedAutoHarvesting: (enabled) => `${enabled ? 'habilitó' : 'deshabilitó'} el envío programado`,
- // eslint-disable-next-line @typescript-eslint/max-params
updatedIndividualBudgetNotification: (
budgetAmount,
budgetFrequency,
@@ -9400,7 +9384,7 @@ ${amount} para ${merchant} - ${date}`,
vacationDelegate: 'No se pudo establecer a este usuario como delegado de vacaciones. Por favor, inténtalo de nuevo.',
moveMember: 'No se pudo mover este miembro. Por favor, inténtalo de nuevo.',
moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ 'No se puede mover al miembro al grupo de dominio. Debes ser administrador de políticas de la Política preferida configurada en el grupo de dominio al que intentas mover a este usuario.',
},
cannotSetVacationDelegateForMember: (email: string) =>
`No puedes establecer un delegado de vacaciones para ${email} porque actualmente es el delegado de los siguientes miembros:`,
diff --git a/src/languages/fr.ts b/src/languages/fr.ts
index af8690d6..f6990231 100644
--- a/src/languages/fr.ts
+++ b/src/languages/fr.ts
@@ -9228,7 +9228,7 @@ Voici un *reçu test* pour vous montrer comment ça fonctionne :`,
vacationDelegate: 'Impossible de définir cet utilisateur comme délégué de vacances. Veuillez réessayer.',
moveMember: 'Impossible de déplacer ce membre. Veuillez réessayer.',
moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ 'Impossible de déplacer le membre vers le groupe de domaine. Vous devez être Administrateur de la Politique pour la Politique préférée définie sur le groupe de domaine vers lequel vous essayez de déplacer cet utilisateur.',
},
cannotSetVacationDelegateForMember: (email: string) =>
`Vous ne pouvez pas définir un délégué de vacances pour ${email}, car cette personne est actuellement le délégué des membres suivants :`,
diff --git a/src/languages/it.ts b/src/languages/it.ts
index de70ed5b..16554307 100644
--- a/src/languages/it.ts
+++ b/src/languages/it.ts
@@ -9199,7 +9199,7 @@ Ecco una *ricevuta di prova* per mostrarti come funziona:`,
vacationDelegate: 'Impossibile impostare questo utente come delegato per le ferie. Riprova.',
moveMember: 'Impossibile spostare questo membro. Riprova.',
moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ 'Impossibile spostare il membro nel gruppo di dominio. Devi essere un amministratore della polizza per la Polizza preferita impostata sul gruppo di dominio a cui stai cercando di spostare questo utente.',
},
cannotSetVacationDelegateForMember: (email: string) => `Non puoi impostare un delegato per le vacanze per ${email} perché al momento è il delegato per i seguenti membri:`,
reportSuspiciousActivityPrompt: (email: string) =>
diff --git a/src/languages/ja.ts b/src/languages/ja.ts
index 3bd89800..8c1c3ac5 100644
--- a/src/languages/ja.ts
+++ b/src/languages/ja.ts
@@ -9082,7 +9082,7 @@ ${reportName}
vacationDelegate: 'このユーザーを休暇代理人として設定できませんでした。もう一度お試しください。',
moveMember: 'このメンバーを移動できませんでした。もう一度お試しください。',
moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ 'メンバーをドメイングループに移動できません。 このユーザーを移動しようとしているドメイングループに設定されている優先ポリシーのポリシー管理者である必要があります。',
},
cannotSetVacationDelegateForMember: (email: string) => `${email} に休暇代理人を設定できません。現在、このユーザーは次のメンバーの代理人になっています。`,
reportSuspiciousActivityPrompt: (email: string) =>
diff --git a/src/languages/nl.ts b/src/languages/nl.ts
index d0e8b07f..174a4edd 100644
--- a/src/languages/nl.ts
+++ b/src/languages/nl.ts
@@ -9166,7 +9166,7 @@ Hier is een *proefbon* om je te laten zien hoe het werkt:`,
vacationDelegate: 'Kan deze gebruiker niet als vakantiemandataris instellen. Probeer het opnieuw.',
moveMember: 'Kan dit lid niet verplaatsen. Probeer het opnieuw.',
moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ 'Kan het lid niet naar de domeingroep verplaatsen. Je moet een beleidsbeheerder zijn voor het voorkeursbeleid dat is ingesteld op de domeingroep waar je deze gebruiker naartoe probeert te verplaatsen.',
},
cannotSetVacationDelegateForMember: (email: string) =>
`Je kunt geen vakantiemandataris instellen voor ${email} omdat die persoon momenteel gedelegeerde is voor de volgende leden:`,
diff --git a/src/languages/pl.ts b/src/languages/pl.ts
index 74284434..42dd2781 100644
--- a/src/languages/pl.ts
+++ b/src/languages/pl.ts
@@ -9151,7 +9151,7 @@ Oto *paragon testowy*, żeby pokazać Ci, jak to działa:`,
vacationDelegate: 'Nie można ustawić tego użytkownika jako zastępującego na czas nieobecności. Spróbuj ponownie.',
moveMember: 'Nie można przenieść tego członka. Spróbuj ponownie.',
moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ 'Nie można przenieść członka do grupy domeny. Musisz być administratorem zasad dla preferowanej polityki ustawionej w grupie domeny, do której próbujesz przenieść tego użytkownika.',
},
cannotSetVacationDelegateForMember: (email: string) => `Nie możesz ustawić zastępstwa urlopowego dla ${email}, ponieważ jest on/ona obecnie zastępcą dla następujących członków:`,
reportSuspiciousActivityPrompt: (email: string) =>
diff --git a/src/languages/pt-BR.ts b/src/languages/pt-BR.ts
index 1a26539c..8699fdba 100644
--- a/src/languages/pt-BR.ts
+++ b/src/languages/pt-BR.ts
@@ -9159,7 +9159,7 @@ Aqui está um *comprovante de teste* para mostrar como funciona:`,
vacationDelegate: 'Não foi possível definir este usuário como delegado de férias. Tente novamente.',
moveMember: 'Não foi possível mover este membro. Tente novamente.',
moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ 'Não é possível mover o membro para o grupo de domínio. Você precisa ser um administrador de política da Política Preferencial definida no grupo de domínio para o qual está tentando mover este usuário.',
},
cannotSetVacationDelegateForMember: (email: string) => `Você não pode definir um procurador de férias para ${email} porque esta pessoa já é procuradora dos seguintes membros:`,
reportSuspiciousActivityPrompt: (email: string) =>
diff --git a/src/languages/zh-hans.ts b/src/languages/zh-hans.ts
index e2d95f81..1835cdc9 100644
--- a/src/languages/zh-hans.ts
+++ b/src/languages/zh-hans.ts
@@ -8930,8 +8930,7 @@ ${reportName}
addMember: '无法添加此成员。请重试。',
vacationDelegate: '无法将此用户设置为休假代理人。请重试。',
moveMember: '无法移动此成员。请重试。',
- moveMemberNotPolicyAdmin:
- 'Cannot move member to the domain group. You must be a Policy Admin for the Preferred Policy set on the domain group you are trying to move this user to.',
+ moveMemberNotPolicyAdmin: '无法将成员移动到该域组。您必须是要将此用户移动到的域组上所设置的首选策略的策略管理员。',
},
cannotSetVacationDelegateForMember: (email: string) => `您无法为 ${email} 设置休假代理人，因为 TA 当前是以下成员的代理人：`,
reportSuspiciousActivityPrompt: (email: string) =>
Note You can apply these changes to your branch by copying the patch to your clipboard, then running |
joekaufmanexpensify
approved these changes
May 12, 2026
Contributor
joekaufmanexpensify
left a comment
joekaufmanexpensify
left a comment
There was a problem hiding this comment.
Core design doc issue
Contributor
|
🚧 @mountiny has triggered a test Expensify/App build. You can view the workflow run here. |
Contributor
|
✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release. |
Contributor
|
🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
|
64 tasks
Contributor
|
🚀 Deployed to staging by https://github.com/mountiny in version: 9.3.74-0 🚀
Bundle Size Analysis (Sentry): |
2 tasks
Contributor
|
Yes, help site changes are needed. PR #89979 adds a validation that blocks moving domain members to a group if the user isn't a Policy Admin for that group's Preferred Policy. The existing article Draft PR created: #90570 Changes made:
|
Contributor
|
🚀 Deployed to production by https://github.com/Beamanator in version: 9.3.74-7 🚀
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation of Change
Follow-up PR to add validation in
MoveUsersBetweenGroupsPage.Fixed Issues
$ #89218
PROPOSAL:
Tests
Cannot move member to the Domain Group. You must be a Policy Admin for the Preferred Policy set on the Domain Group you are trying to move this user to., and no API call is made.Offline tests
N/A
QA Steps
Same as Tests.
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectiontoggleReportand notonIconClick)src/languages/*files and using the translation methodSTYLE.md) were followedAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.ScrollViewcomponent to make it scrollable when more elements are added to the page.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
iOS: Native
Screen.Recording.2026-05-08.at.08.09.12.mov
MacOS: Chrome / Safari
Screen.Recording.2026-05-08.at.08.06.43.mov