[Domain Control] [Release 4] Add Restrict default login selection to DomainGroupDetailsPage

src/languages/de.ts

@@ -9208,6 +9208,9 @@ Hier ist ein *Testbeleg*, um dir zu zeigen, wie es funktioniert:`,
             preferredWorkspaceDescription: (enabled: boolean) => `Alle neuen Berichte und Ausgaben werden im ${enabled ? 'ausgewählten bevorzugten' : 'diesem'} Arbeitsbereich erstellt.`,
             preferredWorkspaceSelectDescription: 'Alle neuen Ausgaben und Berichte werden in diesem Arbeitsbereich erstellt.',
             noWorkspacesMessage: 'Es gibt keine Arbeitsbereiche in dieser Domain. Ein Arbeitsbereich ist erforderlich, um diese Einschränkung zu aktivieren.',
+            restrictDefaultLoginSelection: 'Standard-Login-Auswahl einschränken',
+            restrictDefaultLoginSelectionDescription:
+                'Verhindert, dass Mitglieder ihre Login-E-Mail-Adresse außerhalb der Unternehmensdomäne ändern, um Richtlinienbeschränkungen zu umgehen.',
         },
     },
     proactiveAppReview: {

src/languages/en.ts

@@ -9202,6 +9202,8 @@ const translations = {
             preferredWorkspaceDescription: (enabled: boolean) => `All new reports and expenses will be created on ${enabled ? 'selected preferred' : 'this'} workspace.`,
             preferredWorkspaceSelectDescription: 'All new expenses and reports will be created on this workspace.',
             noWorkspacesMessage: 'There are no workspaces on this domain. A workspace is required to enable this restriction.',
+            restrictDefaultLoginSelection: 'Restrict default login selection',
+            restrictDefaultLoginSelectionDescription: 'Prevent members from changing their login email away from their company domain to avoid policy restrictions.',
         },
     },
 };

src/languages/es.ts

@@ -9439,6 +9439,8 @@ ${amount} para ${merchant} - ${date}`,
                 `Todos los nuevos informes y gastos se crearán en ${enabled ? 'el espacio de trabajo preferido seleccionado' : 'este espacio de trabajo'}.`,
             preferredWorkspaceSelectDescription: 'Todos los nuevos gastos e informes se crearán en este espacio de trabajo.',
             noWorkspacesMessage: 'No hay espacios de trabajo en este dominio. Se requiere un espacio de trabajo para habilitar esta restricción.',
+            restrictDefaultLoginSelection: 'Restringir el inicio de sesión predeterminado',
+            restrictDefaultLoginSelectionDescription: 'Evita que los miembros cambien su correo de inicio de sesión fuera del dominio de la empresa para eludir restricciones de políticas.',
         },
     },
     gps: {

src/languages/fr.ts

@@ -9233,6 +9233,9 @@ Voici un *reçu test* pour vous montrer comment ça fonctionne :`,
                 `Tous les nouveaux rapports et dépenses seront créés dans ${enabled ? "l'espace de travail préféré sélectionné" : 'cet espace de travail'}.`,
             preferredWorkspaceSelectDescription: 'Toutes les nouvelles dépenses et tous les nouveaux rapports seront créés dans cet espace de travail.',
             noWorkspacesMessage: "Il n'y a aucun espace de travail sur ce domaine. Un espace de travail est requis pour activer cette restriction.",
+            restrictDefaultLoginSelection: 'Restreindre la sélection de connexion par défaut',
+            restrictDefaultLoginSelectionDescription:
+                'Empêche les membres de modifier leur e-mail de connexion en dehors du domaine de leur entreprise afin d’éviter les restrictions de politique.',
         },
     },
     proactiveAppReview: {

src/languages/it.ts

@@ -9200,6 +9200,8 @@ Ecco una *ricevuta di prova* per mostrarti come funziona:`,
                 `Tutti i nuovi report e le spese verranno creati ${enabled ? 'nello spazio di lavoro preferito selezionato' : 'in questo spazio di lavoro'}.`,
             preferredWorkspaceSelectDescription: 'Tutte le nuove spese e i report verranno creati in questo spazio di lavoro.',
             noWorkspacesMessage: 'Non ci sono spazi di lavoro su questo dominio. È necessario uno spazio di lavoro per abilitare questa restrizione.',
+            restrictDefaultLoginSelection: 'Limita la selezione di accesso predefinita',
+            restrictDefaultLoginSelectionDescription: 'Impedisce ai membri di modificare l’email di accesso al di fuori del dominio aziendale per eludere le restrizioni delle policy.',
         },
     },
     proactiveAppReview: {

src/languages/ja.ts

@@ -9084,6 +9084,8 @@ ${reportName}
             preferredWorkspaceDescription: (enabled: boolean) => `すべての新しいレポートと経費は${enabled ? '選択された優先' : 'この'}ワークスペースに作成されます。`,
             preferredWorkspaceSelectDescription: 'すべての新しい経費とレポートはこのワークスペースに作成されます。',
             noWorkspacesMessage: 'このドメインにワークスペースがありません。この制限を有効にするにはワークスペースが必要です。',
+            restrictDefaultLoginSelection: 'デフォルトのログイン選択を制限する',
+            restrictDefaultLoginSelectionDescription: 'メンバーがポリシー制限を回避するために、ログイン用のメールアドレスを会社のドメイン以外に変更することを防ぎます。',
         },
     },
     proactiveAppReview: {

src/languages/nl.ts

@@ -9172,6 +9172,8 @@ Hier is een *proefbon* om je te laten zien hoe het werkt:`,
             preferredWorkspaceDescription: (enabled: boolean) => `Alle nieuwe rapporten en uitgaven worden aangemaakt in ${enabled ? 'de geselecteerde voorkeurs' : 'deze'} werkruimte.`,
             preferredWorkspaceSelectDescription: 'Alle nieuwe uitgaven en rapporten worden aangemaakt in deze werkruimte.',
             noWorkspacesMessage: 'Er zijn geen werkruimtes op dit domein. Een werkruimte is vereist om deze beperking in te schakelen.',
+            restrictDefaultLoginSelection: 'Standaard login-selectie beperken',
+            restrictDefaultLoginSelectionDescription: 'Voorkomt dat leden hun login-e-mail wijzigen naar een adres buiten het bedrijfsdomein om beleidsbeperkingen te omzeilen.',
         },
     },
     proactiveAppReview: {

src/languages/pl.ts

@@ -9152,6 +9152,8 @@ Oto *paragon testowy*, żeby pokazać Ci, jak to działa:`,
             preferredWorkspaceDescription: (enabled: boolean) => `Wszystkie nowe raporty i wydatki będą tworzone w ${enabled ? 'wybranym preferowanym' : 'tym'} obszarze roboczym.`,
             preferredWorkspaceSelectDescription: 'Wszystkie nowe wydatki i raporty będą tworzone w tym obszarze roboczym.',
             noWorkspacesMessage: 'W tej domenie nie ma żadnych obszarów roboczych. Obszar roboczy jest wymagany, aby włączyć to ograniczenie.',
+            restrictDefaultLoginSelection: 'Ogranicz wybór domyślnego logowania',
+            restrictDefaultLoginSelectionDescription: 'Zapobiega zmianie adresu e-mail do logowania przez członków na adres spoza domeny firmowej, aby obejść ograniczenia zasad.',
         },
     },
     proactiveAppReview: {

src/languages/pt-BR.ts

@@ -9161,6 +9161,9 @@ Aqui está um *comprovante de teste* para mostrar como funciona:`,
                 `Todos os novos relatórios e despesas serão criados ${enabled ? 'no espaço de trabalho preferido selecionado' : 'neste espaço de trabalho'}.`,
             preferredWorkspaceSelectDescription: 'Todas as novas despesas e relatórios serão criados neste espaço de trabalho.',
             noWorkspacesMessage: 'Não há espaços de trabalho neste domínio. Um espaço de trabalho é necessário para ativar esta restrição.',
+            restrictDefaultLoginSelection: 'Restringir seleção de login padrão',
+            restrictDefaultLoginSelectionDescription:
+                'Impede que os membros alterem o e-mail de login para um endereço fora do domínio da empresa, evitando que burlem restrições de políticas.',
         },
     },
     proactiveAppReview: {

src/languages/zh-hans.ts

@@ -8924,6 +8924,8 @@ ${reportName}
             preferredWorkspaceDescription: (enabled: boolean) => `所有新报告和费用将在${enabled ? '选定的首选' : '此'}工作区中创建。`,
             preferredWorkspaceSelectDescription: '所有新费用和报告将在此工作区中创建。',
             noWorkspacesMessage: '此域上没有工作区。启用此限制需要一个工作区。',
+            restrictDefaultLoginSelection: '限制默认登录选择',
+            restrictDefaultLoginSelectionDescription: '防止成员将登录邮箱更改为公司域名以外的地址，以规避政策限制。',
         },
     },
     proactiveAppReview: {title: '喜欢全新的 Expensify 吗？', description: '请告诉我们，这样我们就能帮助您让报销体验变得更好。', positiveButton: '太棒了！', negativeButton: '不太是'},

src/libs/actions/Domain.ts

@@ -1855,7 +1855,10 @@ function updateDomainSecurityGroup(
     groupID: string,
     currentSecurityGroup: DomainSecurityGroup,
     newSettingValue: Partial<DomainSecurityGroup>,
-    settingsName: keyof Pick<DomainSecurityGroup, 'name' | 'enableStrictPolicyRules' | 'enableRestrictedPolicyCreation' | 'enableRestrictedPrimaryPolicy' | 'restrictedPrimaryPolicyID'>,
+    settingsName: keyof Pick<
+        DomainSecurityGroup,
+        'name' | 'enableStrictPolicyRules' | 'enableRestrictedPolicyCreation' | 'enableRestrictedPrimaryPolicy' | 'restrictedPrimaryPolicyID' | 'enableRestrictedPrimaryLogin'
+    >,
 ) {
     const SECURITY_GROUP_KEY = `${CONST.DOMAIN.DOMAIN_SECURITY_GROUP_PREFIX}${groupID}`;
     const newSecurityGroup = {...currentSecurityGroup, ...newSettingValue};

src/pages/domain/Groups/DomainGroupDetailsPage.tsx

@@ -21,6 +21,7 @@ import type SCREENS from '@src/SCREENS';
 import DefaultGroupToggle from './DefaultGroupToggle';
 import DeleteGroupRow from './DeleteGroupRow';
 import PreferredWorkspaceToggle from './PreferredWorkspaceToggle';
+import RestrictDefaultLoginSelectionToggle from './RestrictDefaultLoginSelectionToggle';
 import RestrictExpenseWorkspaceCreationToggle from './RestrictExpenseWorkspaceCreationToggle';
 import StrictlyEnforceWorkspaceRulesToggle from './StrictlyEnforceWorkspaceRulesToggle';
 
@@ -74,6 +75,10 @@ function DomainGroupDetailsPage({route}: DomainGroupDetailsPageProps) {
                         domainAccountID={domainAccountID}
                         groupID={groupID}
                     />
+                    <RestrictDefaultLoginSelectionToggle
+                        domainAccountID={domainAccountID}
+                        groupID={groupID}
+                    />
                     <RestrictExpenseWorkspaceCreationToggle
                         domainAccountID={domainAccountID}
                         groupID={groupID}

src/pages/domain/Groups/RestrictDefaultLoginSelectionToggle.tsx

@@ -0,0 +1,59 @@
+import {domainSecurityGroupSettingErrorsSelector, domainSecurityGroupSettingPendingActionSelector, selectGroupByID} from '@selectors/Domain';
+import React from 'react';
+import {View} from 'react-native';
+import useLocalize from '@hooks/useLocalize';
+import useOnyx from '@hooks/useOnyx';
+import useThemeStyles from '@hooks/useThemeStyles';
+import ToggleSettingOptionRow from '@pages/workspace/workflows/ToggleSettingsOptionRow';
+import {clearDomainSecurityGroupSettingError, updateDomainSecurityGroup} from '@userActions/Domain';
+import ONYXKEYS from '@src/ONYXKEYS';
+
+type RestrictDefaultLoginSelectionToggleProps = {
+    /** The account ID of the domain */
+    domainAccountID: number;
+
+    /** The ID of the security group */
+    groupID: string;
+};
+
+function RestrictDefaultLoginSelectionToggle({domainAccountID, groupID}: RestrictDefaultLoginSelectionToggleProps) {
+    const styles = useThemeStyles();
+    const {translate} = useLocalize();
+
+    const [group] = useOnyx(`${ONYXKEYS.COLLECTION.DOMAIN}${domainAccountID}`, {
+        selector: selectGroupByID(groupID),
+    });
+
+    const [enableRestrictedPrimaryLoginPendingAction] = useOnyx(`${ONYXKEYS.COLLECTION.DOMAIN_PENDING_ACTIONS}${domainAccountID}`, {
+        selector: domainSecurityGroupSettingPendingActionSelector('enableRestrictedPrimaryLogin', groupID),
+    });
+    const [enableRestrictedPrimaryLoginErrors] = useOnyx(`${ONYXKEYS.COLLECTION.DOMAIN_ERRORS}${domainAccountID}`, {
+        selector: domainSecurityGroupSettingErrorsSelector('enableRestrictedPrimaryLoginErrors', groupID),
+    });
+
+    const isEnabled = !!group?.enableRestrictedPrimaryLogin;
+
+    return (
+        <View style={styles.mv3}>
+            <ToggleSettingOptionRow
+                title={translate('domain.groups.restrictDefaultLoginSelection')}
+                subtitle={translate('domain.groups.restrictDefaultLoginSelectionDescription')}
+                switchAccessibilityLabel={translate('domain.groups.restrictDefaultLoginSelection')}
+                shouldPlaceSubtitleBelowSwitch
+                isActive={isEnabled}
+                onToggle={(enabled) => {
+                    if (!group) {
+                        return;
+                    }
+                    updateDomainSecurityGroup(domainAccountID, groupID, group, {enableRestrictedPrimaryLogin: enabled}, 'enableRestrictedPrimaryLogin');
+                }}
+                wrapperStyle={[styles.ph5]}
+                pendingAction={enableRestrictedPrimaryLoginPendingAction}
+                errors={enableRestrictedPrimaryLoginErrors}
+                onCloseError={() => clearDomainSecurityGroupSettingError(domainAccountID, groupID, 'enableRestrictedPrimaryLoginErrors')}
+            />
+        </View>
+    );
+}
+
+export default RestrictDefaultLoginSelectionToggle;

src/types/onyx/DomainErrors.ts

@@ -74,6 +74,11 @@ type DomainSecurityGroupErrors = {
      * Errors related to changing the preferred workspace ID
      */
     restrictedPrimaryPolicyIDErrors?: OnyxCommon.Errors;
+
+    /**
+     * Errors related to the restricted default login selection
+     */
+    enableRestrictedPrimaryLoginErrors?: OnyxCommon.Errors;
 };
 
 /**

src/types/onyx/DomainPendingActions.ts

@@ -74,6 +74,11 @@ type DomainSecurityGroupPendingActions = {
      * Pending action for changing the preferred workspace ID
      */
     restrictedPrimaryPolicyID?: OnyxCommon.PendingAction;
+
+    /**
+     * Pending action for the restricted default login selection
+     */
+    enableRestrictedPrimaryLogin?: OnyxCommon.PendingAction;
 };
 
 /**