[Due for payment 2026-05-22] [Domain Control] [Release 4] [FE] Add validation in MoveUsersBetweenGroupsPage for Preferred Policy admin restriction

[rayane-d]

Part of #76750

Problem:

Currently, when attempting to move a domain member into a group that has a Preferred Policy, the backend validates whether the acting user is a Policy Admin of that policy. If not, the API returns the following error:

Cannot move member to the Domain Group. You must be a Policy Admin for the Preferred Policy set on the Domain Group you are trying to move this user to.

This validation is only performed server-side. To improve UX and avoid unnecessary API calls, we need to implement equivalent validation on the frontend using existing Onyx data.

Discussion: https://expensify.slack.com/archives/C0A1VKRKEE9/p1777070335149149?thread_ts=1776188523.070079&cid=C0A1VKRKEE9

Reproduction steps:

1. Set up a domain with two domain admins: accountA and accountB.
2. From accountA, create a policy where accountA is the only Policy Admin.
3. In OldDot -> Domain -> Groups, create a new group and set its Preferred Policy to the policy from step 2. Ensure accountB is not a Policy Admin of that policy.
4. As accountA, invite a new domain member and assign them to the new group - confirm this succeeds and the new domain member is invited to the policy.
5. Log in as accountB.
6. As accountB, go to Domain -> Domain Members and try moving an existing member into the new group - an error occurs:

Cannot move member to the Domain Group. You must be a Policy Admin for the Preferred Policy set on the Domain Group you are trying to move this user to.

Current Behavior:

• Validation is performed only on the backend.
• The frontend allows the action, then surfaces the error returned by the API.

Expected Behavior:

• The frontend should validate this condition before making the API call.
• If the user is not a Policy Admin of the group's Preferred Policy, the action should be blocked immediately and the same error message displayed.

Solution:

High-level proposal for frontend validation:

1. Get the destination group data from Onyx.
2. Check if a Preferred Policy is configured for the group.
3. If no Preferred Policy is set -> allow the operation.
4. If a Preferred Policy exists:
   • Get its policyID from the Group data from Onyx.
   • Check whether the current user is a Policy Admin for that policy. we can determine this from Onyx.
5. If the user is a Policy Admin -> allow the operation.
6. Otherwise -> block the action and display the validation error.

---

This is a follow-up to PR #81973

---

cc @jmusial @war-in @mountiny @ZhenjaHorbach

Issue Owner

Current Issue Owner: @ZhenjaHorbach

[melvin-bot]

@jmusial Eep! 4 days overdue now. Issues have feelings too...

[jakubstec]

I'll work on it while @jmusial is OoO

[melvin-bot]

@jmusial Still overdue 6 days?! Let's take care of this!

[melvin-bot]

@jmusial Still overdue 6 days?! Let's take care of this!

[jakubstec]

Draft PR ready: #89979

[melvin-bot]

@jmusial 8 days overdue is a lot. Should this be a Weekly issue? If so, feel free to change it!