[SUPERADMIN] Create a support endpoint to move users between organizations

[emmastephenson]

Background

One of the most common support requests we receive is around moving users between organizations. This usually happens when a user signs up to create an organization when they should have instead waited for an invitation to a different organization. There are design efforts underway to address the root cause here, but in the interim we should create a support UI to move end users between organizations, as these requests are currently escalated to the engineering team. The requests are currently handled manually, with engineers going into Okta and manually changing user groups. This is obviously quite error-prone.

Action requested

Frontend

• Create a new page within the superadmin UI to move users between organizations.
• This page should give space for the support staff to enter the affected user's email address, and the name of the organization they should be moved to (we can use the organization selector combobox already present in the superadmin UI).

Backend

• Create a new graphQL mutation that changes the user's groups to move them between organizations.
• This mutation should only be available to site admins (RequireGlobalAdminUser).
• After the mutation has been run, the user should be part of two different Okta groups for the new organization:
  • NO_ACCESS (this ensures the user will show up in the sidebar list of Manage Users for the org)
  • one of STANDARD, ADMIN, or ENTRY_ONLY permission
• The mutation will probably looks something like this:

mutation moveUserToDifferentOrg ( 
email: String!,
newOrganization: UUID!
permissionLevel: Role!
}

Acceptance Criteria

Once this ticket is complete, "move user between organization" requests no longer need to be escalated to engineering and can be handled directly by the support staff.

[emmastephenson]

Related (closed) tickets: #2677 and #2676

[mehansen]

This is a duplicate of #6163