From a2db0f7b788b8629331c53065d92bc30848d0491 Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Mon, 11 May 2026 17:43:44 +0200
Subject: [PATCH 1/7] allow for empty submitProps

---
 .../ConfirmActionModal/ConfirmActionModal.tsx | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/web/src/shared/components/modals/ConfirmActionModal/ConfirmActionModal.tsx b/web/src/shared/components/modals/ConfirmActionModal/ConfirmActionModal.tsx
index eb3aaeaf76..491247e05a 100644
--- a/web/src/shared/components/modals/ConfirmActionModal/ConfirmActionModal.tsx
+++ b/web/src/shared/components/modals/ConfirmActionModal/ConfirmActionModal.tsx
@@ -85,15 +85,16 @@ const ModalContent = ({ data }: { data: ModalData }) => {
               closeModal(modalNameValue);
             }}
           />
-          <Button
-            text={m.controls_submit()}
-            variant="primary"
-            {...data.submitProps}
-            loading={isPending}
-            onClick={() => {
-              mutate();
-            }}
-          />
+          {isPresent(data.submitProps) && (
+            <Button
+              variant="primary"
+              {...data.submitProps}
+              loading={isPending}
+              onClick={() => {
+                mutate();
+              }}
+            />
+          )}
         </div>
       </Controls>
     </>

From b8ca9513e36f682e0fca3de9f1e9298520400ace Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Mon, 11 May 2026 17:43:56 +0200
Subject: [PATCH 2/7] add locations to groups page

---
 web/src/pages/GroupsPage/GroupsPage.tsx        | 4 +++-
 web/src/routes/_authorized/_default/groups.tsx | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/web/src/pages/GroupsPage/GroupsPage.tsx b/web/src/pages/GroupsPage/GroupsPage.tsx
index 0eeb4dc737..fc63ac999f 100644
--- a/web/src/pages/GroupsPage/GroupsPage.tsx
+++ b/web/src/pages/GroupsPage/GroupsPage.tsx
@@ -6,6 +6,7 @@ import { ThemeSpacing } from '../../shared/defguard-ui/types';
 import { TablePageLayout } from '../../shared/layout/TablePageLayout/TablePageLayout';
 import {
   getGroupsInfoQueryOptions,
+  getLocationsQueryOptions,
   getUsersOverviewQueryOptions,
 } from '../../shared/query';
 import { GroupsTable } from './components/GroupsTable/GroupsTable';
@@ -13,13 +14,14 @@ import { CEGroupModal } from './modals/CEGroupModal/CEGroupModal';
 
 export const GroupsPage = () => {
   const { data: groups } = useSuspenseQuery(getGroupsInfoQueryOptions);
+  const { data: locations } = useSuspenseQuery(getLocationsQueryOptions);
   const { data: users } = useSuspenseQuery(getUsersOverviewQueryOptions);
   return (
     <>
       <Page id="groups-page" title={m.groups_title()}>
         <SizedBox height={ThemeSpacing.Xl3} />
         <TablePageLayout>
-          <GroupsTable groups={groups} users={users} />
+          <GroupsTable groups={groups} locations={locations} users={users} />
         </TablePageLayout>
       </Page>
       <CEGroupModal />
diff --git a/web/src/routes/_authorized/_default/groups.tsx b/web/src/routes/_authorized/_default/groups.tsx
index 25c163fca3..258d66d891 100644
--- a/web/src/routes/_authorized/_default/groups.tsx
+++ b/web/src/routes/_authorized/_default/groups.tsx
@@ -2,6 +2,7 @@ import { createFileRoute } from '@tanstack/react-router';
 import { GroupsPage } from '../../../pages/GroupsPage/GroupsPage';
 import {
   getGroupsInfoQueryOptions,
+  getLocationsQueryOptions,
   getUsersOverviewQueryOptions,
 } from '../../../shared/query';
 
@@ -10,6 +11,7 @@ export const Route = createFileRoute('/_authorized/_default/groups')({
   loader: ({ context }) => {
     return Promise.all([
       context.queryClient.fetchQuery(getGroupsInfoQueryOptions),
+      context.queryClient.fetchQuery(getLocationsQueryOptions),
       context.queryClient.fetchQuery(getUsersOverviewQueryOptions),
     ]);
   },

From d54d32d798ab54a9544e27ae5d58b1ba80958b32 Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Mon, 11 May 2026 17:44:39 +0200
Subject: [PATCH 3/7] show blocked/affected groups modal on deletion

---
 web/messages/en/modal.json                    |  2 ++
 .../components/GroupsTable/GroupsTable.tsx    | 33 ++++++++++++++++---
 2 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/web/messages/en/modal.json b/web/messages/en/modal.json
index 9f6f6a674b..d430eec723 100644
--- a/web/messages/en/modal.json
+++ b/web/messages/en/modal.json
@@ -32,6 +32,8 @@
   "modal_delete_edge_error": "Failed to delete edge",
   "modal_delete_group_title": "Delete group",
   "modal_delete_group_body": "Are you sure you want to delete group {name}? This action cannot be undone.",
+  "modal_delete_group_affected_locations_body": "Group {name} is used in location. Deleting it will also remove location access for users who are in this group.",
+  "modal_delete_group_blocked_body": "Group {name} is the only allowed group in location. Deleting it would leave those locations with an empty Allowed groups list. Update locations manually before deleting this group.",
   "modal_delete_group_success": "Group deleted",
   "modal_delete_group_error": "Failed to delete group",
   "modal_delete_user_device_title": "Delete device",
diff --git a/web/src/pages/GroupsPage/components/GroupsTable/GroupsTable.tsx b/web/src/pages/GroupsPage/components/GroupsTable/GroupsTable.tsx
index 3fd2acb448..69c250917e 100644
--- a/web/src/pages/GroupsPage/components/GroupsTable/GroupsTable.tsx
+++ b/web/src/pages/GroupsPage/components/GroupsTable/GroupsTable.tsx
@@ -7,7 +7,7 @@ import {
 import { useMemo, useState } from 'react';
 import { m } from '../../../../paraglide/messages';
 import api from '../../../../shared/api/api';
-import type { GroupInfo, User } from '../../../../shared/api/types';
+import type { GroupInfo, NetworkLocation, User } from '../../../../shared/api/types';
 import { Badge } from '../../../../shared/defguard-ui/components/Badge/Badge';
 import { Button } from '../../../../shared/defguard-ui/components/Button/Button';
 import type { MenuItemProps } from '../../../../shared/defguard-ui/components/Menu/types';
@@ -23,6 +23,7 @@ import { ModalName } from '../../../../shared/hooks/modalControls/modalTypes';
 
 type Props = {
   groups: GroupInfo[];
+  locations: NetworkLocation[];
   users: User[];
 };
 
@@ -30,7 +31,7 @@ type RowData = GroupInfo;
 
 const columnHelper = createColumnHelper<RowData>();
 
-export const GroupsTable = ({ groups, users }: Props) => {
+export const GroupsTable = ({ groups, locations, users }: Props) => {
   const [search, setSearch] = useState('');
   const reservedNames = useMemo(() => groups.map((g) => g.name), [groups]);
 
@@ -117,11 +118,33 @@ export const GroupsTable = ({ groups, users }: Props) => {
               icon: 'delete',
               variant: 'danger',
               onClick: () => {
+                const affectedLocations = locations.filter(
+                  (location) =>
+                    !location.allow_all_groups &&
+                    location.allowed_groups.includes(rowData.name),
+                );
+                const blockedLocations = affectedLocations.filter(
+                  (location) => location.allowed_groups.length === 1,
+                );
+                if (blockedLocations.length > 0) {
+                  openModal(ModalName.ConfirmAction, {
+                    title: m.modal_delete_group_title(),
+                    contentMd: m.modal_delete_group_blocked_body({ name: rowData.name }),
+                    actionPromise: () => api.group.deleteGroup(rowData.id),
+                    cancelProps: { text: m.controls_close() },
+                  });
+                  return;
+                }
                 openModal(ModalName.ConfirmAction, {
                   title: m.modal_delete_group_title(),
-                  contentMd: m.modal_delete_group_body({ name: rowData.name }),
+                  contentMd:
+                    affectedLocations.length > 0
+                      ? m.modal_delete_group_affected_locations_body({
+                          name: rowData.name,
+                        })
+                      : m.modal_delete_group_body({ name: rowData.name }),
                   actionPromise: () => api.group.deleteGroup(rowData.id),
-                  invalidateKeys: [['group'], ['group-info']],
+                  invalidateKeys: [['group'], ['group-info'], ['network']],
                   submitProps: { text: m.controls_delete(), variant: 'critical' },
                   onSuccess: () => Snackbar.default(m.modal_delete_group_success()),
                   onError: () => Snackbar.error(m.modal_delete_group_error()),
@@ -133,7 +156,7 @@ export const GroupsTable = ({ groups, users }: Props) => {
         },
       }),
     ],
-    [reservedNames, users],
+    [locations, reservedNames, users],
   );
 
   const table = useReactTable({

From f2e0cf1230d0c4e2428275e534bf6adb0cabafd5 Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Mon, 11 May 2026 17:53:45 +0200
Subject: [PATCH 4/7] better text

---
 web/messages/en/modal.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/messages/en/modal.json b/web/messages/en/modal.json
index d430eec723..03db4c73fd 100644
--- a/web/messages/en/modal.json
+++ b/web/messages/en/modal.json
@@ -32,7 +32,7 @@
   "modal_delete_edge_error": "Failed to delete edge",
   "modal_delete_group_title": "Delete group",
   "modal_delete_group_body": "Are you sure you want to delete group {name}? This action cannot be undone.",
-  "modal_delete_group_affected_locations_body": "Group {name} is used in location. Deleting it will also remove location access for users who are in this group.",
+  "modal_delete_group_affected_locations_body": "Group {name} is used in location. Deleting it will also revoke location access for users in this group.",
   "modal_delete_group_blocked_body": "Group {name} is the only allowed group in location. Deleting it would leave those locations with an empty Allowed groups list. Update locations manually before deleting this group.",
   "modal_delete_group_success": "Group deleted",
   "modal_delete_group_error": "Failed to delete group",

From 0cd15d43f334bacb2631c1cc2506ed12dfff40c4 Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Mon, 11 May 2026 17:58:36 +0200
Subject: [PATCH 5/7] add query, block removing groups which are only allowed
 group in location

---
 crates/defguard_common/src/db/models/group.rs | 20 +++++++++++++++++++
 crates/defguard_core/src/handlers/group.rs    | 12 +++++++++++
 2 files changed, 32 insertions(+)

diff --git a/crates/defguard_common/src/db/models/group.rs b/crates/defguard_common/src/db/models/group.rs
index eb81daad3a..b05fe01481 100644
--- a/crates/defguard_common/src/db/models/group.rs
+++ b/crates/defguard_common/src/db/models/group.rs
@@ -108,6 +108,26 @@ impl Group<Id> {
         .await
     }
 
+    pub async fn locations_with_one_allowed_group<'e, E>(&self, executor: E) -> sqlx::Result<Vec<String>>
+    where
+        E: PgExecutor<'e>,
+    {
+        query_scalar(
+            "SELECT wn.name FROM wireguard_network wn \
+            JOIN wireguard_network_allowed_group target_group \
+                ON target_group.network_id = wn.id AND target_group.group_id = $1 \
+            JOIN wireguard_network_allowed_group allowed_group \
+                ON allowed_group.network_id = wn.id \
+            WHERE NOT wn.allow_all_groups \
+            GROUP BY wn.id, wn.name \
+            HAVING COUNT(allowed_group.group_id) = 1 \
+            ORDER BY wn.name",
+        )
+        .bind(self.id)
+        .fetch_all(executor)
+        .await
+    }
+
     pub async fn find_by_permission<'e, E>(
         executor: E,
         permission: Permission,
diff --git a/crates/defguard_core/src/handlers/group.rs b/crates/defguard_core/src/handlers/group.rs
index 09006a46b4..fbe40ab421 100644
--- a/crates/defguard_core/src/handlers/group.rs
+++ b/crates/defguard_core/src/handlers/group.rs
@@ -591,6 +591,18 @@ pub(crate) async fn delete_group(
                 return Ok(ApiResponse::with_status(StatusCode::BAD_REQUEST));
             }
         }
+        let blocked_locations = group
+            .locations_with_one_allowed_group(&appstate.pool)
+            .await?;
+        if !blocked_locations.is_empty() {
+            let msg = format!(
+                "Cannot delete group {} because it is the only allowed group in locations: {}",
+                group.name,
+                blocked_locations.join(", ")
+            );
+            error!("{msg}");
+            return Ok(ApiResponse::with_status(StatusCode::BAD_REQUEST));
+        }
         group.clone().delete(&appstate.pool).await?;
         ldap_delete_group(&group.name, &appstate.pool).await;
 

From 7ab9044ec0b28028553d1a1acd75cf12e4e7f0d1 Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Mon, 11 May 2026 17:59:12 +0200
Subject: [PATCH 6/7] adjust tests

---
 .../api/wireguard_network_allowed_groups.rs   | 70 +++++++++++++++++--
 1 file changed, 66 insertions(+), 4 deletions(-)

diff --git a/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs b/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
index 85d9400ea7..e4b90edef7 100644
--- a/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
@@ -919,7 +919,7 @@ DNS = 10.0.0.2
 }
 
 #[sqlx::test]
-async fn test_delete_only_allowed_group(_: PgPoolOptions, options: PgConnectOptions) {
+async fn test_delete_only_allowed_group_rejected(_: PgPoolOptions, options: PgConnectOptions) {
     let pool = setup_pool(options).await;
 
     let (client, client_state) = make_test_client(pool).await;
@@ -977,14 +977,76 @@ async fn test_delete_only_allowed_group(_: PgPoolOptions, options: PgConnectOpti
         .delete(format!("/api/v1/group/{allowed_group_id}"))
         .send()
         .await;
-    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
 
-    // network configuration was created only for the admin device
+    // network configuration remains unchanged
     let peers = get_location_allowed_peers(&network, &client_state.pool)
         .await
         .unwrap();
-    assert_eq!(peers.len(), 1);
+    assert_eq!(peers.len(), 2);
     assert_eq!(peers[0].pubkey, devices[0].wireguard_pubkey);
+    assert_eq!(peers[1].pubkey, devices[1].wireguard_pubkey);
+}
+
+#[sqlx::test]
+async fn test_delete_allowed_group_when_location_keeps_other_groups(
+    _: PgPoolOptions,
+    options: PgConnectOptions,
+) {
+    let pool = setup_pool(options).await;
+
+    let (client, client_state) = make_test_client(pool).await;
+    setup_test_users(&client_state.pool).await;
+
+    let mut wg_rx = client_state.wireguard_rx;
+
+    let auth = Auth::new("admin", "pass123");
+    let response = &client.post("/api/v1/auth").json(&auth).send().await;
+    assert_eq!(response.status(), StatusCode::OK);
+
+    let response = client
+        .post("/api/v1/network")
+        .json(&json!({
+            "name": "network",
+            "address": "10.1.1.1/24",
+            "port": 55555,
+            "endpoint": "192.168.4.14",
+            "allowed_ips": "10.1.1.0/24",
+            "dns": "1.1.1.1",
+            "mtu": 1420,
+            "fwmark": 0,
+            "allow_all_groups": false,
+            "allowed_groups": ["allowed group", "not allowed group"],
+            "keepalive_interval": 25,
+            "peer_disconnect_threshold": 300,
+            "acl_enabled": false,
+            "acl_default_allow": false,
+            "location_mfa_mode": "disabled",
+            "service_location_mode": "disabled"
+        }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    let network: WireguardNetwork<Id> = response.json().await;
+    let event = wg_rx.try_recv().unwrap();
+    assert_matches!(event, GatewayEvent::NetworkCreated(..));
+
+    let allowed_group_id = Group::find_by_name(&client_state.pool, "allowed group")
+        .await
+        .unwrap()
+        .unwrap()
+        .id;
+    let response = client
+        .delete(format!("/api/v1/group/{allowed_group_id}"))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::OK);
+
+    let allowed_groups = network
+        .fetch_allowed_groups(&client_state.pool)
+        .await
+        .unwrap();
+    assert_eq!(allowed_groups, vec!["not allowed group"]);
 }
 
 #[sqlx::test]

From 103a803fce47d4290cb32cba9de7ca0d30247fec Mon Sep 17 00:00:00 2001
From: Kuba <78603704+jakub-tldr@users.noreply.github.com>
Date: Mon, 11 May 2026 18:01:02 +0200
Subject: [PATCH 7/7] pnpm fix

---
 web/src/shared/validators.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/src/shared/validators.ts b/web/src/shared/validators.ts
index e140b366ac..2200d6f674 100644
--- a/web/src/shared/validators.ts
+++ b/web/src/shared/validators.ts
@@ -252,6 +252,6 @@ export const aclDestinationValidator = z
   );
 
 // Allows Unicode letters, Unicode digits, space, hyphen, underscore, dot, parentheses, colon, slash
-const namePattern = /^[\p{L}\p{N} \-_.():\/]+$/u;
+const namePattern = /^[\p{L}\p{N} \-_.():/]+$/u;
 
 export const nameValidator = z.string().regex(namePattern, m.form_error_forbidden_char());