Deleting a group that is in a strategy's "Assign to" (autoEnrollGroups) makes the strategy impossible to save

[HermessNRJ]

Version: 3.0.2 (still present in 3.1.0)

Steps to reproduce

1. Configure an authentication strategy (SSO/OIDC) with group G in Assign to (autoEnrollGroups).
2. Delete group G in Admin → Groups.
3. Edit the strategy, change anything, and click Apply.

Expected behavior

The strategy saves. The deleted group should have been removed from autoEnrollGroups when it was deleted, or be ignored.

Actual behavior

• The PUT strategies/… request returns 400.
• The UI still sends the deleted group's ID in autoEnrollGroups, but the Assign to selector no longer shows it, so it cannot be unselected.
• The server check in models/authentication.ts, which requires every ID to match an existing group, rejects the request.

Workaround

1. Open DevTools → Network and click Apply again.
2. Right-click the failing PUT strategies/… request and choose Copy as fetch.
3. Paste it in the Console. In the body, replace the deleted ID in autoEnrollGroups with [] or with a valid group ID.
4. Press Enter, then reload the page.

Suggested fix

• When a group is deleted, remove its ID from every strategy's autoEnrollGroups.
• In the UI, drop unknown IDs before saving, or show them so they can be removed.

[karenrebecag]

Short answer: remove the group from the strategy before you delete it. If it is already deleted, your Copy-as-fetch workaround is the right fix.

Avoid it:

1. Edit the strategy, remove the group from Assign to, click Apply.
2. Delete the group in Admin > Groups.

Already stuck: the stale ID stays in autoEnrollGroups and the Assign to list no longer has that option, so the save keeps failing. Replacing the ID with [] (or a valid group ID) in the request, as you did, is the way out.

Why:

• The model rejects any autoEnrollGroups ID that is not in the groups table: Group ${unknown} does not exist. (backend/models/authentication.ts L445-L455).
• deleteGroup only deletes the group row and its user memberships (backend/models/groups.ts L834-L837). It never touches strategies.
• autoEnrollGroups is a plain uuid array column (backend/db/schema.ts L281), so no foreign key cascades into it. That is why the deleted ID survives.
• The Assign to select is built from the live group list (frontend/src/pages/AdminAuth.vue L223-L226), so the deleted ID has no option to unselect.

I read this from the code at a13a208; I did not run a live instance, so the remove-first order is inferred from the validation rule, not observed.

[NGPixel]

Fixed via 73492a5. Will land in next release.