fix: use intersection for user group policies

apps/aether-gateway/src/data/state/auth.rs

@@ -1962,6 +1962,34 @@ mod tests {
         assert_eq!(policy, Some(vec!["gpt-4.1".to_string()]));
     }
 
+    #[test]
+    fn list_policy_intersects_multiple_group_restrictions() {
+        let groups = vec![
+            sample_group(
+                "team-a",
+                10,
+                Some(vec!["gpt-5", "gpt-4.1"]),
+                "specific",
+                None,
+                "system",
+            ),
+            sample_group(
+                "team-b",
+                20,
+                Some(vec!["gpt-4.1", "gemini-2.5-pro"]),
+                "specific",
+                None,
+                "system",
+            ),
+        ];
+
+        let policy = resolve_effective_list_policy(None, "unrestricted", &groups, |group| {
+            (&group.allowed_models_mode, group.allowed_models.clone())
+        });
+
+        assert_eq!(policy, Some(vec!["gpt-4.1".to_string()]));
+    }
+
     #[test]
     fn user_unrestricted_does_not_bypass_group_restrictions() {
         let groups = vec![sample_group(

apps/aether-gateway/src/handlers/admin/users/groups.rs

@@ -118,11 +118,6 @@ pub(in super::super) async fn build_admin_update_user_group_response(
         Ok(value) => value,
         Err(detail) => return Ok(bad_request_owned(detail)),
     };
-    if read_default_user_group_id(state).await?.as_deref() == Some(group_id.as_str())
-        && !is_unrestricted_default_group_record(&record)
-    {
-        return Ok(bad_request_owned("默认用户组不能配置访问限制".to_string()));
-    }
     let group = match state.update_user_group(&group_id, record).await {
         Ok(Some(group)) => group,
         Ok(None) => return Ok(not_found("用户分组不存在")),
@@ -275,11 +270,8 @@ pub(in super::super) async fn build_admin_set_default_user_group_response(
         .map(|value| value.trim().to_string())
         .filter(|value| !value.is_empty());
     if let Some(group_id) = group_id.as_deref() {
-        let Some(group) = state.find_user_group_by_id(group_id).await? else {
+        if state.find_user_group_by_id(group_id).await?.is_none() {
             return Ok(bad_request_owned("默认用户组不存在".to_string()));
-        };
-        if !is_unrestricted_default_group(&group) {
-            return Ok(bad_request_owned("默认用户组不能配置访问限制".to_string()));
         }
         state
             .upsert_system_config_json_value(
@@ -417,30 +409,6 @@ fn normalize_ids(values: Vec<String>) -> Vec<String> {
         .collect()
 }
 
-fn is_unrestricted_default_group(group: &aether_data::repository::users::StoredUserGroup) -> bool {
-    list_mode_has_no_restriction(&group.allowed_providers_mode)
-        && list_mode_has_no_restriction(&group.allowed_api_formats_mode)
-        && list_mode_has_no_restriction(&group.allowed_models_mode)
-        && rate_mode_has_no_restriction(&group.rate_limit_mode)
-}
-
-fn is_unrestricted_default_group_record(
-    record: &aether_data::repository::users::UpsertUserGroupRecord,
-) -> bool {
-    list_mode_has_no_restriction(&record.allowed_providers_mode)
-        && list_mode_has_no_restriction(&record.allowed_api_formats_mode)
-        && list_mode_has_no_restriction(&record.allowed_models_mode)
-        && rate_mode_has_no_restriction(&record.rate_limit_mode)
-}
-
-fn list_mode_has_no_restriction(mode: &str) -> bool {
-    matches!(mode, "inherit" | "unrestricted")
-}
-
-fn rate_mode_has_no_restriction(mode: &str) -> bool {
-    matches!(mode, "inherit" | "system")
-}
-
 fn user_group_id_from_path(request_path: &str) -> Option<String> {
     let value = request_path
         .strip_prefix("/api/admin/user-groups/")?

apps/aether-gateway/src/tests/control/admin/users.rs

@@ -6,7 +6,8 @@ use aether_data::repository::auth::{
 };
 use aether_data::repository::usage::InMemoryUsageReadRepository;
 use aether_data::repository::users::{
-    InMemoryUserReadRepository, StoredUserAuthRecord, StoredUserExportRow,
+    InMemoryUserReadRepository, StoredUserAuthRecord, StoredUserExportRow, UpsertUserGroupRecord,
+    UserReadRepository,
 };
 use aether_data::repository::wallet::InMemoryWalletRepository;
 use aether_data::repository::wallet::StoredWalletSnapshot;
@@ -429,6 +430,121 @@ async fn gateway_handles_admin_users_root_locally_with_trusted_admin_principal()
     create_gateway_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_allows_default_user_group_access_policy_updates() {
+    let upstream_hits = Arc::new(Mutex::new(0usize));
+    let upstream_hits_clone = Arc::clone(&upstream_hits);
+    let upstream = Router::new().fallback(any(move |_request: Request| {
+        let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
+        async move {
+            *upstream_hits_inner.lock().expect("mutex should lock") += 1;
+            (StatusCode::OK, Body::from("unexpected upstream hit"))
+        }
+    }));
+
+    let user_repository = Arc::new(
+        InMemoryUserReadRepository::seed_auth_users(vec![
+            sample_admin_user("user-1"),
+            sample_admin_user_with_role("user-2", "user", "bob@example.com", "bob"),
+        ])
+        .with_export_users(vec![
+            sample_admin_export_user("user-1"),
+            sample_admin_export_user_with("user", true, "user-2", "bob@example.com", "bob"),
+        ]),
+    );
+    let group = user_repository
+        .create_user_group(UpsertUserGroupRecord {
+            name: "Baseline".to_string(),
+            description: None,
+            priority: 0,
+            allowed_providers: Some(vec!["openai".to_string()]),
+            allowed_providers_mode: "specific".to_string(),
+            allowed_api_formats: Some(vec!["openai:chat".to_string()]),
+            allowed_api_formats_mode: "specific".to_string(),
+            allowed_models: Some(vec!["gpt-4.1".to_string()]),
+            allowed_models_mode: "specific".to_string(),
+            rate_limit: Some(60),
+            rate_limit_mode: "custom".to_string(),
+        })
+        .await
+        .expect("user group should create")
+        .expect("user group should exist");
+    let group_id = group.id.clone();
+
+    let (upstream_url, upstream_handle) = start_server(upstream).await;
+    let gateway = build_router_with_state(
+        AppState::new()
+            .expect("gateway should build")
+            .with_data_state_for_tests(
+                GatewayDataState::with_user_reader_for_tests(user_repository.clone())
+                    .with_system_config_values_for_tests(Vec::<(String, serde_json::Value)>::new()),
+            ),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+    let client = reqwest::Client::new();
+
+    let default_response = client
+        .put(format!("{gateway_url}/api/admin/user-groups/default"))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({ "group_id": group_id }))
+        .send()
+        .await
+        .expect("request should succeed");
+    assert_eq!(default_response.status(), StatusCode::OK);
+    let default_payload: serde_json::Value = default_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(default_payload["default_group_id"], group_id);
+
+    let members = user_repository
+        .list_user_group_members(&group_id)
+        .await
+        .expect("default members should list");
+    assert_eq!(members.len(), 2);
+
+    let update_response = client
+        .put(format!("{gateway_url}/api/admin/user-groups/{group_id}"))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "name": "Baseline Limited",
+            "allowed_providers": ["openai", "anthropic"],
+            "allowed_providers_mode": "specific",
+            "allowed_api_formats": ["openai:chat"],
+            "allowed_api_formats_mode": "specific",
+            "allowed_models": ["gpt-4.1", "claude-sonnet-4-5"],
+            "allowed_models_mode": "specific",
+            "rate_limit": 25,
+            "rate_limit_mode": "custom"
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+    assert_eq!(update_response.status(), StatusCode::OK);
+    let update_payload: serde_json::Value = update_response
+        .json()
+        .await
+        .expect("json body should parse");
+    assert_eq!(update_payload["is_default"], true);
+    assert_eq!(update_payload["name"], "Baseline Limited");
+    assert_eq!(
+        update_payload["allowed_models"],
+        json!(["gpt-4.1", "claude-sonnet-4-5"])
+    );
+    assert_eq!(update_payload["rate_limit"], 25);
+
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_resolves_admin_user_batch_selection_locally() {
     let upstream_hits = Arc::new(Mutex::new(0usize));

crates/aether-data/migrations/mysql/20260509120000_add_user_groups.sql

@@ -69,7 +69,7 @@ VALUES (
     '00000000-0000-0000-0000-000000000001',
     'Default',
     'default',
-    'Default unrestricted group for all users',
+    'Default group for all users',
     0,
     'unrestricted',
     'unrestricted',
@@ -91,7 +91,7 @@ VALUES (
     '00000000-0000-0000-0000-000000000002',
     'default_user_group_id',
     '"00000000-0000-0000-0000-000000000001"',
-    'Default unrestricted user group',
+    'Default user group',
     UNIX_TIMESTAMP(),
     UNIX_TIMESTAMP()
 );

crates/aether-data/migrations/postgres/20260509120000_add_user_groups.sql

@@ -74,7 +74,7 @@ VALUES (
     '00000000-0000-0000-0000-000000000001',
     'Default',
     'default',
-    'Default unrestricted group for all users',
+    'Default group for all users',
     0,
     'unrestricted',
     'unrestricted',
@@ -88,7 +88,7 @@ VALUES (
     '00000000-0000-0000-0000-000000000002',
     'default_user_group_id',
     '"00000000-0000-0000-0000-000000000001"'::json,
-    'Default unrestricted user group',
+    'Default user group',
     now(),
     now()
 )

crates/aether-data/migrations/sqlite/20260509120000_add_user_groups.sql

@@ -67,7 +67,7 @@ VALUES (
     '00000000-0000-0000-0000-000000000001',
     'Default',
     'default',
-    'Default unrestricted group for all users',
+    'Default group for all users',
     0,
     'unrestricted',
     'unrestricted',
@@ -89,7 +89,7 @@ VALUES (
     '00000000-0000-0000-0000-000000000002',
     'default_user_group_id',
     '"00000000-0000-0000-0000-000000000001"',
-    'Default unrestricted user group',
+    'Default user group',
     CAST(strftime('%s', 'now') AS INTEGER),
     CAST(strftime('%s', 'now') AS INTEGER)
 );

crates/aether-data/schema/bootstrap/postgres/006_footer.sql

@@ -15,7 +15,7 @@ VALUES (
     '00000000-0000-0000-0000-000000000001',
     'Default',
     'default',
-    'Default unrestricted group for all users',
+    'Default group for all users',
     0,
     'unrestricted',
     'unrestricted',
@@ -29,7 +29,7 @@ VALUES (
     '00000000-0000-0000-0000-000000000002',
     'default_user_group_id',
     '"00000000-0000-0000-0000-000000000001"'::json,
-    'Default unrestricted user group'
+    'Default user group'
 )
 ON CONFLICT (key) DO NOTHING;
 

crates/aether-data/src/repository/auth/types.rs

@@ -154,7 +154,7 @@ pub struct ResolvedAuthApiKeySnapshot {
 impl ResolvedAuthApiKeySnapshot {
     pub fn from_stored(snapshot: StoredAuthApiKeySnapshot, now_unix_secs: u64) -> Self {
         let currently_usable = snapshot.is_currently_usable(now_unix_secs);
-        Self {
+        let mut resolved = Self {
             user_id: snapshot.user_id,
             username: snapshot.username,
             email: snapshot.email,
@@ -178,7 +178,9 @@ impl ResolvedAuthApiKeySnapshot {
             api_key_allowed_api_formats: snapshot.api_key_allowed_api_formats,
             api_key_allowed_models: snapshot.api_key_allowed_models,
             currently_usable,
-        }
+        };
+        resolved.constrain_non_standalone_api_key_policy_to_user_policy();
+        resolved
     }
 
     pub fn effective_allowed_providers(&self) -> Option<&[String]> {
@@ -186,7 +188,8 @@ impl ResolvedAuthApiKeySnapshot {
             return non_empty_allowed_list(self.api_key_allowed_providers.as_deref());
         }
 
-        non_empty_allowed_list(self.api_key_allowed_providers.as_deref())
+        self.api_key_allowed_providers
+            .as_deref()
             .or(self.user_allowed_providers.as_deref())
     }
 
@@ -195,7 +198,8 @@ impl ResolvedAuthApiKeySnapshot {
             return non_empty_allowed_list(self.api_key_allowed_api_formats.as_deref());
         }
 
-        non_empty_allowed_list(self.api_key_allowed_api_formats.as_deref())
+        self.api_key_allowed_api_formats
+            .as_deref()
             .or(self.user_allowed_api_formats.as_deref())
     }
 
@@ -204,7 +208,8 @@ impl ResolvedAuthApiKeySnapshot {
             return non_empty_allowed_list(self.api_key_allowed_models.as_deref());
         }
 
-        non_empty_allowed_list(self.api_key_allowed_models.as_deref())
+        self.api_key_allowed_models
+            .as_deref()
             .or(self.user_allowed_models.as_deref())
     }
 
@@ -219,6 +224,25 @@ impl ResolvedAuthApiKeySnapshot {
         self.user_allowed_api_formats = allowed_api_formats;
         self.user_allowed_models = allowed_models;
         self.user_rate_limit = rate_limit;
+        self.constrain_non_standalone_api_key_policy_to_user_policy();
+    }
+
+    fn constrain_non_standalone_api_key_policy_to_user_policy(&mut self) {
+        if self.api_key_is_standalone {
+            return;
+        }
+        constrain_api_key_list_policy_to_user_policy(
+            &mut self.user_allowed_providers,
+            &mut self.api_key_allowed_providers,
+        );
+        constrain_api_key_list_policy_to_user_policy(
+            &mut self.user_allowed_api_formats,
+            &mut self.api_key_allowed_api_formats,
+        );
+        constrain_api_key_list_policy_to_user_policy(
+            &mut self.user_allowed_models,
+            &mut self.api_key_allowed_models,
+        );
     }
 }
 
@@ -226,6 +250,29 @@ fn non_empty_allowed_list(values: Option<&[String]>) -> Option<&[String]> {
     values.filter(|items| !items.is_empty())
 }
 
+fn constrain_api_key_list_policy_to_user_policy(
+    user_policy: &mut Option<Vec<String>>,
+    api_key_policy: &mut Option<Vec<String>>,
+) {
+    let Some(api_key_values) = api_key_policy.as_ref() else {
+        return;
+    };
+    let Some(user_values) = user_policy.clone() else {
+        return;
+    };
+    let effective = intersect_allowed_lists(api_key_values, &user_values);
+    *user_policy = Some(effective.clone());
+    *api_key_policy = Some(effective);
+}
+
+fn intersect_allowed_lists(left: &[String], right: &[String]) -> Vec<String> {
+    let right_values = right.iter().collect::<std::collections::BTreeSet<_>>();
+    left.iter()
+        .filter(|value| right_values.contains(*value))
+        .cloned()
+        .collect()
+}
+
 #[async_trait]
 pub trait ResolvedAuthApiKeySnapshotReader: Send + Sync {
     async fn find_stored_auth_api_key_snapshot(
@@ -827,7 +874,7 @@ mod tests {
     }
 
     #[test]
-    fn resolved_snapshot_prefers_api_key_lists_over_user_lists() {
+    fn non_standalone_snapshot_intersects_api_key_and_user_allowed_lists() {
         let snapshot = StoredAuthApiKeySnapshot::new(
             "user-1".to_string(),
             "alice".to_string(),
@@ -847,9 +894,9 @@ mod tests {
             Some(60),
             Some(5),
             Some(200),
-            Some(serde_json::json!(["anthropic"])),
+            Some(serde_json::json!(["anthropic", "openai"])),
-            None,
+            Some(serde_json::json!(["claude:messages"])),
-            None,
+            Some(serde_json::json!(["gpt-5"])),
         )
         .expect("snapshot should build");
 
@@ -858,16 +905,56 @@ mod tests {
         assert!(resolved.currently_usable);
         assert_eq!(
             resolved.effective_allowed_providers(),
-            Some(&["anthropic".to_string()][..])
+            Some(&["openai".to_string()][..])
+        );
+        assert_eq!(resolved.effective_allowed_api_formats(), Some(&[][..]));
+        assert_eq!(resolved.effective_allowed_models(), Some(&[][..]));
+    }
+
+    #[test]
+    fn applying_user_group_policy_keeps_non_standalone_key_at_intersection() {
+        let snapshot = StoredAuthApiKeySnapshot::new(
+            "user-1".to_string(),
+            "alice".to_string(),
+            None,
+            "user".to_string(),
+            "local".to_string(),
+            true,
+            false,
+            None,
+            None,
+            None,
+            "key-1".to_string(),
+            Some("default".to_string()),
+            true,
+            false,
+            false,
+            Some(60),
+            Some(5),
+            Some(200),
+            Some(serde_json::json!(["openai", "anthropic"])),
+            Some(serde_json::json!(["openai:chat", "claude:messages"])),
+            Some(serde_json::json!(["gpt-4.1", "claude-sonnet-4-5"])),
+        )
+        .expect("snapshot should build");
+
+        let mut resolved = ResolvedAuthApiKeySnapshot::from_stored(snapshot, 150);
+        resolved.apply_user_policy(
+            Some(vec!["openai".to_string(), "gemini".to_string()]),
+            Some(vec!["openai:chat".to_string()]),
+            Some(vec!["gpt-5".to_string()]),
+            Some(60),
+        );
+
+        assert_eq!(
+            resolved.effective_allowed_providers(),
+            Some(&["openai".to_string()][..])
         );
         assert_eq!(
             resolved.effective_allowed_api_formats(),
             Some(&["openai:chat".to_string()][..])
         );
-        assert_eq!(
+        assert_eq!(resolved.effective_allowed_models(), Some(&[][..]));
-            resolved.effective_allowed_models(),
-            Some(&["gpt-4.1".to_string()][..])
-        );
     }
 
     #[test]
@@ -992,6 +1079,40 @@ mod tests {
         );
     }
 
+    #[test]
+    fn non_standalone_snapshot_keeps_empty_key_allowed_lists_as_deny_all() {
+        let snapshot = StoredAuthApiKeySnapshot::new(
+            "user-1".to_string(),
+            "alice".to_string(),
+            None,
+            "user".to_string(),
+            "local".to_string(),
+            true,
+            false,
+            Some(serde_json::json!(["openai"])),
+            Some(serde_json::json!(["openai:chat"])),
+            Some(serde_json::json!(["gpt-4.1"])),
+            "user-key".to_string(),
+            Some("default".to_string()),
+            true,
+            false,
+            false,
+            Some(60),
+            None,
+            None,
+            Some(serde_json::json!([])),
+            Some(serde_json::json!([])),
+            Some(serde_json::json!([])),
+        )
+        .expect("snapshot should build");
+
+        let resolved = ResolvedAuthApiKeySnapshot::from_stored(snapshot, 150);
+
+        assert_eq!(resolved.effective_allowed_providers(), Some(&[][..]));
+        assert_eq!(resolved.effective_allowed_api_formats(), Some(&[][..]));
+        assert_eq!(resolved.effective_allowed_models(), Some(&[][..]));
+    }
+
     #[test]
     fn standalone_snapshot_treats_empty_key_allowed_lists_as_unrestricted() {
         let snapshot = StoredAuthApiKeySnapshot::new(

frontend/src/features/users/components/UserGroupsDialog.vue

@@ -139,7 +139,6 @@
                 <div class="flex w-full items-center sm:w-auto sm:shrink-0">
                   <Switch
                     :model-value="form.allowed_providers_mode === 'unrestricted'"
-                    :disabled="selectedGroup?.is_default"
                     @update:model-value="(v) => (form.allowed_providers_mode = v ? 'unrestricted' : 'specific')"
                   />
                 </div>
@@ -148,7 +147,7 @@
                     v-model="form.allowed_providers"
                     :options="providerOptions"
                     :search-threshold="0"
-                    :disabled="selectedGroup?.is_default || form.allowed_providers_mode === 'unrestricted'"
+                    :disabled="form.allowed_providers_mode === 'unrestricted'"
                     :placeholder="form.allowed_providers_mode === 'unrestricted' ? '不限制所有选项' : '选择提供商'"
                     empty-text="暂无选项"
                   />
@@ -162,7 +161,6 @@
                 <div class="flex w-full items-center sm:w-auto sm:shrink-0">
                   <Switch
                     :model-value="form.allowed_api_formats_mode === 'unrestricted'"
-                    :disabled="selectedGroup?.is_default"
                     @update:model-value="(v) => (form.allowed_api_formats_mode = v ? 'unrestricted' : 'specific')"
                   />
                 </div>
@@ -171,7 +169,7 @@
                     v-model="form.allowed_api_formats"
                     :options="apiFormatOptions"
                     :search-threshold="0"
-                    :disabled="selectedGroup?.is_default || form.allowed_api_formats_mode === 'unrestricted'"
+                    :disabled="form.allowed_api_formats_mode === 'unrestricted'"
                     :placeholder="form.allowed_api_formats_mode === 'unrestricted' ? '不限制所有选项' : '选择端点'"
                     empty-text="暂无选项"
                   />
@@ -185,7 +183,6 @@
                 <div class="flex w-full items-center sm:w-auto sm:shrink-0">
                   <Switch
                     :model-value="form.allowed_models_mode === 'unrestricted'"
-                    :disabled="selectedGroup?.is_default"
                     @update:model-value="(v) => (form.allowed_models_mode = v ? 'unrestricted' : 'specific')"
                   />
                 </div>
@@ -194,7 +191,7 @@
                     v-model="form.allowed_models"
                     :options="modelOptions"
                     :search-threshold="0"
-                    :disabled="selectedGroup?.is_default || form.allowed_models_mode === 'unrestricted'"
+                    :disabled="form.allowed_models_mode === 'unrestricted'"
                     :placeholder="form.allowed_models_mode === 'unrestricted' ? '不限制所有选项' : '选择模型'"
                     empty-text="暂无选项"
                   />
@@ -208,7 +205,6 @@
                 <div class="flex w-full items-center sm:w-auto sm:shrink-0">
                   <Switch
                     :model-value="form.rate_limit_mode === 'system'"
-                    :disabled="selectedGroup?.is_default"
                     @update:model-value="(v) => (form.rate_limit_mode = v ? 'system' : 'custom')"
                   />
                 </div>
@@ -219,7 +215,7 @@
                     min="0"
                     max="10000"
                     class="h-10"
-                    :disabled="selectedGroup?.is_default || form.rate_limit_mode === 'system'"
+                    :disabled="form.rate_limit_mode === 'system'"
                     :placeholder="form.rate_limit_mode === 'system' ? '使用系统默认' : '0 = 不限速'"
                     @update:model-value="(value) => form.rate_limit = parseNumberInput(value, { min: 0, max: 10000 })"
                   />
@@ -240,7 +236,7 @@
         关闭
       </Button>
       <Button
-        :disabled="saving || !form.name.trim() || defaultGroupHasRestrictions"
+        :disabled="saving || !form.name.trim()"
         @click="saveGroup"
       >
         保存
@@ -299,7 +295,6 @@ const {
 const loading = ref(false)
 const saving = ref(false)
 const groups = ref<UserGroup[]>([])
-const defaultGroupId = ref<string | null>(null)
 const editingGroupId = ref<string | null>(null)
 const memberUserIds = ref<string[]>([])
 
@@ -316,13 +311,6 @@ const form = ref({
 })
 
 const selectedGroup = computed(() => groups.value.find((group) => group.id === editingGroupId.value) ?? null)
-const defaultGroupHasRestrictions = computed(() => {
-  if (!selectedGroup.value?.is_default) return false
-  return form.value.allowed_providers_mode !== 'unrestricted'
-    || form.value.allowed_api_formats_mode !== 'unrestricted'
-    || form.value.allowed_models_mode !== 'unrestricted'
-    || form.value.rate_limit_mode !== 'system'
-})
 const userOptions = computed(() => props.users.map((user) => ({
   label: `${user.username}${user.email ? ` (${user.email})` : ''}`,
   value: user.id,
@@ -348,7 +336,6 @@ async function loadDialogData(): Promise<void> {
   try {
     const response = await usersStore.listUserGroups()
     groups.value = response.items
-    defaultGroupId.value = response.default_group_id ?? null
     if (editingGroupId.value && !groups.value.some((group) => group.id === editingGroupId.value)) {
       editingGroupId.value = null
     }