address at route level

icecrasher321 · icecrasher321 · commit da3bc56fe6d6 · 2026-06-15T17:29:12.000-07:00
diff --git a/apps/sim/app/api/organizations/[id]/permission-groups/[groupId]/route.ts b/apps/sim/app/api/organizations/[id]/permission-groups/[groupId]/route.ts
@@ -128,6 +128,15 @@ export const PUT = withRouteHandler(
               ? false
               : group.appliesToAllWorkspaces
 
+      const effectiveIsDefault =
+        updates.isDefault !== undefined ? updates.isDefault : group.isDefault
+      if (effectiveIsDefault && !resolvedAppliesToAll) {
+        return NextResponse.json(
+          { error: 'The default group must apply to all workspaces' },
+          { status: 400 }
+        )
+      }
+
       // Resolve and validate explicitly-provided workspaceIds before the
       // transaction. When the request omits them for a specific-scope group
       // ("keep current"), they're read under the lock instead (see below) so the
