From 086573438704fb2492999590c4abcee127e13677 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Tue, 3 Mar 2026 13:28:28 +0100
Subject: [PATCH] validate restricted objects selection

---
 web/src/pages/CERulePage/CERulePage.tsx | 34 ++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/web/src/pages/CERulePage/CERulePage.tsx b/web/src/pages/CERulePage/CERulePage.tsx
index 1685ad6160..4e7c28697b 100644
--- a/web/src/pages/CERulePage/CERulePage.tsx
+++ b/web/src/pages/CERulePage/CERulePage.tsx
@@ -352,6 +352,38 @@ const Content = ({ rule: initialRule }: Props) => {
             }
           }
 
+          if (restrictUsers && !vals.deny_all_users && vals.denied_users.length === 0) {
+            ctx.addIssue({
+              path: ['denied_users'],
+              code: 'custom',
+              message: m.form_select_at_least_one(),
+            });
+          }
+
+          if (
+            restrictGroups &&
+            !vals.deny_all_groups &&
+            vals.denied_groups.length === 0
+          ) {
+            ctx.addIssue({
+              path: ['denied_groups'],
+              code: 'custom',
+              message: m.form_select_at_least_one(),
+            });
+          }
+
+          if (
+            restrictDevices &&
+            !vals.deny_all_network_devices &&
+            vals.denied_network_devices.length === 0
+          ) {
+            ctx.addIssue({
+              path: ['denied_network_devices'],
+              code: 'custom',
+              message: m.form_select_at_least_one(),
+            });
+          }
+
           // check if one of allowed users/groups/devices fields is set
           const isAllowConfigured =
             vals.allow_all_users ||
@@ -411,7 +443,7 @@ const Content = ({ rule: initialRule }: Props) => {
             });
           }
         }),
-    [],
+    [restrictDevices, restrictGroups, restrictUsers],
   );
 
   type FormFields = z.infer<typeof formSchema>;