fix(simple-mode): guard non-empty group deletion

backend/internal/handler/admin/admin_service_stub_test.go

@@ -26,6 +26,9 @@ type stubAdminService struct {
 	createdAccounts                     []*service.CreateAccountInput
 	createdGroups                       []*service.CreateGroupInput
 	updatedGroups                       []*service.UpdateGroupInput
+	deletedGroupIDs                     []int64
+	guardedDeletedGroupIDs              []int64
+	deleteGroupIfEmptyErr               error
 	advancedGroupOperationCalls         int
 	lastListGroupsIsExclusive           *bool
 	createdProxies                      []*service.CreateProxyInput
@@ -385,9 +388,15 @@ func (s *stubAdminService) UpdateGroup(ctx context.Context, id int64, input *ser
 }
 
 func (s *stubAdminService) DeleteGroup(ctx context.Context, id int64) error {
+	s.deletedGroupIDs = append(s.deletedGroupIDs, id)
 	return nil
 }
 
+func (s *stubAdminService) DeleteGroupIfEmpty(ctx context.Context, id int64) error {
+	s.guardedDeletedGroupIDs = append(s.guardedDeletedGroupIDs, id)
+	return s.deleteGroupIfEmptyErr
+}
+
 func (s *stubAdminService) GetGroupAPIKeys(ctx context.Context, groupID int64, page, pageSize int) ([]service.APIKey, int64, error) {
 	return s.apiKeys, int64(len(s.apiKeys)), nil
 }

backend/internal/handler/admin/group_handler.go

@@ -889,7 +889,11 @@ func (h *GroupHandler) Delete(c *gin.Context) {
 		return
 	}
 
-	err = h.adminService.DeleteGroup(c.Request.Context(), groupID)
+	if h.isSimpleMode() {
+		err = h.adminService.DeleteGroupIfEmpty(c.Request.Context(), groupID)
+	} else {
+		err = h.adminService.DeleteGroup(c.Request.Context(), groupID)
+	}
 	if err != nil {
 		response.ErrorFrom(c, err)
 		return

backend/internal/handler/admin/group_handler_simple_mode_test.go

@@ -106,6 +106,31 @@ func TestGroupHandlerSimpleModeRejectsCompositeBeforeService(t *testing.T) {
 	require.Empty(t, svc.createdGroups)
 }
 
+func TestGroupHandlerSimpleModeDeleteRejectsNonEmptyGroupBeforeCascade(t *testing.T) {
+	svc := newStubAdminService()
+	svc.deleteGroupIfEmptyErr = service.ErrGroupNotEmpty
+	r := newSimpleModeGroupRouter(svc)
+	res := httptest.NewRecorder()
+
+	r.ServeHTTP(res, httptest.NewRequest(http.MethodDelete, "/groups/7", nil))
+
+	require.Equal(t, http.StatusConflict, res.Code)
+	require.Equal(t, []int64{7}, svc.guardedDeletedGroupIDs)
+	require.Empty(t, svc.deletedGroupIDs)
+}
+
+func TestGroupHandlerSimpleModeDeletePermitsEmptyGroup(t *testing.T) {
+	svc := newStubAdminService()
+	r := newSimpleModeGroupRouter(svc)
+	res := httptest.NewRecorder()
+
+	r.ServeHTTP(res, httptest.NewRequest(http.MethodDelete, "/groups/8", nil))
+
+	require.Equal(t, http.StatusOK, res.Code)
+	require.Equal(t, []int64{8}, svc.guardedDeletedGroupIDs)
+	require.Empty(t, svc.deletedGroupIDs)
+}
+
 func TestGroupHandlerSimpleModeIgnoresExclusiveFilter(t *testing.T) {
 	svc := newStubAdminService()
 	r := newSimpleModeGroupRouter(svc)