From 4429fcff4d870afb72c4e75c8eb036cfd5d3cfcf Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 21 Aug 2026 02:16:49 +0200
Subject: [PATCH 01/21] posture checks part of location update

---
 .../defguard_core/src/handlers/wireguard.rs   | 12 ++++
 .../tests/integration/api/wireguard.rs        | 45 +++++++++++---
 .../EditLocationPage/EditLocationPage.tsx     | 58 ++++++++++---------
 web/src/shared/api/api.ts                     |  3 -
 web/src/shared/api/types.ts                   |  5 +-
 5 files changed, 81 insertions(+), 42 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 9d2d1c180..38dc375f2 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -470,6 +470,18 @@ pub(crate) async fn modify_network(
         .set_allowed_groups(&mut transaction, &data.allowed_groups)
         .await?;
 
+    if let Some(posture_checks) = &data.posture_checks {
+        if !has_enterprise_access(Some(LicenseFeature::DevicePosture)) && !posture_checks.is_empty()
+        {
+            return Ok(WebError::Forbidden(
+                "Cannot assign posture checks to location: Enterprise license required.",
+            )
+            .into());
+        }
+        DevicePostureLocation::set_for_location(&mut transaction, network.id, posture_checks)
+            .await?;
+    }
+
     let _events = sync_location_allowed_devices(&network, &mut transaction, None).await?;
 
     let peers = get_location_allowed_peers(&network, &mut transaction).await?;
diff --git a/crates/defguard_core/tests/integration/api/wireguard.rs b/crates/defguard_core/tests/integration/api/wireguard.rs
index 61d1ae59a..3c8eb6098 100644
--- a/crates/defguard_core/tests/integration/api/wireguard.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard.rs
@@ -854,7 +854,7 @@ async fn test_modify_network_rejects_service_location_with_mfa(
 }
 
 #[sqlx::test]
-async fn test_modify_network_without_posture_checks_keeps_assignments(
+async fn test_modify_network_updates_posture_checks_only_when_supplied(
     _: PgPoolOptions,
     options: PgConnectOptions,
 ) {
@@ -864,6 +864,7 @@ async fn test_modify_network_without_posture_checks_keeps_assignments(
     set_enterprise_license();
 
     let posture = make_posture_check(&client, "Posture").await;
+    let replacement_posture = make_posture_check(&client, "Replacement posture").await;
 
     let mut payload = location_payload("location", "10.1.1.1/24", false, "disabled");
     payload["posture_checks"] = json!([posture]);
@@ -875,11 +876,27 @@ async fn test_modify_network_without_posture_checks_keeps_assignments(
         vec![posture]
     );
 
-    // a payload with the field omitted must leave the assignment alone
+    // an explicit list replaces the current assignments with the location save
+    let mut payload = location_payload("renamed-location", "10.1.1.1/24", false, "disabled");
+    payload["posture_checks"] = json!([replacement_posture]);
+    let response = client
+        .put(format!("/api/v1/network/{}", location.id))
+        .json(&payload)
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let modified: WireguardNetwork<Id> = response.json().await;
+    assert_eq!(modified.name, "renamed-location");
+    assert_eq!(
+        fetch_location_postures(&client, location.id).await,
+        vec![replacement_posture]
+    );
+
+    // a payload with the field omitted or explicitly null keeps assignments for compatibility
     let response = client
         .put(format!("/api/v1/network/{}", location.id))
         .json(&location_payload(
-            "renamed-location",
+            "location",
             "10.1.1.1/24",
             false,
             "disabled",
@@ -887,14 +904,11 @@ async fn test_modify_network_without_posture_checks_keeps_assignments(
         .send()
         .await;
     assert_eq!(response.status(), StatusCode::OK);
-    let modified: WireguardNetwork<Id> = response.json().await;
-    assert_eq!(modified.name, "renamed-location");
     assert_eq!(
         fetch_location_postures(&client, location.id).await,
-        vec![posture]
+        vec![replacement_posture]
     );
 
-    // an explicit `null` behaves the same way
     let mut payload = location_payload("location", "10.1.1.1/24", false, "disabled");
     payload["posture_checks"] = json!(null);
     let response = client
@@ -905,7 +919,22 @@ async fn test_modify_network_without_posture_checks_keeps_assignments(
     assert_eq!(response.status(), StatusCode::OK);
     assert_eq!(
         fetch_location_postures(&client, location.id).await,
-        vec![posture]
+        vec![replacement_posture]
+    );
+
+    // an explicit empty list clears assignments
+    let mut payload = location_payload("location", "10.1.1.1/24", false, "disabled");
+    payload["posture_checks"] = json!([]);
+    let response = client
+        .put(format!("/api/v1/network/{}", location.id))
+        .json(&payload)
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    assert!(
+        fetch_location_postures(&client, location.id)
+            .await
+            .is_empty()
     );
 }
 
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index 849696c6c..4ba0a7f9b 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -3,7 +3,7 @@ import './style.scss';
 import { useMutation, useQuery, useSuspenseQuery } from '@tanstack/react-query';
 import { Link, useNavigate, useParams } from '@tanstack/react-router';
 import { cloneDeep, omit } from 'lodash-es';
-import { useMemo } from 'react';
+import { useMemo, useState } from 'react';
 import z from 'zod';
 import { m } from '../../paraglide/messages';
 import api from '../../shared/api/api';
@@ -371,16 +371,22 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
   });
   const serviceLocationLocked =
     isPresent(canUseServiceLocations) && !canUseServiceLocations;
+  const [pendingPostureChecks, setPendingPostureChecks] = useState(
+    location.posture_checks ?? [],
+  );
   const postureChecksSectionState = useMemo(
     () =>
       getPostureChecksSectionState({
-        assignedPostureChecksCount: location.posture_checks?.length ?? 0,
+        assignedPostureChecksCount: pendingPostureChecks.length,
         canUseEnterprise: canUseDevicePosture,
         postureChecksCount: postureChecks.length,
       }),
-    [canUseDevicePosture, location.posture_checks?.length, postureChecks.length],
+    [canUseDevicePosture, pendingPostureChecks.length, postureChecks.length],
   );
   const firewallLocked = isPresent(canUseBusiness) && !canUseBusiness;
+  const hasPendingPostureCheckChanges =
+    pendingPostureChecks.length !== (location.posture_checks?.length ?? 0) ||
+    pendingPostureChecks.some((id) => !location.posture_checks?.includes(id));
 
   const postureCheckOptions = useMemo(
     () =>
@@ -464,26 +470,10 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
     },
   });
 
-  const { mutateAsync: setLocationPosturesAsync, isPending: isUpdatingLocationPostures } =
-    useMutation({
-      mutationFn: (data: { postures: number[] }) =>
-        api.devicePosture.setLocationPostures(location.id, data),
-      meta: {
-        invalidate: [['device-posture'], ['network'], ['activity-log']],
-      },
-      onError: () => {
-        Snackbar.error(m.location_posture_checks_update_failed());
-      },
-    });
-
   const handlePostureSelection = (values: (string | number)[]) => {
-    const next = values.filter((value): value is number => typeof value === 'number');
-    confirmLocationPostureChange({
-      current: location.posture_checks ?? [],
-      next,
-      options: postureCheckOptions,
-      actionPromise: () => setLocationPosturesAsync({ postures: next }),
-    });
+    setPendingPostureChecks(
+      values.filter((value): value is number => typeof value === 'number'),
+    );
   };
 
   const openPostureChecksSelection = () => {
@@ -499,7 +489,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
         unknown
       >,
       searchPlaceholder: m.controls_search(),
-      selected: new Set(location.posture_checks),
+      selected: new Set(pendingPostureChecks),
       visibleItemsLimit: 4,
       onSubmit: handlePostureSelection,
     });
@@ -531,7 +521,10 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
   const submitLocationChanges = async (value: FormFields) => {
     await editLocation({
       id: location.id,
-      data: buildLocationSubmissionData(value, location),
+      data: {
+        ...buildLocationSubmissionData(value, location),
+        posture_checks: pendingPostureChecks,
+      },
     });
   };
 
@@ -576,6 +569,17 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
         return;
       }
 
+      if (
+        confirmLocationPostureChange({
+          current: location.posture_checks ?? [],
+          next: pendingPostureChecks,
+          options: postureCheckOptions,
+          actionPromise: () => submitLocationChanges(value),
+        })
+      ) {
+        return;
+      }
+
       await submitLocationChanges(value);
     },
   });
@@ -914,7 +918,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
             <div className="posture-checks-assigned-state">
               <SelectMultiple
                 options={postureCheckOptions}
-                selected={new Set(location.posture_checks)}
+                selected={new Set(pendingPostureChecks)}
                 modalTitle={m.location_posture_checks_select()}
                 editText={m.location_posture_checks_edit()}
                 editIcon={IconKind.Edit}
@@ -937,7 +941,6 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
             <Button
               variant="outlined"
               iconLeft={IconKind.ConnectedDevices}
-              loading={isUpdatingLocationPostures}
               text={m.posture_checks_wizard_title()}
               onClick={openPostureChecksSelection}
             />
@@ -956,7 +959,8 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
         <form.Subscribe
           selector={(form) => ({
             isSubmitting: form.isSubmitting,
-            isDefault: form.isPristine || form.isDefaultValue,
+            isDefault:
+              (form.isPristine || form.isDefaultValue) && !hasPendingPostureCheckChanges,
           })}
         >
           {({ isDefault, isSubmitting }) => (
diff --git a/web/src/shared/api/api.ts b/web/src/shared/api/api.ts
index 14bfe70d7..e4c419361 100644
--- a/web/src/shared/api/api.ts
+++ b/web/src/shared/api/api.ts
@@ -32,7 +32,6 @@ import type {
   ApiDevicePosture,
   ApiToken,
   ApplicationInfo,
-  AssignPosturesData,
   AssignStaticIpsRequest,
   AuthKey,
   AvailableLocationIpResponse,
@@ -472,8 +471,6 @@ const api = {
       fetchPage<ApiDevicePosture>('/device-posture', params),
     setLocationsForDevicePosture: (id: number, locations: number[]) =>
       client.put<number[]>(`/device-posture/${id}/locations`, { locations }),
-    setLocationPostures: (locationId: number, data: AssignPosturesData) =>
-      client.put<number[]>(`/network/${locationId}/postures`, data),
   },
   settings: {
     getSettings: () => client.get<Settings>('/settings'),
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 8fe796656..d744ff312 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -839,6 +839,7 @@ export interface EditNetworkLocation
   > {
   allowed_ips: string;
   address: string;
+  posture_checks?: number[];
 }
 
 export interface EditNetworkLocationRequest {
@@ -1019,10 +1020,6 @@ export interface ApiDevicePosture {
   locations: number[];
 }
 
-export interface AssignPosturesData {
-  postures: number[];
-}
-
 export interface EditDevicePostureRequest {
   name: string;
   description: string | null;

From 4ef4a23096f53f72605a456c156cb0e91a71a1b7 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 21 Aug 2026 02:28:33 +0200
Subject: [PATCH 02/21] posture checks non-optional

---
 .../defguard_core/src/handlers/wireguard.rs   | 57 ++++++++++---------
 .../tests/integration/api/wireguard.rs        | 44 +++-----------
 .../api/wireguard_network_allowed_groups.rs   |  4 +-
 .../EditLocationPage/EditLocationPage.tsx     |  1 +
 web/src/shared/api/types.ts                   |  2 +-
 5 files changed, 41 insertions(+), 67 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 38dc375f2..4de697b06 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -86,7 +86,7 @@ pub struct WireguardNetworkData {
     pub allowed_ips_from_acl: bool,
     pub mfa_enabled: bool,
     pub service_location_mode: ServiceLocationMode,
-    pub posture_checks: Option<Vec<i64>>,
+    pub posture_checks: Vec<Id>,
 }
 
 const MIN_PEER_DISCONNECT_THRESHOLD_WITH_MFA: i32 = 120;
@@ -337,23 +337,27 @@ pub(crate) async fn create_network(
     network.add_all_allowed_devices(&mut transaction).await?;
     info!("Assigning IPs for existing devices in network {network}");
 
-    // assign posture checks
-    if let Some(ref posture_checks) = data.posture_checks {
-        debug!("Assigning posture checks {posture_checks:?} to {network}");
-        if !has_enterprise_access(Some(LicenseFeature::DevicePosture)) && !posture_checks.is_empty()
-        {
-            error!(
-                "Cannot assign posture checks to new location {network}: Enterprise license required."
-            );
-            return Ok(WebError::Forbidden(
-                "Cannot assign posture checks to new location: Enterprise license required.",
-            )
-            .into());
-        }
-        DevicePostureLocation::set_for_location(&mut transaction, network.id, posture_checks)
-            .await?;
-        info!("Assigned posture checks {posture_checks:?} to new location {network}");
+    debug!(
+        "Assigning posture checks {:?} to {network}",
+        data.posture_checks
+    );
+    if !has_enterprise_access(Some(LicenseFeature::DevicePosture))
+        && !data.posture_checks.is_empty()
+    {
+        error!(
+            "Cannot assign posture checks to new location {network}: Enterprise license required."
+        );
+        return Ok(WebError::Forbidden(
+            "Cannot assign posture checks to new location: Enterprise license required.",
+        )
+        .into());
     }
+    DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
+        .await?;
+    info!(
+        "Assigned posture checks {:?} to new location {network}",
+        data.posture_checks
+    );
 
     transaction.commit().await?;
 
@@ -470,17 +474,16 @@ pub(crate) async fn modify_network(
         .set_allowed_groups(&mut transaction, &data.allowed_groups)
         .await?;
 
-    if let Some(posture_checks) = &data.posture_checks {
-        if !has_enterprise_access(Some(LicenseFeature::DevicePosture)) && !posture_checks.is_empty()
-        {
-            return Ok(WebError::Forbidden(
-                "Cannot assign posture checks to location: Enterprise license required.",
-            )
-            .into());
-        }
-        DevicePostureLocation::set_for_location(&mut transaction, network.id, posture_checks)
-            .await?;
+    if !has_enterprise_access(Some(LicenseFeature::DevicePosture))
+        && !data.posture_checks.is_empty()
+    {
+        return Ok(WebError::Forbidden(
+            "Cannot assign posture checks to location: Enterprise license required.",
+        )
+        .into());
     }
+    DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
+        .await?;
 
     let _events = sync_location_allowed_devices(&network, &mut transaction, None).await?;
 
diff --git a/crates/defguard_core/tests/integration/api/wireguard.rs b/crates/defguard_core/tests/integration/api/wireguard.rs
index 3c8eb6098..a8e832494 100644
--- a/crates/defguard_core/tests/integration/api/wireguard.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard.rs
@@ -84,7 +84,7 @@ async fn test_network(_: PgPoolOptions, options: PgConnectOptions) {
         allowed_ips_from_acl: false,
         mfa_enabled: false,
         service_location_mode: ServiceLocationMode::Disabled,
-        posture_checks: None,
+        posture_checks: Vec::new(),
     };
     let response = client
         .put(format!("/api/v1/network/{}", network.id))
@@ -344,7 +344,6 @@ async fn test_create_network_with_posture_checks_requires_enterprise_license(
 }
 
 /// Build a location payload with overridable name, address and mode fields.
-/// `posture_checks` is intentionally absent — add it explicitly where it matters.
 fn location_payload(
     name: &str,
     address: &str,
@@ -368,7 +367,8 @@ fn location_payload(
         "acl_default_allow": false,
         "allowed_ips_from_acl": false,
         "mfa_enabled": mfa_enabled,
-        "service_location_mode": service_location_mode
+        "service_location_mode": service_location_mode,
+        "posture_checks": []
     })
 }
 
@@ -854,10 +854,7 @@ async fn test_modify_network_rejects_service_location_with_mfa(
 }
 
 #[sqlx::test]
-async fn test_modify_network_updates_posture_checks_only_when_supplied(
-    _: PgPoolOptions,
-    options: PgConnectOptions,
-) {
+async fn test_modify_network_replaces_posture_checks(_: PgPoolOptions, options: PgConnectOptions) {
     let pool = setup_pool(options).await;
     let (mut client, _client_state) = make_test_client(pool).await;
     authenticate_admin(&mut client).await;
@@ -892,7 +889,7 @@ async fn test_modify_network_updates_posture_checks_only_when_supplied(
         vec![replacement_posture]
     );
 
-    // a payload with the field omitted or explicitly null keeps assignments for compatibility
+    // an empty list clears assignments
     let response = client
         .put(format!("/api/v1/network/{}", location.id))
         .json(&location_payload(
@@ -904,33 +901,6 @@ async fn test_modify_network_updates_posture_checks_only_when_supplied(
         .send()
         .await;
     assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        fetch_location_postures(&client, location.id).await,
-        vec![replacement_posture]
-    );
-
-    let mut payload = location_payload("location", "10.1.1.1/24", false, "disabled");
-    payload["posture_checks"] = json!(null);
-    let response = client
-        .put(format!("/api/v1/network/{}", location.id))
-        .json(&payload)
-        .send()
-        .await;
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(
-        fetch_location_postures(&client, location.id).await,
-        vec![replacement_posture]
-    );
-
-    // an explicit empty list clears assignments
-    let mut payload = location_payload("location", "10.1.1.1/24", false, "disabled");
-    payload["posture_checks"] = json!([]);
-    let response = client
-        .put(format!("/api/v1/network/{}", location.id))
-        .json(&payload)
-        .send()
-        .await;
-    assert_eq!(response.status(), StatusCode::OK);
     assert!(
         fetch_location_postures(&client, location.id)
             .await
@@ -1057,7 +1027,7 @@ async fn test_peer_disconnect_threshold_validation_create(
         allowed_ips_from_acl: false,
         mfa_enabled: false,
         service_location_mode: ServiceLocationMode::Disabled,
-        posture_checks: None,
+        posture_checks: Vec::new(),
     };
 
     let response = client
@@ -1119,7 +1089,7 @@ async fn test_peer_disconnect_threshold_validation_modify(
         allowed_ips_from_acl: false,
         mfa_enabled: false,
         service_location_mode: ServiceLocationMode::Disabled,
-        posture_checks: None,
+        posture_checks: Vec::new(),
     };
 
     let response = client
diff --git a/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs b/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
index 34e4fe976..87c236610 100644
--- a/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
@@ -1115,7 +1115,7 @@ async fn test_create_network_without_groups_rejected(_: PgPoolOptions, options:
         allowed_ips_from_acl: false,
         mfa_enabled: false, // mfa_enabled
         service_location_mode: ServiceLocationMode::Disabled,
-        posture_checks: None,
+        posture_checks: Vec::new(),
     };
 
     // allow_all_groups=false with no groups should be rejected
@@ -1170,7 +1170,7 @@ async fn test_modify_network_without_groups_rejected(_: PgPoolOptions, options:
         allowed_ips_from_acl: false,
         mfa_enabled: false, // mfa_enabled
         service_location_mode: ServiceLocationMode::Disabled,
-        posture_checks: None,
+        posture_checks: Vec::new(),
     };
     let response = client
         .post("/api/v1/network")
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index 4ba0a7f9b..cad4dcb71 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -252,6 +252,7 @@ const buildLocationSubmissionData = (
     acl_enabled: normalizedValue.firewall !== LocationFirewall.Disabled,
     peer_disconnect_threshold:
       normalizedValue.peer_disconnect_threshold ?? location.peer_disconnect_threshold,
+    posture_checks: location.posture_checks ?? [],
   };
 };
 
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index d744ff312..423a62636 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -839,7 +839,7 @@ export interface EditNetworkLocation
   > {
   allowed_ips: string;
   address: string;
-  posture_checks?: number[];
+  posture_checks: number[];
 }
 
 export interface EditNetworkLocationRequest {

From ca5e575baa5d703deb9551e0fa6876482a8ed65c Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 21 Aug 2026 02:38:07 +0200
Subject: [PATCH 03/21] fix clippy issue

---
 crates/defguard_common/src/db/models/wizard.rs | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/crates/defguard_common/src/db/models/wizard.rs b/crates/defguard_common/src/db/models/wizard.rs
index 7c7a34bd3..f95eb8e73 100644
--- a/crates/defguard_common/src/db/models/wizard.rs
+++ b/crates/defguard_common/src/db/models/wizard.rs
@@ -122,15 +122,13 @@ impl Wizard {
         .fetch_one(executor)
         .await?;
 
-        let active_wizard;
-
-        if has_auto_adopt_flags {
-            active_wizard = ActiveWizard::AutoAdoption;
+        let active_wizard = if has_auto_adopt_flags {
+            ActiveWizard::AutoAdoption
         } else if is_fresh_instance {
-            active_wizard = ActiveWizard::Initial;
+            ActiveWizard::Initial
         } else {
-            active_wizard = ActiveWizard::Migration;
-        }
+            ActiveWizard::Migration
+        };
 
         wizard.active_wizard = active_wizard;
 

From 58fa35ffec25db3d670ccb3c39c4713bce9a849a Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 21 Aug 2026 10:53:55 +0200
Subject: [PATCH 04/21] mfa flow assignments part of location create/update

---
 .../defguard_common/src/db/models/mfa_flow.rs |  28 ++-
 crates/defguard_core/src/handlers/mfa_flow.rs | 197 +++++-------------
 .../defguard_core/src/handlers/wireguard.rs   |  73 +++++--
 crates/defguard_core/src/lib.rs               |   7 +-
 crates/defguard_core/src/openapi.rs           |   1 -
 .../tests/integration/api/common/mod.rs       |   4 +-
 .../tests/integration/api/wireguard.rs        |   6 +-
 .../api/wireguard_network_allowed_groups.rs   |   2 +
 .../AddLocationPage/useAddLocationStore.tsx   |   1 +
 .../EditLocationPage/EditLocationPage.tsx     |  17 +-
 web/src/shared/api/api.ts                     |   3 +
 web/src/shared/api/types.ts                   |   7 +
 12 files changed, 166 insertions(+), 180 deletions(-)

diff --git a/crates/defguard_common/src/db/models/mfa_flow.rs b/crates/defguard_common/src/db/models/mfa_flow.rs
index d61c77b19..7a0690c7f 100644
--- a/crates/defguard_common/src/db/models/mfa_flow.rs
+++ b/crates/defguard_common/src/db/models/mfa_flow.rs
@@ -49,7 +49,7 @@ pub struct MfaFlowSnapshot {
     pub steps: Vec<MfaFlowStep<Id>>,
 }
 
-/// Assignment of an MFA flow to a location, enriched for API consumption.
+/// Assignment of an MFA flow to a location, enriched for internal consumers.
 #[derive(Clone, Debug, Serialize)]
 pub struct LocationMfaFlowItem {
     pub id: Id,
@@ -61,7 +61,7 @@ pub struct LocationMfaFlowItem {
 }
 
 /// Input for a single flow assignment to a location.
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
 pub struct LocationMfaFlowAssignment {
     pub flow_id: Id,
     pub is_default: bool,
@@ -549,6 +549,30 @@ impl MfaFlow<Id> {
         .await
     }
 
+    /// Returns the assignments for a location in the shape accepted by location save requests.
+    pub async fn assignments_for_location<'e, E: PgExecutor<'e>>(
+        executor: E,
+        location_id: Id,
+    ) -> sqlx::Result<Vec<LocationMfaFlowAssignment>> {
+        query_as!(
+            LocationMfaFlowAssignment,
+            "SELECT lmf.flow_id, lmf.is_default, \
+             COALESCE(array_agg(lmfg.group_id ORDER BY lmfg.group_id) \
+                      FILTER (WHERE lmfg.group_id IS NOT NULL), '{}') \
+                      AS \"group_ids!: Vec<Id>\" \
+             FROM location_mfa_flow lmf \
+             LEFT JOIN location_mfa_flow_group lmfg \
+                 ON lmfg.location_id = lmf.location_id \
+                 AND lmfg.flow_id = lmf.flow_id \
+             WHERE lmf.location_id = $1 \
+             GROUP BY lmf.flow_id, lmf.position, lmf.is_default \
+             ORDER BY lmf.position",
+            location_id
+        )
+        .fetch_all(executor)
+        .await
+    }
+
     /// Checks whether a flow can be deleted, returning an error naming the
     /// affected locations if it cannot.
     ///
diff --git a/crates/defguard_core/src/handlers/mfa_flow.rs b/crates/defguard_core/src/handlers/mfa_flow.rs
index 31f0faecc..63088db3c 100644
--- a/crates/defguard_core/src/handlers/mfa_flow.rs
+++ b/crates/defguard_core/src/handlers/mfa_flow.rs
@@ -10,9 +10,9 @@ use defguard_common::db::{
     models::{
         Settings, WireguardNetwork,
         mfa_flow::{
-            LocationMfaFlowAssignment, LocationMfaFlowItem, MfaFlow, MfaFlowAssignmentError,
-            MfaFlowDeleteError, MfaFlowSnapshot, MfaFlowStep, MfaFlowUpdateError,
-            MfaFlowValidationField, MfaFlowWithStepCount, validate_flow_input,
+            LocationMfaFlowAssignment, MfaFlow, MfaFlowAssignmentError, MfaFlowDeleteError,
+            MfaFlowSnapshot, MfaFlowStep, MfaFlowUpdateError, MfaFlowValidationField,
+            MfaFlowWithStepCount, validate_flow_input,
         },
         vpn_client_session::VpnClientMfaMethod,
     },
@@ -130,44 +130,8 @@ pub struct UpdateMfaFlowStep {
     pub methods: Vec<VpnClientMfaMethod>,
 }
 
-/// Request body for assigning flows to a location.
-#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
-pub struct AssignMfaFlowsRequest {
-    pub assignments: Vec<AssignMfaFlowEntry>,
-}
-
-/// A single entry in an assignment list.
-#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
-pub struct AssignMfaFlowEntry {
-    pub flow_id: Id,
-    pub is_default: bool,
-    #[serde(default)]
-    pub group_ids: Vec<Id>,
-}
-
-/// Assignment item returned by `GET /location/{id}/mfa-flows`.
-#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
-pub struct LocationMfaFlowResponse {
-    pub id: Id,
-    pub title: String,
-    pub step_count: i64,
-    pub group_names: Vec<String>,
-    pub position: i32,
-    pub is_default: bool,
-}
-
-impl From<LocationMfaFlowItem> for LocationMfaFlowResponse {
-    fn from(item: LocationMfaFlowItem) -> Self {
-        Self {
-            id: item.id,
-            title: item.title,
-            step_count: item.step_count,
-            group_names: item.group_names,
-            position: item.position,
-            is_default: item.is_default,
-        }
-    }
-}
+/// A single MFA flow assignment, used by location read and save requests.
+pub type AssignMfaFlowEntry = LocationMfaFlowAssignment;
 
 // Helpers
 
@@ -270,7 +234,9 @@ fn check_method_prerequisites(
 /// recognise the new variant. The `None` form gates strictly on the Enterprise
 /// tier, which is the correct behaviour for this feature.
 #[must_use]
-fn check_assignment_license_gates(assignments: &[AssignMfaFlowEntry]) -> Option<ApiResponse> {
+pub(crate) fn check_assignment_license_gates(
+    assignments: &[AssignMfaFlowEntry],
+) -> Option<ApiResponse> {
     let scoped = assignments.iter().position(|a| !a.group_ids.is_empty());
     if let Some(index) = scoped
         && !has_enterprise_access(None)
@@ -317,6 +283,42 @@ fn non_default_group_field(assignments: &[AssignMfaFlowEntry], flow_id: Id) -> S
 }
 
 /// Build a `400` response with structured `fields[]` errors.
+pub(crate) fn assignment_error_response(
+    assignments: &[AssignMfaFlowEntry],
+    error: MfaFlowAssignmentError,
+) -> Result<ApiResponse, WebError> {
+    let (field, code) = match error {
+        MfaFlowAssignmentError::NoDefaultDesignated => {
+            ("mfa_flows".to_owned(), "no_default_designated")
+        }
+        MfaFlowAssignmentError::MultipleDefaultsDesignated => {
+            ("mfa_flows".to_owned(), "multiple_defaults_designated")
+        }
+        MfaFlowAssignmentError::DefaultHasGroups => {
+            ("mfa_flows".to_owned(), "default_must_have_no_groups")
+        }
+        MfaFlowAssignmentError::NonDefaultWithoutGroups(flow_id) => (
+            non_default_group_field(assignments, flow_id),
+            "non_default_must_have_groups",
+        ),
+        MfaFlowAssignmentError::DuplicateFlow(flow_id) => {
+            (assignment_field(assignments, flow_id), "duplicate")
+        }
+        MfaFlowAssignmentError::UnknownFlow(flow_id) => {
+            (assignment_field(assignments, flow_id), "unknown_flow")
+        }
+        MfaFlowAssignmentError::UnknownGroup(group_id) => {
+            (group_field(assignments, group_id), "unknown_group")
+        }
+        MfaFlowAssignmentError::Sqlx(error) => return Err(WebError::from(error)),
+    };
+
+    Ok(validation_error_response(vec![MfaFlowValidationField {
+        field,
+        code: code.into(),
+    }]))
+}
+
 fn validation_error_response(errors: Vec<MfaFlowValidationField>) -> ApiResponse {
     let fields: Vec<Value> = errors
         .iter()
@@ -706,7 +708,7 @@ pub async fn delete_mfa_flow(
         ("id" = i64, Path, description = "ID of the location.")
     ),
     responses(
-        (status = 200, description = "MFA flows assigned to the location.", body = [LocationMfaFlowResponse]),
+        (status = 200, description = "MFA flow assignments for the location.", body = [AssignMfaFlowEntry]),
         (status = 401, description = "Session is missing or invalid.", body = ApiErrorResponse),
         (status = 403, description = "Requires admin privileges.", body = ApiErrorResponse),
         (status = 500, description = "Unable to list assigned flows.", body = ApiErrorResponse)
@@ -736,114 +738,9 @@ pub async fn get_location_mfa_flows(
         return Err(WebError::ObjectNotFound(format!("Location {id} not found")));
     }
 
-    let items = MfaFlow::for_location(&appstate.pool, id).await?;
-    let response: Vec<LocationMfaFlowResponse> = items.into_iter().map(Into::into).collect();
-
-    Ok(ApiResponse::json(response, StatusCode::OK))
-}
+    let assignments = MfaFlow::assignments_for_location(&appstate.pool, id).await?;
 
-/// Assign MFA flows to a location (full replace)
-#[utoipa::path(
-    put,
-    path = "/api/v1/location/{id}/mfa-flows",
-    tag = "mfa flow",
-    params(
-        ("id" = i64, Path, description = "ID of the location.")
-    ),
-    request_body = AssignMfaFlowsRequest,
-    responses(
-        (status = 200, description = "MFA flows assigned to the location.", body = [LocationMfaFlowResponse]),
-        (status = 400, description = "Invalid assignment: `no_default_designated`, `multiple_defaults_designated`, `default_must_have_no_groups`, or `non_default_must_have_groups`.", body = ApiErrorResponse, example = json!({"error": "validation_failed", "fields": [{"field": "mfa_flows", "code": "no_default_designated"}]})),
-        (status = 401, description = "Session is missing or invalid.", body = ApiErrorResponse),
-        (status = 403, description = "Requires admin privileges, or group scoping without an enterprise license (`enterprise_license_required`).", body = ApiErrorResponse, example = json!({"error": "license_required", "fields": [{"field": "assignments[0].group_ids", "code": "enterprise_license_required"}]})),
-        (status = 500, description = "Unable to assign flows.", body = ApiErrorResponse)
-    ),
-    security(
-        ("cookie" = []),
-        ("api_token" = [])
-    )
-)]
-pub async fn set_location_mfa_flows(
-    _admin: AdminRole,
-    session: SessionInfo,
-    context: ApiRequestContext,
-    Path(location_id): Path<Id>,
-    State(appstate): State<AppState>,
-    Json(data): Json<AssignMfaFlowsRequest>,
-) -> ApiResult {
-    debug!(
-        "User {} assigning MFA flows to location {location_id}",
-        session.user.username
-    );
-
-    // The location has to exist before we can replace its assignments, and its name is needed for
-    // the audit event.
-    let location = WireguardNetwork::find_by_id(&appstate.pool, location_id)
-        .await?
-        .ok_or_else(|| WebError::ObjectNotFound(format!("Location {location_id} not found")))?;
-
-    let assignments: Vec<LocationMfaFlowAssignment> = data
-        .assignments
-        .iter()
-        .map(|a| LocationMfaFlowAssignment {
-            flow_id: a.flow_id,
-            is_default: a.is_default,
-            group_ids: a.group_ids.clone(),
-        })
-        .collect();
-
-    if let Some(resp) = check_assignment_license_gates(&data.assignments) {
-        return Ok(resp);
-    }
-
-    let mut tx = appstate.pool.begin().await?;
-    if let Err(e) = MfaFlow::assign_to_location(&mut tx, location_id, &assignments).await {
-        let (field, code) = match e {
-            MfaFlowAssignmentError::NoDefaultDesignated => {
-                ("mfa_flows".to_owned(), "no_default_designated")
-            }
-            MfaFlowAssignmentError::MultipleDefaultsDesignated => {
-                ("mfa_flows".to_owned(), "multiple_defaults_designated")
-            }
-            MfaFlowAssignmentError::DefaultHasGroups => {
-                ("mfa_flows".to_owned(), "default_must_have_no_groups")
-            }
-            MfaFlowAssignmentError::NonDefaultWithoutGroups(flow_id) => (
-                non_default_group_field(&data.assignments, flow_id),
-                "non_default_must_have_groups",
-            ),
-            MfaFlowAssignmentError::DuplicateFlow(flow_id) => {
-                (assignment_field(&data.assignments, flow_id), "duplicate")
-            }
-            MfaFlowAssignmentError::UnknownFlow(flow_id) => {
-                (assignment_field(&data.assignments, flow_id), "unknown_flow")
-            }
-            MfaFlowAssignmentError::UnknownGroup(group_id) => {
-                (group_field(&data.assignments, group_id), "unknown_group")
-            }
-            MfaFlowAssignmentError::Sqlx(e) => return Err(WebError::from(e)),
-        };
-
-        return Ok(validation_error_response(vec![MfaFlowValidationField {
-            field,
-            code: code.into(),
-        }]));
-    }
-    tx.commit().await?;
-
-    let items = MfaFlow::for_location(&appstate.pool, location_id).await?;
-    let response: Vec<LocationMfaFlowResponse> = items.into_iter().map(Into::into).collect();
-
-    appstate.emit_event(ApiEvent {
-        context,
-        event: Box::new(ApiEventType::LocationMfaFlowsAssigned {
-            location_id,
-            location_name: location.name,
-            assignments: LocationMfaFlowAssignment::snapshot(&assignments),
-        }),
-    })?;
-
-    Ok(ApiResponse::json(response, StatusCode::OK))
+    Ok(ApiResponse::json(assignments, StatusCode::OK))
 }
 
 /// Method availability entry returned by the catalogue endpoint.
diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 4de697b06..86abeacfe 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -11,7 +11,7 @@ use defguard_common::{
         models::{
             Device, DeviceConfig, DeviceType, User, WireguardNetwork,
             device::{AddDevice, DeviceInfo, ModifyDevice, WireguardNetworkDevice},
-            mfa_flow::MfaFlow,
+            mfa_flow::{LocationMfaFlowAssignment, MfaFlow},
             wireguard::{MappedDevice, ServiceLocationMode},
         },
     },
@@ -42,7 +42,11 @@ use crate::{
     },
     events::{ApiEvent, ApiEventType, ApiRequestContext},
     grpc::GatewayCommand,
-    handlers::{gateway::GatewayInfo, network_devices::DeviceWireGuardConfig},
+    handlers::{
+        gateway::GatewayInfo,
+        mfa_flow::{AssignMfaFlowEntry, assignment_error_response, check_assignment_license_gates},
+        network_devices::DeviceWireGuardConfig,
+    },
     location_management::{
         allowed_peers::get_location_allowed_peers, handle_imported_devices, handle_mapped_devices,
         sync_location_allowed_devices,
@@ -87,6 +91,7 @@ pub struct WireguardNetworkData {
     pub mfa_enabled: bool,
     pub service_location_mode: ServiceLocationMode,
     pub posture_checks: Vec<Id>,
+    pub mfa_flows: Vec<AssignMfaFlowEntry>,
 }
 
 const MIN_PEER_DISCONNECT_THRESHOLD_WITH_MFA: i32 = 120;
@@ -177,17 +182,6 @@ impl WireguardNetworkData {
         )))
     }
 
-    /// Rejects enabling MFA for a location while no MFA flow is assigned to it as its default.
-    ///
-    /// Thin wrapper over [`validate_mfa_flows_exist`] for the create/modify request path.
-    pub(crate) async fn validate_mfa_flows_exist<'e, E: sqlx::PgExecutor<'e> + Copy>(
-        &self,
-        executor: E,
-        location_id: Option<Id>,
-    ) -> Result<Option<ApiResponse>, WebError> {
-        validate_mfa_flows_exist(executor, self.mfa_enabled, location_id).await
-    }
-
     /// Rejects service-location mode combined with location MFA: core cannot serve it and the
     /// client cannot represent it (`Location::is_service_location()` requires MFA disabled).
     pub(crate) fn validate_service_location_mfa(&self) -> Result<(), WebError> {
@@ -303,7 +297,7 @@ pub(crate) async fn create_network(
     data.validate_service_location_mfa()?;
     data.validate_keepalive_interval()?;
     data.validate_allowed_groups()?;
-    if let Some(resp) = data.validate_mfa_flows_exist(&appstate.pool, None).await? {
+    if let Some(resp) = check_assignment_license_gates(&data.mfa_flows) {
         return Ok(resp);
     }
 
@@ -359,6 +353,21 @@ pub(crate) async fn create_network(
         data.posture_checks
     );
 
+    let mfa_assignments: Vec<LocationMfaFlowAssignment> = data.mfa_flows.clone();
+    if let Err(error) =
+        MfaFlow::assign_to_location(&mut transaction, network.id, &mfa_assignments).await
+    {
+        return Ok(assignment_error_response(&data.mfa_flows, error)?);
+    }
+    if data.mfa_enabled {
+        if !MfaFlow::any_exist(&mut *transaction).await? {
+            return Ok(no_flows_exist_response());
+        }
+        if !MfaFlow::has_default_assignment(&mut *transaction, network.id).await? {
+            return Ok(no_flows_assigned_response());
+        }
+    }
+
     transaction.commit().await?;
 
     appstate.send_gateway_command(GatewayCommand::NetworkCreated(network.id, network.clone()));
@@ -368,6 +377,14 @@ pub(crate) async fn create_network(
         session.user.username
     );
 
+    appstate.emit_event(ApiEvent {
+        context: context.clone(),
+        event: Box::new(ApiEventType::LocationMfaFlowsAssigned {
+            location_id: network.id,
+            location_name: network.name.clone(),
+            assignments: LocationMfaFlowAssignment::snapshot(&mfa_assignments),
+        }),
+    })?;
     appstate.emit_event(ApiEvent {
         context,
         event: Box::new(ApiEventType::VpnLocationAdded {
@@ -438,10 +455,7 @@ pub(crate) async fn modify_network(
     data.validate_service_location_mfa()?;
     data.validate_keepalive_interval()?;
     data.validate_allowed_groups()?;
-    if let Some(resp) = data
-        .validate_mfa_flows_exist(&appstate.pool, Some(network_id))
-        .await?
-    {
+    if let Some(resp) = check_assignment_license_gates(&data.mfa_flows) {
         return Ok(resp);
     }
 
@@ -485,6 +499,21 @@ pub(crate) async fn modify_network(
     DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
         .await?;
 
+    let mfa_assignments: Vec<LocationMfaFlowAssignment> = data.mfa_flows.clone();
+    if let Err(error) =
+        MfaFlow::assign_to_location(&mut transaction, network.id, &mfa_assignments).await
+    {
+        return Ok(assignment_error_response(&data.mfa_flows, error)?);
+    }
+    if data.mfa_enabled {
+        if !MfaFlow::any_exist(&mut *transaction).await? {
+            return Ok(no_flows_exist_response());
+        }
+        if !MfaFlow::has_default_assignment(&mut *transaction, network.id).await? {
+            return Ok(no_flows_assigned_response());
+        }
+    }
+
     let _events = sync_location_allowed_devices(&network, &mut transaction, None).await?;
 
     let peers = get_location_allowed_peers(&network, &mut transaction).await?;
@@ -501,6 +530,14 @@ pub(crate) async fn modify_network(
         "User {} updated WireGuard network {network_id}",
         session.user.username,
     );
+    appstate.emit_event(ApiEvent {
+        context: context.clone(),
+        event: Box::new(ApiEventType::LocationMfaFlowsAssigned {
+            location_id: network.id,
+            location_name: network.name.clone(),
+            assignments: LocationMfaFlowAssignment::snapshot(&mfa_assignments),
+        }),
+    })?;
     appstate.emit_event(ApiEvent {
         context,
         event: Box::new(ApiEventType::VpnLocationModified {
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index cf51c7ab9..3d846b669 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -51,7 +51,7 @@ use handlers::{
     group::{bulk_assign_to_groups, list_groups_info},
     mfa_flow::{
         create_mfa_flow, delete_mfa_flow, get_location_mfa_flows, get_method_availability,
-        get_mfa_flow, list_mfa_flows, set_location_mfa_flows, update_mfa_flow,
+        get_mfa_flow, list_mfa_flows, update_mfa_flow,
     },
     network_devices::{
         add_network_device, check_ip_availability, find_available_ips, get_network_device,
@@ -584,10 +584,7 @@ pub fn build_webapp(
                 "/mfa-flow/method-availability",
                 get(get_method_availability),
             )
-            .route(
-                "/location/{id}/mfa-flows",
-                get(get_location_mfa_flows).put(set_location_mfa_flows),
-            ),
+            .route("/location/{id}/mfa-flows", get(get_location_mfa_flows)),
     );
 
     let api_router = api_router.nest(
diff --git a/crates/defguard_core/src/openapi.rs b/crates/defguard_core/src/openapi.rs
index b0c76378f..84733af6f 100644
--- a/crates/defguard_core/src/openapi.rs
+++ b/crates/defguard_core/src/openapi.rs
@@ -271,7 +271,6 @@ Errors are returned as a JSON object with a `msg` field and, for some of them, a
         mfa_flow::update_mfa_flow,
         mfa_flow::delete_mfa_flow,
         mfa_flow::get_location_mfa_flows,
-        mfa_flow::set_location_mfa_flows,
         mfa_flow::get_method_availability,
         // support
         mail::send_support_data,
diff --git a/crates/defguard_core/tests/integration/api/common/mod.rs b/crates/defguard_core/tests/integration/api/common/mod.rs
index 0651c1848..a615612b8 100644
--- a/crates/defguard_core/tests/integration/api/common/mod.rs
+++ b/crates/defguard_core/tests/integration/api/common/mod.rs
@@ -226,7 +226,9 @@ pub(crate) async fn make_network(client: &TestClient, name: &str) -> TestRespons
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
diff --git a/crates/defguard_core/tests/integration/api/wireguard.rs b/crates/defguard_core/tests/integration/api/wireguard.rs
index a8e832494..61c554387 100644
--- a/crates/defguard_core/tests/integration/api/wireguard.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard.rs
@@ -85,6 +85,7 @@ async fn test_network(_: PgPoolOptions, options: PgConnectOptions) {
         mfa_enabled: false,
         service_location_mode: ServiceLocationMode::Disabled,
         posture_checks: Vec::new(),
+        mfa_flows: Vec::new(),
     };
     let response = client
         .put(format!("/api/v1/network/{}", network.id))
@@ -368,7 +369,8 @@ fn location_payload(
         "allowed_ips_from_acl": false,
         "mfa_enabled": mfa_enabled,
         "service_location_mode": service_location_mode,
-        "posture_checks": []
+        "posture_checks": [],
+        "mfa_flows": []
     })
 }
 
@@ -1028,6 +1030,7 @@ async fn test_peer_disconnect_threshold_validation_create(
         mfa_enabled: false,
         service_location_mode: ServiceLocationMode::Disabled,
         posture_checks: Vec::new(),
+        mfa_flows: Vec::new(),
     };
 
     let response = client
@@ -1090,6 +1093,7 @@ async fn test_peer_disconnect_threshold_validation_modify(
         mfa_enabled: false,
         service_location_mode: ServiceLocationMode::Disabled,
         posture_checks: Vec::new(),
+        mfa_flows: Vec::new(),
     };
 
     let response = client
diff --git a/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs b/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
index 87c236610..d1bcb1578 100644
--- a/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
@@ -1116,6 +1116,7 @@ async fn test_create_network_without_groups_rejected(_: PgPoolOptions, options:
         mfa_enabled: false, // mfa_enabled
         service_location_mode: ServiceLocationMode::Disabled,
         posture_checks: Vec::new(),
+        mfa_flows: Vec::new(),
     };
 
     // allow_all_groups=false with no groups should be rejected
@@ -1171,6 +1172,7 @@ async fn test_modify_network_without_groups_rejected(_: PgPoolOptions, options:
         mfa_enabled: false, // mfa_enabled
         service_location_mode: ServiceLocationMode::Disabled,
         posture_checks: Vec::new(),
+        mfa_flows: Vec::new(),
     };
     let response = client
         .post("/api/v1/network")
diff --git a/web/src/pages/AddLocationPage/useAddLocationStore.tsx b/web/src/pages/AddLocationPage/useAddLocationStore.tsx
index 3b7808cd6..bebaca882 100644
--- a/web/src/pages/AddLocationPage/useAddLocationStore.tsx
+++ b/web/src/pages/AddLocationPage/useAddLocationStore.tsx
@@ -39,6 +39,7 @@ const defaults: StoreValues = {
   mfa_enabled: false,
   service_location_mode: LocationServiceMode.Disabled,
   posture_checks: [],
+  mfa_flows: [],
 };
 
 export const useAddLocationStore = create<StoreMethods & StoreValues>()(
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index cad4dcb71..6c94f1cd3 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -53,6 +53,11 @@ export const EditLocationPage = () => {
     from: '/_authorized/_default/locations/$locationId/edit',
   });
   const { data: location } = useSuspenseQuery(getLocationQueryOptions(Number(paramsId)));
+  const { data: mfaFlows } = useSuspenseQuery({
+    queryKey: ['location', location.id, 'mfa-flows'],
+    queryFn: () =>
+      api.mfaFlow.getLocationAssignments(location.id).then((response) => response.data),
+  });
 
   return (
     <EditPage
@@ -62,7 +67,7 @@ export const EditLocationPage = () => {
         title: m.location_edit_title({ name: location.name }),
       }}
     >
-      <EditLocationForm location={location} />
+      <EditLocationForm location={location} mfaFlows={mfaFlows} />
     </EditPage>
   );
 };
@@ -253,6 +258,7 @@ const buildLocationSubmissionData = (
     peer_disconnect_threshold:
       normalizedValue.peer_disconnect_threshold ?? location.peer_disconnect_threshold,
     posture_checks: location.posture_checks ?? [],
+    mfa_flows: [],
   };
 };
 
@@ -345,7 +351,13 @@ const getDisconnectRelevantChangedFields = (
   return Array.from(changedFields);
 };
 
-const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
+const EditLocationForm = ({
+  location,
+  mfaFlows,
+}: {
+  location: NetworkLocation;
+  mfaFlows: EditNetworkLocation['mfa_flows'];
+}) => {
   const navigate = useNavigate();
 
   const { data: licenseInfo } = useQuery(getLicenseInfoQueryOptions);
@@ -525,6 +537,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
       data: {
         ...buildLocationSubmissionData(value, location),
         posture_checks: pendingPostureChecks,
+        mfa_flows: mfaFlows,
       },
     });
   };
diff --git a/web/src/shared/api/api.ts b/web/src/shared/api/api.ts
index e4c419361..847c7ee72 100644
--- a/web/src/shared/api/api.ts
+++ b/web/src/shared/api/api.ts
@@ -89,6 +89,7 @@ import type {
   LoginResponse,
   LoginResponseBasic,
   MfaCompleteResponse,
+  MfaFlowAssignment,
   MfaFlowDetailResponse,
   MfaFlowListItemResponse,
   MfaMethodAvailabilityResponse,
@@ -535,6 +536,8 @@ const api = {
     create: (data: CreateMfaFlowRequest) =>
       client.post<MfaFlowDetailResponse>('/mfa-flow', data),
     get: (id: number) => client.get<MfaFlowDetailResponse>(`/mfa-flow/${id}`),
+    getLocationAssignments: (locationId: number) =>
+      client.get<MfaFlowAssignment[]>(`/location/${locationId}/mfa-flows`),
     update: (id: number, data: UpdateMfaFlowRequest) =>
       client.put<MfaFlowDetailResponse>(`/mfa-flow/${id}`, data),
     delete: (id: number) => client.delete(`/mfa-flow/${id}`),
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 423a62636..4773c5ae4 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -840,6 +840,7 @@ export interface EditNetworkLocation
   allowed_ips: string;
   address: string;
   posture_checks: number[];
+  mfa_flows: MfaFlowAssignment[];
 }
 
 export interface EditNetworkLocationRequest {
@@ -1463,6 +1464,12 @@ export interface MfaFlowStep {
   methods: MfaFlowMethodValue[];
 }
 
+export interface MfaFlowAssignment {
+  flow_id: number;
+  is_default: boolean;
+  group_ids: number[];
+}
+
 export interface MfaFlowDetailResponse {
   id: number;
   title: string;

From c6800b6436f513f8b1d1f8369d5f36d315be2ef3 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 21 Aug 2026 11:19:24 +0200
Subject: [PATCH 05/21] ergonomic location-to-mfa-flow assignment shape

---
 .../defguard_common/src/db/models/mfa_flow.rs | 30 ++------
 .../src/enterprise/handlers/device_posture.rs | 72 -------------------
 crates/defguard_core/src/handlers/mfa_flow.rs | 55 ++++++++++----
 .../defguard_core/src/handlers/wireguard.rs   |  4 +-
 crates/defguard_core/src/lib.rs               |  3 +-
 crates/defguard_core/src/openapi.rs           |  1 -
 .../EditLocationPage/EditLocationPage.tsx     |  9 ++-
 web/src/shared/api/api.ts                     |  4 +-
 web/src/shared/api/types.ts                   | 13 ++++
 9 files changed, 73 insertions(+), 118 deletions(-)

diff --git a/crates/defguard_common/src/db/models/mfa_flow.rs b/crates/defguard_common/src/db/models/mfa_flow.rs
index 7a0690c7f..32a302140 100644
--- a/crates/defguard_common/src/db/models/mfa_flow.rs
+++ b/crates/defguard_common/src/db/models/mfa_flow.rs
@@ -55,6 +55,7 @@ pub struct LocationMfaFlowItem {
     pub id: Id,
     pub title: String,
     pub step_count: i64,
+    pub group_ids: Vec<Id>,
     pub group_names: Vec<String>,
     pub position: i32,
     pub is_default: bool,
@@ -525,7 +526,10 @@ impl MfaFlow<Id> {
             LocationMfaFlowItem,
             "SELECT mf.id, mf.title, \
              COALESCE(s.step_count, 0) AS \"step_count!: i64\", \
-             COALESCE(array_agg(g.name ORDER BY g.name) \
+             COALESCE(array_agg(lmfg.group_id ORDER BY lmfg.group_id) \
+                      FILTER (WHERE lmfg.group_id IS NOT NULL), '{}') \
+                      AS \"group_ids!: Vec<Id>\", \
+             COALESCE(array_agg(g.name ORDER BY lmfg.group_id) \
                       FILTER (WHERE g.name IS NOT NULL), '{}') \
                       AS \"group_names!: Vec<String>\", \
              lmf.position, lmf.is_default \
@@ -549,30 +553,6 @@ impl MfaFlow<Id> {
         .await
     }
 
-    /// Returns the assignments for a location in the shape accepted by location save requests.
-    pub async fn assignments_for_location<'e, E: PgExecutor<'e>>(
-        executor: E,
-        location_id: Id,
-    ) -> sqlx::Result<Vec<LocationMfaFlowAssignment>> {
-        query_as!(
-            LocationMfaFlowAssignment,
-            "SELECT lmf.flow_id, lmf.is_default, \
-             COALESCE(array_agg(lmfg.group_id ORDER BY lmfg.group_id) \
-                      FILTER (WHERE lmfg.group_id IS NOT NULL), '{}') \
-                      AS \"group_ids!: Vec<Id>\" \
-             FROM location_mfa_flow lmf \
-             LEFT JOIN location_mfa_flow_group lmfg \
-                 ON lmfg.location_id = lmf.location_id \
-                 AND lmfg.flow_id = lmf.flow_id \
-             WHERE lmf.location_id = $1 \
-             GROUP BY lmf.flow_id, lmf.position, lmf.is_default \
-             ORDER BY lmf.position",
-            location_id
-        )
-        .fetch_all(executor)
-        .await
-    }
-
     /// Checks whether a flow can be deleted, returning an error naming the
     /// affected locations if it cannot.
     ///
diff --git a/crates/defguard_core/src/enterprise/handlers/device_posture.rs b/crates/defguard_core/src/enterprise/handlers/device_posture.rs
index 3375a94e5..2fb1c05d6 100644
--- a/crates/defguard_core/src/enterprise/handlers/device_posture.rs
+++ b/crates/defguard_core/src/enterprise/handlers/device_posture.rs
@@ -1114,84 +1114,12 @@ pub async fn duplicate_device_posture(
     Ok(ApiResponse::json(response, StatusCode::CREATED))
 }
 
-/// Request body for assigning posture checks to a VPN location.
-#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
-pub struct AssignPosturesData {
-    pub postures: Vec<Id>,
-}
-
 /// Request body for assigning VPN locations to a posture check.
 #[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
 pub struct AssignLocationsData {
     pub locations: Vec<Id>,
 }
 
-/// Assign device posture check policies to a location
-///
-/// Replaces the current assignment.
-#[utoipa::path(
-    put,
-    path = "/api/v1/network/{id}/postures",
-    tag = "device posture",
-    params(
-        ("id" = i64, Path, description = "ID of the location.")
-    ),
-    request_body = AssignPosturesData,
-    responses(
-        (status = 200, description = "Device posture check policies assigned to the location.", body = [Id]),
-        (status = 400, description = "Posture checks cannot be assigned to a service location.", body = ApiErrorResponse, example = json!({"msg": "Posture checks cannot be assigned to service locations"})),
-        (status = 401, description = "Session is missing or invalid.", body = ApiErrorResponse, example = json!({"msg": "Session is required"})),
-        (status = 403, description = "Requires admin privileges and an active enterprise license.", body = ApiErrorResponse, example = json!({"msg": "requires privileged access"})),
-        (status = 404, description = "Location not found.", body = ApiErrorResponse, example = json!({"msg": "Location 1 not found"})),
-        (status = 500, description = "Unable to assign device posture check policies to the location.", body = ApiErrorResponse, example = json!({"msg": "Internal server error"}))
-    ),
-    security(
-        ("cookie" = []),
-        ("api_token" = [])
-    )
-)]
-pub async fn set_postures_for_location(
-    _license: LicenseGated<DevicePostureFeature>,
-    _admin: AdminRole,
-    session: SessionInfo,
-    context: ApiRequestContext,
-    Path(location_id): Path<Id>,
-    State(appstate): State<AppState>,
-    Json(data): Json<AssignPosturesData>,
-) -> ApiResult {
-    debug!(
-        "User {} assigning device posture checks {:?} to location {location_id}",
-        session.user.username, data.postures
-    );
-
-    let location = WireguardNetwork::find_by_id(&appstate.pool, location_id)
-        .await?
-        .ok_or_else(|| WebError::ObjectNotFound(format!("Location {location_id} not found")))?;
-
-    let mut tx = appstate.pool.begin().await?;
-    let old_postures = DevicePostureLocation::find_by_location(&mut *tx, location_id).await?;
-    let result =
-        DevicePostureLocation::set_for_location(&mut tx, location_id, &data.postures).await?;
-    let gateway_commands = if same_id_set(&old_postures, &result) {
-        Vec::new()
-    } else {
-        build_location_peer_refresh_commands(&mut tx, [location_id]).await?
-    };
-    tx.commit().await?;
-
-    appstate.send_multiple_gateway_commands(gateway_commands);
-
-    appstate.emit_event(ApiEvent {
-        context,
-        event: Box::new(ApiEventType::LocationPosturesAssigned {
-            location,
-            posture_ids: result.clone(),
-        }),
-    })?;
-
-    Ok(ApiResponse::json(result, StatusCode::OK))
-}
-
 /// Assign locations to a device posture check policy
 ///
 /// Replaces the current assignment.
diff --git a/crates/defguard_core/src/handlers/mfa_flow.rs b/crates/defguard_core/src/handlers/mfa_flow.rs
index 63088db3c..42d51f029 100644
--- a/crates/defguard_core/src/handlers/mfa_flow.rs
+++ b/crates/defguard_core/src/handlers/mfa_flow.rs
@@ -130,8 +130,22 @@ pub struct UpdateMfaFlowStep {
     pub methods: Vec<VpnClientMfaMethod>,
 }
 
-/// A single MFA flow assignment, used by location read and save requests.
-pub type AssignMfaFlowEntry = LocationMfaFlowAssignment;
+/// A group scoped to a location MFA flow assignment.
+#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
+pub struct LocationMfaFlowGroupResponse {
+    pub id: Id,
+    pub name: String,
+}
+
+/// An MFA flow assignment rendered in the context of one location.
+#[derive(Clone, Debug, Deserialize, Serialize, ToSchema)]
+pub struct LocationMfaFlowResponse {
+    pub id: Id,
+    pub title: String,
+    pub steps: Vec<MfaFlowStepResponse>,
+    pub is_default: bool,
+    pub groups: Vec<LocationMfaFlowGroupResponse>,
+}
 
 // Helpers
 
@@ -235,7 +249,7 @@ fn check_method_prerequisites(
 /// tier, which is the correct behaviour for this feature.
 #[must_use]
 pub(crate) fn check_assignment_license_gates(
-    assignments: &[AssignMfaFlowEntry],
+    assignments: &[LocationMfaFlowAssignment],
 ) -> Option<ApiResponse> {
     let scoped = assignments.iter().position(|a| !a.group_ids.is_empty());
     if let Some(index) = scoped
@@ -254,9 +268,9 @@ pub(crate) fn check_assignment_license_gates(
 /// Errors point at the row the admin submitted rather than at the list as a whole. When no entry
 /// matches, the path degrades to the bare `assignments` list, which is the best available anchor.
 fn assignment_field_path(
-    assignments: &[AssignMfaFlowEntry],
+    assignments: &[LocationMfaFlowAssignment],
     suffix: &str,
-    predicate: impl Fn(&AssignMfaFlowEntry) -> bool,
+    predicate: impl Fn(&LocationMfaFlowAssignment) -> bool,
 ) -> String {
     assignments.iter().position(predicate).map_or_else(
         || "assignments".to_owned(),
@@ -265,12 +279,12 @@ fn assignment_field_path(
 }
 
 /// Field path for the assignment entry referencing `flow_id`.
-fn assignment_field(assignments: &[AssignMfaFlowEntry], flow_id: Id) -> String {
+fn assignment_field(assignments: &[LocationMfaFlowAssignment], flow_id: Id) -> String {
     assignment_field_path(assignments, "flow_id", |a| a.flow_id == flow_id)
 }
 
 /// Field path for the assignment entry referencing `group_id`.
-fn group_field(assignments: &[AssignMfaFlowEntry], group_id: Id) -> String {
+fn group_field(assignments: &[LocationMfaFlowAssignment], group_id: Id) -> String {
     assignment_field_path(assignments, "group_ids", |a| {
         a.group_ids.contains(&group_id)
     })
@@ -278,13 +292,13 @@ fn group_field(assignments: &[AssignMfaFlowEntry], group_id: Id) -> String {
 
 /// Field path for the assignment entry whose empty group set made it inert, pointing at the
 /// `group_ids` the admin must populate rather than at the flow as a whole.
-fn non_default_group_field(assignments: &[AssignMfaFlowEntry], flow_id: Id) -> String {
+fn non_default_group_field(assignments: &[LocationMfaFlowAssignment], flow_id: Id) -> String {
     assignment_field_path(assignments, "group_ids", |a| a.flow_id == flow_id)
 }
 
 /// Build a `400` response with structured `fields[]` errors.
 pub(crate) fn assignment_error_response(
-    assignments: &[AssignMfaFlowEntry],
+    assignments: &[LocationMfaFlowAssignment],
     error: MfaFlowAssignmentError,
 ) -> Result<ApiResponse, WebError> {
     let (field, code) = match error {
@@ -708,7 +722,7 @@ pub async fn delete_mfa_flow(
         ("id" = i64, Path, description = "ID of the location.")
     ),
     responses(
-        (status = 200, description = "MFA flow assignments for the location.", body = [AssignMfaFlowEntry]),
+        (status = 200, description = "MFA flow assignments for the location.", body = [LocationMfaFlowResponse]),
         (status = 401, description = "Session is missing or invalid.", body = ApiErrorResponse),
         (status = 403, description = "Requires admin privileges.", body = ApiErrorResponse),
         (status = 500, description = "Unable to list assigned flows.", body = ApiErrorResponse)
@@ -738,9 +752,26 @@ pub async fn get_location_mfa_flows(
         return Err(WebError::ObjectNotFound(format!("Location {id} not found")));
     }
 
-    let assignments = MfaFlow::assignments_for_location(&appstate.pool, id).await?;
+    let assignments = MfaFlow::for_location(&appstate.pool, id).await?;
+    let mut response = Vec::with_capacity(assignments.len());
+    for assignment in assignments {
+        let steps = MfaFlowStep::find_by_flow(&appstate.pool, assignment.id).await?;
+        let groups = assignment
+            .group_ids
+            .into_iter()
+            .zip(assignment.group_names)
+            .map(|(id, name)| LocationMfaFlowGroupResponse { id, name })
+            .collect();
+        response.push(LocationMfaFlowResponse {
+            id: assignment.id,
+            title: assignment.title,
+            steps: steps.into_iter().map(Into::into).collect(),
+            is_default: assignment.is_default,
+            groups,
+        });
+    }
 
-    Ok(ApiResponse::json(assignments, StatusCode::OK))
+    Ok(ApiResponse::json(response, StatusCode::OK))
 }
 
 /// Method availability entry returned by the catalogue endpoint.
diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 86abeacfe..aa7a5ef7d 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -44,7 +44,7 @@ use crate::{
     grpc::GatewayCommand,
     handlers::{
         gateway::GatewayInfo,
-        mfa_flow::{AssignMfaFlowEntry, assignment_error_response, check_assignment_license_gates},
+        mfa_flow::{assignment_error_response, check_assignment_license_gates},
         network_devices::DeviceWireGuardConfig,
     },
     location_management::{
@@ -91,7 +91,7 @@ pub struct WireguardNetworkData {
     pub mfa_enabled: bool,
     pub service_location_mode: ServiceLocationMode,
     pub posture_checks: Vec<Id>,
-    pub mfa_flows: Vec<AssignMfaFlowEntry>,
+    pub mfa_flows: Vec<LocationMfaFlowAssignment>,
 }
 
 const MIN_PEER_DISCONNECT_THRESHOLD_WITH_MFA: i32 = 120;
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index 3d846b669..c021a0c40 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -122,7 +122,7 @@ use crate::{
             device_posture::{
                 create_device_posture, delete_device_posture, duplicate_device_posture,
                 get_device_posture, get_device_posture_versions, list_device_postures,
-                set_locations_for_posture, set_postures_for_location, update_device_posture,
+                set_locations_for_posture, update_device_posture,
             },
             enterprise_settings::{get_enterprise_settings, patch_enterprise_settings},
             openid_login::{auth_callback, get_auth_info},
@@ -702,7 +702,6 @@ pub fn build_webapp(
                 "/network/{location_id}/snat",
                 get(list_snat_bindings).post(create_snat_binding),
             )
-            .route("/network/{id}/postures", put(set_postures_for_location))
             .route(
                 "/network/{location_id}/snat/{user_id}",
                 put(modify_snat_binding).delete(delete_snat_binding),
diff --git a/crates/defguard_core/src/openapi.rs b/crates/defguard_core/src/openapi.rs
index 84733af6f..bdf5d15c3 100644
--- a/crates/defguard_core/src/openapi.rs
+++ b/crates/defguard_core/src/openapi.rs
@@ -235,7 +235,6 @@ Errors are returned as a JSON object with a `msg` field and, for some of them, a
         device_posture::update_device_posture,
         device_posture::duplicate_device_posture,
         device_posture::set_locations_for_posture,
-        device_posture::set_postures_for_location,
         // SNAT
         snat::list_snat_bindings,
         snat::create_snat_binding,
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index 6c94f1cd3..f933bcbec 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -10,6 +10,7 @@ import api from '../../shared/api/api';
 import {
   type EditNetworkLocation,
   LicenseFeature,
+  type LocationMfaFlowResponse,
   LocationServiceMode,
   type NetworkLocation,
 } from '../../shared/api/types';
@@ -356,7 +357,7 @@ const EditLocationForm = ({
   mfaFlows,
 }: {
   location: NetworkLocation;
-  mfaFlows: EditNetworkLocation['mfa_flows'];
+  mfaFlows: LocationMfaFlowResponse[];
 }) => {
   const navigate = useNavigate();
 
@@ -537,7 +538,11 @@ const EditLocationForm = ({
       data: {
         ...buildLocationSubmissionData(value, location),
         posture_checks: pendingPostureChecks,
-        mfa_flows: mfaFlows,
+        mfa_flows: mfaFlows.map((flow) => ({
+          flow_id: flow.id,
+          is_default: flow.is_default,
+          group_ids: flow.groups.map((group) => group.id),
+        })),
       },
     });
   };
diff --git a/web/src/shared/api/api.ts b/web/src/shared/api/api.ts
index 847c7ee72..f75c91489 100644
--- a/web/src/shared/api/api.ts
+++ b/web/src/shared/api/api.ts
@@ -83,13 +83,13 @@ import type {
   LocationConnectedUserDevicesRequest,
   LocationConnectedUsersRequest,
   LocationDevicesResponse,
+  LocationMfaFlowResponse,
   LocationStats,
   LocationStatsRequest,
   LoginRequest,
   LoginResponse,
   LoginResponseBasic,
   MfaCompleteResponse,
-  MfaFlowAssignment,
   MfaFlowDetailResponse,
   MfaFlowListItemResponse,
   MfaMethodAvailabilityResponse,
@@ -537,7 +537,7 @@ const api = {
       client.post<MfaFlowDetailResponse>('/mfa-flow', data),
     get: (id: number) => client.get<MfaFlowDetailResponse>(`/mfa-flow/${id}`),
     getLocationAssignments: (locationId: number) =>
-      client.get<MfaFlowAssignment[]>(`/location/${locationId}/mfa-flows`),
+      client.get<LocationMfaFlowResponse[]>(`/location/${locationId}/mfa-flows`),
     update: (id: number, data: UpdateMfaFlowRequest) =>
       client.put<MfaFlowDetailResponse>(`/mfa-flow/${id}`, data),
     delete: (id: number) => client.delete(`/mfa-flow/${id}`),
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 4773c5ae4..18da24360 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -1470,6 +1470,19 @@ export interface MfaFlowAssignment {
   group_ids: number[];
 }
 
+export interface LocationMfaFlowGroup {
+  id: number;
+  name: string;
+}
+
+export interface LocationMfaFlowResponse {
+  id: number;
+  title: string;
+  steps: Pick<MfaFlowStep, 'methods'>[];
+  is_default: boolean;
+  groups: LocationMfaFlowGroup[];
+}
+
 export interface MfaFlowDetailResponse {
   id: number;
   title: string;

From f754c363babdce88eb3d1cbed84e0ce326af5c36 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 21 Aug 2026 12:51:50 +0200
Subject: [PATCH 06/21] fix tests

---
 .../tests/integration/api/common/mod.rs       |  84 +++++++-
 .../tests/integration/api/device_posture.rs   | 138 ++++--------
 .../integration/api/enterprise_settings.rs    |  16 +-
 .../tests/integration/api/mfa_flow.rs         | 183 +++++++++-------
 .../tests/integration/api/openid_login.rs     |  17 +-
 .../tests/integration/api/user.rs             |   5 +
 .../tests/integration/api/wireguard.rs        | 200 ++++++++++++------
 .../api/wireguard_network_allowed_groups.rs   |  48 +++--
 .../api/wireguard_network_devices.rs          |  33 ++-
 9 files changed, 446 insertions(+), 278 deletions(-)

diff --git a/crates/defguard_core/tests/integration/api/common/mod.rs b/crates/defguard_core/tests/integration/api/common/mod.rs
index a615612b8..85de8dacc 100644
--- a/crates/defguard_core/tests/integration/api/common/mod.rs
+++ b/crates/defguard_core/tests/integration/api/common/mod.rs
@@ -35,7 +35,7 @@ use defguard_core::{
     handlers::{Auth, user::UserDetails},
 };
 use reqwest::{StatusCode, header::HeaderName};
-use serde_json::json;
+use serde_json::{Value, json};
 use sqlx::PgPool;
 use tokio::{
     net::TcpListener,
@@ -206,6 +206,88 @@ pub(crate) async fn exceed_enterprise_limits(client: &TestClient) {
 }
 
 /// Create test network with a given name.
+/// Save a complete MFA assignment list through the location update endpoint.
+pub(crate) async fn update_location_mfa_flows(
+    client: &TestClient,
+    location_id: Id,
+    mfa_flows: Value,
+) -> TestResponse {
+    let mfa_flows = mfa_flows.get("assignments").cloned().unwrap_or(mfa_flows);
+    update_location_assignments(client, location_id, "mfa_flows", mfa_flows).await
+}
+
+/// Save a complete posture-check assignment list through the location update endpoint.
+pub(crate) async fn update_location_posture_checks(
+    client: &TestClient,
+    location_id: Id,
+    posture_checks: Value,
+) -> TestResponse {
+    update_location_assignments(client, location_id, "posture_checks", posture_checks).await
+}
+
+async fn update_location_assignments(
+    client: &TestClient,
+    location_id: Id,
+    field: &str,
+    assignments: Value,
+) -> TestResponse {
+    let response = client
+        .get(format!("/api/v1/network/{location_id}"))
+        .send()
+        .await;
+    if response.status() != StatusCode::OK {
+        return response;
+    }
+    let mut location: Value = response.json().await;
+    let data = location
+        .as_object_mut()
+        .expect("location must be an object");
+    data.remove("id");
+    data.remove("gateways");
+    data.remove("has_devices");
+    for field in ["address", "allowed_ips"] {
+        let value = data
+            .get_mut(field)
+            .and_then(Value::as_array_mut)
+            .expect("location field must be an array");
+        let joined = value
+            .iter()
+            .map(|item| item.as_str().expect("location field item must be a string"))
+            .collect::<Vec<_>>()
+            .join(",");
+        *data.get_mut(field).expect("field must exist") = Value::String(joined);
+    }
+    let response = client
+        .get(format!("/api/v1/location/{location_id}/mfa-flows"))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let flows: Vec<Value> = response.json().await;
+    let mfa_flows = flows
+        .into_iter()
+        .map(|flow| {
+            json!({
+                "flow_id": flow["id"],
+                "is_default": flow["is_default"],
+                "group_ids": flow["groups"]
+                    .as_array()
+                    .expect("flow groups must be an array")
+                    .iter()
+                    .map(|group| group["id"].clone())
+                    .collect::<Vec<_>>(),
+            })
+        })
+        .collect();
+    data.insert("mfa_flows".into(), Value::Array(mfa_flows));
+    data.insert(field.into(), assignments);
+
+    client
+        .put(format!("/api/v1/network/{location_id}"))
+        .json(&location)
+        .send()
+        .await
+}
+
 pub(crate) async fn make_network(client: &TestClient, name: &str) -> TestResponse {
     let response = client
         .post("/api/v1/network")
diff --git a/crates/defguard_core/tests/integration/api/device_posture.rs b/crates/defguard_core/tests/integration/api/device_posture.rs
index 7ddccc5f9..5463ea271 100644
--- a/crates/defguard_core/tests/integration/api/device_posture.rs
+++ b/crates/defguard_core/tests/integration/api/device_posture.rs
@@ -3,8 +3,8 @@ use defguard_core::{
     enterprise::{
         db::models::device_posture::{DevicePosture, DevicePostureSnapshot},
         handlers::device_posture::{
-            ApiDevicePosture, ApiOsRule, AssignLocationsData, AssignPosturesData,
-            DevicePostureVersionMetadata, EditDevicePosture,
+            ApiDevicePosture, ApiOsRule, AssignLocationsData, DevicePostureVersionMetadata,
+            EditDevicePosture,
         },
         license::{get_cached_license, set_cached_license},
         posture::version_list::{
@@ -16,6 +16,7 @@ use defguard_core::{
     grpc::GatewayCommand,
 };
 use reqwest::StatusCode;
+use serde_json::json;
 use sqlx::postgres::{PgConnectOptions, PgPoolOptions};
 
 use super::{
@@ -34,7 +35,7 @@ fn make_edit(name: &str) -> EditDevicePosture {
     }
 }
 
-use crate::api::common::{client::TestClient, make_network};
+use crate::api::common::{client::TestClient, make_network, update_location_posture_checks};
 
 /// Set up a test client with enterprise license and admin session ready.
 /// All device posture tests that don't test license gating should use this.
@@ -1021,25 +1022,16 @@ async fn test_device_posture_set_postures_for_location(
     client.drain_all_events();
 
     // assign both postures to the location
-    let response = client
-        .put(format!("/api/v1/network/{location_id}/postures"))
-        .json(&AssignPosturesData {
-            postures: vec![p1.id, p2.id],
-        })
-        .send()
-        .await;
+    let response =
+        update_location_posture_checks(&client, location_id, json!(vec![p1.id, p2.id])).await;
     assert_eq!(response.status(), StatusCode::OK);
-    let result: Vec<i64> = response.json().await;
-    assert_eq!(result.len(), 2);
-    assert!(result.contains(&p1.id));
-    assert!(result.contains(&p2.id));
-
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 1);
-    assert!(matches!(
-        events[0].0,
-        ApiEventType::LocationPosturesAssigned { .. }
-    ));
+    assert_eq!(events.len(), 2);
+    assert!(
+        events
+            .iter()
+            .any(|event| matches!(event.0, ApiEventType::VpnLocationModified { .. }))
+    );
 
     // GET on each posture shows the location
     for posture in [&p1, &p2] {
@@ -1063,16 +1055,8 @@ async fn test_device_posture_set_postures_for_location(
     assert_eq!(posture_checks.len(), 2);
 
     // reassign with empty list — all postures removed
-    let response = client
-        .put(format!("/api/v1/network/{location_id}/postures"))
-        .json(&AssignPosturesData {
-            postures: Vec::new(),
-        })
-        .send()
-        .await;
+    let response = update_location_posture_checks(&client, location_id, json!([])).await;
     assert_eq!(response.status(), StatusCode::OK);
-    let result: Vec<i64> = response.json().await;
-    assert!(result.is_empty());
     client.drain_all_events();
 
     // GET on postures now shows no locations
@@ -1101,21 +1085,17 @@ async fn test_assigning_first_posture_refreshes_gateway_with_no_direct_peers(
     drain_gateway_events(&mut gateway_rx);
     client.drain_all_events();
 
-    let response = client
-        .put(format!("/api/v1/network/{location_id}/postures"))
-        .json(&AssignPosturesData {
-            postures: vec![posture.id],
-        })
-        .send()
-        .await;
+    let response =
+        update_location_posture_checks(&client, location_id, json!(vec![posture.id])).await;
     assert_eq!(response.status(), StatusCode::OK);
 
     expect_network_modified_peers(&mut gateway_rx, location_id, &[]);
     let events = client.drain_all_events();
-    assert!(matches!(
-        events[0].0,
-        ApiEventType::LocationPosturesAssigned { .. }
-    ));
+    assert!(
+        events
+            .iter()
+            .any(|event| matches!(event.0, ApiEventType::VpnLocationModified { .. }))
+    );
 }
 
 #[sqlx::test]
@@ -1133,32 +1113,22 @@ async fn test_removing_last_posture_refreshes_gateway_with_direct_peers(
     drain_gateway_events(&mut gateway_rx);
     client.drain_all_events();
 
-    let response = client
-        .put(format!("/api/v1/network/{location_id}/postures"))
-        .json(&AssignPosturesData {
-            postures: vec![posture.id],
-        })
-        .send()
-        .await;
+    let response =
+        update_location_posture_checks(&client, location_id, json!(vec![posture.id])).await;
     assert_eq!(response.status(), StatusCode::OK);
     expect_network_modified_peers(&mut gateway_rx, location_id, &[]);
     client.drain_all_events();
 
-    let response = client
-        .put(format!("/api/v1/network/{location_id}/postures"))
-        .json(&AssignPosturesData {
-            postures: Vec::new(),
-        })
-        .send()
-        .await;
+    let response = update_location_posture_checks(&client, location_id, json!([])).await;
     assert_eq!(response.status(), StatusCode::OK);
 
     expect_network_modified_peers(&mut gateway_rx, location_id, &[device_pubkey]);
     let events = client.drain_all_events();
-    assert!(matches!(
-        events[0].0,
-        ApiEventType::LocationPosturesAssigned { .. }
-    ));
+    assert!(
+        events
+            .iter()
+            .any(|event| matches!(event.0, ApiEventType::VpnLocationModified { .. }))
+    );
 }
 
 #[sqlx::test]
@@ -1222,13 +1192,8 @@ async fn test_deleting_assigned_posture_refreshes_gateway_with_direct_peers(
     drain_gateway_events(&mut gateway_rx);
     client.drain_all_events();
 
-    let response = client
-        .put(format!("/api/v1/network/{location_id}/postures"))
-        .json(&AssignPosturesData {
-            postures: vec![posture.id],
-        })
-        .send()
-        .await;
+    let response =
+        update_location_posture_checks(&client, location_id, json!(vec![posture.id])).await;
     assert_eq!(response.status(), StatusCode::OK);
     expect_network_modified_peers(&mut gateway_rx, location_id, &[]);
     client.drain_all_events();
@@ -1261,13 +1226,7 @@ async fn test_device_posture_assignment_not_found(_: PgPoolOptions, options: PgC
     assert_eq!(response.status(), StatusCode::NOT_FOUND);
     client.assert_event_queue_is_empty();
 
-    let response = client
-        .put("/api/v1/network/999/postures")
-        .json(&AssignPosturesData {
-            postures: Vec::new(),
-        })
-        .send()
-        .await;
+    let response = update_location_posture_checks(&client, 999, json!([])).await;
     assert_eq!(response.status(), StatusCode::NOT_FOUND);
     client.assert_event_queue_is_empty();
 }
@@ -1293,7 +1252,9 @@ async fn make_service_location(client: &TestClient, name: &str) -> i64 {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "prelogon"
+            "service_location_mode": "prelogon",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -1320,23 +1281,16 @@ async fn test_set_postures_for_service_location_allowed(
     client.drain_all_events();
 
     // assigning posture checks to a service location is allowed
-    let response = client
-        .put(format!("/api/v1/network/{service_location_id}/postures"))
-        .json(&AssignPosturesData {
-            postures: vec![posture.id],
-        })
-        .send()
-        .await;
+    let response =
+        update_location_posture_checks(&client, service_location_id, json!(vec![posture.id])).await;
     assert_eq!(response.status(), StatusCode::OK);
-    let result: Vec<i64> = response.json().await;
-    assert_eq!(result, vec![posture.id]);
-
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 1);
-    assert!(matches!(
-        events[0].0,
-        ApiEventType::LocationPosturesAssigned { .. }
-    ));
+    assert_eq!(events.len(), 2);
+    assert!(
+        events
+            .iter()
+            .any(|event| matches!(event.0, ApiEventType::VpnLocationModified { .. }))
+    );
 
     // the assignment is visible on the posture
     let response = client
@@ -1347,13 +1301,7 @@ async fn test_set_postures_for_service_location_allowed(
     assert_eq!(fetched.locations, vec![service_location_id]);
 
     // clearing (empty list) is still allowed on a service location
-    let response = client
-        .put(format!("/api/v1/network/{service_location_id}/postures"))
-        .json(&AssignPosturesData {
-            postures: Vec::new(),
-        })
-        .send()
-        .await;
+    let response = update_location_posture_checks(&client, service_location_id, json!([])).await;
     assert_eq!(response.status(), StatusCode::OK);
     client.drain_all_events();
 
diff --git a/crates/defguard_core/tests/integration/api/enterprise_settings.rs b/crates/defguard_core/tests/integration/api/enterprise_settings.rs
index e4eb978b2..9ae3d341d 100644
--- a/crates/defguard_core/tests/integration/api/enterprise_settings.rs
+++ b/crates/defguard_core/tests/integration/api/enterprise_settings.rs
@@ -100,7 +100,9 @@ async fn test_admin_devices_management_is_enforced(_: PgPoolOptions, options: Pg
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -217,7 +219,9 @@ async fn test_regular_user_device_management(_: PgPoolOptions, options: PgConnec
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -326,7 +330,9 @@ async fn dg25_12_test_enforce_client_activation_only(_: PgPoolOptions, options:
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -453,7 +459,9 @@ async fn dg25_13_test_disable_device_config(_: PgPoolOptions, options: PgConnect
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
diff --git a/crates/defguard_core/tests/integration/api/mfa_flow.rs b/crates/defguard_core/tests/integration/api/mfa_flow.rs
index 7084f8baa..f8fd9befe 100644
--- a/crates/defguard_core/tests/integration/api/mfa_flow.rs
+++ b/crates/defguard_core/tests/integration/api/mfa_flow.rs
@@ -16,6 +16,7 @@ use sqlx::postgres::{PgConnectOptions, PgPoolOptions};
 
 use super::common::{
     authenticate_admin, configure_smtp, make_network, make_test_client, set_enterprise_license,
+    update_location_mfa_flows,
 };
 
 /// Single-step flow without OIDC - should succeed without any license.
@@ -299,11 +300,7 @@ async fn test_mfa_flow_group_scoping_requires_enterprise(
     let _ = client.drain_all_events();
 
     // Business license → 403 (group scoping needs enterprise), and no audit event on refusal.
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&assignment_body)
-        .send()
-        .await;
+    let response = update_location_mfa_flows(&client, location_id, assignment_body.clone()).await;
     assert_eq!(response.status(), StatusCode::FORBIDDEN);
     assert!(
         client.drain_all_events().is_empty(),
@@ -312,16 +309,19 @@ async fn test_mfa_flow_group_scoping_requires_enterprise(
 
     // Enterprise license → 200
     set_enterprise_license();
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&assignment_body)
-        .send()
-        .await;
+    let response = update_location_mfa_flows(&client, location_id, assignment_body).await;
     assert_eq!(response.status(), StatusCode::OK);
 
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 1, "expected exactly 1 event after assign");
-    let (event_type, _user_id, _username) = &events[0];
+    assert_eq!(
+        events.len(),
+        2,
+        "location save must emit assignment and modification events"
+    );
+    let (event_type, _user_id, _username) = events
+        .iter()
+        .find(|event| matches!(event.0, ApiEventType::LocationMfaFlowsAssigned { .. }))
+        .expect("missing MFA assignment event");
     assert_matches!(
         event_type,
         ApiEventType::LocationMfaFlowsAssigned {
@@ -510,22 +510,24 @@ async fn test_location_mfa_flows_input_validation(_: PgPoolOptions, options: PgC
     let response = client.get("/api/v1/location/999999/mfa-flows").send().await;
     assert_eq!(response.status(), StatusCode::NOT_FOUND);
 
-    let response = client
-        .put("/api/v1/location/999999/mfa-flows")
-        .json(&json!({"assignments": [{"flow_id": flow_id, "is_default": true, "group_ids": []}]}))
-        .send()
-        .await;
+    let response = update_location_mfa_flows(
+        &client,
+        999999,
+        json!({"assignments": [{"flow_id": flow_id, "is_default": true, "group_ids": []}]}),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::NOT_FOUND);
 
     // The same flow twice would violate the (location_id, flow_id) primary key.
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let response = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": flow_id, "is_default": true, "group_ids": []},
             {"flow_id": flow_id, "is_default": false, "group_ids": []},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::BAD_REQUEST);
     assert_eq!(
         response.json::<serde_json::Value>().await["fields"][0]["code"],
@@ -533,13 +535,14 @@ async fn test_location_mfa_flows_input_validation(_: PgPoolOptions, options: PgC
     );
 
     // A nonexistent flow would violate the foreign key.
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let response = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": 999999, "is_default": true, "group_ids": []},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::BAD_REQUEST);
     assert_eq!(
         response.json::<serde_json::Value>().await["fields"][0]["code"],
@@ -595,14 +598,15 @@ async fn test_location_mfa_flows_non_default_without_groups(
     // Clear the two create events before exercising the refusal path.
     let _ = client.drain_all_events();
 
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let response = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": flow1_id, "is_default": false, "group_ids": []},
             {"flow_id": flow2_id, "is_default": true, "group_ids": []},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::BAD_REQUEST);
     let body: serde_json::Value = response.json().await;
     assert_eq!(body["error"], "validation_failed");
@@ -642,18 +646,26 @@ async fn test_location_mfa_flows_clear_disabled_location(
     let _ = client.drain_all_events();
 
     // Assign a default, then clear it.
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let response = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": flow_id, "is_default": true, "group_ids": []},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::OK);
 
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 1, "expected exactly 1 event after assign");
-    let (event_type, _user_id, _username) = &events[0];
+    assert_eq!(
+        events.len(),
+        2,
+        "location save must emit assignment and modification events"
+    );
+    let (event_type, _user_id, _username) = events
+        .iter()
+        .find(|event| matches!(event.0, ApiEventType::LocationMfaFlowsAssigned { .. }))
+        .expect("missing MFA assignment event");
     assert_matches!(
         event_type,
         ApiEventType::LocationMfaFlowsAssigned {
@@ -668,16 +680,20 @@ async fn test_location_mfa_flows_clear_disabled_location(
             && assignments[0].group_ids.is_empty()
     );
 
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": []}))
-        .send()
-        .await;
+    let response =
+        update_location_mfa_flows(&client, location_id, json!({"assignments": []})).await;
     assert_eq!(response.status(), StatusCode::OK);
 
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 1, "expected exactly 1 event after clear");
-    let (event_type, _user_id, _username) = &events[0];
+    assert_eq!(
+        events.len(),
+        2,
+        "location save must emit assignment and modification events"
+    );
+    let (event_type, _user_id, _username) = events
+        .iter()
+        .find(|event| matches!(event.0, ApiEventType::LocationMfaFlowsAssigned { .. }))
+        .expect("missing MFA assignment event");
     assert_matches!(
         event_type,
         ApiEventType::LocationMfaFlowsAssigned {
@@ -859,7 +875,7 @@ async fn test_mfa_flow_update_preserves_backfilled_email(
 }
 
 /// The full `WireguardNetworkData` body used to toggle `mfa_enabled` on an existing location.
-fn network_body(name: &str, mfa_enabled: bool) -> serde_json::Value {
+fn network_body(name: &str, mfa_enabled: bool, flow_id: i64) -> serde_json::Value {
     json!({
         "name": name,
         "address": "10.1.1.1/24",
@@ -877,7 +893,9 @@ fn network_body(name: &str, mfa_enabled: bool) -> serde_json::Value {
         "acl_default_allow": false,
         "allowed_ips_from_acl": false,
         "mfa_enabled": mfa_enabled,
-        "service_location_mode": "disabled"
+        "service_location_mode": "disabled",
+        "posture_checks": [],
+        "mfa_flows": [{"flow_id": flow_id, "is_default": true, "group_ids": []}]
     })
 }
 
@@ -910,26 +928,27 @@ async fn test_mfa_enabled_disable_preserves_assignments(
         .unwrap();
 
     // Assign the flow as the location's default.
-    let resp = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let resp = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": flow_id, "is_default": true, "group_ids": []},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(resp.status(), StatusCode::OK);
 
     // Enable MFA, then disable it: the assignment list must survive untouched.
     let resp = client
         .put(format!("/api/v1/network/{location_id}"))
-        .json(&network_body("mfa-lifecycle", true))
+        .json(&network_body("mfa-lifecycle", true, flow_id))
         .send()
         .await;
     assert_eq!(resp.status(), StatusCode::OK);
 
     let resp = client
         .put(format!("/api/v1/network/{location_id}"))
-        .json(&network_body("mfa-lifecycle", false))
+        .json(&network_body("mfa-lifecycle", false, flow_id))
         .send()
         .await;
     assert_eq!(resp.status(), StatusCode::OK);
@@ -947,13 +966,12 @@ async fn test_mfa_enabled_disable_preserves_assignments(
         "disabling MFA must preserve the assignment list"
     );
     assert_eq!(assignments[0]["id"].as_i64(), Some(flow_id));
-    assert_eq!(assignments[0]["position"].as_i64(), Some(0));
     assert_eq!(assignments[0]["is_default"].as_bool(), Some(true));
 
     // Re-enable: the same policy must be in force, resolving the same flow for a user.
     let resp = client
         .put(format!("/api/v1/network/{location_id}"))
-        .json(&network_body("mfa-lifecycle", true))
+        .json(&network_body("mfa-lifecycle", true, flow_id))
         .send()
         .await;
     assert_eq!(resp.status(), StatusCode::OK);
@@ -998,19 +1016,20 @@ async fn test_mfa_flow_delete_location_requires_flow(_: PgPoolOptions, options:
         .as_i64()
         .unwrap();
 
-    let resp = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let resp = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": flow_id, "is_default": true, "group_ids": []},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(resp.status(), StatusCode::OK);
 
     // Enable MFA so the location requires this flow.
     let resp = client
         .put(format!("/api/v1/network/{location_id}"))
-        .json(&network_body("delete-orphan", true))
+        .json(&network_body("delete-orphan", true, flow_id))
         .send()
         .await;
     assert_eq!(resp.status(), StatusCode::OK);
@@ -1082,14 +1101,15 @@ async fn test_mfa_flow_delete_flow_is_default(_: PgPoolOptions, options: PgConne
 
     // flow1 is the default, flow2 is group-scoped; group scoping needs Enterprise.
     set_enterprise_license();
-    let resp = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let resp = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": flow1_id, "is_default": true, "group_ids": []},
             {"flow_id": flow2_id, "is_default": false, "group_ids": [admin_group_id]},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(resp.status(), StatusCode::OK);
 
     let _ = client.drain_all_events();
@@ -1249,13 +1269,14 @@ async fn test_location_mfa_flows_no_default_designated(
 
     let _ = client.drain_all_events();
 
-    let resp = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let resp = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": flow_id, "is_default": false, "group_ids": []},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
     let body: serde_json::Value = resp.json().await;
     assert_eq!(body["error"], "validation_failed");
diff --git a/crates/defguard_core/tests/integration/api/openid_login.rs b/crates/defguard_core/tests/integration/api/openid_login.rs
index 058c695e7..7db7e1aa7 100644
--- a/crates/defguard_core/tests/integration/api/openid_login.rs
+++ b/crates/defguard_core/tests/integration/api/openid_login.rs
@@ -18,7 +18,9 @@ use serde::Deserialize;
 use serde_json::json;
 use sqlx::postgres::{PgConnectOptions, PgPoolOptions};
 
-use super::common::{exceed_enterprise_limits, make_client, make_network, setup_pool};
+use super::common::{
+    exceed_enterprise_limits, make_client, make_network, setup_pool, update_location_mfa_flows,
+};
 use crate::api::PaginatedApiResponse;
 
 #[derive(Deserialize)]
@@ -445,13 +447,14 @@ async fn test_delete_openid_provider_reports_affected_locations(
         .unwrap();
 
     // Assign the OIDC flow as the location's default, so the location genuinely depends on it.
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({
+    let response = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({
             "assignments": [{ "flow_id": flow_id, "is_default": true, "group_ids": [] }]
-        }))
-        .send()
-        .await;
+        }),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::OK);
 
     // Deletion proceeds and names the location whose flows are now unsatisfiable.
diff --git a/crates/defguard_core/tests/integration/api/user.rs b/crates/defguard_core/tests/integration/api/user.rs
index 8b74bdab2..401d7f3cf 100644
--- a/crates/defguard_core/tests/integration/api/user.rs
+++ b/crates/defguard_core/tests/integration/api/user.rs
@@ -1459,6 +1459,11 @@ async fn test_user_add_device(_: PgPoolOptions, options: PgConnectOptions) {
 
     // create network
     make_network(&client, "network").await;
+    expected_events.push(ApiEventType::LocationMfaFlowsAssigned {
+        location_id: 1,
+        location_name: "network".into(),
+        assignments: Vec::new(),
+    });
     expected_events.push(ApiEventType::VpnLocationAdded {
         location: get_db_location(&state.pool, 1).await,
     });
diff --git a/crates/defguard_core/tests/integration/api/wireguard.rs b/crates/defguard_core/tests/integration/api/wireguard.rs
index 61c554387..a49348c90 100644
--- a/crates/defguard_core/tests/integration/api/wireguard.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard.rs
@@ -30,7 +30,7 @@ use sqlx::postgres::{PgConnectOptions, PgPoolOptions};
 
 use super::common::{
     authenticate_admin, client::TestClient, fetch_user_details, make_network, make_test_client,
-    setup_pool,
+    setup_pool, update_location_mfa_flows, update_location_posture_checks,
 };
 
 const INVALID_MFA_PEER_DISCONNECT_THRESHOLD: i32 = 119;
@@ -189,7 +189,9 @@ async fn test_create_network_blocked_when_location_count_exceeds_license_limit(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -263,7 +265,8 @@ async fn test_create_network_with_posture_checks_assigns_postures(
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
             "service_location_mode": "disabled",
-            "posture_checks": posture_ids
+            "posture_checks": posture_ids,
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -325,7 +328,8 @@ async fn test_create_network_with_posture_checks_requires_enterprise_license(
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
             "service_location_mode": "disabled",
-            "posture_checks": [1]
+            "posture_checks": [1],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -397,11 +401,12 @@ async fn make_mfa_flow(client: &TestClient) -> i64 {
 
 /// Assign a flow as a location's default so the location can be MFA-enabled.
 async fn assign_default_mfa_flow(client: &TestClient, location_id: i64, flow_id: i64) {
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({ "assignments": [{ "flow_id": flow_id, "is_default": true, "group_ids": [] }] }))
-        .send()
-        .await;
+    let response = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({ "assignments": [{ "flow_id": flow_id, "is_default": true, "group_ids": [] }] }),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::OK);
 }
 
@@ -432,7 +437,9 @@ async fn test_mfa_enabled_no_flows_structured_body(_: PgPoolOptions, options: Pg
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": true,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -440,8 +447,8 @@ async fn test_mfa_enabled_no_flows_structured_body(_: PgPoolOptions, options: Pg
 
     let body: serde_json::Value = response.json().await;
     assert_eq!(body["error"], "validation_failed");
-    assert_eq!(body["fields"][0]["field"], "mfa_enabled");
-    assert_eq!(body["fields"][0]["code"], "no_flows_exist");
+    assert_eq!(body["fields"][0]["field"], "mfa_flows");
+    assert_eq!(body["fields"][0]["code"], "no_default_designated");
     assert!(
         body.get("msg").is_none(),
         "the refusal body must not be double-encoded via msg"
@@ -478,21 +485,19 @@ async fn test_enable_mfa_after_clear_refused_without_flows(
         .as_i64()
         .unwrap();
 
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": [
+    let response = update_location_mfa_flows(
+        &client,
+        location_id,
+        json!({"assignments": [
             {"flow_id": flow_id, "is_default": true, "group_ids": []},
-        ]}))
-        .send()
-        .await;
+        ]}),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::OK);
 
     // Clearing is allowed on the MFA-disabled location.
-    let response = client
-        .put(format!("/api/v1/location/{location_id}/mfa-flows"))
-        .json(&json!({"assignments": []}))
-        .send()
-        .await;
+    let response =
+        update_location_mfa_flows(&client, location_id, json!({"assignments": []})).await;
     assert_eq!(response.status(), StatusCode::OK);
 
     // Delete the now-unassigned flow so no flows exist globally.
@@ -522,13 +527,15 @@ async fn test_enable_mfa_after_clear_refused_without_flows(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": true,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
     assert_eq!(response.status(), StatusCode::BAD_REQUEST);
     let body: serde_json::Value = response.json().await;
-    assert_eq!(body["fields"][0]["code"], "no_flows_exist");
+    assert_eq!(body["fields"][0]["code"], "no_default_designated");
 }
 
 /// Enabling MFA on a location that has no default flow assigned is refused with
@@ -564,15 +571,17 @@ async fn test_enable_mfa_without_assignment_refused(_: PgPoolOptions, options: P
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": true,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
     assert_eq!(response.status(), StatusCode::BAD_REQUEST);
     let body: serde_json::Value = response.json().await;
     assert_eq!(body["error"], "validation_failed");
-    assert_eq!(body["fields"][0]["field"], "mfa_enabled");
-    assert_eq!(body["fields"][0]["code"], "no_flows_assigned");
+    assert_eq!(body["fields"][0]["field"], "mfa_flows");
+    assert_eq!(body["fields"][0]["code"], "no_default_designated");
 }
 
 /// Create a posture check and return its ID.
@@ -945,14 +954,11 @@ async fn test_posture_checks_allowed_on_service_locations(
     assert_eq!(response.status(), StatusCode::CREATED);
     let location: WireguardNetwork<Id> = response.json().await;
 
+    let mut payload = location_payload("regular-location", "10.2.2.1/24", false, "alwayson");
+    payload["posture_checks"] = json!([posture]);
     let response = client
         .put(format!("/api/v1/network/{}", location.id))
-        .json(&location_payload(
-            "regular-location",
-            "10.2.2.1/24",
-            false,
-            "alwayson",
-        ))
+        .json(&payload)
         .send()
         .await;
     assert_eq!(response.status(), StatusCode::OK);
@@ -966,7 +972,7 @@ async fn test_posture_checks_allowed_on_service_locations(
         vec![posture]
     );
 
-    // dedicated assignment path: posture checks can be assigned to an existing service location
+    // posture checks can be assigned to an existing service location through the location save
     let response = client
         .post("/api/v1/network")
         .json(&location_payload(
@@ -985,14 +991,12 @@ async fn test_posture_checks_allowed_on_service_locations(
             .is_empty()
     );
 
-    let response = client
-        .put(format!(
-            "/api/v1/network/{}/postures",
-            service_location_without_postures.id
-        ))
-        .json(&json!({ "postures": [posture] }))
-        .send()
-        .await;
+    let response = update_location_posture_checks(
+        &client,
+        service_location_without_postures.id,
+        json!([posture]),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::OK);
     assert_eq!(
         fetch_location_postures(&client, service_location_without_postures.id).await,
@@ -1060,7 +1064,7 @@ async fn test_peer_disconnect_threshold_validation_create(
         .await;
     assert_eq!(response.status(), StatusCode::BAD_REQUEST);
     let body: serde_json::Value = response.json().await;
-    assert_eq!(body["fields"][0]["code"], "no_flows_assigned");
+    assert_eq!(body["fields"][0]["code"], "no_default_designated");
 }
 
 #[sqlx::test]
@@ -1106,6 +1110,13 @@ async fn test_peer_disconnect_threshold_validation_modify(
     // Give the location a default flow so the threshold checks below operate on a
     // MFA-enableable location.
     assign_default_mfa_flow(&client, 1, flow_id).await;
+    location_data.mfa_flows = vec![
+        defguard_common::db::models::mfa_flow::LocationMfaFlowAssignment {
+            flow_id,
+            is_default: true,
+            group_ids: Vec::new(),
+        },
+    ];
 
     let response = client
         .put("/api/v1/network/1")
@@ -1370,7 +1381,9 @@ async fn test_network_address_reassignment(_: PgPoolOptions, options: PgConnectO
         "acl_default_allow": false,
             "allowed_ips_from_acl": false,
         "mfa_enabled": false,
-        "service_location_mode": "disabled"
+        "service_location_mode": "disabled",
+        "posture_checks": [],
+        "mfa_flows": []
     });
     let response = client
         .put(format!("/api/v1/network/{network_id}"))
@@ -1699,7 +1712,9 @@ async fn test_network_size_validation(_: PgPoolOptions, options: PgConnectOption
         "acl_default_allow": false,
             "allowed_ips_from_acl": false,
         "mfa_enabled": false,
-        "service_location_mode": "disabled"
+        "service_location_mode": "disabled",
+        "posture_checks": [],
+        "mfa_flows": []
     });
     let response = client
         .put(format!("/api/v1/network/{}", network_from_details.id))
@@ -1727,7 +1742,9 @@ async fn test_network_size_validation(_: PgPoolOptions, options: PgConnectOption
         "acl_default_allow": false,
             "allowed_ips_from_acl": false,
         "mfa_enabled": false,
-        "service_location_mode": "disabled"
+        "service_location_mode": "disabled",
+        "posture_checks": [],
+        "mfa_flows": []
     });
     let response = client
         .put(format!("/api/v1/network/{}", network_from_details.id))
@@ -1858,7 +1875,9 @@ async fn test_user_device_configs_auth(_: PgPoolOptions, options: PgConnectOptio
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -1948,7 +1967,9 @@ async fn test_add_device_for_disabled_user(_: PgPoolOptions, options: PgConnectO
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2014,7 +2035,9 @@ async fn test_user_device_configs_excludes_mfa_locations(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await
@@ -2042,7 +2065,9 @@ async fn test_user_device_configs_excludes_mfa_locations(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await
@@ -2070,7 +2095,9 @@ async fn test_user_device_configs_excludes_mfa_locations(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": true,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": [{"flow_id": flow_id, "is_default": true, "group_ids": []}]
         }))
         .send()
         .await;
@@ -2135,7 +2162,9 @@ async fn test_location_allowed_ips_from_acl_flag(_: PgPoolOptions, options: PgCo
             "acl_default_allow": false,
             "allowed_ips_from_acl": true,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2148,8 +2177,15 @@ async fn test_location_allowed_ips_from_acl_flag(_: PgPoolOptions, options: PgCo
 
     // Verify API event was emitted for location creation
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 1, "expected exactly 1 event after create");
-    let (event_type, _user_id, _username) = &events[0];
+    assert_eq!(
+        events.len(),
+        2,
+        "location save must emit assignment and location events"
+    );
+    let (event_type, _user_id, _username) = events
+        .iter()
+        .find(|event| matches!(event.0, ApiEventType::VpnLocationAdded { .. }))
+        .expect("missing location event");
     assert_matches!(
         event_type,
         ApiEventType::VpnLocationAdded { location: event_location }
@@ -2176,7 +2212,9 @@ async fn test_location_allowed_ips_from_acl_flag(_: PgPoolOptions, options: PgCo
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2188,8 +2226,15 @@ async fn test_location_allowed_ips_from_acl_flag(_: PgPoolOptions, options: PgCo
     );
 
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 1, "expected exactly 1 event after edit off");
-    let (event_type, _user_id, _username) = &events[0];
+    assert_eq!(
+        events.len(),
+        2,
+        "location save must emit assignment and location events"
+    );
+    let (event_type, _user_id, _username) = events
+        .iter()
+        .find(|event| matches!(event.0, ApiEventType::VpnLocationModified { .. }))
+        .expect("missing location event");
     assert_matches!(
         event_type,
         ApiEventType::VpnLocationModified { before: before_loc, after: after_loc }
@@ -2219,7 +2264,9 @@ async fn test_location_allowed_ips_from_acl_flag(_: PgPoolOptions, options: PgCo
             "acl_default_allow": false,
             "allowed_ips_from_acl": true,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2231,8 +2278,15 @@ async fn test_location_allowed_ips_from_acl_flag(_: PgPoolOptions, options: PgCo
     );
 
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 1, "expected exactly 1 event after edit on");
-    let (event_type, _user_id, _username) = &events[0];
+    assert_eq!(
+        events.len(),
+        2,
+        "location save must emit assignment and location events"
+    );
+    let (event_type, _user_id, _username) = events
+        .iter()
+        .find(|event| matches!(event.0, ApiEventType::VpnLocationModified { .. }))
+        .expect("missing location event");
     assert_matches!(
         event_type,
         ApiEventType::VpnLocationModified { before: before_loc, after: after_loc }
@@ -2360,7 +2414,9 @@ async fn test_config_allowed_ips_from_acl_merged(_: PgPoolOptions, options: PgCo
             "acl_default_allow": false,
             "allowed_ips_from_acl": true,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2429,7 +2485,9 @@ async fn test_config_allowed_ips_from_acl_no_match(_: PgPoolOptions, options: Pg
             "acl_default_allow": false,
             "allowed_ips_from_acl": true,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2536,7 +2594,9 @@ async fn test_config_allowed_ips_from_acl_toggle_off(_: PgPoolOptions, options:
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2608,7 +2668,9 @@ async fn test_config_allowed_ips_from_acl_any_address_skipped(
             "acl_default_allow": false,
             "allowed_ips_from_acl": true,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2688,7 +2750,9 @@ async fn test_config_allowed_ips_from_acl_no_license(_: PgPoolOptions, options:
             "acl_default_allow": false,
             "allowed_ips_from_acl": true,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -2759,7 +2823,9 @@ async fn test_config_allowed_ips_from_acl_disabled(_: PgPoolOptions, options: Pg
             "acl_default_allow": false,
             "allowed_ips_from_acl": true,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
diff --git a/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs b/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
index d1bcb1578..c3bc2a4c6 100644
--- a/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard_network_allowed_groups.rs
@@ -174,7 +174,9 @@ async fn test_create_new_network(_: PgPoolOptions, options: PgConnectOptions) {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -227,7 +229,9 @@ async fn test_create_new_network_allow_all_groups(_: PgPoolOptions, options: PgC
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -288,7 +292,9 @@ async fn test_modify_network(_: PgPoolOptions, options: PgConnectOptions) {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -326,7 +332,9 @@ async fn test_modify_network(_: PgPoolOptions, options: PgConnectOptions) {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -363,7 +371,9 @@ async fn test_modify_network(_: PgPoolOptions, options: PgConnectOptions) {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -401,7 +411,9 @@ async fn test_modify_network(_: PgPoolOptions, options: PgConnectOptions) {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -454,7 +466,9 @@ async fn test_modify_network_enable_allow_all_groups(_: PgPoolOptions, options:
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -489,7 +503,9 @@ async fn test_modify_network_enable_allow_all_groups(_: PgPoolOptions, options:
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -760,7 +776,9 @@ async fn test_modify_user(_: PgPoolOptions, options: PgConnectOptions) {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -875,7 +893,9 @@ async fn test_modify_user_no_effect_when_allow_all_groups(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -991,7 +1011,9 @@ async fn test_delete_only_allowed_group_rejected(_: PgPoolOptions, options: PgCo
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -1064,7 +1086,9 @@ async fn test_delete_allowed_group_when_location_keeps_other_groups(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
diff --git a/crates/defguard_core/tests/integration/api/wireguard_network_devices.rs b/crates/defguard_core/tests/integration/api/wireguard_network_devices.rs
index 9125b0a48..9a7ea5f02 100644
--- a/crates/defguard_core/tests/integration/api/wireguard_network_devices.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard_network_devices.rs
@@ -17,7 +17,7 @@ use sqlx::postgres::{PgConnectOptions, PgPoolOptions};
 
 use super::common::{
     client::{TestClient, TestResponse},
-    make_test_client, setup_pool,
+    make_test_client, setup_pool, update_location_mfa_flows,
 };
 
 async fn make_first_network(client: &TestClient) -> TestResponse {
@@ -40,7 +40,9 @@ async fn make_first_network(client: &TestClient) -> TestResponse {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -68,7 +70,9 @@ async fn make_second_network(client: &TestClient) -> TestResponse {
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
@@ -336,7 +340,9 @@ async fn test_device_ip_validation(_: PgPoolOptions, options: PgConnectOptions)
         "acl_default_allow": false,
             "allowed_ips_from_acl": false,
         "mfa_enabled": false,
-        "service_location_mode": "disabled"
+        "service_location_mode": "disabled",
+        "posture_checks": [],
+        "mfa_flows": []
     });
     let response = client.post("/api/v1/network").json(&location).send().await;
     assert_eq!(response.status(), StatusCode::CREATED);
@@ -464,18 +470,21 @@ async fn test_network_device_config_skips_mfa_location(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": false,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": []
         }))
         .send()
         .await;
     assert_eq!(response.status(), StatusCode::CREATED);
     let location: WireguardNetwork<Id> = response.json().await;
 
-    let response = client
-        .put(format!("/api/v1/location/{}/mfa-flows", location.id))
-        .json(&json!({ "assignments": [{ "flow_id": flow_id, "is_default": true, "group_ids": [] }] }))
-        .send()
-        .await;
+    let response = update_location_mfa_flows(
+        &client,
+        location.id,
+        json!({ "assignments": [{ "flow_id": flow_id, "is_default": true, "group_ids": [] }] }),
+    )
+    .await;
     assert_eq!(response.status(), StatusCode::OK);
 
     let response = client
@@ -497,7 +506,9 @@ async fn test_network_device_config_skips_mfa_location(
             "acl_default_allow": false,
             "allowed_ips_from_acl": false,
             "mfa_enabled": true,
-            "service_location_mode": "disabled"
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": [{"flow_id": flow_id, "is_default": true, "group_ids": []}]
         }))
         .send()
         .await;

From 37aa5684bf31950fe1520e297c252da4dd753552 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 21 Aug 2026 13:24:35 +0200
Subject: [PATCH 07/21] don't block location edits when license expires

---
 .../defguard_core/src/handlers/wireguard.rs   | 26 ++++++++-----
 .../tests/integration/api/wireguard.rs        | 39 +++++++++++++++++++
 2 files changed, 55 insertions(+), 10 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index aa7a5ef7d..afae94180 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -488,16 +488,22 @@ pub(crate) async fn modify_network(
         .set_allowed_groups(&mut transaction, &data.allowed_groups)
         .await?;
 
-    if !has_enterprise_access(Some(LicenseFeature::DevicePosture))
-        && !data.posture_checks.is_empty()
-    {
-        return Ok(WebError::Forbidden(
-            "Cannot assign posture checks to location: Enterprise license required.",
-        )
-        .into());
-    }
-    DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
-        .await?;
+    let posture_checks = if has_enterprise_access(Some(LicenseFeature::DevicePosture)) {
+        data.posture_checks.clone()
+    } else {
+        let current =
+            DevicePostureLocation::find_by_location(&mut *transaction, network.id).await?;
+        if data.posture_checks != current {
+            warn!(
+                location_id = network.id,
+                requested_posture_checks = ?data.posture_checks,
+                current_posture_checks = ?current,
+                "Ignoring posture check assignment update because the Enterprise license is inactive"
+            );
+        }
+        current
+    };
+    DevicePostureLocation::set_for_location(&mut transaction, network.id, &posture_checks).await?;
 
     let mfa_assignments: Vec<LocationMfaFlowAssignment> = data.mfa_flows.clone();
     if let Err(error) =
diff --git a/crates/defguard_core/tests/integration/api/wireguard.rs b/crates/defguard_core/tests/integration/api/wireguard.rs
index a49348c90..eeefde3a5 100644
--- a/crates/defguard_core/tests/integration/api/wireguard.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard.rs
@@ -919,6 +919,45 @@ async fn test_modify_network_replaces_posture_checks(_: PgPoolOptions, options:
     );
 }
 
+#[sqlx::test]
+async fn test_modify_network_preserves_posture_checks_without_enterprise_license(
+    _: PgPoolOptions,
+    options: PgConnectOptions,
+) {
+    let pool = setup_pool(options).await;
+    let (mut client, _client_state) = make_test_client(pool).await;
+    authenticate_admin(&mut client).await;
+    set_enterprise_license();
+
+    let posture = make_posture_check(&client, "Posture").await;
+    let mut payload = location_payload("location", "10.1.1.1/24", false, "disabled");
+    payload["posture_checks"] = json!([posture]);
+    let response = client.post("/api/v1/network").json(&payload).send().await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    let location: WireguardNetwork<Id> = response.json().await;
+
+    let license = get_cached_license().clone();
+    set_cached_license(None);
+    let response = client
+        .put(format!("/api/v1/network/{}", location.id))
+        .json(&location_payload(
+            "renamed-location",
+            "10.1.1.1/24",
+            false,
+            "disabled",
+        ))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let modified: WireguardNetwork<Id> = response.json().await;
+    assert_eq!(modified.name, "renamed-location");
+    assert_eq!(
+        fetch_location_postures(&client, location.id).await,
+        vec![posture]
+    );
+    set_cached_license(license);
+}
+
 #[sqlx::test]
 async fn test_posture_checks_allowed_on_service_locations(
     _: PgPoolOptions,

From 2f0bca9819cd5826db004c69b5881e7d612faded Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 07:49:28 +0200
Subject: [PATCH 08/21] allow business license to save location with
 group-assigned mfa flow

---
 crates/defguard_core/src/handlers/mfa_flow.rs | 29 +-------
 .../defguard_core/src/handlers/wireguard.rs   | 71 +++++++++----------
 .../tests/integration/api/mfa_flow.rs         | 23 +++---
 3 files changed, 44 insertions(+), 79 deletions(-)

diff --git a/crates/defguard_core/src/handlers/mfa_flow.rs b/crates/defguard_core/src/handlers/mfa_flow.rs
index 42d51f029..6091971b7 100644
--- a/crates/defguard_core/src/handlers/mfa_flow.rs
+++ b/crates/defguard_core/src/handlers/mfa_flow.rs
@@ -25,10 +25,7 @@ use utoipa::ToSchema;
 use crate::{
     appstate::AppState,
     auth::{AdminRole, SessionInfo},
-    enterprise::{
-        db::models::openid_provider::OpenIdProvider, has_enterprise_access,
-        is_business_license_active,
-    },
+    enterprise::{db::models::openid_provider::OpenIdProvider, is_business_license_active},
     error::WebError,
     events::{ApiEvent, ApiEventType, ApiRequestContext},
     handlers::{ApiErrorResponse, ApiResponse, ApiResult},
@@ -239,30 +236,6 @@ fn check_method_prerequisites(
     }
 }
 
-/// Check licence gates for flow assignment: group scoping requires Enterprise.
-///
-/// Uses `has_enterprise_access(None)` (raw Enterprise tier) rather than
-/// `has_enterprise_access(Some(LicenseFeature::MfaFlowGroupScoping))` because
-/// adding a `LicenseFeature` variant would require coordination outside this
-/// repo: the proto enum in the `proto` repo and license issuance must both
-/// recognise the new variant. The `None` form gates strictly on the Enterprise
-/// tier, which is the correct behaviour for this feature.
-#[must_use]
-pub(crate) fn check_assignment_license_gates(
-    assignments: &[LocationMfaFlowAssignment],
-) -> Option<ApiResponse> {
-    let scoped = assignments.iter().position(|a| !a.group_ids.is_empty());
-    if let Some(index) = scoped
-        && !has_enterprise_access(None)
-    {
-        return Some(license_error_response(
-            format!("assignments[{index}].group_ids"),
-            "enterprise_license_required",
-        ));
-    }
-    None
-}
-
 /// Field path for the first assignment entry matching `predicate`, suffixed with `suffix`.
 ///
 /// Errors point at the row the admin submitted rather than at the list as a whole. When no entry
diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index afae94180..29b549050 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -36,15 +36,14 @@ use crate::{
         },
         firewall::try_get_location_firewall_config,
         handlers::CanManageDevices,
-        has_enterprise_access,
+        has_enterprise_access, is_business_license_active,
         license::{LicenseFeature, get_cached_license},
         limits::{get_counts, update_counts},
     },
     events::{ApiEvent, ApiEventType, ApiRequestContext},
     grpc::GatewayCommand,
     handlers::{
-        gateway::GatewayInfo,
-        mfa_flow::{assignment_error_response, check_assignment_license_gates},
+        gateway::GatewayInfo, mfa_flow::assignment_error_response,
         network_devices::DeviceWireGuardConfig,
     },
     location_management::{
@@ -297,9 +296,6 @@ pub(crate) async fn create_network(
     data.validate_service_location_mfa()?;
     data.validate_keepalive_interval()?;
     data.validate_allowed_groups()?;
-    if let Some(resp) = check_assignment_license_gates(&data.mfa_flows) {
-        return Ok(resp);
-    }
 
     let allowed_ips = data.parse_allowed_ips();
     let mut network = WireguardNetwork::new(
@@ -455,9 +451,6 @@ pub(crate) async fn modify_network(
     data.validate_service_location_mfa()?;
     data.validate_keepalive_interval()?;
     data.validate_allowed_groups()?;
-    if let Some(resp) = check_assignment_license_gates(&data.mfa_flows) {
-        return Ok(resp);
-    }
 
     let network = find_network(network_id, &appstate.pool).await?;
     // store network before mods
@@ -488,29 +481,31 @@ pub(crate) async fn modify_network(
         .set_allowed_groups(&mut transaction, &data.allowed_groups)
         .await?;
 
-    let posture_checks = if has_enterprise_access(Some(LicenseFeature::DevicePosture)) {
-        data.posture_checks.clone()
+    if has_enterprise_access(Some(LicenseFeature::DevicePosture)) {
+        DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
+            .await?;
     } else {
-        let current =
-            DevicePostureLocation::find_by_location(&mut *transaction, network.id).await?;
-        if data.posture_checks != current {
-            warn!(
-                location_id = network.id,
-                requested_posture_checks = ?data.posture_checks,
-                current_posture_checks = ?current,
-                "Ignoring posture check assignment update because the Enterprise license is inactive"
-            );
+        warn!(
+            location_id = network.id,
+            "Ignoring posture check assignments because the Enterprise license is inactive"
+        );
+    }
+
+    let mfa_assignments_updated = is_business_license_active();
+    let mfa_assignments: Vec<LocationMfaFlowAssignment> = if mfa_assignments_updated {
+        if let Err(error) =
+            MfaFlow::assign_to_location(&mut transaction, network.id, &data.mfa_flows).await
+        {
+            return Ok(assignment_error_response(&data.mfa_flows, error)?);
         }
-        current
+        data.mfa_flows.clone()
+    } else {
+        warn!(
+            location_id = network.id,
+            "Ignoring MFA flow assignments because the paid license is inactive"
+        );
+        Vec::new()
     };
-    DevicePostureLocation::set_for_location(&mut transaction, network.id, &posture_checks).await?;
-
-    let mfa_assignments: Vec<LocationMfaFlowAssignment> = data.mfa_flows.clone();
-    if let Err(error) =
-        MfaFlow::assign_to_location(&mut transaction, network.id, &mfa_assignments).await
-    {
-        return Ok(assignment_error_response(&data.mfa_flows, error)?);
-    }
     if data.mfa_enabled {
         if !MfaFlow::any_exist(&mut *transaction).await? {
             return Ok(no_flows_exist_response());
@@ -536,14 +531,16 @@ pub(crate) async fn modify_network(
         "User {} updated WireGuard network {network_id}",
         session.user.username,
     );
-    appstate.emit_event(ApiEvent {
-        context: context.clone(),
-        event: Box::new(ApiEventType::LocationMfaFlowsAssigned {
-            location_id: network.id,
-            location_name: network.name.clone(),
-            assignments: LocationMfaFlowAssignment::snapshot(&mfa_assignments),
-        }),
-    })?;
+    if mfa_assignments_updated {
+        appstate.emit_event(ApiEvent {
+            context: context.clone(),
+            event: Box::new(ApiEventType::LocationMfaFlowsAssigned {
+                location_id: network.id,
+                location_name: network.name.clone(),
+                assignments: LocationMfaFlowAssignment::snapshot(&mfa_assignments),
+            }),
+        })?;
+    }
     appstate.emit_event(ApiEvent {
         context,
         event: Box::new(ApiEventType::VpnLocationModified {
diff --git a/crates/defguard_core/tests/integration/api/mfa_flow.rs b/crates/defguard_core/tests/integration/api/mfa_flow.rs
index f8fd9befe..e3073828f 100644
--- a/crates/defguard_core/tests/integration/api/mfa_flow.rs
+++ b/crates/defguard_core/tests/integration/api/mfa_flow.rs
@@ -225,7 +225,7 @@ async fn test_mfa_flow_email_requires_smtp(_: PgPoolOptions, options: PgConnectO
 
 /// Group-scoped assignments require an enterprise license.
 #[sqlx::test]
-async fn test_mfa_flow_group_scoping_requires_enterprise(
+async fn test_mfa_flow_group_scoping_is_saved_for_later_enforcement(
     _: PgPoolOptions,
     options: PgConnectOptions,
 ) {
@@ -296,19 +296,9 @@ async fn test_mfa_flow_group_scoping_requires_enterprise(
         ]
     });
 
-    // Drain the create/location events so the refusal assertion below is exact.
+    // Group scoping can be saved on Business. Enforcement decides whether a
+    // location can be delivered to a particular device.
     let _ = client.drain_all_events();
-
-    // Business license → 403 (group scoping needs enterprise), and no audit event on refusal.
-    let response = update_location_mfa_flows(&client, location_id, assignment_body.clone()).await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    assert!(
-        client.drain_all_events().is_empty(),
-        "refused request must not emit an audit event"
-    );
-
-    // Enterprise license → 200
-    set_enterprise_license();
     let response = update_location_mfa_flows(&client, location_id, assignment_body).await;
     assert_eq!(response.status(), StatusCode::OK);
 
@@ -946,9 +936,13 @@ async fn test_mfa_enabled_disable_preserves_assignments(
         .await;
     assert_eq!(resp.status(), StatusCode::OK);
 
+    let license = get_cached_license().clone();
+    set_cached_license(None);
+    let mut body = network_body("mfa-lifecycle", false, flow_id);
+    body["mfa_flows"] = json!([]);
     let resp = client
         .put(format!("/api/v1/network/{location_id}"))
-        .json(&network_body("mfa-lifecycle", false, flow_id))
+        .json(&body)
         .send()
         .await;
     assert_eq!(resp.status(), StatusCode::OK);
@@ -969,6 +963,7 @@ async fn test_mfa_enabled_disable_preserves_assignments(
     assert_eq!(assignments[0]["is_default"].as_bool(), Some(true));
 
     // Re-enable: the same policy must be in force, resolving the same flow for a user.
+    set_cached_license(license);
     let resp = client
         .put(format!("/api/v1/network/{location_id}"))
         .json(&network_body("mfa-lifecycle", true, flow_id))

From c131ec5f1b4a10993de81f0890cb895d3e2c55fb Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 07:57:12 +0200
Subject: [PATCH 09/21] query data

---
 ...eb9256373908ceeea0ed599fc3827733c9d5f.json | 52 -----------------
 ...0fdb9f80fd38c47ca9b5c9ff10a0f50e7b00e.json | 58 +++++++++++++++++++
 .../defguard_common/src/db/models/mfa_flow.rs |  2 +-
 .../defguard_core/src/handlers/wireguard.rs   |  9 +--
 4 files changed, 64 insertions(+), 57 deletions(-)
 delete mode 100644 .sqlx/query-bc760664c6a1f3f7324acf3d45deb9256373908ceeea0ed599fc3827733c9d5f.json
 create mode 100644 .sqlx/query-c2ae1735ee44ce964580e17ac3c0fdb9f80fd38c47ca9b5c9ff10a0f50e7b00e.json

diff --git a/.sqlx/query-bc760664c6a1f3f7324acf3d45deb9256373908ceeea0ed599fc3827733c9d5f.json b/.sqlx/query-bc760664c6a1f3f7324acf3d45deb9256373908ceeea0ed599fc3827733c9d5f.json
deleted file mode 100644
index 591dad2ba..000000000
--- a/.sqlx/query-bc760664c6a1f3f7324acf3d45deb9256373908ceeea0ed599fc3827733c9d5f.json
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT mf.id, mf.title, COALESCE(s.step_count, 0) AS \"step_count!: i64\", COALESCE(array_agg(g.name ORDER BY g.name) FILTER (WHERE g.name IS NOT NULL), '{}') AS \"group_names!: Vec<String>\", lmf.position, lmf.is_default FROM location_mfa_flow lmf JOIN mfa_flow mf ON mf.id = lmf.flow_id LEFT JOIN ( SELECT flow_id, COUNT(*) AS step_count FROM mfa_flow_step GROUP BY flow_id ) s ON s.flow_id = mf.id LEFT JOIN location_mfa_flow_group lmfg ON lmfg.location_id = lmf.location_id AND lmfg.flow_id = lmf.flow_id LEFT JOIN \"group\" g ON g.id = lmfg.group_id WHERE lmf.location_id = $1 GROUP BY mf.id, mf.title, s.step_count, lmf.position, lmf.is_default ORDER BY lmf.position",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 1,
-        "name": "title",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "step_count!: i64",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 3,
-        "name": "group_names!: Vec<String>",
-        "type_info": "TextArray"
-      },
-      {
-        "ordinal": 4,
-        "name": "position",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 5,
-        "name": "is_default",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      null,
-      null,
-      false,
-      false
-    ]
-  },
-  "hash": "bc760664c6a1f3f7324acf3d45deb9256373908ceeea0ed599fc3827733c9d5f"
-}
diff --git a/.sqlx/query-c2ae1735ee44ce964580e17ac3c0fdb9f80fd38c47ca9b5c9ff10a0f50e7b00e.json b/.sqlx/query-c2ae1735ee44ce964580e17ac3c0fdb9f80fd38c47ca9b5c9ff10a0f50e7b00e.json
new file mode 100644
index 000000000..6b5558b93
--- /dev/null
+++ b/.sqlx/query-c2ae1735ee44ce964580e17ac3c0fdb9f80fd38c47ca9b5c9ff10a0f50e7b00e.json
@@ -0,0 +1,58 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT mf.id, mf.title, COALESCE(s.step_count, 0) AS \"step_count!: i64\", COALESCE(array_agg(lmfg.group_id ORDER BY lmfg.group_id) FILTER (WHERE lmfg.group_id IS NOT NULL), '{}') AS \"group_ids!: Vec<Id>\", COALESCE(array_agg(g.name ORDER BY lmfg.group_id) FILTER (WHERE g.name IS NOT NULL), '{}') AS \"group_names!: Vec<String>\", lmf.position, lmf.is_default FROM location_mfa_flow lmf JOIN mfa_flow mf ON mf.id = lmf.flow_id LEFT JOIN ( SELECT flow_id, COUNT(*) AS step_count FROM mfa_flow_step GROUP BY flow_id ) s ON s.flow_id = mf.id LEFT JOIN location_mfa_flow_group lmfg ON lmfg.location_id = lmf.location_id AND lmfg.flow_id = lmf.flow_id LEFT JOIN \"group\" g ON g.id = lmfg.group_id WHERE lmf.location_id = $1 GROUP BY mf.id, mf.title, s.step_count, lmf.position, lmf.is_default ORDER BY lmf.position",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "title",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "step_count!: i64",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 3,
+        "name": "group_ids!: Vec<Id>",
+        "type_info": "Int8Array"
+      },
+      {
+        "ordinal": 4,
+        "name": "group_names!: Vec<String>",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 5,
+        "name": "position",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 6,
+        "name": "is_default",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      null,
+      null,
+      null,
+      false,
+      false
+    ]
+  },
+  "hash": "c2ae1735ee44ce964580e17ac3c0fdb9f80fd38c47ca9b5c9ff10a0f50e7b00e"
+}
diff --git a/crates/defguard_common/src/db/models/mfa_flow.rs b/crates/defguard_common/src/db/models/mfa_flow.rs
index 32a302140..d0958c986 100644
--- a/crates/defguard_common/src/db/models/mfa_flow.rs
+++ b/crates/defguard_common/src/db/models/mfa_flow.rs
@@ -49,7 +49,7 @@ pub struct MfaFlowSnapshot {
     pub steps: Vec<MfaFlowStep<Id>>,
 }
 
-/// Assignment of an MFA flow to a location, enriched for internal consumers.
+/// MFA flow assignment with location metadata.
 #[derive(Clone, Debug, Serialize)]
 pub struct LocationMfaFlowItem {
     pub id: Id,
diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 29b549050..9d1f8fd37 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -433,7 +433,7 @@ pub(crate) async fn modify_network(
         session.user.username
     );
 
-    // check if tries to modify service location without active enterprise
+    // check if tries to configure service location without active enterprise
     if data.service_location_mode != ServiceLocationMode::Disabled
         && !has_enterprise_access(Some(LicenseFeature::ServiceLocations))
     {
@@ -481,6 +481,7 @@ pub(crate) async fn modify_network(
         .set_allowed_groups(&mut transaction, &data.allowed_groups)
         .await?;
 
+	// Don't error out on no license - otherwise users won't be able to update other location fields.
     if has_enterprise_access(Some(LicenseFeature::DevicePosture)) {
         DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
             .await?;
@@ -491,8 +492,8 @@ pub(crate) async fn modify_network(
         );
     }
 
-    let mfa_assignments_updated = is_business_license_active();
-    let mfa_assignments: Vec<LocationMfaFlowAssignment> = if mfa_assignments_updated {
+    let update_mfa_assignments = is_business_license_active();
+    let mfa_assignments: Vec<LocationMfaFlowAssignment> = if update_mfa_assignments {
         if let Err(error) =
             MfaFlow::assign_to_location(&mut transaction, network.id, &data.mfa_flows).await
         {
@@ -531,7 +532,7 @@ pub(crate) async fn modify_network(
         "User {} updated WireGuard network {network_id}",
         session.user.username,
     );
-    if mfa_assignments_updated {
+    if update_mfa_assignments {
         appstate.emit_event(ApiEvent {
             context: context.clone(),
             event: Box::new(ApiEventType::LocationMfaFlowsAssigned {

From 7147e57ff2a4728f586c3c2da94413e4bac461df Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 09:09:54 +0200
Subject: [PATCH 10/21] c fmt

---
 crates/defguard_core/src/handlers/wireguard.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 9d1f8fd37..1e098bd1c 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -481,7 +481,7 @@ pub(crate) async fn modify_network(
         .set_allowed_groups(&mut transaction, &data.allowed_groups)
         .await?;
 
-	// Don't error out on no license - otherwise users won't be able to update other location fields.
+    // Don't error out on no license - otherwise users won't be able to update other location fields.
     if has_enterprise_access(Some(LicenseFeature::DevicePosture)) {
         DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
             .await?;

From ad139b427f59a994b7ba6dde4a28986d56de2488 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 09:48:59 +0200
Subject: [PATCH 11/21] comment fixes

---
 crates/defguard_core/src/handlers/wireguard.rs    | 15 +++++----------
 .../tests/integration/api/common/mod.rs           |  2 +-
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 1e098bd1c..22db1d771 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -124,16 +124,11 @@ pub fn no_flows_assigned_response() -> ApiResponse {
     )
 }
 
-/// Rejects enabling MFA for a location while no MFA flow is assigned to it as its default.
+/// Validate enabling MFA on an already-persisted location.
 ///
-/// The check is per-location: an existing location (`Some(id)`) must carry a designated default
-/// assignment, and a brand-new location (`None`, the create path) can never have one, so creating
-/// with `mfa_enabled` is refused here too. The global `no_flows_exist` check runs first so a fresh
-/// instance reports the more actionable "create a flow" error. Returns a structured `400` response
-/// (not a `WebError`) so the body is parsed in one step.
-///
-/// Shared by `create_network`, `modify_network` and the auto-adoption wizard, which sets
-/// `mfa_enabled` on an already-persisted location, so the three entry points cannot drift.
+/// Used by the auto-adoption wizard after it creates a location. The normal location create and
+/// update handlers validate assignments inside their transactions. Returns a structured `400`
+/// response (not a `WebError`) when no MFA flow or no default assignment exists.
 pub async fn validate_mfa_flows_exist<'e, E: sqlx::PgExecutor<'e> + Copy>(
     executor: E,
     mfa_enabled: bool,
@@ -975,7 +970,7 @@ pub(crate) struct AddDeviceResult {
                         "pubkey": "pubkey",
                         "dns": "8.8.8.8",
                         "keepalive_interval": 5,
-			            "mfa_enabled": false,
+                        "mfa_enabled": false,
                         "service_location_mode": "disabled"
                     }
                 ],
diff --git a/crates/defguard_core/tests/integration/api/common/mod.rs b/crates/defguard_core/tests/integration/api/common/mod.rs
index 85de8dacc..46d05d710 100644
--- a/crates/defguard_core/tests/integration/api/common/mod.rs
+++ b/crates/defguard_core/tests/integration/api/common/mod.rs
@@ -205,7 +205,6 @@ pub(crate) async fn exceed_enterprise_limits(client: &TestClient) {
     make_network(client, "network2").await;
 }
 
-/// Create test network with a given name.
 /// Save a complete MFA assignment list through the location update endpoint.
 pub(crate) async fn update_location_mfa_flows(
     client: &TestClient,
@@ -288,6 +287,7 @@ async fn update_location_assignments(
         .await
 }
 
+/// Create a test network with a given name.
 pub(crate) async fn make_network(client: &TestClient, name: &str) -> TestResponse {
     let response = client
         .post("/api/v1/network")

From d5a0ff743f0320aba09df5e026d10e2290bbd842 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 09:50:57 +0200
Subject: [PATCH 12/21] fix e2e test

---
 e2e/tests/gatewayAdoption.spec.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/e2e/tests/gatewayAdoption.spec.ts b/e2e/tests/gatewayAdoption.spec.ts
index b5f337c4f..4eb6b2fde 100644
--- a/e2e/tests/gatewayAdoption.spec.ts
+++ b/e2e/tests/gatewayAdoption.spec.ts
@@ -44,6 +44,8 @@ test.describe('Gateway Adoption', () => {
         acl_default_allow: false,
         allowed_ips_from_acl: false,
         mfa_enabled: false,
+        posture_checks: [],
+        mfa_flows: [],
         service_location_mode: 'disabled',
       },
     });

From ebe2fb6eb6ca31fd6c4c1e509ea41cc06a8a4e2e Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 10:18:11 +0200
Subject: [PATCH 13/21] emit posture events when relevant

---
 .../defguard_core/src/handlers/wireguard.rs   | 37 +++++++++++++++++--
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 22db1d771..ce6d698fc 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -368,6 +368,15 @@ pub(crate) async fn create_network(
         session.user.username
     );
 
+    if !data.posture_checks.is_empty() {
+        appstate.emit_event(ApiEvent {
+            context: context.clone(),
+            event: Box::new(ApiEventType::LocationPosturesAssigned {
+                location: network.clone(),
+                posture_ids: data.posture_checks.clone(),
+            }),
+        })?;
+    }
     appstate.emit_event(ApiEvent {
         context: context.clone(),
         event: Box::new(ApiEventType::LocationMfaFlowsAssigned {
@@ -477,15 +486,26 @@ pub(crate) async fn modify_network(
         .await?;
 
     // Don't error out on no license - otherwise users won't be able to update other location fields.
-    if has_enterprise_access(Some(LicenseFeature::DevicePosture)) {
-        DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
-            .await?;
+    let postures_changed = if has_enterprise_access(Some(LicenseFeature::DevicePosture)) {
+        let mut current_postures =
+            DevicePostureLocation::find_by_location(&mut *transaction, network.id).await?;
+        let mut requested_postures = data.posture_checks.clone();
+
+        current_postures.sort_unstable();
+        requested_postures.sort_unstable();
+
+        if current_postures != requested_postures {
+            DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
+                .await?;
+        }
+        current_postures != requested_postures
     } else {
         warn!(
             location_id = network.id,
             "Ignoring posture check assignments because the Enterprise license is inactive"
         );
-    }
+        false
+    };
 
     let update_mfa_assignments = is_business_license_active();
     let mfa_assignments: Vec<LocationMfaFlowAssignment> = if update_mfa_assignments {
@@ -527,6 +547,15 @@ pub(crate) async fn modify_network(
         "User {} updated WireGuard network {network_id}",
         session.user.username,
     );
+    if postures_changed {
+        appstate.emit_event(ApiEvent {
+            context: context.clone(),
+            event: Box::new(ApiEventType::LocationPosturesAssigned {
+                location: network.clone(),
+                posture_ids: data.posture_checks.clone(),
+            }),
+        })?;
+    }
     if update_mfa_assignments {
         appstate.emit_event(ApiEvent {
             context: context.clone(),

From c0048277f4bb054dc90fdbf8d25b8ea057fb89d6 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 10:19:26 +0200
Subject: [PATCH 14/21] fix test

---
 crates/defguard_core/src/handlers/wireguard.rs           | 8 ++++++--
 .../tests/integration/api/device_posture.rs              | 9 ++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index ce6d698fc..5568c51a1 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -495,8 +495,12 @@ pub(crate) async fn modify_network(
         requested_postures.sort_unstable();
 
         if current_postures != requested_postures {
-            DevicePostureLocation::set_for_location(&mut transaction, network.id, &data.posture_checks)
-                .await?;
+            DevicePostureLocation::set_for_location(
+                &mut transaction,
+                network.id,
+                &data.posture_checks,
+            )
+            .await?;
         }
         current_postures != requested_postures
     } else {
diff --git a/crates/defguard_core/tests/integration/api/device_posture.rs b/crates/defguard_core/tests/integration/api/device_posture.rs
index 5463ea271..ab5c49774 100644
--- a/crates/defguard_core/tests/integration/api/device_posture.rs
+++ b/crates/defguard_core/tests/integration/api/device_posture.rs
@@ -1026,7 +1026,14 @@ async fn test_device_posture_set_postures_for_location(
         update_location_posture_checks(&client, location_id, json!(vec![p1.id, p2.id])).await;
     assert_eq!(response.status(), StatusCode::OK);
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 2);
+    assert_eq!(events.len(), 3);
+    assert!(events.iter().any(|event| matches!(
+        &event.0,
+        ApiEventType::LocationPosturesAssigned {
+            location,
+            posture_ids,
+        } if location.id == location_id && posture_ids == &[p1.id, p2.id]
+    )));
     assert!(
         events
             .iter()

From 29c5cbea7a086e71654e3bab408073f917f9a5f0 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 10:23:55 +0200
Subject: [PATCH 15/21] don't emit mfa flow assignment events when no
 assignments

---
 crates/defguard_core/src/handlers/wireguard.rs | 18 ++++++++++--------
 .../tests/integration/api/user.rs              |  5 -----
 .../tests/integration/api/wireguard.rs         |  4 ++--
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 5568c51a1..19433b8d7 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -377,14 +377,16 @@ pub(crate) async fn create_network(
             }),
         })?;
     }
-    appstate.emit_event(ApiEvent {
-        context: context.clone(),
-        event: Box::new(ApiEventType::LocationMfaFlowsAssigned {
-            location_id: network.id,
-            location_name: network.name.clone(),
-            assignments: LocationMfaFlowAssignment::snapshot(&mfa_assignments),
-        }),
-    })?;
+    if !mfa_assignments.is_empty() {
+        appstate.emit_event(ApiEvent {
+            context: context.clone(),
+            event: Box::new(ApiEventType::LocationMfaFlowsAssigned {
+                location_id: network.id,
+                location_name: network.name.clone(),
+                assignments: LocationMfaFlowAssignment::snapshot(&mfa_assignments),
+            }),
+        })?;
+    }
     appstate.emit_event(ApiEvent {
         context,
         event: Box::new(ApiEventType::VpnLocationAdded {
diff --git a/crates/defguard_core/tests/integration/api/user.rs b/crates/defguard_core/tests/integration/api/user.rs
index 401d7f3cf..8b74bdab2 100644
--- a/crates/defguard_core/tests/integration/api/user.rs
+++ b/crates/defguard_core/tests/integration/api/user.rs
@@ -1459,11 +1459,6 @@ async fn test_user_add_device(_: PgPoolOptions, options: PgConnectOptions) {
 
     // create network
     make_network(&client, "network").await;
-    expected_events.push(ApiEventType::LocationMfaFlowsAssigned {
-        location_id: 1,
-        location_name: "network".into(),
-        assignments: Vec::new(),
-    });
     expected_events.push(ApiEventType::VpnLocationAdded {
         location: get_db_location(&state.pool, 1).await,
     });
diff --git a/crates/defguard_core/tests/integration/api/wireguard.rs b/crates/defguard_core/tests/integration/api/wireguard.rs
index eeefde3a5..c19f28cf1 100644
--- a/crates/defguard_core/tests/integration/api/wireguard.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard.rs
@@ -2218,8 +2218,8 @@ async fn test_location_allowed_ips_from_acl_flag(_: PgPoolOptions, options: PgCo
     let events = client.drain_all_events();
     assert_eq!(
         events.len(),
-        2,
-        "location save must emit assignment and location events"
+        1,
+        "location save must emit only a location event"
     );
     let (event_type, _user_id, _username) = events
         .iter()

From 66af0d3895bff58e92c7a8d55320c2f809f51ca9 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 11:32:23 +0200
Subject: [PATCH 16/21] validate assignments during location creation

---
 .../defguard_common/src/db/models/mfa_flow.rs |  2 ++
 crates/defguard_core/src/handlers/mfa_flow.rs |  3 ++
 .../defguard_core/src/handlers/wireguard.rs   | 35 ++++++++++++++++++-
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/crates/defguard_common/src/db/models/mfa_flow.rs b/crates/defguard_common/src/db/models/mfa_flow.rs
index d0958c986..3edb432ec 100644
--- a/crates/defguard_common/src/db/models/mfa_flow.rs
+++ b/crates/defguard_common/src/db/models/mfa_flow.rs
@@ -114,6 +114,8 @@ pub enum MfaFlowAssignmentError {
     UnknownFlow(Id),
     #[error("Group {0} does not exist")]
     UnknownGroup(Id),
+    #[error("MFA flow assignments not valid for this license tier")]
+    NotValidForCurrentLicenseTier,
     #[error(transparent)]
     Sqlx(#[from] sqlx::Error),
 }
diff --git a/crates/defguard_core/src/handlers/mfa_flow.rs b/crates/defguard_core/src/handlers/mfa_flow.rs
index 6091971b7..f8437aa5b 100644
--- a/crates/defguard_core/src/handlers/mfa_flow.rs
+++ b/crates/defguard_core/src/handlers/mfa_flow.rs
@@ -284,6 +284,9 @@ pub(crate) fn assignment_error_response(
         MfaFlowAssignmentError::DefaultHasGroups => {
             ("mfa_flows".to_owned(), "default_must_have_no_groups")
         }
+        MfaFlowAssignmentError::NotValidForCurrentLicenseTier => {
+            ("mfa_flows".to_owned(), "not_allowed_by_license")
+        }
         MfaFlowAssignmentError::NonDefaultWithoutGroups(flow_id) => (
             non_default_group_field(assignments, flow_id),
             "non_default_must_have_groups",
diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 19433b8d7..1b7f67903 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -11,7 +11,7 @@ use defguard_common::{
         models::{
             Device, DeviceConfig, DeviceType, User, WireguardNetwork,
             device::{AddDevice, DeviceInfo, ModifyDevice, WireguardNetworkDevice},
-            mfa_flow::{LocationMfaFlowAssignment, MfaFlow},
+            mfa_flow::{LocationMfaFlowAssignment, MfaFlow, MfaFlowAssignmentError},
             wireguard::{MappedDevice, ServiceLocationMode},
         },
     },
@@ -231,6 +231,35 @@ pub struct ImportedNetworkData {
     pub devices: Vec<ImportedDevice>,
 }
 
+/// Validates if given MFA flow can be assigned
+fn validate_mfaflow_assignments(
+    assignments: &[LocationMfaFlowAssignment],
+) -> Result<(), MfaFlowAssignmentError> {
+    // enterprise can make all assignments
+    if has_enterprise_access(None) {
+        return Ok(());
+    }
+    // business and free can't assign groups
+    if assignments.iter().any(|a| !a.group_ids.is_empty()) {
+        return Err(MfaFlowAssignmentError::NotValidForCurrentLicenseTier);
+    }
+    if is_business_license_active() {
+        return Ok(());
+    }
+
+    // free license can't assign multiple flows
+    if assignments.len() > 1 {
+        return Err(MfaFlowAssignmentError::NotValidForCurrentLicenseTier);
+    }
+
+    // free license can't assign multi-step flows
+    if assignments.iter().any(|a| !a.group_ids.is_empty()) {
+        // TODO(jck): check if the flow is multi-step
+    }
+
+    Ok(())
+}
+
 /// Create a network
 #[utoipa::path(
     post,
@@ -345,6 +374,9 @@ pub(crate) async fn create_network(
     );
 
     let mfa_assignments: Vec<LocationMfaFlowAssignment> = data.mfa_flows.clone();
+    if let Err(error) = validate_mfaflow_assignments(&mfa_assignments) {
+        return Ok(assignment_error_response(&data.mfa_flows, error)?);
+    }
     if let Err(error) =
         MfaFlow::assign_to_location(&mut transaction, network.id, &mfa_assignments).await
     {
@@ -562,6 +594,7 @@ pub(crate) async fn modify_network(
             }),
         })?;
     }
+    // TODO: also check new-old assignments equality before emitting
     if update_mfa_assignments {
         appstate.emit_event(ApiEvent {
             context: context.clone(),

From d47deb5cff85241210459d0f4d0206ad7636bdb3 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 11:36:57 +0200
Subject: [PATCH 17/21] separate error for license validation

---
 .../defguard_common/src/db/models/mfa_flow.rs |  2 -
 crates/defguard_core/src/handlers/mfa_flow.rs |  5 +--
 .../defguard_core/src/handlers/wireguard.rs   | 43 +++++++++++++------
 3 files changed, 31 insertions(+), 19 deletions(-)

diff --git a/crates/defguard_common/src/db/models/mfa_flow.rs b/crates/defguard_common/src/db/models/mfa_flow.rs
index 3edb432ec..d0958c986 100644
--- a/crates/defguard_common/src/db/models/mfa_flow.rs
+++ b/crates/defguard_common/src/db/models/mfa_flow.rs
@@ -114,8 +114,6 @@ pub enum MfaFlowAssignmentError {
     UnknownFlow(Id),
     #[error("Group {0} does not exist")]
     UnknownGroup(Id),
-    #[error("MFA flow assignments not valid for this license tier")]
-    NotValidForCurrentLicenseTier,
     #[error(transparent)]
     Sqlx(#[from] sqlx::Error),
 }
diff --git a/crates/defguard_core/src/handlers/mfa_flow.rs b/crates/defguard_core/src/handlers/mfa_flow.rs
index f8437aa5b..84efdf2a5 100644
--- a/crates/defguard_core/src/handlers/mfa_flow.rs
+++ b/crates/defguard_core/src/handlers/mfa_flow.rs
@@ -152,7 +152,7 @@ pub struct LocationMfaFlowResponse {
 /// The status stays `403` rather than the `400` the impl spec tabulates: a licence refusal is not
 /// a malformed request, and the rest of the codebase answers licence gates with `403`. The
 /// top-level `error` discriminator distinguishes it from `validation_failed`.
-fn license_error_response(field: String, code: &str) -> ApiResponse {
+pub(crate) fn license_error_response(field: String, code: &str) -> ApiResponse {
     ApiResponse::new(
         json!({
             "error": "license_required",
@@ -284,9 +284,6 @@ pub(crate) fn assignment_error_response(
         MfaFlowAssignmentError::DefaultHasGroups => {
             ("mfa_flows".to_owned(), "default_must_have_no_groups")
         }
-        MfaFlowAssignmentError::NotValidForCurrentLicenseTier => {
-            ("mfa_flows".to_owned(), "not_allowed_by_license")
-        }
         MfaFlowAssignmentError::NonDefaultWithoutGroups(flow_id) => (
             non_default_group_field(assignments, flow_id),
             "non_default_must_have_groups",
diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 1b7f67903..51a36927f 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -11,7 +11,7 @@ use defguard_common::{
         models::{
             Device, DeviceConfig, DeviceType, User, WireguardNetwork,
             device::{AddDevice, DeviceInfo, ModifyDevice, WireguardNetworkDevice},
-            mfa_flow::{LocationMfaFlowAssignment, MfaFlow, MfaFlowAssignmentError},
+            mfa_flow::{LocationMfaFlowAssignment, MfaFlow},
             wireguard::{MappedDevice, ServiceLocationMode},
         },
     },
@@ -43,7 +43,8 @@ use crate::{
     events::{ApiEvent, ApiEventType, ApiRequestContext},
     grpc::GatewayCommand,
     handlers::{
-        gateway::GatewayInfo, mfa_flow::assignment_error_response,
+        gateway::GatewayInfo,
+        mfa_flow::{assignment_error_response, license_error_response},
         network_devices::DeviceWireGuardConfig,
     },
     location_management::{
@@ -231,28 +232,36 @@ pub struct ImportedNetworkData {
     pub devices: Vec<ImportedDevice>,
 }
 
-/// Validates if given MFA flow can be assigned
-fn validate_mfaflow_assignments(
+enum MfaFlowAssignmentLicenseError {
+    EnterpriseRequired,
+    BusinessRequired,
+}
+
+/// Validates whether the current license permits the requested MFA flow assignments.
+fn validate_mfa_flow_assignments(
     assignments: &[LocationMfaFlowAssignment],
-) -> Result<(), MfaFlowAssignmentError> {
-    // enterprise can make all assignments
+) -> Result<(), MfaFlowAssignmentLicenseError> {
+    // Enterprise can make all assignments.
     if has_enterprise_access(None) {
         return Ok(());
     }
-    // business and free can't assign groups
+
+    // Business and Free can't assign groups.
     if assignments.iter().any(|a| !a.group_ids.is_empty()) {
-        return Err(MfaFlowAssignmentError::NotValidForCurrentLicenseTier);
+        return Err(MfaFlowAssignmentLicenseError::EnterpriseRequired);
     }
+
+    // Business can assign multiple and multi-step flows.
     if is_business_license_active() {
         return Ok(());
     }
 
-    // free license can't assign multiple flows
+    // Free can't assign multiple flows.
     if assignments.len() > 1 {
-        return Err(MfaFlowAssignmentError::NotValidForCurrentLicenseTier);
+        return Err(MfaFlowAssignmentLicenseError::BusinessRequired);
     }
 
-    // free license can't assign multi-step flows
+    // Free can't assign multi-step flows.
     if assignments.iter().any(|a| !a.group_ids.is_empty()) {
         // TODO(jck): check if the flow is multi-step
     }
@@ -260,6 +269,14 @@ fn validate_mfaflow_assignments(
     Ok(())
 }
 
+fn mfa_flow_assignment_license_error_response(error: MfaFlowAssignmentLicenseError) -> ApiResponse {
+    let code = match error {
+        MfaFlowAssignmentLicenseError::EnterpriseRequired => "enterprise_license_required",
+        MfaFlowAssignmentLicenseError::BusinessRequired => "business_license_required",
+    };
+    license_error_response("mfa_flows".into(), code)
+}
+
 /// Create a network
 #[utoipa::path(
     post,
@@ -374,8 +391,8 @@ pub(crate) async fn create_network(
     );
 
     let mfa_assignments: Vec<LocationMfaFlowAssignment> = data.mfa_flows.clone();
-    if let Err(error) = validate_mfaflow_assignments(&mfa_assignments) {
-        return Ok(assignment_error_response(&data.mfa_flows, error)?);
+    if let Err(error) = validate_mfa_flow_assignments(&mfa_assignments) {
+        return Ok(mfa_flow_assignment_license_error_response(error));
     }
     if let Err(error) =
         MfaFlow::assign_to_location(&mut transaction, network.id, &mfa_assignments).await

From f5aae4a7e3ac5ecac6a0aa2ed8300538a997c6f9 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 12:01:07 +0200
Subject: [PATCH 18/21] license gate mfa flow assignments

---
 .../defguard_core/src/handlers/wireguard.rs   | 43 ++++++++++++-------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 51a36927f..116745df1 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -11,7 +11,7 @@ use defguard_common::{
         models::{
             Device, DeviceConfig, DeviceType, User, WireguardNetwork,
             device::{AddDevice, DeviceInfo, ModifyDevice, WireguardNetworkDevice},
-            mfa_flow::{LocationMfaFlowAssignment, MfaFlow},
+            mfa_flow::{LocationMfaFlowAssignment, MfaFlow, MfaFlowStep},
             wireguard::{MappedDevice, ServiceLocationMode},
         },
     },
@@ -19,7 +19,8 @@ use defguard_common::{
 };
 use ipnetwork::IpNetwork;
 use serde_json::{Value, json};
-use sqlx::PgPool;
+use sqlx::{PgConnection, PgPool};
+use thiserror::Error;
 use utoipa::ToSchema;
 
 use super::{
@@ -232,15 +233,21 @@ pub struct ImportedNetworkData {
     pub devices: Vec<ImportedDevice>,
 }
 
-enum MfaFlowAssignmentLicenseError {
+#[derive(Debug, Error)]
+enum MfaFlowAssignmentValidationError {
+    #[error("MFA flow group assignments require an Enterprise license")]
     EnterpriseRequired,
+    #[error("Multiple or multi-step MFA flows require a Business license")]
     BusinessRequired,
+    #[error(transparent)]
+    Database(#[from] sqlx::Error),
 }
 
 /// Validates whether the current license permits the requested MFA flow assignments.
-fn validate_mfa_flow_assignments(
+async fn validate_mfa_flow_assignments(
+    conn: &mut PgConnection,
     assignments: &[LocationMfaFlowAssignment],
-) -> Result<(), MfaFlowAssignmentLicenseError> {
+) -> Result<(), MfaFlowAssignmentValidationError> {
     // Enterprise can make all assignments.
     if has_enterprise_access(None) {
         return Ok(());
@@ -248,7 +255,7 @@ fn validate_mfa_flow_assignments(
 
     // Business and Free can't assign groups.
     if assignments.iter().any(|a| !a.group_ids.is_empty()) {
-        return Err(MfaFlowAssignmentLicenseError::EnterpriseRequired);
+        return Err(MfaFlowAssignmentValidationError::EnterpriseRequired);
     }
 
     // Business can assign multiple and multi-step flows.
@@ -258,23 +265,29 @@ fn validate_mfa_flow_assignments(
 
     // Free can't assign multiple flows.
     if assignments.len() > 1 {
-        return Err(MfaFlowAssignmentLicenseError::BusinessRequired);
+        return Err(MfaFlowAssignmentValidationError::BusinessRequired);
     }
 
     // Free can't assign multi-step flows.
-    if assignments.iter().any(|a| !a.group_ids.is_empty()) {
-        // TODO(jck): check if the flow is multi-step
+    if let Some(assignment) = assignments.first() {
+        let steps = MfaFlowStep::find_by_flow(&mut *conn, assignment.flow_id).await?;
+        if steps.len() > 1 {
+            return Err(MfaFlowAssignmentValidationError::BusinessRequired);
+        }
     }
 
     Ok(())
 }
 
-fn mfa_flow_assignment_license_error_response(error: MfaFlowAssignmentLicenseError) -> ApiResponse {
+fn mfa_flow_assignment_validation_error_response(
+    error: MfaFlowAssignmentValidationError,
+) -> Result<ApiResponse, WebError> {
     let code = match error {
-        MfaFlowAssignmentLicenseError::EnterpriseRequired => "enterprise_license_required",
-        MfaFlowAssignmentLicenseError::BusinessRequired => "business_license_required",
+        MfaFlowAssignmentValidationError::EnterpriseRequired => "enterprise_license_required",
+        MfaFlowAssignmentValidationError::BusinessRequired => "business_license_required",
+        MfaFlowAssignmentValidationError::Database(error) => return Err(WebError::from(error)),
     };
-    license_error_response("mfa_flows".into(), code)
+    Ok(license_error_response("mfa_flows".into(), code))
 }
 
 /// Create a network
@@ -391,8 +404,8 @@ pub(crate) async fn create_network(
     );
 
     let mfa_assignments: Vec<LocationMfaFlowAssignment> = data.mfa_flows.clone();
-    if let Err(error) = validate_mfa_flow_assignments(&mfa_assignments) {
-        return Ok(mfa_flow_assignment_license_error_response(error));
+    if let Err(error) = validate_mfa_flow_assignments(&mut transaction, &mfa_assignments).await {
+        return Ok(mfa_flow_assignment_validation_error_response(error)?);
     }
     if let Err(error) =
         MfaFlow::assign_to_location(&mut transaction, network.id, &mfa_assignments).await

From 7c01faba0419088b680ffa2a368ad13ae99b89a6 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 12:37:34 +0200
Subject: [PATCH 19/21] add license gate tests

---
 .../tests/integration/api/wireguard.rs        | 190 +++++++++++++++++-
 1 file changed, 187 insertions(+), 3 deletions(-)

diff --git a/crates/defguard_core/tests/integration/api/wireguard.rs b/crates/defguard_core/tests/integration/api/wireguard.rs
index c19f28cf1..f2081a458 100644
--- a/crates/defguard_core/tests/integration/api/wireguard.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard.rs
@@ -25,17 +25,70 @@ use defguard_core::{
 use ipnetwork::IpNetwork;
 use matches::assert_matches;
 use reqwest::StatusCode;
-use serde_json::json;
+use serde_json::{Value, json};
 use sqlx::postgres::{PgConnectOptions, PgPoolOptions};
 
 use super::common::{
-    authenticate_admin, client::TestClient, fetch_user_details, make_network, make_test_client,
-    setup_pool, update_location_mfa_flows, update_location_posture_checks,
+    authenticate_admin,
+    client::{TestClient, TestResponse},
+    fetch_user_details, make_network, make_test_client, setup_pool, update_location_mfa_flows,
+    update_location_posture_checks,
 };
 
 const INVALID_MFA_PEER_DISCONNECT_THRESHOLD: i32 = 119;
 const MINIMUM_MFA_PEER_DISCONNECT_THRESHOLD: i32 = 120;
 
+async fn create_mfa_flow(client: &TestClient, title: &str, steps: Value) -> Id {
+    let response = client
+        .post("/api/v1/mfa-flow")
+        .json(&json!({"title": title, "steps": steps}))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    response.json::<Value>().await["id"].as_i64().unwrap()
+}
+
+async fn create_network_with_mfa_flows(
+    client: &TestClient,
+    name: &str,
+    address: &str,
+    mfa_flows: Value,
+) -> TestResponse {
+    client
+        .post("/api/v1/network")
+        .json(&json!({
+            "name": name,
+            "address": address,
+            "port": 55555,
+            "endpoint": "192.168.4.14",
+            "allowed_ips": address,
+            "dns": "1.1.1.1",
+            "mtu": 1420,
+            "fwmark": 0,
+            "allowed_groups": ["admin"],
+            "allow_all_groups": false,
+            "keepalive_interval": 25,
+            "peer_disconnect_threshold": 300,
+            "acl_enabled": false,
+            "acl_default_allow": false,
+            "allowed_ips_from_acl": false,
+            "mfa_enabled": false,
+            "service_location_mode": "disabled",
+            "posture_checks": [],
+            "mfa_flows": mfa_flows,
+        }))
+        .send()
+        .await
+}
+
+async fn assert_assignment_license_error(response: TestResponse, code: &str) {
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    let body: Value = response.json().await;
+    assert_eq!(body["error"], "license_required");
+    assert_eq!(body["fields"][0]["field"], "mfa_flows");
+    assert_eq!(body["fields"][0]["code"], code);
+}
+
 #[sqlx::test]
 async fn test_network(_: PgPoolOptions, options: PgConnectOptions) {
     let pool = setup_pool(options).await;
@@ -200,6 +253,137 @@ async fn test_create_network_blocked_when_location_count_exceeds_license_limit(
     set_cached_license(license);
 }
 
+#[sqlx::test]
+async fn test_create_network_mfa_assignment_license_gates(
+    _: PgPoolOptions,
+    options: PgConnectOptions,
+) {
+    let pool = setup_pool(options).await;
+    let (mut client, _) = make_test_client(pool.clone()).await;
+    authenticate_admin(&mut client).await;
+    let business_license = get_cached_license().clone();
+
+    let single_step_flow =
+        create_mfa_flow(&client, "Single-step flow", json!([{"methods": ["totp"]}])).await;
+    let second_single_step_flow = create_mfa_flow(
+        &client,
+        "Second single-step flow",
+        json!([{"methods": ["biometric"]}]),
+    )
+    .await;
+    let multi_step_flow = create_mfa_flow(
+        &client,
+        "Multi-step flow",
+        json!([
+            {"methods": ["totp"]},
+            {"methods": ["biometric"]}
+        ]),
+    )
+    .await;
+    let admin_group_id = Group::find_by_name(&pool, "admin")
+        .await
+        .unwrap()
+        .unwrap()
+        .id;
+
+    set_cached_license(None);
+
+    let response = create_network_with_mfa_flows(
+        &client,
+        "free-single-step",
+        "10.10.1.1/24",
+        json!([{
+            "flow_id": single_step_flow,
+            "is_default": true,
+            "group_ids": []
+        }]),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let response = create_network_with_mfa_flows(
+        &client,
+        "free-multi-step",
+        "10.10.2.1/24",
+        json!([{
+            "flow_id": multi_step_flow,
+            "is_default": true,
+            "group_ids": []
+        }]),
+    )
+    .await;
+    assert_assignment_license_error(response, "business_license_required").await;
+
+    let response = create_network_with_mfa_flows(
+        &client,
+        "free-multiple-flows",
+        "10.10.3.1/24",
+        json!([
+            {
+                "flow_id": single_step_flow,
+                "is_default": true,
+                "group_ids": []
+            },
+            {
+                "flow_id": second_single_step_flow,
+                "is_default": false,
+                "group_ids": []
+            }
+        ]),
+    )
+    .await;
+    assert_assignment_license_error(response, "business_license_required").await;
+
+    set_cached_license(business_license.clone());
+
+    let response = create_network_with_mfa_flows(
+        &client,
+        "business-multi-step",
+        "10.10.4.1/24",
+        json!([{
+            "flow_id": multi_step_flow,
+            "is_default": true,
+            "group_ids": []
+        }]),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let scoped_assignments = json!([
+        {
+            "flow_id": single_step_flow,
+            "is_default": true,
+            "group_ids": []
+        },
+        {
+            "flow_id": second_single_step_flow,
+            "is_default": false,
+            "group_ids": [admin_group_id]
+        }
+    ]);
+    let response = create_network_with_mfa_flows(
+        &client,
+        "business-group-scoping",
+        "10.10.5.1/24",
+        scoped_assignments.clone(),
+    )
+    .await;
+    assert_assignment_license_error(response, "enterprise_license_required").await;
+
+    set_enterprise_license();
+
+    let response = create_network_with_mfa_flows(
+        &client,
+        "enterprise-group-scoping",
+        "10.10.6.1/24",
+        scoped_assignments,
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    set_cached_license(business_license);
+}
+
 #[sqlx::test]
 async fn test_create_network_with_posture_checks_assigns_postures(
     _: PgPoolOptions,

From cef6d7387f2df4f2d0edfd2d9cc3d8131f0d11bf Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 12:45:31 +0200
Subject: [PATCH 20/21] fix test

---
 .../tests/integration/api/device_posture.rs              | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/crates/defguard_core/tests/integration/api/device_posture.rs b/crates/defguard_core/tests/integration/api/device_posture.rs
index ab5c49774..0894c18c3 100644
--- a/crates/defguard_core/tests/integration/api/device_posture.rs
+++ b/crates/defguard_core/tests/integration/api/device_posture.rs
@@ -1292,7 +1292,14 @@ async fn test_set_postures_for_service_location_allowed(
         update_location_posture_checks(&client, service_location_id, json!(vec![posture.id])).await;
     assert_eq!(response.status(), StatusCode::OK);
     let events = client.drain_all_events();
-    assert_eq!(events.len(), 2);
+    assert_eq!(events.len(), 3);
+    assert!(events.iter().any(|event| matches!(
+        &event.0,
+        ApiEventType::LocationPosturesAssigned {
+            location,
+            posture_ids,
+        } if location.id == service_location_id && posture_ids == &[posture.id]
+    )));
     assert!(
         events
             .iter()

From 79c3b02e5b8b3b1a24f64b836ab904e957e173ea Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Sun, 23 Aug 2026 12:45:35 +0200
Subject: [PATCH 21/21] fix clippy issues

---
 crates/defguard_core/src/handlers/wireguard.rs          | 6 +++---
 crates/defguard_core/tests/integration/api/wireguard.rs | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/crates/defguard_core/src/handlers/wireguard.rs b/crates/defguard_core/src/handlers/wireguard.rs
index 116745df1..854e8a602 100644
--- a/crates/defguard_core/src/handlers/wireguard.rs
+++ b/crates/defguard_core/src/handlers/wireguard.rs
@@ -405,12 +405,12 @@ pub(crate) async fn create_network(
 
     let mfa_assignments: Vec<LocationMfaFlowAssignment> = data.mfa_flows.clone();
     if let Err(error) = validate_mfa_flow_assignments(&mut transaction, &mfa_assignments).await {
-        return Ok(mfa_flow_assignment_validation_error_response(error)?);
+        return mfa_flow_assignment_validation_error_response(error);
     }
     if let Err(error) =
         MfaFlow::assign_to_location(&mut transaction, network.id, &mfa_assignments).await
     {
-        return Ok(assignment_error_response(&data.mfa_flows, error)?);
+        return assignment_error_response(&data.mfa_flows, error);
     }
     if data.mfa_enabled {
         if !MfaFlow::any_exist(&mut *transaction).await? {
@@ -580,7 +580,7 @@ pub(crate) async fn modify_network(
         if let Err(error) =
             MfaFlow::assign_to_location(&mut transaction, network.id, &data.mfa_flows).await
         {
-            return Ok(assignment_error_response(&data.mfa_flows, error)?);
+            return assignment_error_response(&data.mfa_flows, error);
         }
         data.mfa_flows.clone()
     } else {
diff --git a/crates/defguard_core/tests/integration/api/wireguard.rs b/crates/defguard_core/tests/integration/api/wireguard.rs
index f2081a458..21afec9eb 100644
--- a/crates/defguard_core/tests/integration/api/wireguard.rs
+++ b/crates/defguard_core/tests/integration/api/wireguard.rs
@@ -586,7 +586,7 @@ async fn make_mfa_flow(client: &TestClient) -> i64 {
 /// Assign a flow as a location's default so the location can be MFA-enabled.
 async fn assign_default_mfa_flow(client: &TestClient, location_id: i64, flow_id: i64) {
     let response = update_location_mfa_flows(
-        &client,
+        client,
         location_id,
         json!({ "assignments": [{ "flow_id": flow_id, "is_default": true, "group_ids": [] }] }),
     )