Merge pull request #872 from code0-tech/852-change-foreign-key-from-namespace_projectsprimary_runtime_id-to-runtimesid-from-cascade-to-restrict

Prevent runtime deletion when configured as primary runtime

Author: Taucher2003

app/graphql/types/oidc_identity_provider_config_type.rb

@@ -8,15 +8,15 @@ class OidcIdentityProviderConfigType < Types::BaseObject
       For more information see: https://github.com/code0-tech/code0-identities/blob/#{Code0::Identities::VERSION}/README.md#oauth-based
     MARKDOWN
 
-    # rubocop:disable Graphql/ExtractType
+    # rubocop:disable GraphQL/ExtractType
     field :client_id, String,
           null: false,
           description: 'The client ID for the OIDC identity provider'
 
     field :client_secret, String,
           null: false,
           description: 'The client secret for the OIDC identity provider'
-    # rubocop:enable Graphql/ExtractType
+    # rubocop:enable GraphQL/ExtractType
 
     field :redirect_uri, String,
           null: false,

app/models/runtime.rb

@@ -12,6 +12,7 @@ class Runtime < ApplicationRecord
   has_many :project_assignments, class_name: 'NamespaceProjectRuntimeAssignment', inverse_of: :runtime
   has_many :projects, class_name: 'NamespaceProject', through: :project_assignments, source: :namespace_project,
                       inverse_of: :runtimes
+  has_many :primary_projects, class_name: 'NamespaceProject', inverse_of: :primary_runtime
 
   has_many :data_types, inverse_of: :runtime
   has_many :data_type_identifiers, inverse_of: :runtime

app/services/error_code.rb

@@ -22,6 +22,7 @@ def self.error_codes
       runtime_mismatch: { description: 'Resources are from different runtimes' },
       generic_key_not_found: { description: 'The given key was not found in the data type' },
       no_primary_runtime: { description: 'The project does not have a primary runtime' },
+      is_primary_runtime: { description: 'This runtime is the primary runtime of a project' },
       invalid_external_identity: { description: 'This external identity is invalid' },
       external_identity_does_not_exist: { description: 'This external identity does not exist' },
       identity_validation_failed: { description: 'Failed to validate the external identity' },

app/services/runtimes/delete_service.rb

@@ -16,11 +16,18 @@ def execute
         return ServiceResponse.error(message: 'Missing permissions', error_code: :missing_permission)
       end
 
+      if runtime.primary_projects.any?
+        return ServiceResponse.error(
+          message: 'Runtime is primary runtime in some projects',
+          error_code: :is_primary_runtime
+        )
+      end
+
       transactional do |t|
         runtime.delete
 
         if runtime.persisted?
-          t.rollback_and_return! ServiceResponse.error(message: 'Failed to delete organization',
+          t.rollback_and_return! ServiceResponse.error(message: 'Failed to delete runtime',
                                                        error_code: :invalid_runtime,
                                                        details: runtime.errors)
         end

db/fixtures/production/01_users.rb

@@ -13,10 +13,10 @@
   admin: true
 )
 
-# rubocop:disable ZeroTrack/Logs/RailsLogger -- we can't include a module here
+# rubocop:disable Code0/ZeroTrack/Logs/RailsLogger -- we can't include a module here
 if root.save
   Rails.logger.info(message: 'Initial root user created', email: initial_root_email, password: initial_root_password)
 else
   Rails.logger.warn(message: 'Failed to create initial root user', errors: root.errors.full_messages)
 end
-# rubocop:enable ZeroTrack/Logs/RailsLogger
+# rubocop:enable Code0/ZeroTrack/Logs/RailsLogger

db/migrate/20260307231919_change_primary_runtime_fk_to_restrict.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class ChangePrimaryRuntimeFkToRestrict < Code0::ZeroTrack::Database::Migration[1.0]
+  def change
+    remove_foreign_key :namespace_projects,
+                       :runtimes,
+                       column: :primary_runtime_id,
+                       on_delete: :cascade
+
+    add_foreign_key :namespace_projects,
+                    :runtimes,
+                    column: :primary_runtime_id,
+                    on_delete: :restrict
+  end
+end

db/schema_migrations/20260307231919

@@ -0,0 +1 @@
+2dd6de5b55c1dd2c8dd5fd084e9e0ec5bfed0d4eb804bea4f2a730eecac7b431

db/structure.sql

@@ -1417,7 +1417,7 @@ ALTER TABLE ONLY data_type_rules
     ADD CONSTRAINT fk_rails_7759633ff8 FOREIGN KEY (data_type_id) REFERENCES data_types(id) ON DELETE CASCADE;
 
 ALTER TABLE ONLY namespace_projects
-    ADD CONSTRAINT fk_rails_79012c5895 FOREIGN KEY (primary_runtime_id) REFERENCES runtimes(id) ON DELETE CASCADE;
+    ADD CONSTRAINT fk_rails_79012c5895 FOREIGN KEY (primary_runtime_id) REFERENCES runtimes(id) ON DELETE RESTRICT;
 
 ALTER TABLE ONLY flows
     ADD CONSTRAINT fk_rails_7de9ce6578 FOREIGN KEY (starting_node_id) REFERENCES node_functions(id) ON DELETE SET NULL;

docs/graphql/enum/errorcodeenum.md

@@ -58,6 +58,7 @@ Represents the available error responses
 | `INVALID_USER_IDENTITY` | The user identity is invalid because of active model errors |
 | `INVALID_USER_SESSION` | The user session is invalid because of active model errors |
 | `INVALID_VERIFICATION_CODE` | Invalid verification code provided |
+| `IS_PRIMARY_RUNTIME` | This runtime is the primary runtime of a project |
 | `LICENSE_NOT_FOUND` | The namespace license with the given identifier was not found |
 | `LOADING_IDENTITY_FAILED` | Failed to load user identity from external provider |
 | `MFA_FAILED` | Invalid MFA data provided |

spec/services/runtimes/delete_service_spec.rb

@@ -65,5 +65,13 @@
         target_type: 'Namespace'
       )
     end
+
+    context 'when runtime is primary runtime of a project' do
+      before do
+        create(:namespace_project, primary_runtime: runtime, namespace: runtime.namespace)
+      end
+
+      it { expect(service_response.payload[:error_code]).to eq(:is_primary_runtime) }
+    end
   end
 end