Prevent runtime deletion when configured as primary runtime

Author: Taucher2003

app/models/runtime.rb

@@ -12,6 +12,7 @@ class Runtime < ApplicationRecord
   has_many :project_assignments, class_name: 'NamespaceProjectRuntimeAssignment', inverse_of: :runtime
   has_many :projects, class_name: 'NamespaceProject', through: :project_assignments, source: :namespace_project,
                       inverse_of: :runtimes
+  has_many :primary_projects, class_name: 'NamespaceProject', inverse_of: :primary_runtime
 
   has_many :data_types, inverse_of: :runtime
   has_many :data_type_identifiers, inverse_of: :runtime

app/services/error_code.rb

@@ -22,6 +22,7 @@ def self.error_codes
       runtime_mismatch: { description: 'Resources are from different runtimes' },
       generic_key_not_found: { description: 'The given key was not found in the data type' },
       no_primary_runtime: { description: 'The project does not have a primary runtime' },
+      is_primary_runtime: { description: 'This runtime is the primary runtime of a project' },
       invalid_external_identity: { description: 'This external identity is invalid' },
       external_identity_does_not_exist: { description: 'This external identity does not exist' },
       identity_validation_failed: { description: 'Failed to validate the external identity' },

app/services/runtimes/delete_service.rb

@@ -16,11 +16,18 @@ def execute
         return ServiceResponse.error(message: 'Missing permissions', error_code: :missing_permission)
       end
 
+      if runtime.primary_projects.any?
+        return ServiceResponse.error(
+          message: 'Runtime is primary runtime in some projects',
+          error_code: :is_primary_runtime
+        )
+      end
+
       transactional do |t|
         runtime.delete
 
         if runtime.persisted?
-          t.rollback_and_return! ServiceResponse.error(message: 'Failed to delete organization',
+          t.rollback_and_return! ServiceResponse.error(message: 'Failed to delete runtime',
                                                        error_code: :invalid_runtime,
                                                        details: runtime.errors)
         end

db/migrate/20260307231919_change_primary_runtime_fk_to_restrict.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class ChangePrimaryRuntimeFkToRestrict < Code0::ZeroTrack::Database::Migration[1.0]
+  def change
+    remove_foreign_key :namespace_projects,
+                       :runtimes,
+                       column: :primary_runtime_id,
+                       on_delete: :cascade
+
+    add_foreign_key :namespace_projects,
+                    :runtimes,
+                    column: :primary_runtime_id,
+                    on_delete: :restrict
+  end
+end

db/schema_migrations/20260307231919

@@ -0,0 +1 @@
+2dd6de5b55c1dd2c8dd5fd084e9e0ec5bfed0d4eb804bea4f2a730eecac7b431

db/structure.sql

@@ -1417,7 +1417,7 @@ ALTER TABLE ONLY data_type_rules
     ADD CONSTRAINT fk_rails_7759633ff8 FOREIGN KEY (data_type_id) REFERENCES data_types(id) ON DELETE CASCADE;
 
 ALTER TABLE ONLY namespace_projects
-    ADD CONSTRAINT fk_rails_79012c5895 FOREIGN KEY (primary_runtime_id) REFERENCES runtimes(id) ON DELETE CASCADE;
+    ADD CONSTRAINT fk_rails_79012c5895 FOREIGN KEY (primary_runtime_id) REFERENCES runtimes(id) ON DELETE RESTRICT;
 
 ALTER TABLE ONLY flows
     ADD CONSTRAINT fk_rails_7de9ce6578 FOREIGN KEY (starting_node_id) REFERENCES node_functions(id) ON DELETE SET NULL;

docs/graphql/enum/errorcodeenum.md

@@ -58,6 +58,7 @@ Represents the available error responses
 | `INVALID_USER_IDENTITY` | The user identity is invalid because of active model errors |
 | `INVALID_USER_SESSION` | The user session is invalid because of active model errors |
 | `INVALID_VERIFICATION_CODE` | Invalid verification code provided |
+| `IS_PRIMARY_RUNTIME` | This runtime is the primary runtime of a project |
 | `LICENSE_NOT_FOUND` | The namespace license with the given identifier was not found |
 | `LOADING_IDENTITY_FAILED` | Failed to load user identity from external provider |
 | `MFA_FAILED` | Invalid MFA data provided |

spec/services/runtimes/delete_service_spec.rb

@@ -65,5 +65,13 @@
         target_type: 'Namespace'
       )
     end
+
+    context 'when runtime is primary runtime of a project' do
+      before do
+        create(:namespace_project, primary_runtime: runtime, namespace: runtime.namespace)
+      end
+
+      it { expect(service_response.payload[:error_code]).to eq(:is_primary_runtime) }
+    end
   end
 end