Added allowedMasterQueues

Author: matt-aitken

apps/webapp/app/presenters/v3/RegionsPresenter.server.ts

@@ -22,6 +22,7 @@ export class RegionsPresenter extends BasePresenter {
         id: true,
         organizationId: true,
         defaultWorkerGroupId: true,
+        allowedMasterQueues: true,
       },
       where: {
         slug: projectSlug,
@@ -57,9 +58,15 @@ export class RegionsPresenter extends BasePresenter {
         location: true,
         staticIPs: true,
       },
-      where: {
-        hidden: false,
-      },
+      where:
+        // Hide hidden unless they're allowed to use them
+        project.allowedMasterQueues.length > 0
+          ? {
+              masterQueue: { in: project.allowedMasterQueues },
+            }
+          : {
+              hidden: false,
+            },
       orderBy: {
         name: "asc",
       },

apps/webapp/app/v3/services/setDefaultRegion.server.ts

@@ -5,12 +5,30 @@ export class SetDefaultRegionService extends BaseService {
     const workerGroup = await this._prisma.workerInstanceGroup.findFirst({
       where: {
         id: regionId,
-        hidden: false,
       },
     });
 
     if (!workerGroup) {
-      throw new ServiceValidationError("Region not found or is hidden");
+      throw new ServiceValidationError("Region not found");
+    }
+
+    const project = await this._prisma.project.findFirst({
+      where: {
+        id: projectId,
+      },
+    });
+
+    if (!project) {
+      throw new ServiceValidationError("Project not found");
+    }
+
+    // If their project is restricted, only allow them to set default regions that are allowed
+    if (project.allowedMasterQueues.length > 0) {
+      if (!project.allowedMasterQueues.includes(workerGroup.masterQueue)) {
+        throw new ServiceValidationError("You're not allowed to set this region as default");
+      }
+    } else if (workerGroup.hidden) {
+      throw new ServiceValidationError("This region is not available to you");
     }
 
     await this._prisma.project.update({

internal-packages/database/prisma/migrations/20250806124301_project_allowed_master_queues_column/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "Project" ADD COLUMN     "allowedMasterQueues" TEXT[] DEFAULT ARRAY[]::TEXT[];

internal-packages/database/prisma/schema.prisma

@@ -335,6 +335,9 @@ model Project {
   defaultWorkerGroup   WorkerInstanceGroup? @relation("ProjectDefaultWorkerGroup", fields: [defaultWorkerGroupId], references: [id])
   defaultWorkerGroupId String?
 
+  /// The master queues they are allowed to use (impacts what they can set as default and trigger runs with)
+  allowedMasterQueues String[] @default([])
+
   environments           RuntimeEnvironment[]
   backgroundWorkers      BackgroundWorker[]
   backgroundWorkerTasks  BackgroundWorkerTask[]