zen: restrict alpha models to admin workspaces

1 files changed, 10 insertions, 2 deletions

diff --git a/packages/console/app/src/routes/zen/util/handler.ts b/packages/console/app/src/routes/zen/util/handler.ts
index 80a4b3ab7..171962583 100644
--- a/packages/console/app/src/routes/zen/util/handler.ts
+++ b/packages/console/app/src/routes/zen/util/handler.ts
@@ -34,6 +34,7 @@ import { createDataDumper } from "./dataDumper"
 import { createTrialLimiter } from "./trialLimiter"
 import { createStickyTracker } from "./stickyProviderTracker"
 import { LiteData } from "@opencode-ai/console-core/lite.js"
+import { Resource } from "@opencode-ai/console-resource"
 
 type ZenData = Awaited<ReturnType<typeof ZenData.list>>
 type RetryOptions = {
@@ -59,7 +60,7 @@ export async function handler(
 
   const MAX_FAILOVER_RETRIES = 3
   const MAX_429_RETRIES = 3
-  const FREE_WORKSPACES = [
+  const ADMIN_WORKSPACES = [
     "wrk_01K46JDFR0E75SG2Q8K172KF3Y", // frank
     "wrk_01K6W1A3VE0KMNVSCQT43BG2SX", // opencode bench
   ]
@@ -520,6 +521,13 @@ export async function handler(
     )
 
     if (!data) throw new AuthError("Invalid API key.")
+    if (
+      modelInfo.id.startsWith("alpha-") &&
+      Resource.App.stage === "production" &&
+      !ADMIN_WORKSPACES.includes(data.workspaceID)
+    )
+      throw new AuthError(`Model ${modelInfo.id} not supported`)
+
     logger.metric({
       api_key: data.apiKey,
       workspace: data.workspaceID,
@@ -546,7 +554,7 @@ export async function handler(
       black: data.black,
       lite: data.lite,
       provider: data.provider,
-      isFree: FREE_WORKSPACES.includes(data.workspaceID),
+      isFree: ADMIN_WORKSPACES.includes(data.workspaceID),
       isDisabled: !!data.timeDisabled,
     }
   }