api: not possible to change subscription user_external_id (#61631)

chrono/api/views.py

@@ -2055,6 +2055,12 @@ class SubscriptionAPI(APIView):
         ) and overlapping_subscription_qs.exists():
             raise APIErrorBadRequest(N_('another subscription overlapping this period already exists'))
 
+        if (
+            'user_external_id' in serializer.validated_data
+            and serializer.validated_data['user_external_id'] != self.subscription.user_external_id
+        ):
+            raise APIErrorBadRequest(N_('it is not possible to change user_external_id value'))
+
         serializer.save()
         extra_data = {k: v for k, v in request.data.items() if k not in serializer.validated_data}
         if extra_data:

tests/api/test_subscription.py

@@ -435,8 +435,23 @@ def test_api_patch_subscription(app, user):
         'err': 0,
     }
 
+    # user_external_id is not updatable
+    params = {
+        'user_external_id': 'xxx',
+    }
+    resp = app.patch('/api/agenda/%s/subscription/%s/' % (agenda.slug, subscription.pk), params=params)
+    assert resp.json['user_external_id'] == 'xxx'
+    subscription.refresh_from_db()
+    assert subscription.user_external_id == 'xxx'
+    params = {
+        'user_external_id': 'foobar',
+    }
+    resp = app.patch(
+        '/api/agenda/%s/subscription/%s/' % (agenda.slug, subscription.pk), params=params, status=400
+    )
+    assert resp.json['err_class'] == 'it is not possible to change user_external_id value'
+
     to_test = [
-        ('user_external_id', 'yyy', 'yyy'),
         ('user_first_name', 'fooo', 'fooo'),
         ('user_last_name', 'baaaar', 'baaaar'),
         ('user_email', '', ''),