add database trigger to ensure dod id is never updated

alembic/versions/c222327c3963_stop_updates_of_dod_id.py

@@ -0,0 +1,46 @@
+"""stop updates of dod id
+
+Revision ID: c222327c3963
+Revises: 02d11579a581
+Create Date: 2018-12-12 10:23:00.773973
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'c222327c3963'
+down_revision = '02d11579a581'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    connection = op.get_bind()
+    connection.execute("""
+CREATE OR REPLACE FUNCTION lock_dod_id()
+RETURNS TRIGGER
+AS $$
+BEGIN
+    IF NEW.dod_id != OLD.dod_id THEN
+        RAISE EXCEPTION 'DOD ID cannot be updated';
+    END IF;
+
+    RETURN NEW;
+END
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER lock_dod_id
+BEFORE UPDATE ON users
+FOR EACH ROW
+    EXECUTE PROCEDURE lock_dod_id();
+    """)
+
+
+def downgrade():
+    connection = op.get_bind()
+    connection.execute("""
+DROP TRIGGER IF EXISTS lock_dod_id ON users;
+DROP FUNCTION IF EXISTS lock_dod_id();
+    """)

tests/models/test_user.py

@@ -1,4 +1,5 @@
 import pytest
+from sqlalchemy.exc import InternalError
 
 from atst.models.user import User
 
@@ -15,3 +16,11 @@ def test_profile_complete_with_missing_info(missing_field):
     user = UserFactory.create()
     setattr(user, missing_field, None)
     assert not user.profile_complete
+
+
+def test_cannot_update_dod_id(session):
+    user = UserFactory.create()
+    user.dod_id = "23403498202"
+    session.add(user)
+    with pytest.raises(InternalError):
+        session.commit()