Change how env_roles are updated

This change makes it so that when an env_role is updated to be None, the
role property on the env_role is changed to be None in addition to being
marked as deleted. This also adds in a check so that previously deleted
env_roles cannot be reassigned a role.

tests/domain/test_environments.py

@@ -45,6 +45,9 @@ def test_update_env_role_no_access():
     assert not EnvironmentRoles.get(
         env_role.application_role.id, env_role.environment.id
     )
+    assert env_role.role is None
+    assert env_role.deleted
+    assert env_role.status == EnvironmentRole.Status.DISABLED
 
 
 def test_update_env_role_no_change():
@@ -56,6 +59,19 @@ def test_update_env_role_no_change():
     )
 
 
+def test_update_env_role_deleted_role():
+    env_role = EnvironmentRoleFactory.create(role=CSPRole.BASIC_ACCESS.value)
+    Environments.update_env_role(
+        env_role.environment, env_role.application_role, None
+    )
+    assert not Environments.update_env_role(
+        env_role.environment, env_role.application_role, CSPRole.TECHNICAL_READ.value
+    )
+    assert env_role.role is None
+    assert env_role.deleted
+    assert env_role.status == EnvironmentRole.Status.DISABLED
+
+
 def test_get_excludes_deleted():
     env = EnvironmentFactory.create(
         deleted=True, application=ApplicationFactory.create()