Disable updates for API/terraform shifts in internal API

CHANGELOG.md

@@ -13,6 +13,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Prevent additional polling on Incidents if the previous request didn't complete
   ([#3205](https://github.com/grafana/oncall/pull/3205))
 
+### Fixed
+
+- Do not allow to update terraform-based shifts in web UI schedule API ([#3224](https://github.com/grafana/oncall/pull/3224))
+
 ## v1.3.48 (2023-10-30)
 
 ### Added

engine/apps/api/serializers/on_call_shifts.py

@@ -228,6 +228,9 @@ class Meta(OnCallShiftSerializer.Meta):
         read_only_fields = ["schedule", "type"]
 
     def update(self, instance, validated_data):
+        if not instance.schedule:
+            # only web-based schedule events can be updated using UI
+            raise serializers.ValidationError(["This event cannot be updated"])
         validated_data = self._correct_validated_data(instance.type, validated_data)
         change_only_name = True
         create_or_update_last_shift = False

engine/apps/api/tests/test_oncall_shift.py

@@ -400,6 +400,42 @@ def test_list_on_call_shift_filter_schedule_id(
     assert response.json() == expected_payload
 
 
+@pytest.mark.django_db
+def test_update_calendar_shift_is_disabled(
+    on_call_shift_internal_api_setup,
+    make_schedule,
+    make_on_call_shift,
+    make_user_auth_headers,
+):
+    token, user1, user2, organization, _ = on_call_shift_internal_api_setup
+    schedule = make_schedule(organization, schedule_class=OnCallScheduleCalendar)
+
+    client = APIClient()
+    start_date = timezone.now().replace(microsecond=0)
+
+    name = "Test Shift Rotation"
+    on_call_shift = make_on_call_shift(
+        schedule.organization,
+        shift_type=CustomOnCallShift.TYPE_ROLLING_USERS_EVENT,
+        name=name,
+        start=start_date,
+        duration=timezone.timedelta(hours=1),
+        rotation_start=start_date,
+        rolling_users=[{user1.pk: user1.public_primary_key}, {user2.pk: user2.public_primary_key}],
+    )
+    on_call_shift.schedules.add(schedule)
+
+    client = APIClient()
+
+    data_to_update = {
+        "name": name,
+    }
+    url = reverse("api-internal:oncall_shifts-detail", kwargs={"pk": on_call_shift.public_primary_key})
+
+    response = client.put(url, data=data_to_update, format="json", **make_user_auth_headers(user1, token))
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+
 @pytest.mark.django_db
 def test_update_future_on_call_shift(
     on_call_shift_internal_api_setup,