From 904c6001e9fa7c95de40ee81ac8149e870b69b01 Mon Sep 17 00:00:00 2001
From: Seth Foster <fosterbseth@gmail.com>
Date: Tue, 30 Jan 2024 12:19:23 -0500
Subject: [PATCH] If managed, cannot modify peers_from_control_nodes

Adds validation to prevent changing
peers_from_control_nodes if instance managed=True

Signed-off-by: Seth Foster <fosterbseth@gmail.com>
---
 awx/api/serializers.py                        |  6 +++++
 .../functional/api/test_instance_peers.py     | 27 +++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/awx/api/serializers.py b/awx/api/serializers.py
index 6de8f65752..f8e7468d65 100644
--- a/awx/api/serializers.py
+++ b/awx/api/serializers.py
@@ -5753,6 +5753,12 @@ class InstanceSerializer(BaseSerializer):
 
         return value
 
+    def validate_peers_from_control_nodes(self, value):
+        if self.instance and self.instance.managed and self.instance.canonical_address_peers_from_control_nodes != value:
+            raise serializers.ValidationError(_("Cannot change peers_from_control_nodes for managed nodes."))
+
+        return value
+
 
 class InstanceHealthCheckSerializer(BaseSerializer):
     class Meta:
diff --git a/awx/main/tests/functional/api/test_instance_peers.py b/awx/main/tests/functional/api/test_instance_peers.py
index 5a6e3b0778..48da2fdacb 100644
--- a/awx/main/tests/functional/api/test_instance_peers.py
+++ b/awx/main/tests/functional/api/test_instance_peers.py
@@ -462,6 +462,33 @@ class TestPeers:
 
         assert 'Cannot deprovision managed nodes.' in str(resp.data)
 
+    def test_changing_managed_peers_from_control_nodes(self, admin_user, patch):
+        """
+        cannot change peers_from_control_nodes of managed node
+        """
+        hop = Instance.objects.create(hostname='hop', node_type='hop', managed=True)
+        ReceptorAddress.objects.create(instance=hop, address='hop', peers_from_control_nodes=True, canonical=True)
+        resp = patch(
+            url=reverse('api:instance_detail', kwargs={'pk': hop.pk}),
+            data={"peers_from_control_nodes": False},
+            user=admin_user,
+            expect=400,
+        )
+
+        assert 'Cannot change peers_from_control_nodes for managed nodes.' in str(resp.data)
+
+        hop.peers_from_control_nodes = False
+        hop.save()
+
+        resp = patch(
+            url=reverse('api:instance_detail', kwargs={'pk': hop.pk}),
+            data={"peers_from_control_nodes": False},
+            user=admin_user,
+            expect=400,
+        )
+
+        assert 'Cannot change peers_from_control_nodes for managed nodes.' in str(resp.data)
+
     @pytest.mark.parametrize('node_type', ['control', 'hybrid'])
     def test_control_node_automatically_peers(self, node_type):
         """