chore: make sub claim mapping readonly after creation (#3306)

addons/api/addon/serializers/auth-method.js

@@ -48,6 +48,18 @@ export default class AuthMethodSerializer extends ApplicationSerializer {
     } else {
       delete serialized.attributes.state;
     }
+
+    // Don't send account_claim_maps on update if there's a saved 'sub' mapping
+    // The API doesn't allow updating when 'sub' claim mappings exist
+    if (!snapshot.record.isNew && snapshot.record.account_claim_maps) {
+      const hasSubClaimMap = snapshot.record.account_claim_maps.some(
+        (item) => item?.value === 'sub',
+      );
+
+      if (hasSubClaimMap) {
+        delete serialized.attributes.account_claim_maps;
+      }
+    }
     return serialized;
   }
 

addons/api/tests/unit/serializers/auth-method-test.js

@@ -506,4 +506,90 @@ module('Unit | Serializer | auth method', function (hooks) {
     assert.strictEqual(record.client_certificate_key, '');
     assert.strictEqual(record.bind_password, '');
   });
+
+  test('it includes account_claim_maps when serializing new OIDC records', function (assert) {
+    const store = this.owner.lookup('service:store');
+    const serializer = store.serializerFor('auth-method');
+    const record = store.createRecord('auth-method', {
+      type: TYPE_AUTH_METHOD_OIDC,
+      name: 'Test OIDC',
+      account_claim_maps: [
+        { key: 'email', value: 'email' },
+        { key: 'name', value: 'sub' },
+      ],
+    });
+    const snapshot = record._createSnapshot();
+    const serializedRecord = serializer.serialize(snapshot);
+
+    assert.ok(
+      serializedRecord.attributes.account_claim_maps,
+      'account_claim_maps is included for new records',
+    );
+
+    assert.deepEqual(serializedRecord.attributes.account_claim_maps, [
+      'email=email',
+      'name=sub',
+    ]);
+  });
+
+  test('it excludes account_claim_maps when serializing existing OIDC records with "sub" mapping', function (assert) {
+    const store = this.owner.lookup('service:store');
+    const serializer = store.serializerFor('auth-method');
+
+    const record = store.push({
+      data: {
+        id: 'oidc123',
+        type: 'auth-method',
+        attributes: {
+          type: TYPE_AUTH_METHOD_OIDC,
+          name: 'Test OIDC',
+          account_claim_maps: [
+            { key: 'email', value: 'email' },
+            { key: 'name', value: 'sub' },
+          ],
+        },
+      },
+    });
+
+    const snapshot = record._createSnapshot();
+    const serializedRecord = serializer.serialize(snapshot);
+
+    assert.notOk(
+      serializedRecord.attributes.account_claim_maps,
+      'account_claim_maps is excluded when updating with "sub" mapping',
+    );
+  });
+
+  test('it includes account_claim_maps when serializing existing OIDC records without "sub" mapping', function (assert) {
+    const store = this.owner.lookup('service:store');
+    const serializer = store.serializerFor('auth-method');
+
+    const record = store.push({
+      data: {
+        id: 'oidc456',
+        type: 'auth-method',
+        attributes: {
+          type: TYPE_AUTH_METHOD_OIDC,
+          name: 'Test OIDC',
+          account_claim_maps: [
+            { key: 'email', value: 'email' },
+            { key: 'name', value: 'name' },
+          ],
+        },
+      },
+    });
+
+    const snapshot = record._createSnapshot();
+    const serializedRecord = serializer.serialize(snapshot);
+
+    assert.ok(
+      serializedRecord.attributes.account_claim_maps,
+      'account_claim_maps is included when updating without "sub" mapping',
+    );
+
+    assert.deepEqual(serializedRecord.attributes.account_claim_maps, [
+      'email=email',
+      'name=name',
+    ]);
+  });
 });