chore: make sub claim mapping readonly after creation (#3306)

ui/admin/app/components/form/auth-method/oidc/index.hbs

@@ -242,7 +242,7 @@
     @data={{@model.account_claim_maps}}
     @legend={{t 'form.account_claim_maps.label'}}
     @helperText={{t 'form.account_claim_maps.help'}}
-    @disabled={{form.disabled}}
+    @disabled={{or form.disabled this.hasSavedSubClaimMap}}
     @isOptional={{true}}
   >
     <:row as |R|>
@@ -264,7 +264,7 @@
           <option disabled hidden selected value=''>
             {{t 'titles.choose-an-option'}}
           </option>
-          {{#each this.toClaims as |claim|}}
+          {{#each (this.toClaimOptions R.rowData) as |claim|}}
             <option value={{claim}} selected={{eq R.rowData.value claim}}>
               {{claim}}
             </option>

ui/admin/app/components/form/auth-method/oidc/index.js

@@ -39,6 +39,35 @@ export default class FormAuthMethodOidcComponent extends Component {
   @tracked selectedPrompts = this.parsePromptsArray();
   @tracked skipPromptsList = this.isToggleChecked();
 
+  /**
+   * @returns {boolean}
+   */
+  get hasSavedSubClaimMap() {
+    return (
+      !this.args.model?.isNew &&
+      this.args.model.account_claim_maps?.some((item) => item?.value === 'sub')
+    );
+  }
+
+  /**
+   * Filter 'sub' from dropdown options when updating
+   * On creation, show all options including sub.
+   * On update, hide sub unless it's the current value of the row (to display it when disabled).
+   * @param {Object} rowData - The current row data
+   * @returns {string[]}
+   */
+  toClaimOptions = (rowData) => {
+    // On creation, show all options
+    if (this.args.model?.isNew) {
+      return this.toClaims;
+    }
+
+    // On update, filter "sub" unless it's the current value
+    return this.toClaims.filter(
+      (claim) => claim !== 'sub' || rowData?.value === 'sub',
+    );
+  };
+
   /**
    * @returns {string}
    */