fix: dont overwrite created by

alexandria/core/serializers.py

@@ -40,7 +40,6 @@ def validate(self, *args, **kwargs):
 
         user = self.context["request"].user
         username = getattr(user, settings.ALEXANDRIA_CREATED_BY_USER_PROPERTY)
-        validated_data["created_by_user"] = username
         validated_data["modified_by_user"] = username
 
         self.Meta.model.check_permissions(self.context["request"])
@@ -49,6 +48,13 @@ def validate(self, *args, **kwargs):
 
         return validated_data
 
+    def validate_created_by_user(self, value):
+        # Created by user can be set on creation, then must remain constant
+        if self.instance:
+            # can't change created_by_user on existing instances
+            return self.instance.created_by_user
+        return value
+
     def validate_created_by_group(self, value):
         # Created by group can be set on creation, then must remain constant
         if self.instance:

alexandria/core/tests/test_views.py

@@ -498,3 +498,36 @@ def test_checksum(
             file.checksum
             == "sha256:778caf7d8d81a7ff8041003ef01afe00a85750d15086a3cb267fd8d23d8dd285"
         )
+
+
+@pytest.mark.parametrize(
+    "field,value",
+    [
+        ("created_at", "test"),
+        ("created_by_user", "test"),
+        ("created_by_group", "test"),
+    ],
+)
+def test_base_read_only(admin_client, document_factory, field, value):
+    document = document_factory()
+
+    url = reverse("document-detail", args=[document.pk])
+
+    data = {
+        "data": {
+            "type": "documents",
+            "id": document.pk,
+            "attributes": {
+                field: value,
+            },
+        }
+    }
+
+    response = admin_client.patch(url, data=data)
+
+    result = response.json()
+    assert result["data"]["attributes"][field.replace("_", "-")] != value
+    assert result["data"]["attributes"][field.replace("_", "-")] is not None
+
+    document.refresh_from_db()
+    assert getattr(document, field) != value