Currently making a PUT /trapline-user request can change both the trapline of the enrolment, and the user of the enrolment. This circumvents the permissions on POST requests to the same entity and should not be allowed.
Realistically, we should only allow toggling the admin/non-admin status of trapline-user enrollments as there are no other fields on the record.
Adding or removing enrollments can be done with POST and DELETE, so we don't need these editable here.
Currently making a
PUT /trapline-userrequest can change both the trapline of the enrolment, and the user of the enrolment. This circumvents the permissions on POST requests to the same entity and should not be allowed.Realistically, we should only allow toggling the admin/non-admin status of trapline-user enrollments as there are no other fields on the record.
Adding or removing enrollments can be done with POST and DELETE, so we don't need these editable here.