🦺 ensure foirequest reference can only be set when initially creating

workaround since restframework doesn't support read & create only, see encode/django-rest-framework#8606

froide/foirequest/api/serializers.py

@@ -3,6 +3,7 @@
 from django.utils.translation import gettext as _
 
 from rest_framework import permissions, serializers
+from rest_framework.generics import ValidationError
 from rest_framework.views import PermissionDenied
 
 from froide.document.api_views import DocumentSerializer
@@ -174,6 +175,11 @@ def get_queryset(self):
         else:
             return get_write_foirequest_queryset(request)
 
+    def run_validation(self, data):
+        if self.context["view"].action == "update":
+            raise ValidationError("Cannot update request reference.")
+        return super().run_validation(data)
+
 
 class FoiMessageSerializer(serializers.HyperlinkedModelSerializer):
     resource_uri = serializers.HyperlinkedIdentityField(view_name="api:message-detail")