Ensure source systems may not send Event.Type.INCIDENT_START events

[hmpf]

INCIDENT_START is created by the backend when it receives a new incident and should not be created by any other process.

Needed:

• [ ] Make test that api may not create such an event
• [ ] Remove Type.INCIDENT_START from ALLOWED_TYPES_FOR_SOURCE_SYSTEMS
• [ ] Simplify EventViewSet.validate_event_type_for_incident

.. plus eventual surprises..

This is really a case where making the test first is a good way to proceed!

[hmpf]

.. it might be useful to have a readonly endpoint that shows which event types are available for use with the API for the logged-in user.

[johannaengland]

While I am at it: Should it be allowed to post stateless events? Because when creating a stateless incident a stateless event is automatically created.

[johannaengland]

And I was also thinking: Why should we explicitly forbid source systems to send start events? Because currently when encountering an event that doesn't fit (e.g. a start event, a double reopen, ...) we simply register the event without it influencing the incidents (see https://github.com/Uninett/Argus/blob/master/src/argus/incident/views.py#L507-L517). Why do we need to change this?

[lunkwill42]

And I was also thinking: Why should we explicitly forbid source systems to send start events? Because currently when encountering an event that doesn't fit (e.g. a start event, a double reopen, ...) we simply register the event without it influencing the incidents (see https://github.com/Uninett/Argus/blob/master/src/argus/incident/views.py#L507-L517). Why do we need to change this?

I assume these are the lines you're referring to (remember to use the permalink option when linking to GitHub code, or your link will be outdated as soon as the branch changes): https://github.com/Uninett/Argus/blob/31446976010ad9e9610f07feca2f7ab128d65dbc/src/argus/incident/views.py#L507-L517

According to the linked code, I assume we can create the test mentioned by @hmpf's initial comment, and use this to verify that this isn't actually an issue. Case closed. Maybe?