...
Add flag, isExternalIdValidated. At the very least it should toggle between current behavior (any string can be set) and a stricter set of rules described below.
There I would have this flag validate and assign an ID, require it at sign up, and not allow it to be unassigned, only deleted when the user is deleted (for testing). There are actually many behaviors and there may need to be more than one flag:
- should ID be validated?
- should ID be assigned?
- is the ID required at sign up (that is, don't create an account until you've validated the external ID you're going to use for it)
- can the ID be unassigned or re-assigned? (you'd think no, but see below)
- can the ID be deleted once assigned? (you'd think no, but see below)
...
ExternalId Table
- String studyId (key)
- String externalId (range)
- String healthCode
- long reservation
...