Remove unique constraint on NHS number

[Themitchell]

What is the change?

Remove unique constraint on user NHS number

Why are we making this change?

At p5 level NHS login identities are only "claimed" identities and multiple users may have the same NHS number (p9 is verified identity). For pilot we will maintain multiple that multiple NHS numbers may exist for different users in the system.

We should review post pilot and have a view to how to handle NHS number duplicates for national launch and what this means for sending data to other systems or for further care.

Currently the system uses the OIDC sub as a unique identifier so there are no security concerns around one user seing another users data in the case where 2 users have the same NHS number

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Removes the database-level uniqueness constraint on User.nhs_number so multiple users can share an NHS number (to support p5 “claimed” identities while still using OIDC sub as the unique user identifier).

Changes:

• Drop unique=True from User.nhs_number in the Django model.
• Remove the unit test that asserted duplicate NHS numbers are rejected.
• Add a migration to alter User.nhs_number (and also alters SexAtBirthResponse.value choices).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
lung_cancer_screening/questions/models/user.py	Removes uniqueness constraint from the nhs_number field.
lung_cancer_screening/questions/tests/unit/models/test_user.py	Removes the test that expected duplicates to raise a ValidationError.
lung_cancer_screening/questions/migrations/0009_alter_sexatbirthresponse_value_alter_user_nhs_number.py	Applies schema/state changes for nhs_number (and includes an additional SexAtBirthResponse choices change).

Comments suppressed due to low confidence (1)

lung_cancer_screening/questions/tests/unit/models/test_user.py:99

• This change removes the uniqueness constraint on User.nhs_number, but the unit tests no longer assert the new intended behavior (that duplicate NHS numbers are allowed). Add a test that creates two users with the same nhs_number and verifies no ValidationError is raised, to prevent the constraint from being reintroduced accidentally in future migrations/model edits.

    def test_nhs_number_has_a_max_length_of_10(self):
        self.user.nhs_number = "1"*11

        with self.assertRaises(ValidationError) as context:
            self.user.full_clean()

        self.assertIn(
            "Ensure this value has at most 10 characters (it has 11).",
            context.exception.messages
        )

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The PR description/title is about allowing duplicate NHS numbers, but this migration also alters SexAtBirthResponse.value choices (removes the 'Intersex' option). If that change is intentional, it should be called out in the PR description and you should consider what happens to any existing rows with value 'I' (they will start failing model validation). If it’s not intentional, regenerate/split the migration so it only drops the unique constraint on User.nhs_number.